permdock 0.0.0 → 0.2.0

package/dist/authzen/index.js

@@ -0,0 +1,302 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { E as ownGet, _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
+import { t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
+import { n as hasCredentials } from "../http-SO7qGttf.js";
+import { i as methodNotAllowed, l as unauthenticatedProblem, s as problemResponse, t as batchTooLarge, u as validationProblem } from "../problem-B43ztKIm.js";
+import { t as applyApprovalResume } from "../evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as permissionLookup } from "../evaluation-items-CfCCejQd.js";
+import { a as endsWithPath, c as mergeItem, d as pathnameOf, f as permissionOf, g as userFromEntity, h as tenantOf, i as delegationOf, l as pageOf, m as resourceIdOf, n as UNKNOWN, o as evaluationRow, p as resourceData, r as actorOf, s as isRecord, t as UNAVAILABLE, u as paged } from "../map-AcxK9o_D.js";
+//#region src/authzen/create.ts
+function notFound(detail) {
+	return problemResponse({
+		type: `${PROBLEM_BASE}/not-found`,
+		title: "Not found",
+		status: 404,
+		detail
+	});
+}
+async function readJson(request) {
+	try {
+		return await request.json();
+	} catch {
+		return validationProblem("AuthZEN body was not valid JSON");
+	}
+}
+const SEMANTICS = [
+	"execute_all",
+	"deny_on_first_deny",
+	"permit_on_first_permit"
+];
+function semanticOf(body) {
+	const options = body["options"];
+	const value = isRecord(options) ? options["evaluations_semantic"] : void 0;
+	if (value === void 0) return "execute_all";
+	return SEMANTICS.find((semantic) => semantic === value);
+}
+const WELL_KNOWN = "/.well-known/authzen-configuration";
+function withRequestId(request, response) {
+	const id = request.headers.get("x-request-id");
+	if (id !== null && id !== "") response.headers.set("X-Request-ID", id);
+	return response;
+}
+const createPermDock = (policy, options) => {
+	const maxEvaluations = options.maxEvaluations ?? 256;
+	const lookup = permissionLookup(policy.permissions);
+	const trusts = (pep) => {
+		const allow = options.trustedPep;
+		if (typeof allow !== "function" || pep === null) return false;
+		try {
+			return allow(pep) === true;
+		} catch {
+			return false;
+		}
+	};
+	const allowAnonymous = options.anonymous === true;
+	async function authenticate(request) {
+		let pep;
+		try {
+			pep = await options.subject(request);
+		} catch {
+			pep = null;
+		}
+		if ((pep === null || pep === void 0) && !allowAnonymous) return unauthenticatedProblem(hasCredentials(request));
+		return { pep: pep ?? null };
+	}
+	function instantiate(pep, item) {
+		const trusted = trusts(pep);
+		const user = (trusted ? userFromEntity(item.subject) : null) ?? pep;
+		return createPermDock$1(policy, user, compact({
+			actor: trusted ? actorOf(item) : void 0,
+			delegation: trusted ? delegationOf(item) : void 0,
+			tenant: tenantOf(item),
+			...instanceOptions(options)
+		}));
+	}
+	async function resourceOf(item) {
+		const properties = item.resource?.properties;
+		if (properties !== null && typeof properties === "object") return {
+			data: properties,
+			trusted: false
+		};
+		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
+		const id = resourceIdOf(item);
+		const load = type !== void 0 && options.resources !== void 0 ? options.resources[type]?.load : void 0;
+		if (id !== void 0 && load !== void 0) try {
+			return {
+				data: await load(id),
+				trusted: true
+			};
+		} catch {
+			return;
+		}
+		return {
+			data: resourceData(item),
+			trusted: false
+		};
+	}
+	async function decideItem(request, pep, item) {
+		const permission = permissionOf(lookup, item);
+		if (permission === void 0) return UNKNOWN;
+		const resolved = await resourceOf(item);
+		if (resolved === void 0) return UNAVAILABLE;
+		const { data, trusted } = resolved;
+		const permdock = await instantiate(pep, item);
