permdock 0.0.0 → 0.2.0

package/dist/sha256-BO0swRXL.js

@@ -0,0 +1,150 @@
+//#region src/core/sha256.ts
+const K = [
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+];
+function rotr(value, bits) {
+	return value >>> bits | value << 32 - bits;
+}
+/**
+* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and WinterTC-safe.
+*/
+function sha256(message) {
+	const bytes = new TextEncoder().encode(message);
+	const bitLength = bytes.length * 8;
+	const paddedLength = bytes.length + 9 + 63 >> 6 << 6;
+	const padded = new Uint8Array(paddedLength);
+	padded.set(bytes);
+	padded[bytes.length] = 128;
+	const view = new DataView(padded.buffer);
+	view.setUint32(paddedLength - 4, bitLength, false);
+	let h0 = 1779033703;
+	let h1 = 3144134277;
+	let h2 = 1013904242;
+	let h3 = 2773480762;
+	let h4 = 1359893119;
+	let h5 = 2600822924;
+	let h6 = 528734635;
+	let h7 = 1541459225;
+	const w = /* @__PURE__ */ new Int32Array(64);
+	for (let offset = 0; offset < paddedLength; offset += 64) {
+		for (let i = 0; i < 16; i += 1) w[i] = view.getInt32(offset + i * 4, false);
+		for (let i = 16; i < 64; i += 1) {
+			const w15 = w[i - 15] ?? 0;
+			const w2 = w[i - 2] ?? 0;
+			const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+			const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+			w[i] = (w[i - 16] ?? 0) + s0 + (w[i - 7] ?? 0) + s1 | 0;
+		}
+		let a = h0;
+		let b = h1;
+		let c = h2;
+		let d = h3;
+		let e = h4;
+		let f = h5;
+		let g = h6;
+		let h = h7;
+		for (let i = 0; i < 64; i += 1) {
+			const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const temp1 = h + S1 + ch + (K[i] ?? 0) + (w[i] ?? 0) | 0;
+			const temp2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) | 0;
+			h = g;
+			g = f;
+			f = e;
+			e = d + temp1 | 0;
+			d = c;
+			c = b;
+			b = a;
+			a = temp1 + temp2 | 0;
+		}
+		h0 = h0 + a | 0;
+		h1 = h1 + b | 0;
+		h2 = h2 + c | 0;
+		h3 = h3 + d | 0;
+		h4 = h4 + e | 0;
+		h5 = h5 + f | 0;
+		h6 = h6 + g | 0;
+		h7 = h7 + h | 0;
+	}
+	const out = /* @__PURE__ */ new Uint8Array(32);
+	const outView = new DataView(out.buffer);
+	outView.setInt32(0, h0, false);
+	outView.setInt32(4, h1, false);
+	outView.setInt32(8, h2, false);
+	outView.setInt32(12, h3, false);
+	outView.setInt32(16, h4, false);
+	outView.setInt32(20, h5, false);
+	outView.setInt32(24, h6, false);
+	outView.setInt32(28, h7, false);
+	return out;
+}
+function bytesToBase64Url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+//#endregion
+export { sha256 as n, bytesToBase64Url as t };

