permdock 0.1.0 → 0.2.0

package/dist/expiry-BoBJ8Tvc.js

@@ -0,0 +1,7 @@
+//#region src/core/expiry.ts
+/** `expiresAt` is Unix seconds; a membership with none never expires. */
+function expiredAt(item, now) {
+	return item.expiresAt !== void 0 && item.expiresAt <= now;
+}
+//#endregion
+export { expiredAt as t };

package/dist/express/index.d.ts

@@ -1,41 +1,18 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { o as OtelWrap } from "../types-B9dmiiab.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
 import { a as toRequest, i as sendResponse } from "../http-DPuDaChb.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts
-type ExpressPermDockOptions<TUser = unknown> = {
-  readonly subject: (req: Request) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<Request>;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
-};
+type ExpressPermDockOptions<TUser = unknown> = ServerAdapterOptions<Request, TUser>;
 type PermDockRequest<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = Request & {
   permdock: PermDock<V>;
   permdockData?: T;
 };
 type ExpressPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly permdock: () => RequestHandler;
-  readonly protect: (permission: Permission, loadData?: (req: Request) => unknown, protectOptions?: ProtectOptions) => RequestHandler;
+  readonly protect: (permission: Permission | null, loadData?: (req: Request) => unknown, protectOptions?: ProtectOptions) => RequestHandler;
   readonly errorHandler: () => ErrorRequestHandler;
   readonly permdockHandler: () => Router;
   readonly withPermDock: (fn: (req: PermDockRequest<unknown, V>, res: Response) => unknown) => RequestHandler;

package/dist/express/index.js

@@ -1,15 +1,14 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
-import { i as toRequest, r as sendResponse } from "../http-GgVApX1k.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as toRequest, r as sendResponse } from "../http-BIhmLfCc.js";
 import express from "express";
 //#region src/express/create.ts
 function run(work, next) {
 	work().catch(next);
 }
-const errorHandler = () => (err, _req, res, next) => {
-	const problem = problemFromError(err);
+function sendProblem(err, req, res, next) {
+	const problem = problemFromError(err, { credentials: req.headers.authorization !== void 0 });
 	if (problem === void 0) {
 		next(err);
 		return;
@@ -17,81 +16,52 @@ const errorHandler = () => (err, _req, res, next) => {
 	run(async () => {
 		await sendResponse(res, problem);
 	}, next);
+}
+/** Answers a PermDock error with Problem Details; anything else reaches the app's error middleware. */
+function respond(req, res, next, work) {
+	work().catch((err) => {
+		sendProblem(err, req, res, next);
+	});
+}
+const errorHandler = () => (err, req, res, next) => {
+	sendProblem(err, req, res, next);
 };
 const withPermDock = (fn) => (req, res, next) => {
 	run(async () => {
 		await fn(req, res);
 	}, next);
 };
-/** Runs `use` on the Express request bound to `request`; `fallback` for a request this adapter never bound. */
-function withBound(contexts, request, use, fallback) {
-	const req = contexts.get(request);
-	return req === void 0 ? fallback : use(req);
-}
 function createPermDock(policy, options) {
-	const contexts = /* @__PURE__ */ new WeakMap();
-	const bound = /* @__PURE__ */ new WeakMap();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => withBound(contexts, request, options.subject, null),
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		adapter: "express",
-		wrap: options.otel
-	}));
-	const bind = (req) => {
-		const hit = bound.get(req);
-		if (hit !== void 0) return hit;
-		const request = toRequest(req);
-		bound.set(req, request);
-		contexts.set(request, req);
-		return request;
-	};
-	const scopeOf = (req) => tenantScope(options.tenant, req);
-	/** The decision endpoint reads the body a parser may have consumed since `bind`. */
-	const rebind = (req) => {
-		const request = toRequest(req);
-		contexts.set(request, req);
-		return request;
-	};
-	const permdock = () => (req, _res, next) => {
-		run(async () => {
-			req.permdock = await kernel.permdock(bind(req), await scopeOf(req));
+	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "express", toRequest);
+	const permdock = () => (req, res, next) => {
+		respond(req, res, next, async () => {
+			decorate(req, await kernel.permdock(bind(req), await scopeOf(req)));
 			next();
-		}, next);
+		});
 	};
 	const protect = (permission, loadData, protectOptions) => (req, res, next) => {
-		run(async () => {
+		respond(req, res, next, async () => {
 			const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(req), protectOptions)(bind(req), await scopeOf(req));
 			if (!guard.ok) {
 				await sendResponse(res, guard.response);
 				return;
 			}
-			const scoped = req;
-			scoped.permdock = guard.permdock;
-			scoped.permdockData = guard.data;
+			decorate(req, guard.permdock, guard.data);
 			next();
-		}, next);
+		});
 	};
 	const permdockHandler = () => {
-		const { POST, GET } = kernel.permdockHandler((request) => withBound(contexts, request, scopeOf, { tenant: void 0 }));
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
 		const router = express.Router({ mergeParams: true });
 		router.post("/", (req, res, next) => {
-			run(async () => {
+			respond(req, res, next, async () => {
 				await sendResponse(res, await POST(rebind(req)));
-			}, next);
+			});
 		});
 		router.get("/", (req, res, next) => {
-			run(async () => {
+			respond(req, res, next, async () => {
 				await sendResponse(res, await GET(bind(req)));
-			}, next);
+			});
 		});
 		return router;
 	};