+		const decide = permdock.decide;
+		const decision = decide(permission, data, trusted ? {
+			source: "endpoint",
+			adapter: "authzen",
+			trusted: true
+		} : {
+			source: "endpoint",
+			adapter: "authzen",
+			trusted: false,
+			boundary: "decision-endpoint"
+		});
+		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, item.resource?.id), "authzen");
+	}
+	async function evaluation(request, pep) {
+		const body = await readJson(request);
+		if (body instanceof Response) return body;
+		if (!isRecord(body)) return validationProblem("evaluation body must be an object");
+		return Response.json(evaluationRow(await decideItem(request, pep, body)));
+	}
+	async function evaluations(request, pep) {
+		const body = await readJson(request);
+		if (body instanceof Response) return body;
+		if (!isRecord(body)) return validationProblem("evaluations body must be an object");
+		const items = body["evaluations"] ?? [];
+		if (!Array.isArray(items)) return validationProblem("evaluations must be an array");
+		if (items.length === 0) return Response.json(evaluationRow(await decideItem(request, pep, body)));
+		if (items.length > maxEvaluations) return batchTooLarge(maxEvaluations);
+		const semantic = semanticOf(body);
+		if (semantic === void 0) return validationProblem(`options.evaluations_semantic must be one of ${SEMANTICS.join(", ")}`);
+		const shared = compact({
+			subject: isRecord(body["subject"]) ? body["subject"] : void 0,
+			action: isRecord(body["action"]) ? body["action"] : void 0,
+			resource: isRecord(body["resource"]) ? body["resource"] : void 0,
+			context: body["context"]
+		});
+		const rowOf = (item) => decideItem(request, pep, mergeItem(shared, item)).then(evaluationRow);
+		if (semantic === "execute_all") return Response.json({ evaluations: await Promise.all(items.map(rowOf)) });
+		const stopOn = semantic === "permit_on_first_permit";
+		const rows = [];
+		for (const item of items) {
+			const row = await rowOf(item);
+			rows.push(row);
+			if (row.decision === stopOn) break;
+		}
+		return Response.json({ evaluations: rows });
+	}
+	async function searchAction(request, pep) {
+		const body = await readJson(request);
+		if (body instanceof Response) return body;
+		if (!isRecord(body)) return validationProblem("search/action body must be an object");
+		const item = body;
+		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
+		const leaves = listPermissions(policy.permissions).filter((leaf) => type === void 0 || leaf.resource === type);
+		const decisions = await Promise.all(leaves.map(async (leaf) => ({
+			leaf,
+			decision: await decideItem(request, pep, compact({
+				subject: item.subject,
+				context: item.context,
+				resource: item.resource,
+				action: { name: leaf.key }
+			}))
+		})));
+		const names = [];
+		for (const { leaf, decision } of decisions) if (decision.outcome === "granted" && !names.includes(leaf.action)) names.push(leaf.action);
+		const { offset, size } = pageOf(body);
+		return Response.json(paged(names.map((name) => ({ name })), offset, size));
+	}
+	async function listRows(type, where) {
+		const list = options.resources?.[type]?.list;
+		if (list === void 0) return [];
+		try {
+			return await list({ where });
+		} catch {
+			return [];
+		}
+	}
+	async function searchResource(request, pep) {
+		const body = await readJson(request);
+		if (body instanceof Response) return body;
+		if (!isRecord(body)) return validationProblem("search/resource body must be an object");
+		const item = body;
+		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
+		const permission = permissionOf(lookup, item);
+		if (type === void 0 || permission === void 0) return Response.json(paged([], 0, 1));
+		const rows = await listRows(type, isRecord(item.resource?.properties) ? item.resource.properties : void 0);
+		const permdock = await instantiate(pep, item);
+		let permitted = [];
