permdock 0.0.0 → 0.2.0

package/dist/supabase-hook-D5qVd_D8.js

@@ -0,0 +1,2 @@
+import { i as runSupabase } from "./supabase-hook-BuxLQLpU.js";
+export { runSupabase };

package/dist/supautils-DYZnzRWV.js

@@ -0,0 +1,91 @@
+import { d as group, p as sqlStatements } from "./supabase-config-Bs44dare.js";
+//#region src/cli/supautils.ts
+/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"supabase_privileged_role",
+	"dashboard_user",
+	"pgbouncer",
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
+const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/** `supautils.reserved_memberships` of the same image. */
+const RESERVED_MEMBERSHIPS = /* @__PURE__ */ new Set([
+	"pg_read_server_files",
+	"pg_write_server_files",
+	"pg_execute_server_program",
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer",
+	"authenticator"
+]);
+const ROLE = String.raw`(?:"[^"]+"|\w+)`;
+const ROLES = String.raw`${ROLE}(?:\s*,\s*${ROLE})*`;
+const ALTER_ROLE = new RegExp(String.raw`^alter\s+(role|user|group)\s+(${ROLE})\s+([\s\S]*)$`, "iu");
+const DROP_ROLE = new RegExp(String.raw`^drop\s+(?:role|user|group)\s+(?:if\s+exists\s+)?(${ROLES})\s*$`, "iu");
+const GRANT_ROLE = /^grant\s+([\s\S]+?)\s+to\s/iu;
+const CREATE_IN_ROLE = new RegExp(String.raw`^create\s+(?:role|user|group)\s+${ROLE}\b[\s\S]*?\bin\s+(?:role|group)\s+(${ROLES})`, "iu");
+const CONFIG_CHANGE = /^(?:in\s+database\s+\S+\s+)?(?:set|reset)\s/iu;
+function roleName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function roleList(list) {
+	return list.split(",").map((name) => roleName(name.trim()));
+}
+function rejection(text) {
+	const alter = ALTER_ROLE.exec(text);
+	if (alter !== null) {
+		const role = roleName(group(alter, 2));
+		const rest = group(alter, 3);
+		if (group(alter, 1).toLowerCase() === "group" && /^add\s/iu.test(rest)) return RESERVED_MEMBERSHIPS.has(role) ? `grants membership in the reserved role ${role}` : void 0;
+		if (!RESERVED_ROLES.has(role) || CONFIGURABLE_ROLES.has(role) && CONFIG_CHANGE.test(rest)) return;
+		return `changes the reserved role ${role}`;
+	}
+	const drop = DROP_ROLE.exec(text);
+	if (drop !== null) {
+		const role = roleList(group(drop, 1)).find((name) => RESERVED_ROLES.has(name));
+		return role === void 0 ? void 0 : `drops the reserved role ${role}`;
+	}
+	const grant = GRANT_ROLE.exec(text);
+	const granted = CREATE_IN_ROLE.exec(text)?.[1] ?? (grant === null || /\bon\b/iu.test(group(grant, 1)) ? void 0 : group(grant, 1));
+	if (granted === void 0) return;
+	const role = roleList(granted).find((name) => RESERVED_MEMBERSHIPS.has(name));
+	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
+}
+/**
+* The statements of `sql` that supautils rejects for a non-superuser:
+* changing or dropping a reserved role, other than `set` or `reset` on the
+* four API roles, and granting a reserved membership.
+*/
+function supautilsRejections(sql) {
+	return sqlStatements(sql).flatMap(({ line, text }) => {
+		const reason = rejection(text);
+		return reason === void 0 ? [] : [{
+			line,
+			reason
+		}];
+	});
+}
+//#endregion
+export { supautilsRejections as t };

