permdock 0.0.0 → 0.2.0

package/dist/map-claims-Z4QZOiFF.js

@@ -0,0 +1,369 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { O as readPath, T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+import { t as clientNameOf } from "./clients-DjU5ABMy.js";
+//#region src/jwt/map-claims.ts
+/** OpenID Connect Core section 5.1: profile data the provider owns. */
+const PROFILE_CLAIMS = [
+	"name",
+	"given_name",
+	"family_name",
+	"middle_name",
+	"nickname",
+	"preferred_username",
+	"profile",
+	"picture",
+	"website",
+	"email",
+	"email_verified",
+	"gender",
+	"birthdate",
+	"zoneinfo",
+	"locale",
+	"phone_number",
+	"phone_number_verified",
+	"address",
+	"updated_at"
+];
+const DEFAULT_CLAIMS = {
+	id: "sub",
+	roles: "roles",
+	groups: "groups",
+	entitlements: "entitlements",
+	session: "sid"
+};
+function asStringArray(value) {
+	if (typeof value === "string") return value.length === 0 ? [] : value.split(/[,\s]+/u).filter(Boolean);
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	for (const item of value) {
+		if (typeof item === "string") {
+			out.push(item);
+			continue;
+		}
+		if (item !== null && typeof item === "object" && "value" in item && typeof item.value === "string") out.push(item.value);
+	}
+	return out;
+}
+function kindOf(claims, paths) {
+	const kind = paths?.kind;
+	if (kind === "workload" || kind === "user" || kind === "service") return kind;
+	if (kind !== void 0) {
+		const value = readPath(claims, kind);
+		if (value === "workload" || value === "user" || value === "service") return value;
+	}
+}
+function assuranceOf(claims, paths) {
+	const configured = paths?.assurance;
+	const acrPath = typeof configured === "string" ? configured : configured?.acr ?? "acr";
+	const amrPath = typeof configured === "string" ? "amr" : configured?.amr ?? "amr";
+	const authTimePath = typeof configured === "string" ? "auth_time" : configured?.authTime ?? "auth_time";
+	const verifiedPath = typeof configured === "string" ? "verified_claims" : configured?.verified ?? "verified_claims";
+	const acr = readPath(claims, acrPath);
+	const amr = readPath(claims, amrPath);
+	const authTime = readPath(claims, authTimePath);
+	const assurance = compact({
+		acr: typeof acr === "string" ? acr : void 0,
+		amr: Array.isArray(amr) ? amr.filter((item) => typeof item === "string") : void 0,
+		authTime: typeof authTime === "number" ? authTime : void 0,
+		verified: verifiedClaimsOf(readPath(claims, verifiedPath))
+	});
+	return Object.keys(assurance).length === 0 ? void 0 : assurance;
+}
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasForbiddenKey(value, depth = 0) {
+	if (depth > 16) return true;
+	if (Array.isArray(value)) return value.some((item) => hasForbiddenKey(item, depth + 1));
+	if (!isPlainRecord(value)) return false;
+	return Object.keys(value).some((key) => isForbiddenKey(key) || hasForbiddenKey(value[key], depth + 1));
+}
+/**
+* `verified_claims` is one object or an array (OIDC4IDA section 5); an entry
+* without `verification.trust_framework` and a `claims` object is dropped.
