permdock 0.0.0 → 0.2.0

package/dist/validation-error-CnjZ4t92.js

@@ -0,0 +1,33 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+//#region src/core/validation-error.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+const PROBLEM_BASE = "https://permdock.com/problems";
+var PermDockValidationError = class extends Error {
+	name = "PermDockValidationError";
+	code;
+	permission;
+	resource;
+	issues;
+	boundary;
+	constructor(input) {
+		super(input.message);
+		this.code = input.code;
+		this.permission = input.permission;
+		this.resource = input.resource;
+		this.issues = input.issues ?? [];
+		this.boundary = input.boundary;
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/validation`,
+			title: "Invalid resource data",
+			status: 400,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			issues: this.issues
+		});
+	}
+};
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };

package/dist/validation-error-CtF23SrC.d.ts

@@ -0,0 +1,26 @@
+import { a as ProblemDetails } from "./errors-DAqevpNk.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/validation-error.d.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+declare const PROBLEM_BASE = "https://permdock.com/problems";
+declare class PermDockValidationError extends Error {
+  override readonly name: "PermDockValidationError";
+  readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+  readonly permission: string;
+  readonly resource: string;
+  readonly issues: readonly StandardSchemaV1.Issue[];
+  readonly boundary: string;
+  constructor(input: {
+    readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+    readonly permission: string;
+    readonly resource: string;
+    readonly issues?: readonly StandardSchemaV1.Issue[];
+    readonly boundary: string;
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };

package/dist/validity-uOp8UpYn.js

@@ -0,0 +1,245 @@
+import { f as isFieldRelation } from "./permissions-DVoF6dMt.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+//#region src/core/tenancy.ts
+function nowSeconds(now) {
+	return now ?? Date.now() / 1e3;
+}
+function isMembershipExpired(membership, now) {
+	return expiredAt(membership, now ?? nowSeconds());
+}
+/** The instances of the first scope the subject holds a live membership in. */
+function tenantsOf(principal, scopes, now) {
+	if (principal === null) return [];
+	const tenants = /* @__PURE__ */ new Set();
+	for (const membership of principal.memberships ?? []) {
+		if (isMembershipExpired(membership, now)) continue;
+		const tenant = tenantOf(membership, scopes);
+		if (tenant !== void 0) tenants.add(tenant);
+	}
+	return [...tenants];
+}
+function heldRoleNamesIn(principal, scopes, tenant, now) {
+	const names = /* @__PURE__ */ new Set();
+	for (const membership of principal?.memberships ?? []) if (!isMembershipExpired(membership, now) && membership.keep === void 0 && tenantOf(membership, scopes) === tenant) for (const name of membership.roles) names.add(name);
+	return [...names];
+}
+/** `requested` when a live membership sits in that instance of the first scope; never a default. */
+function resolveActiveTenant(principal, requested, scopes, now) {
+	if (requested === void 0) return principal.tenant;
+	return (principal.memberships ?? []).some((membership) => !isMembershipExpired(membership, now) && tenantOf(membership, scopes) === requested) ? requested : void 0;
+}
+/** `permdock.team(id)`: only memberships inside that instance of the second scope. */
+function inTeam(membership, scopes, team) {
+	if (team === void 0) return true;
+	const second = scopes[1]?.name;
+	return second !== void 0 && scopeIdOf(membership, second) === team;
+}
+/**
+* Whether `resource` declares a `memberOf` relation to `scope` on `field`:
+* its rows are partitioned by that scope, so a row without the field matches
+* no membership.
+*/
+function relatesTo(resource, field, scope, scopes) {
+	if (resource === void 0) return false;
+	return Object.values(resource.relations).some((relation) => isFieldRelation(relation) && relation.field === field && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope);
+}
+/** The fields of `resource`'s `memberOf` relations to `scope`. */
+function memberOfFields(resource, scope, scopes) {
+	return [...new Set(Object.values(resource.relations).flatMap((relation) => isFieldRelation(relation) && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope ? [relation.field] : []))];
+}
+/**
+* The field of `resource` that holds `scope`'s instance id: the scope's
+* `key` when one of the resource's `memberOf` relations names it, otherwise
+* the field of its one `memberOf` relation to the scope. A table whose own
+* id is the instance (`organizations.id`) declares
+* `{ self: { field: 'id', memberOf: 'organization' } }`.
+*/
+function scopeField(resource, scope, scopes) {
+	const key = findScope(scopes, scope)?.key;
+	if (resource === void 0) return key;
+	const fields = memberOfFields(resource, scope, scopes);
+	if (key !== void 0 && fields.includes(key)) return key;
+	return fields.length === 1 ? fields[0] : key;
+}
+/** The scopes that partition `resource`, from its `memberOf` relations. */
+function partitionsOf(resource, scopes) {
+	return scopes.filter((scope) => {
+		const field = scopeField(resource, scope.name, scopes);
+		return field !== void 0 && relatesTo(resource, field, scope.name, scopes);
+	}).map((scope) => scope.name);
+}
+/**
+* Whether `row` lies inside a named membership's instance: for the scope and
+* each ancestor, outermost first, a row that carries the scope's key (or whose
+* resource declares it) must hold the membership's id for it. There is no
+* cascade: the membership's own scope is checked, never a scope below it.
+*/
+function rowInScope(membership, scopes, row, partitioned, fieldOf) {
+	if (membership.scope === void 0 || row === null || typeof row !== "object") return { ok: true };
+	const root = rootScope(scopes);
+	const chain = scopeChain(scopes, membership.scope).toReversed();
+	for (const name of chain) {
+		const key = fieldOf?.(name) ?? findScope(scopes, name)?.key;
+		if (key === void 0) continue;
+		const value = Object.hasOwn(row, key) ? row[key] : void 0;
+		if ((value !== void 0 || partitioned(name, key)) && !sameId(value, scopeIdOf(membership, name))) return {
+			ok: false,
+			reason: name === root ? "tenant-mismatch" : "scope"
+		};
+	}
+	return { ok: true };
+}
+/**
+* Whether a membership answers an instance check for `row`: any membership
+* with a row object, otherwise only the first scope or the instance of the
+* second scope that `team(id)` selected.
+*/
+function nestedAppliesWithoutRow(membership, scopes, row, team) {
+	if (row !== null && typeof row === "object") return true;
+	return membership.scope === rootScope(scopes) || team !== void 0 && membership.scope === scopes[1]?.name;
+}
+function matchScopedMembership(subject, scope, roleName, row, scopes, resource, resources, now, rolesOf = (membership) => membership.roles, team, walk, instance = false, only) {
+	if (scope === "global") return { ok: true };
+	if (only !== void 0 && scope !== only) return {
+		ok: false,
+		reason: "scope"
+	};
+	const principal = subject.principal;