package/dist/fastify/index.d.ts

@@ -1,33 +1,10 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { o as OtelWrap } from "../types-B9dmiiab.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/fastify/create.d.ts
-type FastifyPermDockOptions<TUser = unknown> = {
-  readonly subject: (request: FastifyRequest) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<FastifyRequest>;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
-};
+type FastifyPermDockOptions<TUser = unknown> = ServerAdapterOptions<FastifyRequest, TUser>;
 type PermDockRequest<Route extends RouteGenericInterface = RouteGenericInterface, V extends PolicyVocabulary = PolicyVocabulary> = FastifyRequest<Route> & {
   permdock: PermDock<V>;
   permdockData?: unknown;
@@ -38,7 +15,7 @@ type ProtectRequest<Route extends RouteGenericInterface = RouteGenericInterface,
  * Generic over the route, schema and type provider so a `preHandler` slot
  * infers them: `loadData` sees the same typed `request.body` as the handler.
  */
-type FastifyProtect = <Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault>(permission: Permission, loadData?: (request: ProtectRequest<Route, Schema, Provider>) => unknown, protectOptions?: ProtectOptions) => (request: ProtectRequest<Route, Schema, Provider>, reply: FastifyReply) => Promise<void>;
+type FastifyProtect = <Route extends RouteGenericInterface = RouteGenericInterface, Schema extends FastifySchema = FastifySchema, Provider extends FastifyTypeProvider = FastifyTypeProviderDefault>(permission: Permission | null, loadData?: (request: ProtectRequest<Route, Schema, Provider>) => unknown, protectOptions?: ProtectOptions) => (request: ProtectRequest<Route, Schema, Provider>, reply: FastifyReply) => Promise<void>;
 type FastifyPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly permdock: FastifyPluginAsync;
   readonly protect: FastifyProtect;

