permdock 0.0.0 → 0.2.0

package/dist/src-CSbUiozF.js

@@ -0,0 +1,568 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { i as findPermission } from "./permissions-DVoF6dMt.js";
+import { b as assertSqlFunctionArg, i as declaredRoleNames, s as grantList, u as levelNames, v as normalizeWhere, x as assertSqlFunctionName, y as assertPortableTwin } from "./policy-xyWg7QdR.js";
+import { d as scopeList, m as tenantOf } from "./scopes-CVdPrWN-.js";
+import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-Enxd0n-s.js";
+import { T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { g as tenantsOf } from "./validity-uOp8UpYn.js";
+import { n as isThenable } from "./thenable-okc2xDsj.js";
+import { a as collectSnapshotGrants, c as rankRoles, l as usesAssigns, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as declaredRoleNames$1, y as resolveCustomRole } from "./permdock-CzqXjCpU.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-BrMozJCo.js";
+//#region src/conditions/sql-function.ts
+function sqlFunction(name, options) {
+	assertSqlFunctionName(name);
+	const args = options.args ?? [];
+	for (const arg of args) assertSqlFunctionArg(arg);
+	const twin = normalizeWhere(options.twin);
+	assertPortableTwin(twin);
+	return freezeDeep({
+		op: "sqlFunction",
+		name,
+		args,
+		twin
+	});
+}
+//#endregion
+//#region src/core/interfaces.ts
+function memoryEntitlementSource(entries) {
+	return { entitlementsFor(_principal, options) {
+		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
+	} };
+}
+function memorySettings(settings) {
+	const byTenant = new Map(Object.entries(settings));
+	return Object.freeze({ settingsFor(tenant) {
+		return byTenant.get(tenant);
+	} });
+}
+/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+function memoryMembershipSource(entries) {
+	const byPrincipal = new Map(Object.entries(entries));
+	return Object.freeze({
+		membershipsFor(principal) {
+			return [...byPrincipal.get(principal.id) ?? []];
+		},
+		list(query) {
+			const members = [];
+			for (const [id, memberships] of byPrincipal) for (const membership of memberships) if (membership.scope === query.scope && membership.id === query.id) members.push({
+				principal: { id },
+				membership
+			});
+			return members;
+		}
+	});
+}
+/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
+function memorySnapshotSource(initial) {
+	let current = initial;
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		get: () => current,
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		set(snapshot) {
+			current = snapshot;
+			for (const listener of listeners) listener();
+		}
+	});
+}
+function memoryRoleSource(customRoles) {
+	const byTenant = /* @__PURE__ */ new Map();
+	const global = [];
+	for (const role of customRoles) {
+		if (role.tenant === void 0) {
+			global.push(role);
+			continue;
+		}
+		const list = byTenant.get(role.tenant) ?? [];
+		list.push(role);
+		byTenant.set(role.tenant, list);
+	}
+	return {
+		rolesFor(tenant) {
+			return [...byTenant.get(tenant) ?? []];
+		},
+		globalRoles() {
+			return [...global];
+		}
+	};
+}
+//#endregion
+//#region src/core/stripe-entitlements.ts
+const PAGE = 100;
+const MAX_PAGES = 10;
+/**
+* Plan names from Stripe Entitlements: the `lookup_key` of every active
+* entitlement of the tenant's Stripe customer. `customer` maps the active
+* tenant to its customer id; no tenant or no customer means no entitlements.
+* Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
+*/
+function fromStripeEntitlements(options) {
+	return { async entitlementsFor(principal, query) {
+		if (query.tenant === void 0) return [];
+		const customer = await options.customer(query.tenant, principal);
+		if (customer === void 0 || customer === "") return [];
+		const keys = /* @__PURE__ */ new Set();
+		let after;
+		for (let page = 0; page < MAX_PAGES; page += 1) {
+			const result = await options.stripe.entitlements.activeEntitlements.list(after === void 0 ? {
+				customer,
+				limit: PAGE
+			} : {
+				customer,
+				limit: PAGE,
+				starting_after: after
+			});
+			for (const item of result.data) if (typeof item.lookup_key === "string" && item.lookup_key !== "") keys.add(item.lookup_key);
+			const last = result.data.at(-1);
+			if (!result.has_more || last === void 0) break;
+			after = last.id;
+		}
+		return [...keys].toSorted();
+	} };
+}
+//#endregion
+//#region src/core/local-manifest.ts
+/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
+function localGrant(grant) {
+	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
+	return snapshotGrant(relational ? {
+		...grant,
+		portable: false
+	} : grant, void 0);
+}
+function customTable(policy, scope, roles) {
+	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
+	if (keys.length === 0) return;
+	const resolve = (body) => resolveCustomRole(policy, scope === "global" ? {
+		name: LOCAL_CUSTOM_ROLE,
+		scope: "global",
+		...body
+	} : {
+		name: LOCAL_CUSTOM_ROLE,
+		tenant: LOCAL_CUSTOM_ROLE,
+		scope,
+		...body
+	}).grants.map(localGrant);
+	const permissions = {};
+	for (const key of keys) {
+		const leaf = findPermission(policy.permissions, key);
+		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		permissions[key] = compact({
+			all: resolve({ grants: [{ permission: key }] }),
+			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
+				permission: key,
+				level
+			}] })]))
+		});
+	}
+	const includes = {};
+	for (const role of roles) {
+		const grants = resolve({ includes: [role] });
+		if (grants.length > 0) includes[role] = grants;
+	}
+	return {
+		permissions,
+		includes
+	};
+}
+/**
+* What the policy grants, as JSON a device turns into snapshots from its own
+* membership rows (`localSnapshot` in `permdock/react-native`). Write it at
+* build time; the policy itself never ships to the client.
+*/
+function localSnapshotManifest(policy) {
+	const roles = [...declaredRoleNames(policy)].toSorted();
+	const custom = {};
+	for (const scope of [...scopeList(policy.scopes).map((item) => item.name), "global"]) {
+		const table = customTable(policy, scope, roles);
+		if (table !== void 0) custom[scope] = table;
+	}
+	const scopes = snapshotScopes(policy);
+	const { vocabulary } = buildSnapshot({
+		subject: {
+			principal: null,
+			context: {}
+		},
+		roles: [],
+		grants: [],
+		vocabulary: policy.vocabulary
+	});
+	return freezeDeep(compact({
+		v: 1,
+		scopes,
+		vocabulary,
+		roles,
+		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
+		grants: grantList(policy).map(localGrant),
+		custom
+	}));
+}
+//#endregion
+//#region src/core/may-access.ts
+function policyPlans(policy) {
+	const names = new Set(listPlans(policy.vocabulary?.plans).map((p) => p.key));
+	for (const grant of grantList(policy)) for (const item of flattenGrantee(grant.to)) if (item.kind === "plan") names.add(item.plan);
+	return [...names];
+}
+function heldRoleNames(principal) {
+	return [...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((item) => item.roles)];
+}
+/**
+* An optimistic routing hint for a proxy or middleware, never a decision.
+* `false` only when the subject's declared roles provably lack `permission`;
+* `true` whenever custom roles, plans, memberships the claims do not carry or
+* row conditions could still grant it. Synchronous, no network, never throws.
+* Pages, Server Actions and RLS remain the enforcement points.