+*/
+function verifiedClaimsOf(value) {
+	const verified = (Array.isArray(value) ? value : [value]).filter((entry) => isPlainRecord(entry) && isPlainRecord(entry["verification"]) && typeof entry["verification"]["trust_framework"] === "string" && isPlainRecord(entry["claims"]) && !hasForbiddenKey(entry));
+	return verified.length === 0 ? void 0 : freezeDeep(verified.map((entry) => ({
+		verification: entry.verification,
+		claims: entry.claims
+	})));
+}
+function bindingOf(claims) {
+	const cnf = claims["cnf"];
+	if (cnf === null || typeof cnf !== "object" || Array.isArray(cnf)) return;
+	const record = cnf;
+	const binding = compact({
+		jkt: typeof record["jkt"] === "string" ? record["jkt"] : void 0,
+		"x5t#S256": typeof record["x5t#S256"] === "string" ? record["x5t#S256"] : void 0,
+		jwk: record["jwk"] !== null && typeof record["jwk"] === "object" ? record["jwk"] : void 0,
+		kid: typeof record["kid"] === "string" ? record["kid"] : void 0
+	});
+	return Object.keys(binding).length === 0 ? void 0 : binding;
+}
+/** Group roles hold in the active tenant; the group itself is only the `via`. */
+function membershipsFromGroups(groups, groupRoles, tenant) {
+	if (tenant === void 0) return [];
+	return groups.map((group) => compact({
+		tenant,
+		roles: groupRoles?.[group] ?? [],
+		via: `group:${group}`
+	}));
+}
+function stringRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const out = {};
+	for (const [key, item] of Object.entries(value)) if (typeof item === "string") out[key] = item;
+	return out;
+}
+function keptKeys(value) {
+	if (value === void 0) return;
+	if (!Array.isArray(value)) return [];
+	const keys = value.filter((key) => typeof key === "string" && key !== "");
+	return keys.length === value.length ? keys : [];
+}
+function claimExtras(record) {
+	return compact({
+		via: typeof record["via"] === "string" ? record["via"] : void 0,
+		expiresAt: typeof record["expiresAt"] === "number" ? record["expiresAt"] : void 0,
+		keep: keptKeys(record["keep"])
+	});
+}
+function membershipsFromClaim(value) {
+	if (Array.isArray(value)) return value.flatMap((item) => membershipsFromClaim(item));
+	if (value === null || typeof value !== "object") return [];
+	const record = value;
+	if (typeof record["scope"] === "string" && typeof record["id"] === "string") return [compact({
+		scope: record["scope"],
+		id: record["id"],
+		within: stringRecord(record["within"]),
+		roles: asStringArray(record["roles"]),
+		...claimExtras(record)
+	})];
+	if (typeof record["tenant"] === "string" || typeof record["org_id"] === "string") return [compact({
+		tenant: typeof record["tenant"] === "string" ? record["tenant"] : String(record["org_id"]),
+		roles: asStringArray(record["roles"]),
+		team: typeof record["team"] === "string" ? record["team"] : void 0,
+		...claimExtras(record)
+	})];
+	const out = [];
+	const byOrganisation = /* @__PURE__ */ new Map();
+	for (const [tenant, entry] of Object.entries(record)) {
+		if (Array.isArray(entry)) {
+			out.push(compact({
+				tenant,
+				roles: asStringArray(entry)
+			}));
+			continue;
+		}
+		if (entry !== null && typeof entry === "object") {
+			const nested = entry;
+			if (isRoleToOrganisations(nested)) {
+				for (const organisation of Object.keys(nested)) {
+					const roles = byOrganisation.get(organisation) ?? [];
+					roles.push(tenant);
+					byOrganisation.set(organisation, roles);
+				}
+				continue;
+			}
+			out.push(compact({
+				tenant,
+				roles: asStringArray(nested["roles"] ?? nested)
+			}));
+		}
+	}
+	for (const [tenant, roles] of byOrganisation) out.push({
+		tenant,
+		roles
+	});
+	return out;
+}
+/** Zitadel's `role -> { orgId: orgDomain }` form: string values and no `roles` key. */
+function isRoleToOrganisations(value) {
+	const entries = Object.entries(value);
+	return entries.length > 0 && !("roles" in value) && entries.every(([key, item]) => typeof item === "string" && !isForbiddenKey(key));
+}
+function isActObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function actorFromAct(claims, options) {
+	const configured = options.actor;
+	if (typeof configured === "function") {
+		const actor = configured(claims);
+		return actor === void 0 ? { status: "absent" } : {
+			status: "ok",
+			actor,
+			chain: claims["act"]
+		};
+	}
+	if (!Object.hasOwn(claims, "act") || claims["act"] === void 0) return { status: "absent" };
+	const act = claims["act"];
+	if (!isActObject(act)) return { status: "invalid" };
+	let current = act;
+	while (current !== void 0) {
+		if (!isActObject(current) || typeof current.sub !== "string" || current.sub.length === 0) return { status: "invalid" };