package/dist/svelte/PermissionBoundary.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+  import {
+    boundaryDigest,
+    boundaryFallback,
+    type PermissionBoundaryProps,
+    type PermissionBoundaryState,
+  } from './runtime.js';
+
+  let { children, denied, approval }: PermissionBoundaryProps = $props();
+
+  let refused = $state<PermissionBoundaryState | null>(null);
+
+  // A rethrown error reaches the next boundary up.
+  function onerror(error: unknown, reset: () => void): void {
+    const digest = boundaryDigest(error);
+    if (digest === null) {
+      throw error;
+    }
+    refused = {
+      ...digest,
+      retry: (): void => {
+        refused = null;
+        reset();
+      },
+    };
+  }
+</script>
+
+<svelte:boundary {onerror}>
+  {@render children?.()}
+  {#snippet failed()}
+    {#if refused !== null}
+      {@const fallback = boundaryFallback(refused, { denied, approval })}
+      {@render fallback?.(refused)}
+    {/if}
+  {/snippet}
+</svelte:boundary>

package/dist/svelte/Protected.svelte

@@ -0,0 +1,40 @@
+<script lang="ts">
+  import { onDestroy } from 'svelte';
+
+  import {
+    getStore,
+    scopedFor,
+    viewFor,
+    type ProtectedProps,
+  } from './runtime.js';
+
+  let {
+    permission,
+    data,
+    tenant,
+    children,
+    pending,
+    fallback,
+  }: ProtectedProps = $props();
+
+  const store = getStore();
+  let tick = $state(0);
+  onDestroy(
+    store.subscribe(() => {
+      tick += 1;
+    }),
+  );
+  const scoped = $derived(scopedFor(store, tenant, tick));
+  const view = $derived.by(() => {
+    const generation = tick;
+    return viewFor(store, permission, data, scoped, generation);
+  });
+</script>
+
+{#if view.slot === 'pending'}
+  {@render pending?.()}
+{:else if view.slot === 'fallback'}
+  {@render fallback?.(view.decision)}
+{:else}
+  {@render children?.(view.decision)}
+{/if}

package/dist/svelte/index.d.ts

@@ -0,0 +1,13 @@
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
+import { Component } from "svelte";
+//#region src/svelte/index.d.ts
+export declare const Protected: Component<ProtectedProps>;
+export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -0,0 +1,107 @@
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { t as getStore } from "../context-Ttp0ekMT.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
+import "svelte/internal/disclose-version";
+import * as $ from "svelte/internal/client";
+import { onDestroy } from "svelte";
+//#region src/svelte/PermissionBoundary.svelte
+function PermissionBoundary$1($$anchor, $$props) {
+	$.push($$props, true);
+	let refused = $.state(null);
+	function onerror(error, reset) {
+		const digest = boundaryDigest(error);
+		if (digest === null) throw error;
+		$.set(refused, {
+			...digest,
+			retry: () => {
+				$.set(refused, null);
+				reset();
+			}
+		}, true);
+	}
+	var fragment = $.comment();
+	var node = $.first_child(fragment);
+	{
+		const failed = ($$anchor) => {
+			var fragment_1 = $.comment();
+			var node_1 = $.first_child(fragment_1);
+			var consequent = ($$anchor) => {
+				const fallback = $.derived(() => boundaryFallback($.get(refused), {
+					denied: $$props.denied,
+					approval: $$props.approval
+				}));
+				var fragment_2 = $.comment();
+				var node_2 = $.first_child(fragment_2);
+				$.snippet(node_2, () => $.get(fallback) ?? $.noop, () => $.get(refused));
+				$.append($$anchor, fragment_2);
+			};
+			$.if(node_1, ($$render) => {
+				if ($.get(refused) !== null) $$render(consequent);
+			});
+			$.append($$anchor, fragment_1);
+		};
+		$.boundary(node, {
+			onerror,
+			failed
+		}, ($$anchor) => {
+			var fragment_3 = $.comment();
+			var node_3 = $.first_child(fragment_3);
+			$.snippet(node_3, () => $$props.children ?? $.noop);
+			$.append($$anchor, fragment_3);
+		});
+	}
+	$.append($$anchor, fragment);
+	$.pop();
+}
+//#endregion
+//#region src/svelte/Protected.svelte
+function Protected$1($$anchor, $$props) {
+	$.push($$props, true);
+	const store = getStore();
+	let tick = $.state(0);
+	onDestroy(store.subscribe(() => {
+		$.set(tick, $.get(tick) + 1);
+	}));
+	const scoped = $.derived(() => scopedFor(store, $$props.tenant, $.get(tick)));
+	const view = $.derived(() => {
+		const generation = $.get(tick);
+		return viewFor(store, $$props.permission, $$props.data, $.get(scoped), generation);
+	});
+	var fragment = $.comment();
+	var node = $.first_child(fragment);
+	var consequent = ($$anchor) => {
+		var fragment_1 = $.comment();
+		var node_1 = $.first_child(fragment_1);
+		$.snippet(node_1, () => $$props.pending ?? $.noop);
+		$.append($$anchor, fragment_1);
+	};
+	var consequent_1 = ($$anchor) => {
+		var fragment_2 = $.comment();
+		var node_2 = $.first_child(fragment_2);
+		$.snippet(node_2, () => $$props.fallback ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_2);
+	};
+	var alternate = ($$anchor) => {
+		var fragment_3 = $.comment();
+		var node_3 = $.first_child(fragment_3);
+		$.snippet(node_3, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_3);
+	};
+	$.if(node, ($$render) => {
+		if ($.get(view).slot === "pending") $$render(consequent);
+		else if ($.get(view).slot === "fallback") $$render(consequent_1, 1);
+		else $$render(alternate, -1);
+	});
+	$.append($$anchor, fragment);
+	$.pop();
+}
+//#endregion
+//#region src/svelte/index.ts
+const Protected = Protected$1;
+const PermissionBoundary = PermissionBoundary$1;
+//#endregion
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -0,0 +1,7 @@
+import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as ClientStore } from "../store-D_pjn91-.js";
+import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+//#region src/svelte/context.d.ts
+export declare function getStore(): ClientStore;
+//#endregion
+export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, viewFor };