+*/
+function mayAccess(policy, user, permission, options = {}) {
+	try {
+		const resolved = resolveSubject(policy, user, compact({ tenant: options.tenant }), []);
+		if (isThenable(resolved)) return true;
+		const principal = resolved.principal;
+		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
+		if (principal !== null) {
+			const declared = declaredRoleNames$1(policy);
+			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
+			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
+		}
+		const tenant = options.tenant;
+		const subject = principal === null ? resolved : {
+			...resolved,
+			principal: {
+				...principal,
+				plans: policyPlans(policy),
+				memberships: (principal.memberships ?? []).filter((item) => {
+					const owner = tenantOf(item, scopeList(policy.scopes));
+					return tenant === void 0 || owner === void 0 || owner === tenant;
+				})
+			}
+		};
+		const matched = collectSnapshotGrants(policy, subject, []).filter((item) => item.grant.permission.key === permission.key);
+		if (matched.some((item) => item.grant.effect === "deny" && item.grant.where === void 0 && item.grant.check === void 0 && item.grant.portable)) return false;
+		return matched.some((item) => item.grant.effect === "allow");
+	} catch {
+		return true;
+	}
+}
+//#endregion
+//#region src/core/custom-role-source.ts
+function ofTenant(tenant, roles) {
+	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
+}
+/**
+* A `RoleSource` over a reader that returns every custom role of a tenant.
+* It keeps only the roles of the requested tenant. With `read: 'held'` it
+* skips a tenant's read, and `globalRoles`, when the subject holds only
+* declared roles there.
+*/
+function customRoleSource(reader, options = {}) {
+	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
+	return Object.freeze({
+		rolesFor(tenant, context) {
+			if (declared !== void 0 && context?.held.every((name) => declared.has(name)) === true) return [];
+			const roles = reader.rolesOf(tenant);
+			return isThenable(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
+		},
+		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
+		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] }
+	});
+}
+//#endregion
+//#region src/core/snapshot-for.ts
+function withPlans(subject, plans) {
+	if (plans === void 0 || subject.principal === null) return subject;
+	return freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...subject.principal,
+			plans: [...plans]
+		})
+	}));
+}
+/**
+* Builds the serializable access snapshot for a subject without a request,
+* a network call or a cache directive: call it inside the app's own
+* `'use cache: private'` function. Synchronous; the policy's `subject` and
+* `context` mappers must be synchronous too.
+*/
+function snapshotFor(policy, user, options = {}) {
+	const auth = [];
+	const memberships = options.memberships;
+	const resolved = resolveSubject(policy, user, compact({
+		tenant: options.tenant,
+		memberships: memberships === void 0 ? void 0 : { membershipsFor: () => [...memberships] }
+	}), auth);
+	if (isThenable(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use createPermDock(...).snapshot().");
+	const subject = withPlans(resolved, options.plans);
+	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
+	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
+	const names = options.assignable;
+	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
+	return snapshotOf(policy, subject, compact({
+		customRoles,
+		assignable,
+		include: options.include,
+		tenants: options.tenants,
+		now: options.now
+	}));
+}
+//#endregion
+//#region src/core/presets.ts
+const CRUD_ACTIONS = {
+	read: { readOnly: true },
+	update: {},
+	delete: { destructive: true }
+};
+const CRUD_COLLECTION = {
+	create: {},
+	list: { readOnly: true }
+};
+const READABLE_ACTIONS = { read: { readOnly: true } };
