permdock 0.1.0 → 0.2.0

package/dist/{from-snapshot-BMGnhmgv.js → from-snapshot-C3sHpZNS.js}

@@ -1,29 +1,35 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { g as listPermissions } from "./permissions-DC7GROPA.js";
-import { a as resolveScope, f as tenantOf, i as normalizeMemberships, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { T as synthesiseRole, b as findRole, l as matchGrantee, w as listRoles } from "./grantee-Bv04_Vzf.js";
-import { a as approvalMessage, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
-import { a as whereFromGrants, f as resourceIdOf, g as evaluateCondition, h as simulateArazzo, m as isArazzoSimulateInput, o as decisionToken, s as payloadDigest, u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
-import { d as rowInScope, i as isMembershipExpired, m as pickVisible, p as grantCoversField, r as inTeam, s as nowSeconds, t as isActive, u as resolveActiveTenant } from "./validity-D0uRmJKJ.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
+import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition } from "./snapshot-Enxd0n-s.js";
+import { D as synthesiseRole, E as listRoles, S as findRole, d as matchGrantee } from "./grantee-Cv5Sogfv.js";
+import { n as pickVisible, t as grantCoversField } from "./fields-BMl1RxoX.js";
+import { a as isMembershipExpired, i as inTeam, l as nestedAppliesWithoutRow, m as rowInScope, p as resolveActiveTenant, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
+import { n as payloadDigest, t as decisionToken } from "./token-CIWxJOCh.js";
 //#region src/core/snapshot-evaluate.ts
-function isRowPair(value) {
-	return value !== null && typeof value === "object" && "current" in value && "next" in value;
-}
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
 	if (include === void 0 || include.length === 0) return true;
 	return include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
 }
-function rowId(data) {
-	if (data === null || typeof data !== "object") return "*";
-	const id = data["id"];
-	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+/** The field of `resource` that holds scope `name`'s id in a snapshot: its `fields` entry, else the scope's key. */
+function snapshotField(snapshot, name, resource) {
+	const entry = snapshot.scopes?.find((item) => item.name === name);
+	return entry?.fields?.[resource] ?? entry?.key;
 }
-function scopeOk(snapshot, grant, permission, subject, data, team, now) {
+function scopeOk(snapshot, grant, permission, subject, data, team, now, only) {
 	const scope = grant.scope;
 	if (scope === void 0) return { ok: true };
+	if (only !== void 0 && scope !== only) return {
+		ok: false,
+		reason: "scope"
+	};
 	const principal = subject.principal;
 	const membership = grant.membership;
 	if (principal === null || membership === void 0) return {
@@ -48,16 +54,19 @@ function scopeOk(snapshot, grant, permission, subject, data, team, now) {
 			ok: false,
 			reason: "scope"
 		};
-		if (permission.kind !== "instance" && (data === null || typeof data !== "object")) return { ok: true };
+		if (data === null || typeof data !== "object") return permission.kind !== "instance" || nestedAppliesWithoutRow(membership, scopes, data, team) ? { ok: true } : {
+			ok: false,
+			reason: "scope"
+		};
 		const partitioned = (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true;
-		return rowInScope(membership, scopes, data !== null && typeof data === "object" ? data : {}, partitioned);
+		return rowInScope(membership, scopes, data, partitioned, (name) => snapshotField(snapshot, name, permission.resource));
 	}
 	const on = membership.on;
 	if (on === void 0 || on.resource !== scope.resource || on.resource !== permission.resource) return {
 		ok: false,
 		reason: "scope"
 	};
-	if (on.id !== rowId(data)) return {