package/dist/svelte/runtime.js

@@ -0,0 +1,4 @@
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { t as getStore } from "../context-Ttp0ekMT.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
+export { boundaryDigest, boundaryFallback, getStore, scopedFor, viewFor };

package/dist/svelte/source.d.ts

@@ -0,0 +1,13 @@
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
+import { Component } from "svelte";
+//#region src/svelte/source.d.ts
+export declare const Protected: Component<ProtectedProps>;
+export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -0,0 +1,11 @@
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
+import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
+import ProtectedComponent from "./Protected.svelte";
+//#region src/svelte/source.ts
+const Protected = ProtectedComponent;
+const PermissionBoundary = PermissionBoundaryComponent;
+//#endregion
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/terminal/index.d.ts

@@ -0,0 +1,163 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-DAqevpNk.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+//#region src/terminal/types.d.ts
+type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
+type TokenSource = TokenSourceName | {
+  readonly env: string;
+} | {
+  readonly source: TokenSourceName;
+  readonly env?: string;
+  /** `ci-oidc`: the audience requested from GitHub Actions (`aud`). */
+  readonly audience?: string;
+};
+type TokenHelper = (sources: readonly TokenSource[]) => Promise<string | null>;
+type TokenContext = {
+  readonly token: TokenHelper;
+  readonly profile: string;
+};
+type DeviceFlowOptions = {
+  readonly issuer?: string;
+  readonly clientId: string;
+  readonly scope?: string;
+  readonly authorizationEndpoint?: string;
+  readonly tokenEndpoint?: string;
+  readonly revocationEndpoint?: string;
+  readonly open?: (url: string) => void;
+  readonly onPrompt?: (info: {
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+  }) => void;
+};
+type InteractiveConfirm = (input: {
+  readonly permission: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly reason: string;
+  readonly token: string;
+}) => Promise<boolean>;
+/** Asks the user to type `expected` before a destructive action; resolves with what they typed. */
+type TypedConfirm = (input: {
+  readonly permission: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly expected: string;
+}) => Promise<string>;
+type TerminalRuntime = {
+  readonly argv?: readonly string[];
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  readonly stdoutIsTTY?: boolean;
+  readonly platform?: string;
+  readonly now?: () => number;
+  readonly write?: (text: string) => void;
+  readonly exit?: (code: number) => never;
+  readonly fetch?: typeof fetch;
+  readonly sleep?: (ms: number) => Promise<void>;
+  readonly homedir?: () => string;
+  readonly configDir?: string;
+};
+/** The shape of `Entry` from `@napi-rs/keyring`. */
+type KeyringEntry = {
+  getPassword(): string | null | undefined;
+  setPassword(password: string): void;
+  deletePassword(): unknown;
+};
+type TerminalStorageOptions = {
+  readonly service: string;
+  readonly dir?: string;
+  /**
+   * `Entry` from `@napi-rs/keyring`: tokens go to the OS keychain under
+   * `service`, one entry per profile. Without it, or when the keychain
+   * throws, they go to the mode-0600 credentials file.