+const READABLE_COLLECTION = { list: { readOnly: true } };
+const WRITABLE_ACTIONS = {
+	read: { readOnly: true },
+	update: {}
+};
+const WRITABLE_COLLECTION = {};
+function isNameList(list) {
+	return Array.isArray(list);
+}
+function toRecord(list) {
+	if (list === void 0) return {};
+	if (isNameList(list)) {
+		const out = {};
+		for (const name of list) out[name] = {};
+		return out;
+	}
+	return { ...list };
+}
+function mergeMeta(base, extra) {
+	return compact({
+		title: extra.title ?? base.title,
+		description: extra.description ?? base.description,
+		tags: extra.tags ?? base.tags,
+		readOnly: extra.readOnly ?? base.readOnly,
+		destructive: extra.destructive ?? base.destructive,
+		idempotent: extra.idempotent ?? base.idempotent
+	});
+}
+function mergeActionLists(base, extra) {
+	const extraRecord = toRecord(extra);
+	const out = {};
+	for (const [name, baseMeta] of Object.entries(base)) {
+		const extraMeta = extraRecord[name];
+		out[name] = extraMeta === void 0 ? baseMeta : mergeMeta(baseMeta, extraMeta);
+	}
+	for (const [name, extraMeta] of Object.entries(extraRecord)) {
+		if (Object.hasOwn(out, name)) continue;
+		out[name] = extraMeta;
+	}
+	return freezeDeep(out);
+}
+function finishPreset(baseActions, baseCollection, options) {
+	const actions = mergeActionLists(baseActions, options?.actions);
+	const collection = mergeActionLists(baseCollection, options?.collection);
+	return compact({
+		id: options?.id,
+		parent: options?.parent,
+		relations: options?.relations,
+		restricted: options?.restricted,
+		disclosure: options?.disclosure,
+		actions,
+		collection: Object.keys(collection).length === 0 ? void 0 : collection
+	});
+}
+function crud(options) {
+	return finishPreset(CRUD_ACTIONS, CRUD_COLLECTION, options);
+}
+function readable(options) {
+	return finishPreset(READABLE_ACTIONS, READABLE_COLLECTION, options);
+}
+function writable(options) {
+	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
+}
+//#endregion
+//#region src/core/ocsf.ts
+/** The OCSF schema version `toOcsf` emits. */
+const OCSF_VERSION = "1.3.0";
+function status(outcome) {
+	switch (outcome) {
+		case "granted": return {
+			status_id: 1,
+			status: "Success"
+		};
+		case "denied": return {
+			status_id: 2,
+			status: "Failure"
+		};
+		case "approval-required": return {
+			status_id: 99,
+			status: "Other"
+		};
+		default: return unknownStatus(outcome);
+	}
+}
+/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
+function unknownStatus(_outcome) {
+	return {
+		status_id: 0,
+		status: "Unknown"
+	};
+}
+/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
+function toOcsf(event) {
+	const principal = event.subject.principal;
+	const actor = event.subject.actor;
+	const breakGlass = event.matched?.breakGlass === true;
+	const detail = event.outcome === "approval-required" ? "approval-required" : event.denials?.map((denial) => denial.reason).join(",");
+	const time = Date.parse(event.at);
+	return compact({
+		class_uid: 3003,
+		category_uid: 3,
+		activity_id: 1,
+		type_uid: 300301,
+		severity_id: breakGlass ? 4 : 1,
+		time: Number.isNaN(time) ? 0 : time,
+		...status(event.outcome),
+		status_detail: detail === "" ? void 0 : detail,
+		message: `${event.permission} ${event.outcome}`,
+		privileges: [event.permission],
+		user: principal === null ? { name: "anonymous" } : { uid: principal.id },
+		actor: actor === void 0 ? void 0 : compact({
+			user: principal === null ? void 0 : { uid: principal.id },
+			app_name: actor.id
+		}),
+		metadata: compact({
+			version: OCSF_VERSION,
+			product: compact({
+				name: "PermDock",
+				vendor_name: "PermDock",
+				feature: event.adapter === void 0 ? void 0 : { name: event.adapter }
+			}),
+			tenant_uid: event.tenant,
+			correlation_uid: event.token
+		}),
+		unmapped: compact({
+			outcome: event.outcome,
+			scope: event.scope,
+			resource: event.resource,