+		if (permission.kind === "instance") permitted = permdock.filter(permission, rows);
+		else if (permission.kind === "collection" && permdock.can(permission)) permitted = rows;
+		const idField = getResource(policy.permissions, type)?.id ?? "id";
+		const entities = permitted.flatMap((row) => {
+			const id = isRecord(row) ? ownGet(row, idField) : void 0;
+			return typeof id === "string" || typeof id === "number" ? [{
+				type,
+				id: String(id)
+			}] : [];
+		});
+		const { offset, size } = pageOf(body);
+		return Response.json(paged(entities, offset, size));
+	}
+	async function searchSubject(request, pep) {
+		if (options.subjects?.list === void 0) return notFound("search/subject is not configured");
+		const body = await readJson(request);
+		if (body instanceof Response) return body;
+		if (!isRecord(body)) return validationProblem("search/subject body must be an object");
+		let records;
+		try {
+			records = await options.subjects.list();
+		} catch {
+			return Response.json(paged([], 0, 1));
+		}
+		const item = body;
+		const wanted = item.subject?.type;
+		if (typeof wanted === "string" && wanted !== "user") return Response.json(paged([], 0, 1));
+		const matches = (await Promise.all(records.map(async (record) => {
+			const properties = {};
+			for (const [key, value] of Object.entries(record)) if (key !== "id") properties[key] = value;
+			return {
+				id: record.id,
+				decision: await decideItem(request, pep, compact({
+					action: item.action,
+					resource: item.resource,
+					context: item.context,
+					subject: {
+						type: "user",
+						id: record.id,
+						properties
+					}
+				}))
+			};
+		}))).flatMap(({ id, decision }) => decision.outcome === "granted" ? [{
+			type: "user",
+			id
+		}] : []);
+		const { offset, size } = pageOf(body);
+		return Response.json(paged(matches, offset, size));
+	}
+	function discovery(request, pathname) {
+		const pdp = `${new URL(request.url).origin}${pathname.slice(pathname.indexOf(WELL_KNOWN) + 34).replace(/\/+$/u, "")}`;
+		const document = {
+			policy_decision_point: pdp,
+			access_evaluation_endpoint: `${pdp}/access/v1/evaluation`,
+			access_evaluations_endpoint: `${pdp}/access/v1/evaluations`,
+			search_action_endpoint: `${pdp}/access/v1/search/action`,
+			search_resource_endpoint: `${pdp}/access/v1/search/resource`
+		};
+		if (options.subjects?.list !== void 0) document["search_subject_endpoint"] = `${pdp}/access/v1/search/subject`;
+		return Response.json(document);
+	}
+	async function route(request) {
+		const pathname = pathnameOf(request);
+		if (endsWithPath(pathname, WELL_KNOWN) || pathname.includes(`${WELL_KNOWN}/`)) {
+			if (request.method !== "GET") return methodNotAllowed("GET");
+			return discovery(request, pathname);
+		}
+		const identity = await authenticate(request);
+		if (identity instanceof Response) return identity;
+		const routes = [
+			[
+				"POST",
+				"/access/v1/evaluation",
+				evaluation
+			],
+			[
+				"POST",
+				"/access/v1/evaluations",
+				evaluations
+			],
+			[
+				"POST",
+				"/access/v1/search/action",
+				searchAction
+			],
+			[
+				"POST",
+				"/access/v1/search/resource",
+				searchResource
+			],
+			[
+				"POST",
+				"/access/v1/search/subject",
+				searchSubject
+			]
+		];
+		for (const [method, suffix, serve] of routes) if (endsWithPath(pathname, suffix)) {
+			if (request.method !== method) return methodNotAllowed(method);
+			return serve(request, identity.pep);
+		}
+		return notFound("unknown AuthZEN path");
+	}
+	return { async permdockHandler(request) {
+		return withRequestId(request, await route(request));
+	} };
+};
+//#endregion
+export { createPermDock };

package/dist/better-auth/index.d.ts

@@ -0,0 +1,109 @@
+import { Nr as Principal, Pr as Subject, at as DecisionSink, k as RoleBinding, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { m as PermissionTree } from "../permissions-DttnqqxC.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/better-auth/types.d.ts