+		current = Object.hasOwn(current, "act") ? current.act : void 0;
+	}
+	if (typeof act.sub !== "string") return { status: "invalid" };
+	return {
+		status: "ok",
+		actor: compact({
+			id: act.sub,
+			kind: configured?.kind ?? "oauth-client",
+			client: clientNameOf(configured?.clients, act.sub)
+		}),
+		chain: act
+	};
+}
+function delegationOf(claims, options, chain) {
+	const paths = options.delegation;
+	const scopes = asStringArray(readPath(claims, paths?.scopes ?? "scope"));
+	const details = readPath(claims, paths?.authorizationDetails ?? "authorization_details");
+	const access = readPath(claims, paths?.access ?? "access");
+	const authorizationDetails = Array.isArray(details) ? details : void 0;
+	const accessList = Array.isArray(access) ? access : void 0;
+	const delegation = compact({
+		scopes: scopes.length > 0 ? scopes : void 0,
+		authorizationDetails,
+		access: accessList,
+		chain
+	});
+	return Object.keys(delegation).length === 0 ? void 0 : delegation;
+}
+function customClaims(claims, reserved) {
+	const out = {};
+	for (const [key, value] of Object.entries(claims)) {
+		if (reserved.includes(key)) continue;
+		out[key] = value;
+	}
+	return out;
+}
+function validateCustomClaims(claims, schema) {
+	const result = schema["~standard"].validate(claims);
+	if (result instanceof Promise) {
+		ignoreRejection(result);
+		return { ok: false };
+	}
+	if ("issues" in result && result.issues !== void 0) return { ok: false };
+	return {
+		ok: true,
+		value: result.value
+	};
+}
+function mapClaimsToSubject(claims, options) {
+	const paths = options.claims;
+	const idPath = paths?.id ?? DEFAULT_CLAIMS.id;
+	const id = readPath(claims, idPath);
+	if (typeof id !== "string" || id.length === 0) return {
+		subject: anonymousSubject(),
+		invalidClaims: false,
+		invalidChain: false
+	};
+	const tenantPath = paths?.tenant;
+	const tenant = tenantPath === void 0 ? void 0 : readPath(claims, tenantPath);
+	const activeTenant = typeof tenant === "string" ? tenant : void 0;
+	const roles = asStringArray(readPath(claims, paths?.roles ?? DEFAULT_CLAIMS.roles));
+	const plans = asStringArray(readPath(claims, paths?.plans ?? paths?.entitlements ?? DEFAULT_CLAIMS.entitlements));
+	const groups = asStringArray(readPath(claims, paths?.groups ?? DEFAULT_CLAIMS.groups));
+	const memberships = [...membershipsFromClaim(paths?.memberships === void 0 ? void 0 : readPath(claims, paths.memberships)), ...membershipsFromGroups(groups, options.groupRoles, activeTenant)];
+	let extra = customClaims(claims, [
+		"iss",
+		"sub",
+		"aud",
+		"exp",
+		"nbf",
+		"iat",
+		"jti",
+		"client_id",
+		"scope",
+		"cnf",
+		"act",
+		"sid",
+		"acr",
+		"amr",
+		"auth_time",
+		"roles",
+		"groups",
+		"entitlements",
+		"authorization_details",
+		"access",
+		"nonce",
+		"azp",
+		...PROFILE_CLAIMS
+	]);
+	let invalidClaims = false;
+	if (options.schema !== void 0) {
+		const validated = validateCustomClaims(extra, options.schema);
+		if (validated.ok) extra = validated.value;
+		else {
+			extra = {};
+			invalidClaims = true;
+		}
+	}
+	const binding = bindingOf(claims);
+	const act = actorFromAct(claims, options);
+	if (act.status === "invalid") return {
+		subject: anonymousSubject(),
+		invalidClaims: false,
+		invalidChain: true
+	};
+	const principal = freezeDeep(compact({
+		id,
+		issuer: typeof claims.iss === "string" ? claims.iss : void 0,
+		kind: kindOf(claims, paths),
+		roles: roles.length > 0 ? roles : void 0,
+		plans: plans.length > 0 ? plans : void 0,
+		memberships: memberships.length > 0 ? memberships : void 0,
+		tenant: activeTenant,
+		assurance: assuranceOf(claims, paths),
+		binding: act.status === "absent" ? binding : void 0,
+		claims: Object.keys(extra).length === 0 ? void 0 : extra
+	}));
+	const actor = act.status === "absent" ? void 0 : freezeDeep(compact({
+		...act.actor,
+		binding
+	}));
+	const sessionPath = paths?.session ?? DEFAULT_CLAIMS.session;
+	const sessionValue = readPath(claims, sessionPath);
+	const sessionExpiry = claims["session_expiry"];
+	const exp = typeof claims.exp === "number" ? claims.exp : void 0;
+	const expiresAt = typeof sessionExpiry === "number" && exp !== void 0 ? Math.min(exp, sessionExpiry) : exp;
+	return {
+		subject: freezeDeep(compact({
+			principal,
+			actor,
+			delegation: options.accept === "id-token" ? void 0 : delegationOf(claims, options, act.status === "ok" ? act.chain : void 0),
+			context: {},
+			session: typeof sessionValue === "string" ? sessionValue : void 0,
+			expiresAt
+		})),
+		invalidClaims,
+		invalidChain: false
+	};
+}