+	if (principal === null) return {
+		ok: false,
+		reason: "no-membership"
+	};
+	const memberships = principal.memberships ?? [];
+	const root = rootScope(scopes);
+	let sawExpired = false;
+	let sawWrongScope = false;
+	let sawTenantMismatch = false;
+	let sawGraph;
+	for (const membership of memberships) {
+		if (!rolesOf(membership).includes(roleName)) continue;
+		if (isMembershipExpired(membership, now)) {
+			sawExpired = true;
+			continue;
+		}
+		if (typeof scope === "string") {
+			if (findScope(scopes, scope) === void 0 || membership.scope !== scope || !inTeam(membership, scopes, team) || !activeFor(membership, scopes, principal.tenant)) continue;
+			if (instance && !nestedAppliesWithoutRow(membership, scopes, row, team)) {
+				sawWrongScope = true;
+				continue;
+			}
+			const inside = rowInScope(membership, scopes, row, (name, key) => relatesTo(resource, key, name, scopes), (name) => scopeField(resource, name, scopes));
+			if (!inside.ok) {
+				if (inside.reason === "tenant-mismatch") sawTenantMismatch = true;
+				else sawWrongScope = true;
+				continue;
+			}
+			return {
+				ok: true,
+				membership
+			};
+		}
+		if (membership.on === void 0) continue;
+		if (matchResourceMembership(membership, scope.resource, row, resource, resources)) return {
+			ok: true,
+			membership
+		};
+		const walked = walk !== void 0 && (membership.on.resource === scope.resource || membershipField(resources.get(scope.resource), membership.on.resource, resources) !== void 0) ? walk(membership, row) : false;
+		if (walked === true) return {
+			ok: true,
+			membership
+		};
+		if (walked !== false) sawGraph ??= walked;
+		sawWrongScope = true;
+	}
+	if (sawGraph !== void 0) return {
+		ok: false,
+		reason: sawGraph
+	};
+	if (scope === root && principal.tenant !== void 0 && !memberships.some((membership) => tenantOf(membership, scopes) === principal.tenant && !isMembershipExpired(membership, now))) return {
+		ok: false,
+		reason: "no-membership"
+	};
+	if (sawTenantMismatch) return {
+		ok: false,
+		reason: "tenant-mismatch"
+	};
+	if (sawExpired && !sawWrongScope) return {
+		ok: false,
+		reason: "expired-membership"
+	};
+	if (sawWrongScope) return {
+		ok: false,
+		reason: "scope"
+	};
+	return {
+		ok: false,
+		reason: "no-membership"
+	};
+}
+function matchResourceMembership(membership, roleResource, row, resource, resources) {
+	const on = membership.on;
+	if (on === void 0)
+ /* v8 ignore next */
+	return false;
+	if (row === null || typeof row !== "object") return false;
+	if (on.resource !== roleResource && membershipField(resources.get(roleResource), on.resource, resources) === void 0) return false;
+	const field = membershipField(resource, on.resource, resources);
+	return field !== void 0 && sameId(row[field], on.id);
+}
+/**
+* The row field that holds the id of a `membershipResource` membership: the
+* row's own id field when the row is of that resource, the declared parent
+* field of the matching ancestor otherwise (the row carries it, never a
+* walk-up query), `undefined` when the resource is not on the row's chain.
+*/
+function membershipField(resource, membershipResource, resources) {
+	if (resource === void 0) return;
+	if (resource.name === membershipResource) return resource.id ?? "id";
+	let current = resource;
+	const seen = /* @__PURE__ */ new Set();
+	while (current?.parent !== void 0 && !seen.has(current.name)) {
+		seen.add(current.name);
+		if (current.parent.resource === membershipResource) return current.parent.field;
+		current = resources.get(current.parent.resource);
+	}
+}
+//#endregion
+//#region src/core/validity.ts
+/**
+* An instant as Unix seconds: a finite number is taken as seconds already, a
+* string must parse as RFC 3339. Anything else is `undefined`, and the caller
+* decides whether that is "absent" or an error.
+*/
+function instantOf(input) {
+	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
+	if (typeof input !== "string" || input.trim() === "") return;
+	const millis = Date.parse(input);
+	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
+}
+/**
+* The normalised validity of a grant, or `undefined` when neither bound is
+* set. Fail-closed at definition time: a bound that does not parse, or a
+* window that ends before it starts, throws so a typo never widens a grant.
+*/
+function normalizeValidity(options, permissionKey) {
+	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
+	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
+	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
+	if (from === void 0 && until === void 0) return;
+	return Object.freeze({
+		...from === void 0 ? {} : { from },
+		...until === void 0 ? {} : { until }
+	});
+}
+/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
+function isActive(validity, now) {
+	if (validity === void 0) return true;
+	if (validity.from !== void 0 && now < validity.from) return false;
+	return validity.until === void 0 || now < validity.until;
+}
+//#endregion
+export { isMembershipExpired as a, membershipField as c, partitionsOf as d, relatesTo as f, tenantsOf as g, scopeField as h, inTeam as i, nestedAppliesWithoutRow as l, rowInScope as m, normalizeValidity as n, matchScopedMembership as o, resolveActiveTenant as p, heldRoleNamesIn as r, memberOfFields as s, isActive as t, nowSeconds as u };