+			source: event.source,
+			phase: event.phase,
+			role: event.matched?.role,
+			via: event.via,
+			breakGlass: breakGlass ? true : void 0,
+			purpose: event.purpose,
+			reason: event.reason
+		})
+	});
+}
+function accessToOcsf(event) {
+	const time = Date.parse(event.at);
+	const enable = event.operation === "started";
+	return compact({
+		class_uid: 3001,
+		category_uid: 3,
+		activity_id: enable ? 2 : 5,
+		type_uid: enable ? 300102 : 300105,
+		severity_id: 4,
+		time: Number.isNaN(time) ? 0 : time,
+		message: `support access ${event.operation}`,
+		user: { uid: event.principal.id },
+		actor: event.actor === void 0 ? void 0 : { user: { uid: event.actor.id } },
+		metadata: {
+			version: OCSF_VERSION,
+			product: {
+				name: "PermDock",
+				vendor_name: "PermDock"
+			},
+			tenant_uid: event.tenant
+		},
+		unmapped: compact({
+			operation: event.operation,
+			via: event.via,
+			roles: event.roles,
+			member: event.member,
+			grantedBy: event.grantedBy,
+			reason: event.reason
+		})
+	});
+}
+//#endregion
+//#region src/core/csv.ts
+/** The CSV export columns, in order; the header row of every CSV file. */
+const CSV_COLUMNS = Object.freeze([
+	"time",
+	"principal",
+	"actor",
+	"tenant",
+	"permission",
+	"outcome",
+	"matched.role",
+	"via",
+	"denials.reason",
+	"token"
+]);
+function field(value) {
+	const text = value ?? "";
+	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
+}
+/**
+* One RFC 4180 row for a decision or approval event, without a line
+* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+*/
+function toCsvRow(event) {
+	return [
+		event.at,
+		event.subject.principal?.id,
+		event.subject.actor?.id,
+		event.tenant,
+		event.permission,
+		event.outcome,
+		event.matched?.role,
+		event.via,
+		event.denials?.map((denial) => denial.reason).join(";"),
+		event.token
+	].map(field).join(",");
+}
+//#endregion
+//#region src/core/catalog-fingerprint.ts
+const OMITTED_TOP_LEVEL = /* @__PURE__ */ new Set([
+	"generatedAt",
+	"generator",
+	"fingerprint"
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function fingerprintInput(catalog) {
+	const out = {};
+	for (const [key, value] of Object.entries(catalog)) {
+		if (OMITTED_TOP_LEVEL.has(key)) continue;
+		out[key] = key === "permissions" && Array.isArray(value) ? value.map((permission) => {
+			if (!isRecord(permission)) return permission;
+			const { usages: _usages, ...rest } = permission;
+			return rest;
+		}) : value;
+	}
+	return out;
+}
+/**
+* The catalog v1 fingerprint: base64url SHA-256 of canonical JSON (keys
+* sorted, no whitespace) without `generatedAt`, `generator`, `fingerprint`
+* and every `permissions[].usages`, so neither the CLI version, the clock nor
+* call sites change it.
+*/
+function catalogFingerprint(catalog) {
+	if (!isRecord(catalog)) throw new TypeError("PermDock: a catalog must be an object");
+	return bytesToBase64Url(sha256(canonicalJson(fingerprintInput(catalog))));
+}
+//#endregion
+export { memoryRoleSource as _, accessToOcsf as a, sqlFunction as b, readable as c, customRoleSource as d, mayAccess as f, memoryMembershipSource as g, memoryEntitlementSource as h, OCSF_VERSION as i, writable as l, fromStripeEntitlements as m, CSV_COLUMNS as n, toOcsf as o, localSnapshotManifest as p, toCsvRow as r, crud as s, catalogFingerprint as t, snapshotFor as u, memorySettings as v, memorySnapshotSource as y };

package/dist/ssf/index.d.ts

@@ -0,0 +1,4 @@
+import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-9AWO9EGt.js";
+import { t as memoryReplayStore } from "../replay-sqBGMnNs.js";
+import { t as createPermDock } from "../index-CtE07CBF.js";
+export { type CaepEventName, type PollHandle, type PollOptions, type PollResult, type ReplayStore, type SetSubject, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfSubject, type SsfSubjectMapper, createPermDock, memoryReplayStore };