package/dist/shared-DRu8VFVM.js

@@ -0,0 +1,123 @@
+import { t as decisionToken } from "./token-CIWxJOCh.js";
+//#region src/pdp/shared.ts
+const MAX_CACHE_TTL_MS = 3e4;
+const CACHE_MAX = 1e3;
+/** Milliseconds, clamped to `[0, 30s]`; anything unparseable disables the cache. */
+function ttlMs(cache) {
+	if (cache === void 0) return 0;
+	const raw = typeof cache.ttl === "number" ? cache.ttl : cache.ttl.endsWith("ms") ? Number(cache.ttl.slice(0, -2)) : Number(cache.ttl.slice(0, -1)) * 1e3;
+	if (!Number.isFinite(raw) || raw <= 0) return 0;
+	return Math.min(raw, MAX_CACHE_TTL_MS);
+}
+function denied(reason) {
+	return {
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason
+		}],
+		alternatives: []
+	};
+}
+function resourceIdOf(data, field = "id") {
+	if (data === null || typeof data !== "object") return "*";
+	const id = Object.hasOwn(data, field) ? data[field] : void 0;
+	if (typeof id === "string" || typeof id === "number") return String(id);
+	return "*";
+}
+function granted(provider, permission, subject, data) {
+	const principal = subject.principal;
+	if (principal === null) return denied("anonymous");
+	return {
+		outcome: "granted",
+		subject: {
+			...subject,
+			principal
+		},
+		matched: {
+			role: provider,
+			permission: permission.key,
+			provider
+		},
+		token: decisionToken({
+			key: permission.key,
+			resourceId: resourceIdOf(data),
+			principal,
+			actor: subject.actor,
+			fingerprint: provider
+		})
+	};
+}
+/**
+* The request that would be sent, plus what a custom mapping may drop
+* (issuer, tenant, actor): a tenant switch or a changed row never reuses a
+* cached answer.
+*/
+function cacheKey(subject, permission, body) {
+	return JSON.stringify([
+		permission.key,
+		subject.principal?.issuer ?? null,
+		subject.principal?.tenant ?? null,
+		subject.actor === void 0 ? null : [subject.actor.id, subject.actor.kind],
+		body
+	]);
+}
+function ttlCache(ttl) {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get(key) {
+			if (ttl <= 0) return;
+			const hit = entries.get(key);
+			if (hit !== void 0 && Date.now() - hit.at < ttl) return hit.value;
+			entries.delete(key);
+		},
+		set(key, value) {
+			if (ttl <= 0) return;
+			entries.set(key, {
+				at: Date.now(),
+				value
+			});
+			if (entries.size > CACHE_MAX) {
+				const oldest = entries.keys().next();
+				if (oldest.done !== true) entries.delete(oldest.value);
+			}
+		}
+	};
+}
+async function bearerOf(auth) {
+	if (auth === void 0) return null;
+	try {
+		const token = typeof auth.bearer === "function" ? await auth.bearer() : auth.bearer;
+		return token === "" ? null : token;
+	} catch {
+		return null;
+	}
+}
+async function postJson(fetcher, url, body, options) {
+	const token = await bearerOf(options.auth);
+	const headers = {
+		"content-type": "application/json",
+		accept: "application/json"
+	};
+	if (token !== null) headers["authorization"] = `Bearer ${token}`;
+	try {
+		const response = await fetcher(url, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(body),
+			signal: AbortSignal.timeout(options.timeout)
+		});
+		return response.ok ? {
+			ok: true,
+			response
+		} : { ok: false };
+	} catch {
+		return { ok: false };
+	}
+}
+function joinUrl(base, path) {
+	if (path.startsWith("http://") || path.startsWith("https://")) return path;
+	return `${base.endsWith("/") ? base.slice(0, -1) : base}${path.startsWith("/") ? path : `/${path}`}`;
+}
+//#endregion
+export { postJson as a, ttlMs as c, joinUrl as i, denied as n, resourceIdOf as o, granted as r, ttlCache as s, cacheKey as t };