+type BetterAuthPrincipal = Principal & {
+  readonly email?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type BetterAuthStatements = Readonly<Record<string, readonly string[]>>;
+type BetterAuthAccessRole = {
+  readonly statements?: BetterAuthStatements;
+  readonly permissions?: BetterAuthStatements;
+};
+type BetterAuthAccessControl = {
+  readonly ac?: unknown;
+  readonly roles: Readonly<Record<string, BetterAuthAccessRole>>;
+};
+type BetterAuthAssignableRole = {
+  readonly name: string;
+  readonly statements: BetterAuthStatements;
+};
+type BetterAuthMemberQuery = {
+  readonly model: string;
+  where: {
+    readonly field: string;
+    readonly value: string;
+  }[];
+  readonly limit?: number;
+};
+type BetterAuthLike = {
+  readonly $context?: Promise<{
+    readonly adapter?: {
+      readonly findMany?: (query: BetterAuthMemberQuery) => Promise<unknown>;
+    };
+  }>;
+  readonly api?: {
+    readonly listOrganizations?: (args?: {
+      readonly headers?: unknown;
+    }) => Promise<unknown>;
+    readonly listMembers?: (args?: {
+      readonly query?: {
+        readonly organizationId?: string;
+        readonly filterField?: string;
+        readonly filterOperator?: "eq";
+        readonly filterValue?: string;
+      };
+      readonly headers?: unknown;
+    }) => Promise<unknown>;
+    readonly getActiveMember?: (args?: {
+      readonly headers?: unknown;
+    }) => Promise<unknown>;
+    readonly listUserTeams?: (args?: {
+      readonly headers?: unknown;
+    }) => Promise<unknown>;
+    readonly listOrganizationRoles?: (args?: {
+      readonly query?: {
+        readonly organizationId?: string;
+      };
+      readonly headers?: unknown;
+    }) => Promise<unknown>;
+  };
+};
+type BetterAuthSubjectOptions = {
+  readonly memberships?: "all" | "active";
+  /**
+   * Parses the user's additional fields into `principal.claims`. Without it no
+   * field reaches claims, because a user may edit their own additional fields.
+   */
+  readonly schema?: StandardSchemaV1;
+  readonly headers?: unknown;
+  readonly declared?: readonly string[];
+};
+type BetterAuthRoleSourceOptions = {
+  readonly assignable?: readonly BetterAuthAssignableRole[];
+  readonly headers?: unknown;
+};
+type BetterAuthUnmatchedStatement = {
+  readonly role: string;
+  readonly resource: string;
+  readonly action: string;
+};
+type BetterAuthRoleChangeEvent = {
+  readonly userId?: string;
+  readonly organizationId?: string;
+  readonly role?: string;
+  readonly previousRole?: string;
+  readonly teamId?: string;
+  readonly by?: {
+    readonly id: string;
+    readonly kind: string;
+  };
+};
+//#endregion
+//#region src/better-auth/roles.d.ts
+type SeededRoles = RoleBinding<"tenant">[] & {
+  readonly unmatched: readonly BetterAuthUnmatchedStatement[];
+};
+export declare function rolesFromAccessControl(access: BetterAuthAccessControl, permissions: PermissionTree, options?: {
+  readonly on?: "tenant" | "global";
+}): SeededRoles;
+export declare function betterAuthRoleSource(auth: BetterAuthLike, options?: BetterAuthRoleSourceOptions): RoleSource;
+export declare function onRoleChange(refresh: (event: BetterAuthRoleChangeEvent) => void | Promise<void>, options?: {
+  readonly sink?: DecisionSink;
+}): (event: BetterAuthRoleChangeEvent) => Promise<void>;
+//#endregion
+//#region src/better-auth/subject.d.ts
+export declare function subjectFromBetterAuth(auth: BetterAuthLike, session: unknown, options?: BetterAuthSubjectOptions): Promise<Subject<BetterAuthPrincipal>>;
+//#endregion
+export type { BetterAuthAccessControl, BetterAuthAccessRole, BetterAuthAssignableRole, BetterAuthLike, BetterAuthMemberQuery, BetterAuthPrincipal, BetterAuthRoleChangeEvent, BetterAuthRoleSourceOptions, BetterAuthStatements, BetterAuthSubjectOptions, BetterAuthUnmatchedStatement, SeededRoles };