+	if (on.id !== rowIdOf(data, snapshot.ids?.[permission.resource])) return {
 		ok: false,
 		reason: "scope"
 	};
@@ -123,15 +132,16 @@ function matchedOf(grant) {
 		approval: grant.approval
 	});
 }
-function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
-	const now = options.now ?? nowSeconds();
+function evaluateSnapshot(snapshot, subject, permission, data, team, options, outcomeOnly = false) {
+	let clock = options.now;
+	const now = () => clock ??= nowSeconds();
 	const tracer = options.explain === true ? {
 		evaluated: 0,
 		allows: [],
 		denies: [],
 		skipped: []
 	} : void 0;
-	const done = (decision) => freezeDeep(tracer === void 0 ? decision : {
+	const done = (decision) => outcomeOnly ? decision : freezeDeep(tracer === void 0 ? decision : {
 		...decision,
 		trace: {
 			evaluated: tracer.evaluated,
@@ -156,22 +166,14 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
 		}],
 		alternatives: []
 	});
-	let current = data;
-	let next = data;
-	if (permission.kind === "instance" && isRowPair(data)) {
-		current = data.current;
-		next = data.next;
-	}
-	if (permission.kind === "collection") {
-		current = void 0;
-		next = data;
-	}
+	const { current, next } = rowValues(permission, data);
+	const scopes = scopeList(snapshot.scopes);
 	const denials = [];
 	const allows = [];
 	for (const grant of snapshot.grants) {
 		if (grant.permission !== permission.key) continue;
 		if (tracer !== void 0) tracer.evaluated += 1;
-		const match = matchGrantee(grant.to, subject, now, void 0, void 0, void 0, grant.effect === "deny");
+		const match = matchGrantee(grant.to, subject, now(), void 0, scopes, void 0, grant.effect === "deny");
 		if (!match.matched) {
 			denials.push(compact({
 				role: grant.role,
@@ -180,8 +182,8 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
 			}));
 			continue;
 		}
-		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now);
-		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now);
+		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now(), options.scope);
+		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
 		if (!scoped.ok) {
 			denials.push(compact({
 				role: grant.role,
@@ -190,7 +192,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
 			}));
 			continue;
 		}
-		if (!isActive(grant.validity, now)) {
+		if (!isActive(grant.validity, now())) {
 			if (grant.effect === "allow") denials.push({
 				role: grant.role,
 				reason: "inactive-grant",
@@ -214,7 +216,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
 				alternatives: []
 			});
 		}
-		const condition = conditionOk(grant, permission, current, next, subject, now, scopeList(snapshot.scopes));
+		const condition = conditionOk(grant, permission, current, next, subject, now(), scopes);
 		if (!condition.matched && grant.effect === "deny" && condition.reason === "opaque-condition" && grantCoversField(grant.fields, options.field, grant.effect)) {
 			tracer?.denies.push(matchedOf(grant));
 			return done({
@@ -284,8 +286,8 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options) {
 		}],
 		alternatives: []
 	});
-	const resourceId = permission.kind === "collection" ? "*" : rowId(current);
-	const token = decisionToken({
+	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, snapshot.ids?.[permission.resource]);
+	const token = outcomeOnly ? "" : decisionToken({
 		key: permission.key,
 		resourceId,
 		principal: subject.principal,
@@ -312,6 +314,7 @@ function whereFromSnapshot(snapshot, subject, permission, team) {
 		resource: permission.resource,
 		scopes: scopeList(snapshot.scopes),
 		partitioned: (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true,
+		fieldOf: (name) => snapshotField(snapshot, name, permission.resource),
 		tenant: subject.principal?.tenant,
 		team,
 		now: nowSeconds(),