+   */
+  readonly keyring?: new (service: string, account: string) => KeyringEntry;
+};
+type TerminalPermDockOptions<TUser = unknown> = InstanceOptions & {
+  readonly subject: (context: TokenContext) => TUser | Promise<TUser>;
+  readonly actor?: (context: TokenContext) => unknown;
+  readonly tenant?: string;
+  readonly store?: ApprovalStore;
+  readonly storage?: TerminalStorageOptions;
+  readonly device?: DeviceFlowOptions;
+  readonly interactive?: boolean | {
+    readonly confirm?: InteractiveConfirm;
+    readonly typed?: TypedConfirm;
+  };
+  /** Runs a destructive action without the typed confirmation; defaults to `--yes` / `-y` in argv. */
+  readonly yes?: boolean;
+  /** Decides and prints the decision without running the action; defaults to `--dry-run` in argv. */
+  readonly dryRun?: boolean;
+  readonly output?: {
+    readonly json?: boolean;
+  };
+  readonly approval?: ApprovalHint;
+  readonly runtime?: TerminalRuntime;
+};
+type PermDockResolveOptions = {
+  readonly refresh?: boolean;
+  readonly source?: TokenSourceName;
+  readonly as?: string;
+};
+type CommandEntry = {
+  readonly name: string;
+  readonly permission: Permission;
+  readonly description: string;
+};
+type FilterCommandsOptions = {
+  readonly mode: "hide" | "annotate";
+  readonly permdock?: PermDock;
+};
+type FormatOptions = {
+  readonly json?: boolean;
+  readonly permission?: Permission;
+  readonly instance?: string;
+  readonly subject?: Subject;
+  readonly approval?: ApprovalHint;
+};
+type TerminalProblemDetails = ProblemDetails;
+type ProtectContext<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly data: T;
+  readonly decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>;
+};
+type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
+  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, load?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
+  readonly filterCommands: (entries: readonly CommandEntry[], options?: FilterCommandsOptions) => readonly CommandEntry[];
+  readonly format: (decision: Decision, options?: FormatOptions) => string;
+  readonly exitCode: (decision: Decision) => number;
+  readonly logout: () => Promise<void>;
+};
+//#endregion
+//#region src/terminal/create.d.ts
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
+//#endregion
+//#region src/terminal/exit.d.ts
+export declare const EX_OK = 0;
+export declare const EX_USAGE = 64;
+export declare const EX_TEMPFAIL = 75;
+export declare const EX_NOPERM = 77;
+export declare const EX_CONFIG = 78;
+export declare class TerminalExit extends Error {
+  override readonly name: "TerminalExit";
+  readonly code: number;
+  constructor(code: number);
+}
+//#endregion
+//#region src/terminal/format.d.ts
+export declare function exitCode(decision: Decision): number;
+export declare function formatDecision(decision: Decision, options?: FormatOptions): string;
+//#endregion
+//#region src/terminal/token.d.ts
+export declare function looksLikeJwt(value: string): boolean;
+//#endregion
+export type { ApprovalHint, CommandEntry, DeviceFlowOptions, FilterCommandsOptions, FormatOptions, InteractiveConfirm, KeyringEntry, PermDockResolveOptions, ProtectContext, TerminalPermDock, TerminalPermDockOptions, TerminalProblemDetails, TerminalRuntime, TerminalStorageOptions, TokenContext, TokenHelper, TokenSource, TokenSourceName, TypedConfirm };