package/dist/fastify/index.js

@@ -1,25 +1,18 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+import { i as parsedBody, r as headersFrom, t as firstHeader } from "../http-SO7qGttf.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
-	const host = headerValue(request.headers.host) ?? "localhost";
+	const host = firstHeader(request.headers.host) ?? "localhost";
 	const url = `${request.protocol}://${host}${request.url}`;
-	const headers = new Headers();
-	for (const [key, value] of Object.entries(request.headers)) {
-		if (typeof value === "string") {
-			headers.set(key, value);
-			continue;
-		}
-		if (Array.isArray(value)) for (const item of value) headers.append(key, item);
-	}
+	const headers = headersFrom(request.headers);
 	const method = request.method;
 	if (method === "GET" || method === "HEAD") return new Request(url, {
 		method,
 		headers
 	});
-	const body = bodyOf(request, headers);
+	const body = parsedBody(request.body, headers);
 	if (body === void 0) return new Request(url, {
 		method,
 		headers
@@ -30,16 +23,6 @@ function toRequest(request) {
 		body
 	});
 }
-function headerValue(value) {
-	if (typeof value === "string" && value.length > 0) return value;
-	if (Array.isArray(value) && typeof value[0] === "string") return value[0];
-}
-function bodyOf(request, headers) {
-	if (request.body === void 0) return;
-	if (typeof request.body === "string") return request.body;
-	if (!headers.has("content-type")) headers.set("content-type", "application/json");
-	return JSON.stringify(request.body);
-}
 async function sendReply(reply, response) {
 	reply.code(response.status);
 	for (const [key, value] of response.headers.entries()) reply.header(key, value);
@@ -52,50 +35,23 @@ function breakEncapsulation(plugin) {
 	Object.defineProperty(plugin, SKIP_OVERRIDE, { value: true });
 	return plugin;
 }
-function decorate(request, instance, data) {
-	const scoped = request;
-	scoped.permdock = instance;
-	if (data !== void 0) scoped.permdockData = data;
+/** A route registered with `config: { permdock: false }`, such as a health check, gets no instance. */
+function skipped(request) {
+	const config = request.routeOptions.config;
+	return typeof config === "object" && config !== null && Reflect.get(config, "permdock") === false;
 }
 function createPermDock(policy, options) {
-	const contexts = /* @__PURE__ */ new WeakMap();
-	const bound = /* @__PURE__ */ new WeakMap();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => {
-			const req = contexts.get(request);
-			return req === void 0 ? null : options.subject(req);
-		},
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		adapter: "fastify",
-		wrap: options.otel
-	}));
-	const bind = (request) => {
-		const hit = bound.get(request);
-		if (hit !== void 0) return hit;
-		const next = toRequest(request);
-		bound.set(request, next);
-		contexts.set(next, request);
-		return next;
-	};
-	const scopeOf = (request) => tenantScope(options.tenant, request);
+	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "fastify", toRequest);
 	const permdock = breakEncapsulation((app) => {
 		app.decorateRequest("permdock", null);
 		app.decorateRequest("permdockData", null);
 		app.addHook("onRequest", async (request) => {
+			if (skipped(request)) return;
 			decorate(request, await kernel.permdock(bind(request), await scopeOf(request)));
 		});
 		const previous = app.errorHandler;
 		app.setErrorHandler(async function permdockErrors(err, request, reply) {
-			const problem = problemFromError(err);
+			const problem = problemFromError(err, { credentials: request.headers.authorization !== void 0 });
 			if (problem === void 0) {
 				await previous.call(this, err, request, reply);
 				return;
@@ -114,14 +70,9 @@ function createPermDock(policy, options) {
 		decorate(plain, guard.permdock, guard.data);
 	};
 	const permdockHandler = (app) => {
-		const { POST, GET } = kernel.permdockHandler((request) => {
-			const req = contexts.get(request);
-			return req === void 0 ? { tenant: void 0 } : scopeOf(req);
-		});
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
 		app.post("/", async (request, reply) => {
-			const parsed = toRequest(request);
-			contexts.set(parsed, request);
-			await sendReply(reply, await POST(parsed));
+			await sendReply(reply, await POST(rebind(request)));
 		});
 		app.get("/", async (request, reply) => {
 			await sendReply(reply, await GET(bind(request)));