@@ -346,7 +349,7 @@ function heldRoleNames(subject, tenant, scopes, only, now) {
 	const names = new Set(scope === void 0 ? subject.principal?.roles ?? [] : []);
 	for (const membership of subject.principal?.memberships ?? []) {
 		if (isMembershipExpired(membership, now)) continue;
-		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || membership.id === only.id))) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
 		for (const role of membership.roles) names.add(role);
 	}
 	const rank = only?.rank ?? [];
@@ -358,8 +361,8 @@ function heldRoleNames(subject, tenant, scopes, only, now) {
 }
 //#endregion
 //#region src/core/from-snapshot.ts
-function resourceRef(permission, data) {
-	const id = permission.kind === "collection" ? void 0 : rowId(data);
+function resourceRef(snapshot, permission, data) {
+	const id = permission.kind === "collection" ? void 0 : rowIdOf(data, snapshot.ids?.[permission.resource]);
 	return id === void 0 || id === "*" ? { type: permission.resource } : {
 		type: permission.resource,
 		id
@@ -374,7 +377,13 @@ function fromSnapshot(snapshot, options = {}) {
 	const team = options.team;
 	const run = (permission, data, decideOptions = {}) => evaluateSnapshot(snapshot, subject, permission, data, team, decideOptions);
 	const decide = ((permission, data, decideOptions = {}) => run(permission, data, decideOptions));
-	const can = ((permission, data, decideOptions) => run(permission, data, decideOptions).outcome === "granted");
+	const can = ((permission, data, decideOptions) => {
+		try {
+			return evaluateSnapshot(snapshot, subject, permission, data, team, decideOptions ?? {}, true).outcome === "granted";
+		} catch {
+			return false;
+		}
+	});
 	const assert = ((permission, data, decideOptions) => {
 		const decision = run(permission, data, decideOptions);
 		if (decision.outcome === "granted") return decision;
@@ -382,14 +391,14 @@ function fromSnapshot(snapshot, options = {}) {
 			decision,
 			permission: permission.key,
 			scope: permission.scope,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(snapshot, permission, data),
 			message: approvalMessage(permission.key, decision.reason, decision.token)
 		});
 		throw new PermDockDeniedError({
 			decision,
 			permission: permission.key,
 			scope: permission.scope,
-			resource: resourceRef(permission, data),
+			resource: resourceRef(snapshot, permission, data),
 			subject,
 			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, [])
 		});
@@ -446,9 +455,7 @@ function fromSnapshot(snapshot, options = {}) {
 				}
 			}), options);
 		}),
-		snapshot() {
-			return snapshot;
-		},
+		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, signing.audience)),
 		on() {
 			return () => void 0;
 		},
@@ -510,6 +517,9 @@ function fromSnapshot(snapshot, options = {}) {
 				}]
 			});
 		},
+		derive() {
+			return instance;
+		},
 		activate() {
 			return freezeDeep({
 				outcome: "denied",
@@ -531,6 +541,13 @@ function fromSnapshot(snapshot, options = {}) {
 			if (query?.scope === "global") return [];
 			return assignableEntry(snapshot, query?.tenant ?? subject.principal?.tenant)?.permissions ?? [];
 		},
+		assignableLevels(permission, query) {
+			if (query?.scope === "global") return [];
+			const levels = assignableEntry(snapshot, query?.tenant ?? subject.principal?.tenant)?.levels;
+			if (levels === void 0 || !Object.hasOwn(levels, permission.key)) return [];
+			const names = levels[permission.key];
+			return Array.isArray(names) ? names.filter((name) => typeof name === "string") : [];
+		},
 		subject
 	};
 	return Object.freeze(instance);
@@ -549,4 +566,4 @@ function emptySnapshot() {
 	});
 }
 //#endregion
-export { fromSnapshot as n, emptySnapshot as t };
+export { fromSnapshot as n, heldRoleNames as r, emptySnapshot as t };