package/dist/sink-Bd9PSyfq.js

@@ -0,0 +1,141 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+//#region src/core/sink.ts
+/** The closed list of CloudEvents `type` values PermDock emits. */
+const CLOUD_EVENT_TYPES = Object.freeze({
+	decision: "dev.permdock.decision",
+	approval: "dev.permdock.approval",
+	directory: "dev.permdock.directory",
+	membership: "dev.permdock.membership",
+	catalog: "dev.permdock.catalog",
+	credential: "dev.permdock.credential",
+	accessStarted: "dev.permdock.access.started",
+	accessEnded: "dev.permdock.access.ended",
+	accessRevoked: "dev.permdock.access.revoked"
+});
+function cloudEventType(event) {
+	switch (event.type) {
+		case "directory": return CLOUD_EVENT_TYPES.directory;
+		case "membership": return CLOUD_EVENT_TYPES.membership;
+		case "credential": return CLOUD_EVENT_TYPES.credential;
+		case "access": return event.operation === "started" ? CLOUD_EVENT_TYPES.accessStarted : event.operation === "ended" ? CLOUD_EVENT_TYPES.accessEnded : CLOUD_EVENT_TYPES.accessRevoked;
+		case "decision":
+			if (event.phase === "requested" || event.phase === "resolved") return CLOUD_EVENT_TYPES.approval;
+			return CLOUD_EVENT_TYPES.decision;
+		default: return event;
+	}
+}
+function cloudEventSubject(event) {
+	if (event.type === "directory") return event.resource.id;
+	if (event.type === "membership" || event.type === "access") return event.principal.id;
+	if (event.type === "credential") return event.credential.id;
+	return event.permission;
+}
+/**
+* A `credential` sink event for `credential`. `sample` belongs on `used`
+* events only and must be in `(0, 1]`.
+*/
+function credentialEvent(input) {
+	const sample = input.sample;
+	if (sample !== void 0 && (input.operation !== "used" || !Number.isFinite(sample) || sample <= 0 || sample > 1)) throw new RangeError("PermDock: sample is a number in (0, 1] on used events only");
+	const { credential } = input;
+	return compact({
+		type: "credential",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source ?? "permdock",
+		operation: input.operation,
+		credential: {
+			id: credential.id,
+			kind: credential.kind
+		},
+		principal: { id: credential.principal },
+		tenant: credential.tenant,
+		expiresAt: credential.expiresAt,
+		by: input.by,
+		sample
+	});
+}
+function membershipEvent(input) {
+	if (input.scope === void 0 !== (input.id === void 0)) throw new TypeError("PermDock: membershipEvent needs scope and id together");
+	if (input.scope === void 0 && input.within !== void 0) throw new TypeError("PermDock: membershipEvent within needs a scope");
+	return compact({
+		type: "membership",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source,
+		operation: input.operation,
+		principal: input.principal,
+		scope: input.scope,
+		id: input.id,
+		within: input.within,
+		via: input.via,
+		expiresAt: input.expiresAt,
+		roles: input.roles,
+		by: input.by
+	});
+}
+/**
+* A support-access lifecycle event. `started` on consent, `ended` when the
+* session lapses, `revoked` when the tenant pulls consent early. It never
+* decides; the app writes and revokes the membership.
+*/
+function accessEvent(input) {
+	return compact({
+		type: "access",
+		at: input.at ?? (/* @__PURE__ */ new Date()).toISOString(),
+		source: input.source,
+		operation: input.operation,
+		tenant: input.tenant,
+		principal: input.principal,
+		via: input.via ?? "support",
+		roles: input.roles,
+		member: input.member,
+		expiresAt: input.expiresAt,
+		grantedBy: input.grantedBy,
+		reason: input.reason,
+		actor: input.actor
+	});
+}
+function toCloudEvent(event, source = "permdock") {
+	return compact({
+		specversion: "1.0",
+		type: cloudEventType(event),
+		source,
+		subject: cloudEventSubject(event),
+		id: globalThis.crypto.randomUUID(),
+		time: event.at,
+		datacontenttype: "application/json",
+		data: event
+	});
+}
+function signDecisionBatch(events, signer, options = {}) {
+	const source = options.source ?? "permdock";
+	return signer.sign({ events: events.map((event) => toCloudEvent(event, source)) }, compact({
+		typ: "permdock-decisions+jwt",
+		audience: options.audience
+	}));
+}
+function memorySink(options = {}) {
+	const capacity = options.capacity ?? 1e4;
+	const buffer = [];
+	const signed = [];
+	return {
+		write(events) {
+			buffer.push(...events);
+			if (buffer.length > capacity) buffer.splice(0, buffer.length - capacity);
+			if (options.signer === void 0) return;
+			return signDecisionBatch(events, options.signer, compact({
+				audience: options.audience,
+				source: options.source
+			})).then((batch) => {
+				signed.push(batch);
+			}).catch(() => void 0);
+		},
+		events() {
+			return [...buffer];
+		},
+		batches() {
+			return [...signed];
+		}
+	};
+}
+//#endregion
+export { memorySink as a, membershipEvent as i, accessEvent as n, signDecisionBatch as o, credentialEvent as r, toCloudEvent as s, CLOUD_EVENT_TYPES as t };