package/dist/fields-BMl1RxoX.js

@@ -0,0 +1,26 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { D as ownKeys, E as ownGet, T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+//#region src/core/fields.ts
+function sanitizeFields(fields) {
+	if (fields === void 0) return;
+	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
+}
+function grantCoversField(fields, field, effect) {
+	if (fields === void 0) return true;
+	if (fields.length === 0) return false;
+	if (field === void 0) return effect === "allow";
+	return fields.includes(field);
+}
+function pickVisible(row, canField) {
+	const out = {};
+	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
+	return freezeDeep(out);
+}
+function sanitizeContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+	const out = {};
+	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
+	return out;
+}
+//#endregion
+export { sanitizeFields as i, pickVisible as n, sanitizeContext as r, grantCoversField as t };

package/dist/{files-B_wAGYmt.js → files-DWUN9PzI.js}

@@ -117,5 +117,9 @@ function rel(cwd, abs) {
 function defaultSrcPath() {
 	return ["./src"];
 }
+/** Where `doctor` reads source files: `doctor.srcPath`, else `collect.srcPath`, else `./src`. */
+function doctorSrcPath(config) {
+	return config.doctor?.srcPath ?? config.collect?.srcPath ?? defaultSrcPath();
+}
 //#endregion
-export { sqlFiles as i, listSourceFiles as n, rel as r, defaultSrcPath as t };
+export { sqlFiles as a, rel as i, doctorSrcPath as n, listSourceFiles as r, defaultSrcPath as t };

package/dist/{fixtures-Cvaw0gDG.js → fixtures-ht28Cplr.js}

@@ -1,4 +1,4 @@
-import { a as loadModule, o as pickNamed } from "./load-BZ24CpZP.js";
+import { a as loadModule, o as pickNamed } from "./load-DhWEB9P1.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
@@ -16,6 +16,8 @@ function asFixtures(value) {
 		if (memberships !== void 0 && !Array.isArray(memberships)) throw new Error(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
 		const tenant = item["subject"]["tenant"];
 		if (tenant !== void 0 && typeof tenant !== "string") throw new Error(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
+		const claims = item["subject"]["claims"];
+		if (claims !== void 0 && !isRecord(claims)) throw new Error(`PermDock CLI: fixture ${index} subject.claims must be an object`);
 		return item;
 	});
 }
@@ -48,7 +50,8 @@ function fixtureSubject(fixture) {
 			id: fixture.id,
 			roles: fixture.roles ?? [],
 			...fixture.tenant === void 0 ? {} : { tenant: fixture.tenant },
-			memberships: fixture.memberships ?? []
+			memberships: fixture.memberships ?? [],
+			...fixture.claims === void 0 ? {} : { claims: fixture.claims }
 		},
 		context: {}
 	};

package/dist/{freeze-y1_jQL4v.js → freeze-CrU8nQeX.js}

@@ -1,11 +1,40 @@
 //#region src/core/freeze.ts
+function refuse() {
+	throw new TypeError("PermDock: this collection is frozen");
+}
+const LOCKED = {
+	value: refuse,
+	writable: false,
+	enumerable: false
+};
+/**
+* `Object.freeze` leaves a `Map` or `Set` writable through `set`, `add`,
+* `delete` and `clear`, so those are shadowed on the instance with a method
+* that throws. Identity and `instanceof` stay as they were.
+*/
+function freezeCollection(value) {
+	Object.defineProperties(value, value instanceof Map ? {
+		set: LOCKED,
+		delete: LOCKED,
+		clear: LOCKED
+	} : {
+		add: LOCKED,
+		delete: LOCKED,
+		clear: LOCKED
+	});
+	Object.freeze(value);
+	for (const [key, item] of value.entries()) {
+		freezeDeep(key);
+		freezeDeep(item);
+	}
+}
 function freezeDeep(value) {
 	if (value === null || typeof value !== "object") return value;
+	if (Object.isFrozen(value)) return value;
 	if (value instanceof Map || value instanceof Set) {
-		Object.freeze(value);
+		freezeCollection(value);
 		return value;
 	}
-	if (Object.isFrozen(value)) return value;
 	Object.freeze(value);
 	if (Array.isArray(value)) {
 		for (const item of value) freezeDeep(item);