package/dist/{grantee-Bv04_Vzf.js → grantee-Cv5Sogfv.js}

@@ -1,7 +1,7 @@
 import { r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { S as isForbiddenKey, d as isFieldRelation, g as listPermissions, h as isSelfParented, l as isComputedRelation, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation, w as ownKeys, x as assertSafeKey } from "./permissions-DC7GROPA.js";
-import { a as resolveScope, s as rootScope, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { C as restrictedStops, D as ownKeys, S as restrictedFor, T as isForbiddenKey, _ as listPermissions, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, m as isPrincipalRelation, p as isPermission, r as expandRelation, u as isComputedRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+import { c as rootScope, d as scopeList, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";
 const PLAN_KIND = "plan";
@@ -127,6 +127,18 @@ function relation(resource, name, options) {
 		depth
 	}));
 }
+function inherit(permission, options) {
+	if (!isPermission(permission) || permission.kind === "collection") throw new Error("PermDock: inherit() takes an instance permission leaf");
+	const through = options.through;
+	const links = Array.isArray(through) ? through : void 0;
+	if (through !== "parent" && (links === void 0 || links.length === 0 || !links.every((link) => typeof link === "string" && link !== "" && link !== "parent"))) throw new Error("PermDock: inherit() through must be 'parent' or a non-empty list of link names");
+	return freezeDeep({
+		kind: "inherit",
+		permission: permission.key,
+		resource: permission.resource,
+		through: links === void 0 ? "parent" : links.map(String)
+	});
+}
 function plan(name) {
 	return freezeDeep({
 		kind: "plan",
@@ -233,9 +245,29 @@ function resourceRoleCondition(resource, membershipResource, ids, resources) {
 		field: start.field,
 		depth: DEFAULT_RELATION_DEPTH,
 		parent: start.parent ? true : void 0,
-		restricted: resource.restricted
+		restricted: restrictedFor(resource, "parent"),
+		passRestricted: passesRestricted(resources.get(membershipResource))
 	});
 }
+function passesRestricted(node) {
+	return node?.restricted !== void 0 && !restrictedStops(node, "parent") ? true : void 0;
+}
+function linkStop(resource, link) {
+	const restricted = restrictedFor(resource, link);
+	if (restricted === void 0) return {};
+	const parent = resource.parent;
+	if (parent === void 0 || !isSelfParented(resource)) return { restricted };
+	return {
+		restricted,
+		restrictedAncestors: {
+			resource: resource.name,
+			id: resource.id,
+			parent: parent.field,
+			field: restricted,
+			depth: 32
+		}
+	};
+}
 /**
 * The link path from the row to the grantee's resource: the row field of
 * the first link and each hop. `undefined` when a link is not declared or
@@ -320,7 +352,8 @@ function relationCondition(grantee, resource, scopes = scopeList(void 0), option
 				field: path.field,
 				depth: path.depth,
 				hops: path.hops,
-				restricted: resource?.restricted
+				...resource === void 0 ? {} : linkStop(resource, firstLink(path)),
+				passRestricted: path.depth > 0 ? passesRestricted(target) : void 0
 			});
 		}
 		const start = relationStart(grantee, resource, target);
@@ -332,7 +365,8 @@ function relationCondition(grantee, resource, scopes = scopeList(void 0), option
 			field: start.field,
 			depth: start.depth,
 			parent: start.parent ? true : void 0,
-			restricted: start.parent || start.depth > 0 ? resource?.restricted : void 0
+			restricted: start.parent || start.depth > 0 ? restrictedFor(resource, "parent") : void 0,
+			passRestricted: start.depth > 0 ? passesRestricted(target) : void 0
 		});
 	}
 	const spec = resource?.relations?.[grantee.relation];
@@ -390,6 +424,43 @@ function relationCondition(grantee, resource, scopes = scopeList(void 0), option
 		value: { ref: "principal.id" }
 	};
 }
+function inheritCondition(grantee, resource, resources) {
+	if (resource === void 0) return;
+	if (grantee.through === "parent") {
+		const parent = resource.parent;
+		if (parent === void 0 || parent.resource !== grantee.resource) return;
+		return compact({
+			op: "related",
+			resource: grantee.resource,
+			relation: "",
+			permission: grantee.permission,
+			field: parent.field,
+			depth: 0,
+			parent: true,
+			restricted: restrictedFor(resource, "parent")
+		});
+	}
+	const path = relationHops({
+		kind: "relation",
+		resource: grantee.resource,
+		relation: "",
+		through: grantee.through
+	}, resource, resources);
+	if (path === void 0) return;
+	return compact({
+		op: "related",
+		resource: grantee.resource,
+		relation: "",
+		permission: grantee.permission,
+		field: path.field,
+		depth: 0,
+		hops: path.hops,
+		...linkStop(resource, firstLink(path))
+	});
+}
+function firstLink(path) {
+	return path.hops[0]?.link ?? "";
+}
 function targetMap(target) {
 	return target === void 0 ? void 0 : /* @__PURE__ */ new Map([[target.name, target]]);
 }
@@ -480,6 +551,16 @@ function matchOne(grantee, subject, now, resource, scopes, resources) {
 				where
 			});
 		}
+		case "inherit": {
+			const where = inheritCondition(grantee, resource, resources);
+			return where === void 0 ? {
+				matched: false,
+				reason: "condition"
+			} : {
+				matched: true,
+				where
+			};
+		}
 		case "role":
 			if (subject.principal === null) return {
 				matched: false,
@@ -518,4 +599,4 @@ function matchGrantee(to, subject, now, resource, scopes, resources, unknownMatc
 	});
 }
 //#endregion
-export { listPlans as C, isRole as S, synthesiseRole as T, roleScopeOf as _, authenticated as a, findRole as b, isGraphRelation as c, relation as d, relationCondition as f, roleNameOf as g, resourceRoleCondition as h, assurance as i, matchGrantee as l, relationStart as m, anyone as n, combineWhere as o, relationHops as p, asGrantee as r, flattenGrantee as s, actor as t, plan as u, definePlans as v, listRoles as w, isPlan as x, defineRoles as y };
+export { isPlan as C, synthesiseRole as D, listRoles as E, findRole as S, listPlans as T, resourceRoleCondition as _, authenticated as a, definePlans as b, inherit as c, matchGrantee as d, plan as f, relationStart as g, relationHops as h, assurance as i, inheritCondition as l, relationCondition as m, anyone as n, combineWhere as o, relation as p, asGrantee as r, flattenGrantee as s, actor as t, isGraphRelation as u, roleNameOf as v, isRole as w, defineRoles as x, roleScopeOf as y };