+function acceptMismatch(claims, headerTyp, options, audience) {
+	const accept = options.accept ?? "access-token";
+	const typ = headerTyp?.toLowerCase();
+	if (accept === "id-token") {
+		if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
+		if (typeof claims.iat !== "number") return true;
+		const aud = claims.aud;
+		const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
+		const clients = audience === void 0 ? [] : typeof audience === "string" ? [audience] : audience;
+		const azp = claims["azp"];
+		if (azp === void 0) return audiences.length > 1;
+		return typeof azp !== "string" || !clients.includes(azp);
+	}
+	if (options.profile === "fapi2" && typ !== "at+jwt") return true;
+	if (typeof claims["nonce"] === "string") return true;
+	if (audience !== void 0 && typeof claims.aud === "string") {
+		const expected = typeof audience === "string" ? audience : audience[0];
+		if (claims.aud !== expected && typ !== "at+jwt") return true;
+	}
+	return false;
+}
+//#endregion
+export { mapClaimsToSubject as n, validateCustomClaims as r, acceptMismatch as t };

package/dist/map-error-pgUWNNtG.js

@@ -0,0 +1,23 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { r as decisionResponse, s as problemResponse } from "./problem-B43ztKIm.js";
+import { r as InvalidSignatureError } from "./evaluations-tz6D9A2G.js";
+//#region src/server/map-error.ts
+/**
+* Turns a thrown PermDock error into its Problem Details response, with the
+* status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
+* same decision. Returns `undefined` for anything else so the framework's own
+* error path takes over.
+*/
+function problemFromError(error, options = {}) {
+	if (error instanceof InvalidSignatureError) return error.response;
+	if (error instanceof PermDockDeniedError || error instanceof PermDockApprovalRequiredError) return decisionResponse(error.toProblemDetails(compact({ instance: options.instance })), error.decision, compact({
+		scope: error.scope,
+		credentials: options.credentials
+	}));
+	if (error instanceof PermDockRevokedError) return problemResponse(error.toProblemDetails(), void 0, error.decision);
+	if (error instanceof PermDockValidationError) return problemResponse(error.toProblemDetails(compact({ instance: options.instance })));
+}
+//#endregion
+export { problemFromError as t };

package/dist/markers-B0hYLvMD.js

@@ -0,0 +1,60 @@
+//#region src/cli/markers.ts
+const HOOK_MARKER = "-- permdock:hook v1";
+/** The first line of a `--grants-out` file. */
+const GRANTS_MARKER = "-- permdock:grants v1";
+/** The first line of the `seeds` part: the `role_permissions` rows, a versioned migration. */
+const SEEDS_MARKER = "-- permdock:seeds v1";
+/** The first line of the `indexes` part: the indexes the policies and helpers read through. */
+const INDEXES_MARKER = "-- permdock:indexes v1";
+const HOOK_LINE = /^-- permdock:hook v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
+const GRANTS_LINE = /^-- permdock:grants v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
+function firstLine(sql) {
+	return (sql.split("\n", 1)[0] ?? "").replace(/\r$/u, "");
+}
+/** The `key=value` pairs after the marker, in a prototype-less object. */
+function pairs(rest) {
+	const fields = Object.create(null);
+	for (const pair of (rest ?? "").split(" ")) {
+		const eq = pair.indexOf("=");
+		if (eq > 0) fields[pair.slice(0, eq)] = pair.slice(eq + 1);
+	}
+	return fields;
+}
+/** The fields of a hook marker line, or undefined when `sql` does not start with one. */
+function hookMarkerFields(sql) {
+	const line = firstLine(sql);
+	return line.startsWith(`-- permdock:hook v1 `) ? pairs(line.slice(20)) : void 0;
+}
+/**
+* Reads the `-- permdock:hook v<N>` line that starts a generated hook
+* migration. Undefined when the first line is not a hook marker.
+*/
+function parseHookMarker(sql) {
+	const match = HOOK_LINE.exec(firstLine(sql));
+	if (match?.groups === void 0) return;
+	const fields = pairs(match.groups["rest"]);
+	const budget = Number(fields["budget"]);
+	const claims = fields["claims"];
+	return Object.freeze({
+		version: Number(match.groups["version"]),
+		...fields["schema"] === void 0 ? {} : { schema: fields["schema"] },
+		...fields["tenant"] === void 0 ? {} : { tenantClaim: fields["tenant"] },
+		...Number.isSafeInteger(budget) && budget > 0 ? { budget } : {},
+		claims: Object.freeze(claims === void 0 || claims === "" ? [] : claims.split(",").filter((name) => name !== ""))
+	});
+}
+/**
+* Reads the `-- permdock:grants v<N>` line that starts a `--grants-out`
+* migration. Undefined when the first line is not a grants marker.
