permdock 0.0.0 → 0.2.0

package/dist/schema-D3MnDMxa.js

@@ -0,0 +1,300 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+//#region src/catalog/schema.ts
+const name = {
+	type: "string",
+	pattern: "^[a-z][a-z0-9_]*$"
+};
+const validity = {
+	type: "object",
+	properties: {
+		from: { type: "integer" },
+		until: { type: "integer" }
+	}
+};
+const strings = {
+	type: "array",
+	items: { type: "string" }
+};
+const approval = { oneOf: [{ const: "human" }, {
+	type: "object",
+	properties: {
+		by: {},
+		mode: { enum: [
+			"any",
+			"all",
+			"sequential"
+		] },
+		stages: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["by"],
+				properties: {
+					by: {},
+					quorum: {
+						type: "integer",
+						minimum: 1
+					}
+				}
+			}
+		},
+		distinct: { type: "boolean" },
+		staleOn: { const: "resource-change" },
+		quorum: {
+			type: "integer",
+			minimum: 1
+		},
+		ttl: { type: "string" },
+		escalation: {
+			type: "object",
+			required: ["after", "to"],
+			properties: {
+				after: { type: "string" },
+				to: {}
+			}
+		}
+	}
+}] };
+/** `schemas/catalog-v1.json`; a test keeps the two equal. */
+const catalogSchema = freezeDeep({
+	$schema: "https://json-schema.org/draft/2020-12/schema",
+	$id: "https://permdock.com/schemas/catalog-v1.json",
+	type: "object",
+	required: [
+		"$schema",
+		"version",
+		"generatedAt",
+		"generator",
+		"resources",
+		"permissions"
+	],
+	properties: {
+		$schema: { type: "string" },
+		version: { const: 1 },
+		generatedAt: { type: "string" },
+		generator: { type: "string" },
+		fingerprint: { type: "string" },
+		resources: {
+			type: "object",
+			additionalProperties: {
+				type: "object",
+				required: ["id", "schema"],
+				properties: {
+					id: { type: "string" },
+					schema: {},
+					definedIn: { type: "string" },
+					relations: { type: "object" },
+					version: { type: "string" },
+					restricted: { type: "string" },
+					restrictedStops: strings
+				}
+			}
+		},
+		roles: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["key"],
+				properties: {
+					key: { type: "string" },
+					on: name,
+					assignable: { type: "boolean" },
+					min: {
+						type: "integer",
+						minimum: 1
+					},
+					max: {
+						type: "integer",
+						minimum: 1
+					},
+					transferOnly: { const: true },
+					assigns: strings,
+					for: strings,
+					exclusiveWith: strings,
+					audience: { type: "string" },
+					activation: {
+						type: "object",
+						required: ["justification"],
+						properties: {
+							maxDuration: { type: "string" },
+							justification: { enum: ["required", "optional"] },
+							approval: { type: "boolean" },
+							assurance: { type: "object" }
+						}
+					},
+					supportAccess: {
+						type: "object",
+						required: [
+							"actorRequired",
+							"group",
+							"durations"
+						],
+						properties: {
+							actorRequired: { type: "boolean" },
+							group: { type: "string" },
+							durations: strings
+						}
+					}
+				}
+			}
+		},
+		scopes: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["name", "key"],
+				properties: {
+					name,
+					key: { type: "string" },
+					within: { type: "string" }
+				}
+			}
+		},
+		plans: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["key"],
+				properties: { key: { type: "string" } }
+			}
+		},
+		permissions: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"key",
+					"scope",
+					"resource",
+					"action",
+					"arity",
+					"meta",
+					"usages",
+					"rowConditions"
+				],
+				properties: {
+					key: { type: "string" },
+					scope: { type: "string" },
+					resource: { type: "string" },
+					action: { type: "string" },
+					arity: { enum: ["instance", "collection"] },
+					meta: { type: "object" },
+					usages: {
+						type: "array",
+						items: {
+							type: "object",
+							required: [
+								"file",
+								"line",
+								"call"
+							],
+							properties: {
+								file: { type: "string" },
+								line: {
+									type: "integer",
+									minimum: 0
+								},
+								call: { type: "string" }
+							}
+						}
+					},
+					renamedFrom: strings,
+					levels: strings,
+					hostable: { const: true },
+					rowConditions: { type: "boolean" },
+					approvals: {
+						type: "array",
+						items: approval
+					},
+					breakGlass: {
+						type: "object",
+						required: [
+							"overrides",
+							"reason",
+							"obligations"
+						],
+						properties: {
+							overrides: strings,
+							purpose: strings,
+							reason: { type: "boolean" },
+							maxDuration: { type: "string" },
+							obligations: strings
+						}
+					}
+				}
+			}
+		},
+		grants: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"permission",
+					"effect",
+					"role",
+					"to",
+					"scope"
+				],
+				properties: {
+					permission: { type: "string" },
+					effect: { enum: ["allow", "deny"] },
+					role: { oneOf: [{ type: "string" }, { const: null }] },
+					to: {},
+					scope: { oneOf: [{ type: "string" }, {
+						type: "object",
+						required: ["resource"],
+						properties: { resource: { type: "string" } }
+					}] },
+					where: {},
+					check: {},
+					approval,
+					fields: strings,
+					validity,
+					name: { type: "string" },
+					purpose: strings,
+					requires: { oneOf: [{ type: "string" }, strings] },
+					limit: {
+						type: "object",
+						required: ["count", "per"],
+						properties: {
+							count: {
+								type: "integer",
+								minimum: 1
+							},
+							per: { type: "string" },
+							mode: { enum: ["hard", "soft"] }
+						}
+					},
+					portable: { const: false }
+				}
+			}
+		},
+		delegations: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"from",
+					"to",
+					"permissions"
+				],
+				properties: {
+					from: {},
+					to: {
+						type: "object",
+						required: ["kind"],
+						properties: {
+							kind: { type: "string" },
+							id: { type: "string" },
+							client: { type: "string" }
+						}
+					},
+					permissions: strings,
+					validity
+				}
+			}
+		}
+	}
+});
+//#endregion
+export { catalogSchema as t };

package/dist/scim/index.d.ts

@@ -0,0 +1,2 @@
+import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-A0YNL8jZ.js";
+export { type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -0,0 +1,2 @@
+import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-BFGBBAqR.js";
+export { DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };