permdock 0.0.0 → 0.2.0

package/dist/supabase/middleware.d.ts

@@ -0,0 +1,82 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { n as OpenApiHooks } from "../create-BWyx3jua.js";
+import { n as ServerAdapterServices } from "../bind-CVy3Espv.js";
+import { Middleware } from "@supabase/middleware";
+//#region src/supabase/middleware.d.ts
+/**
+ * The verified Supabase Auth access-token payload as `@supabase/server`
+ * contributes it under `ctx.jwtClaims`. Structural, so the `JWTClaims`
+ * interface from `@supabase/server` satisfies it without an import.
+ */
+export type SupabaseJwtClaims = {
+  readonly sub: string;
+  readonly iss?: string;
+  readonly aud?: string | readonly string[];
+  readonly exp?: number;
+  readonly iat?: number;
+  readonly role?: string;
+  readonly email?: string;
+  readonly app_metadata?: Readonly<Record<string, unknown>>;
+  readonly user_metadata?: Readonly<Record<string, unknown>>;
+  readonly [claim: string]: unknown;
+};
+/**
+ * What `withPermDock` requires upstream: a `jwtClaims` contribution. Supabase's
+ * `withClaims`, `withRequiredClaims` and `withSupabase` all provide it; `null`
+ * is the anonymous caller (no bearer token or an `sb_*` API key), unless
+ * `secretKeys` names the secret key `withSupabase` matched.
+ */
+export type SupabaseMiddlewareContext = {
+  readonly jwtClaims: SupabaseJwtClaims | null;
+};
+/**
+ * A Supabase secret key that acts as a tenant service principal. `id` is the
+ * principal id, `roles` are held in `tenant` only, and `permissions` caps
+ * what the key may do, as a `service` credential does.
+ */
+export type SupabaseSecretKey = {
+  readonly id: string;
+  readonly tenant: string;
+  readonly roles: readonly string[];
+  readonly permissions: readonly Permission[];
+};
+export type SupabaseMiddlewarePermDockOptions<TUser = unknown> = InstanceOptions & ServerAdapterServices & {
+  /**
+   * Named secret keys (`SUPABASE_SECRET_KEYS`) that act as service
+   * principals when `withSupabase` matched one (`authMode: 'secret'` with
+   * that `authKeyName`). Any other key, an unnamed `secret` and every
+   * `publishable` key stay anonymous.
+   */
+  readonly secretKeys?: Readonly<Record<string, SupabaseSecretKey>>;
+  readonly subject: (ctx: SupabaseMiddlewareContext, request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
+  readonly tenant?: string | ((ctx: SupabaseMiddlewareContext, request: Request) => string | undefined | Promise<string | undefined>);
+};
+export type WithPermDockConfig = {
+  /** Run `protect` before the handler; a denial short-circuits with Problem Details. */
+  readonly protect?: Permission;
+  /**
+   * The OAuth scopes that reach the handler: a delegated token holding none
+   * of them is refused with `insufficient_scope`. Without `protect`, the
+   * handler needs a signed-in principal and checks no permission.
+   */
+  readonly oauthScopes?: readonly string[];
+  /** Load the row `protect` decides on; `null` or `undefined` yields 404. */
+  readonly data?: (ctx: SupabaseMiddlewareContext, request: Request) => unknown;
+  /** `true` when `data` returns a row the server loaded; anything else is validated before the check. */
+  readonly trusted?: boolean;
+};
+/**
+ * A terminal pipeline handler. Generic over the accumulated context so
+ * `pipeline([withClaims()], permdockHandler())` infers without a wrapping
+ * lambda; the constraint still requires an upstream `jwtClaims` contribution.
+ */
+export type SupabaseMiddlewareHandler = <Ctx extends SupabaseMiddlewareContext>(request: Request, ctx: Ctx) => Promise<Response>;
+export type SupabaseMiddlewarePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly withPermDock: Middleware<"permdock", WithPermDockConfig | undefined, SupabaseMiddlewareContext, PermDock<V>>;
+  readonly permdockHandler: () => SupabaseMiddlewareHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SupabaseMiddlewarePermDockOptions<TUser>): SupabaseMiddlewarePermDock<V>;
+//#endregion

package/dist/supabase/middleware.js

@@ -0,0 +1,102 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { r as credentialSubject } from "../credential-8P81ff4u.js";
+import { i as methodNotAllowed } from "../problem-B43ztKIm.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createServerKernel } from "../create-CPhDL6qx.js";
+import { n as attached } from "../bind-VnYn2HKq.js";
+import { defineMiddleware } from "@supabase/middleware";
+//#region src/supabase/middleware.ts
+const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;
+function secretKeySubjects(keys, permissions) {
+	const subjects = /* @__PURE__ */ new Map();
+	for (const [name, key] of Object.entries(keys ?? {})) {
+		if (!SECRET_KEY_NAME.test(name)) throw new Error(`PermDock: secretKeys name '${name}' must be a key name from SUPABASE_SECRET_KEYS, not a pattern`);
+		if (key.id === "" || key.tenant === "") throw new Error(`PermDock: secretKeys.${name} needs a non-empty id and tenant`);
+		const credential = {
+			v: 1,
+			id: `supabase-secret:${name}`,
+			kind: "service",
+			principal: key.id,
+			tenant: key.tenant,
+			roles: [...key.roles],
+			permissions: key.permissions.map((permission) => ({ permission: permission.key })),
+			createdBy: key.id,
+			createdAt: 0,
+			name
+		};
+		subjects.set(name, credentialSubject(credential, { permissions }));
+	}
+	return subjects;
+}
+function readString(ctx, key) {
+	const value = Reflect.get(ctx, key);
+	return typeof value === "string" ? value : void 0;
+}
+/**
+* `authMode` and `authKeyName` are optional upstream contributions (only
+* `withSupabase` makes them), so they are read here instead of being part of
+* the entry's declared prerequisites.
+*/
+function secretKeySubject(subjects, ctx) {
+	if (subjects.size === 0 || ctx.jwtClaims !== null || readString(ctx, "authMode") !== "secret") return;
+	const name = readString(ctx, "authKeyName");
+	return name === void 0 ? void 0 : subjects.get(name);
+}
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const tenantOption = options.tenant;
+	const contextFor = (request) => contexts.get(request) ?? { jwtClaims: null };
+	const secretKeys = secretKeySubjects(options.secretKeys, policy.permissions);
+	const kernel = createServerKernel(policy, compact({
+		subject: (request) => {
+			const ctx = contextFor(request);
+			return secretKeySubject(secretKeys, ctx) ?? options.subject(ctx, request);
+		},
+		tenant: typeof tenantOption === "function" ? (request) => tenantOption(contextFor(request), request) : tenantOption,
+		...instanceOptions(options),
+		store: options.store,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		adapter: "supabase-middleware",
+		wrap: options.otel
+	}));
+	const bind = (request, ctx) => {
+		contexts.set(request, ctx);
+		return request;
+	};
+	const withPermDock = defineMiddleware({
+		key: "permdock",
+		run: (config) => async (request, ctx) => {
+			bind(request, ctx);
+			if (config?.protect === void 0 && config?.oauthScopes === void 0) {
+				const instance = await attached(() => kernel.permdock(request));
+				return instance.ok ? { permdock: instance.permdock } : instance.response;
+			}
+			const loadData = config.data;
+			const guard = await kernel.protect(config.protect ?? null, loadData === void 0 ? void 0 : () => loadData(ctx, request), compact({
+				trusted: config.trusted,
+				oauthScopes: config.oauthScopes
+			}))(request);
+			if (!guard.ok) return guard.response;
+			return { permdock: guard.permdock };
+		}
+	});
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler();
+		return (request, ctx) => {
+			bind(request, ctx);
+			switch (request.method) {
+				case "POST": return POST(request);
+				case "GET": return GET(request);
+				default: return Promise.resolve(methodNotAllowed("GET, POST"));
+			}
+		};
+	};
+	return {
+		withPermDock,
+		permdockHandler,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { createPermDock };

package/dist/supabase-CwafwxxF.js

@@ -0,0 +1,83 @@
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/supabase.ts
+function supabase(ctx) {
+	return defineCommand({
+		meta: {
+			name: "supabase",
+			description: COMMAND_DESCRIPTIONS.supabase
+		},
+		args: {
+			...globalArgs,
+			area: {
+				type: "positional",
+				required: false,
+				description: "hook or inspect"
+			},
+			verb: {
+				type: "positional",
+				required: false,
+				description: "hook: generate"
+			},
+			out: {
+				type: "string",
+				description: "File to write; a bare --out on inspect writes permdock.manifest.json",
+				valueHint: "file"
+			},
+			check: {
+				type: "boolean",
+				description: "Exit 1 when the file on disk is stale; write nothing"
+			},
+			db: {
+				type: "string",
+				description: "Postgres connection string",
+				valueHint: "url"
+			},
+			"active-from": {
+				type: "string",
+				description: "Where the hook reads the active tenant",
+				valueHint: "source"
+			},
+			budget: {
+				type: "string",
+				description: "Byte budget for the memberships claim",
+				valueHint: "bytes"
+			},
+			schema: {
+				type: "string",
+				description: "Schema for the hook function",
+				valueHint: "name"
+			},
+			"grants-out": {
+				type: "string",
+				description: "File for the privileges db diff drops",
+				valueHint: "file"
+			}
+		},
+		async run({ args: parsed }) {
+			const out = parsed.out === "" ? true : stringArg(parsed.out);
+			const db = stringArg(parsed.db);
+			const activeFrom = stringArg(parsed["active-from"]);
+			const budget = stringArg(parsed.budget);
+			const schema = stringArg(parsed.schema);
+			const grantsOut = stringArg(parsed["grants-out"]);
+			const { runSupabase } = await import("./supabase-hook-D5qVd_D8.js");
+			ctx.report(await runSupabase({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				rest: parsed._,
+				check: parsed.check === true,
+				json: ctx.json,
+				io: ctx.io,
+				...out === void 0 ? {} : { out },
+				...db === void 0 ? {} : { db },
+				...activeFrom === void 0 ? {} : { activeFrom },
+				...budget === void 0 ? {} : { budget },
+				...schema === void 0 ? {} : { schema },
+				...grantsOut === void 0 ? {} : { grantsOut }
+			}));
+		}
+	});
+}
+//#endregion
+export { supabase };