+*/
+function parseGrantsMarker(sql) {
+	const match = GRANTS_LINE.exec(firstLine(sql));
+	if (match?.groups === void 0) return;
+	const fields = pairs(match.groups["rest"]);
+	return Object.freeze({
+		version: Number(match.groups["version"]),
+		...fields["schema"] === void 0 ? {} : { schema: fields["schema"] }
+	});
+}
+//#endregion
+export { hookMarkerFields as a, SEEDS_MARKER as i, HOOK_MARKER as n, parseGrantsMarker as o, INDEXES_MARKER as r, parseHookMarker as s, GRANTS_MARKER as t };

package/dist/may-use-DndQ5tQ-.js

@@ -0,0 +1,77 @@
+import { d as scopeList, m as tenantOf, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { a as isMembershipExpired, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+//#region src/core/may-use.ts
+function delegationMayCover(permission, delegation, hasActor) {
+	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);
+}
+function blocksEveryRow(grant) {
+	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
+}
+/**
+* Whether `permission` could be granted to this instance's subject for some
+* row: the grants its snapshot carries for the active tenant, minus an
+* unconditional deny, within its delegation. A listing hint for tools and
+* skills, never a decision; the call itself is decided in full.
+*/
+function mayUse(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		if (!("grants" in snapshot)) return false;
+		const ceiling = snapshot.delegated;
+		if (ceiling !== void 0 && !ceiling.includes(permission.key)) return false;
+		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		const tenant = permdock.subject.principal?.tenant;
+		const scopes = scopeList(snapshot.scopes);
+		const grants = snapshot.grants.filter((grant) => {
+			if (grant.permission !== permission.key) return false;
+			const owner = grant.membership === void 0 ? void 0 : tenantOf(grant.membership, scopes);
+			return owner === void 0 || owner === tenant;
+		});
+		if (grants.some(blocksEveryRow)) return false;
+		return grants.some((grant) => grant.effect === "allow");
+	} catch {
+		return false;
+	}
+}
+function isConditioned(grant) {
+	return grant.where !== void 0 || grant.check !== void 0 || grant.validity !== void 0 || grant.portable === false;
+}
+/**
+* The instances of `scope` in which the subject holds `permission`, from its
+* live memberships of exactly that scope, within its delegation: by default
+* those with an allow that carries no row condition (`where`, `check`, a
+* validity window or a non-portable test; a `fields` limit is not a row
+* condition), minus the instances any deny of the permission reaches. The
+* in-process mirror of the SQL `permitted_<scope>_ids_by_permission`. With
+* `conditioned: true` it also lists the instances where a conditioned allow
+* applies, minus only unconditional denies, as
+* `permitted_<scope>_ids_by_permission(p_permission, true)` does. A listing,
+* never a decision: a row's own check still runs `can`.
+*/
+function permittedIds(permdock, permission, scope, options = {}) {
+	try {
+		const snapshot = permdock.snapshot({ tenants: "all" });
+		if (!("grants" in snapshot)) return [];
+		const scopes = scopeList(snapshot.scopes);
+		const name = resolveScope(scopes, scope);
+		const ceiling = snapshot.delegated;
+		if (name === void 0 || ceiling !== void 0 && !ceiling.includes(permission.key) || !delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return [];
+		const conditioned = options.conditioned === true;
+		const now = nowSeconds();
+		const allowed = /* @__PURE__ */ new Set();
+		const denied = /* @__PURE__ */ new Set();
+		for (const grant of snapshot.grants) {
+			const membership = grant.membership;
+			if (grant.permission !== permission.key || grant.scope !== name || membership?.scope !== name || membership.id === void 0 || isMembershipExpired(membership, now) || options.within !== void 0 && tenantOf(membership, scopes) !== options.within) continue;
+			if (grant.effect === "deny") {
+				if (!conditioned || !isConditioned(grant)) denied.add(membership.id);
+			} else if ((conditioned || !isConditioned(grant)) && isActive(grant.validity, now)) allowed.add(membership.id);
+		}
+		return [...allowed].filter((id) => !denied.has(id)).toSorted();
+	} catch {
+		return [];
+	}
+}
+//#endregion
+export { permittedIds as n, mayUse as t };