package/dist/sink-Gs6TTVa-.d.ts

@@ -0,0 +1,104 @@
+import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-CFZAr_Al.js";
+//#region src/core/sink.d.ts
+/** The closed list of CloudEvents `type` values PermDock emits. */
+declare const CLOUD_EVENT_TYPES: {
+  readonly decision: "dev.permdock.decision";
+  readonly approval: "dev.permdock.approval";
+  readonly directory: "dev.permdock.directory";
+  readonly membership: "dev.permdock.membership";
+  readonly catalog: "dev.permdock.catalog";
+  readonly credential: "dev.permdock.credential";
+  readonly accessStarted: "dev.permdock.access.started";
+  readonly accessEnded: "dev.permdock.access.ended";
+  readonly accessRevoked: "dev.permdock.access.revoked";
+};
+type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
+/** Why a published catalog broke a live hosted grant, which the Cloud then suspends. */
+type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened";
+/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+type CatalogFinding = {
+  readonly code: CatalogFindingCode;
+  readonly permission: string;
+  readonly grant?: string;
+};
+/** `data` of a `dev.permdock.catalog` event: a `permdock cloud push` or a drift against live hosted grants. */
+type CatalogEventData = {
+  readonly kind: "publish" | "drift";
+  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  readonly fingerprint: string;
+  readonly previous?: string;
+  readonly findings?: readonly CatalogFinding[];
+};
+type CloudEvent = {
+  readonly specversion: "1.0";
+  readonly type: CloudEventType;
+  readonly source: string;
+  readonly subject?: string;
+  readonly id: string;
+  readonly time: string;
+  readonly datacontenttype: "application/json";
+  readonly data: SinkEvent | CatalogEventData;
+};
+type SignDecisionBatchOptions = {
+  readonly audience?: string | readonly string[];
+  readonly source?: string;
+};
+type MemorySinkOptions = {
+  readonly capacity?: number;
+  readonly signer?: TokenSigner;
+  readonly audience?: string | readonly string[];
+  readonly source?: string;
+};
+type MemorySink = DecisionSink & {
+  readonly events: () => readonly SinkEvent[];
+  readonly batches: () => readonly string[];
+};
+/**
+ * A `credential` sink event for `credential`. `sample` belongs on `used`
+ * events only and must be in `(0, 1]`.
+ */
+declare function credentialEvent(input: {
+  readonly operation: CredentialEvent["operation"];
+  readonly credential: Credential;
+  readonly source?: string;
+  readonly by?: CredentialEvent["by"];
+  readonly sample?: number;
+  readonly at?: string;
+}): CredentialEvent;
+declare function membershipEvent(input: {
+  readonly source: string;
+  readonly operation: MembershipEvent["operation"];
+  readonly principal: MembershipEvent["principal"];
+  readonly scope?: string;
+  readonly id?: string;
+  readonly within?: MembershipEvent["within"];
+  readonly via?: string;
+  readonly expiresAt?: number;
+  readonly roles: MembershipEvent["roles"];
+  readonly by?: MembershipEvent["by"];
+  readonly at?: string;
+}): MembershipEvent;
+/**
+ * A support-access lifecycle event. `started` on consent, `ended` when the
+ * session lapses, `revoked` when the tenant pulls consent early. It never
+ * decides; the app writes and revokes the membership.
+ */
+declare function accessEvent(input: {
+  readonly source: string;
+  readonly operation: AccessEvent["operation"];
+  readonly tenant: string;
+  readonly principal: AccessEvent["principal"];
+  readonly via?: string;
+  readonly roles: readonly string[];
+  readonly member?: AccessEvent["member"];
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly actor?: AccessEvent["actor"];
+  readonly at?: string;
+}): AccessEvent;
+declare function toCloudEvent(event: SinkEvent, source?: string): CloudEvent;
+declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options?: SignDecisionBatchOptions): Promise<string>;
+declare function memorySink(options?: MemorySinkOptions): MemorySink;
+//#endregion
+export { CloudEvent as a, MemorySinkOptions as c, credentialEvent as d, membershipEvent as f, toCloudEvent as h, CatalogFindingCode as i, SignDecisionBatchOptions as l, signDecisionBatch as m, CatalogEventData as n, CloudEventType as o, memorySink as p, CatalogFinding as r, MemorySink as s, CLOUD_EVENT_TYPES as t, accessEvent as u };