package/dist/graph-sql-B-dsAT6j.d.ts

@@ -0,0 +1,29 @@
+//#region src/conditions/graph-sql.d.ts
+/**
+ * Postgres SQL as parts, so each compiler binds values and names columns its
+ * own way: literal `text`, a bound `value`, the subject's id as text, or a
+ * `column` of the row being filtered.
+ */
+type GraphSqlPart = {
+  readonly text: string;
+} | {
+  readonly value: string | number | boolean;
+} | {
+  readonly subject: true;
+} | {
+  readonly column: string;
+};
+type GraphSql = readonly GraphSqlPart[];
+/** Where the graph lives in the database, as the `toWhere` compilers take it. */
+type RelationsMapping = {
+  /** The table of each resource the graph reads; default the resource name. */
+  readonly tables?: Readonly<Record<string, string>>;
+  /**
+   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as
+   * the one `permdock rls` keeps. Without it, parent walks are a bounded
+   * recursive query over the resource's own table.
+   */
+  readonly closure?: string;
+};
+//#endregion
+export { GraphSqlPart as n, RelationsMapping as r, GraphSql as t };

package/dist/{headers-B5RRv3Xm.js → headers-BZSDieNT.js}

@@ -1,4 +1,4 @@
-//#region src/react/headers.ts
+//#region src/client/headers.ts
 function approvalHeaders(token) {
 	return { "PermDock-Approval": token };
 }

package/dist/{headers-C8SHQccD.d.ts → headers-Cf-zWvsO.d.ts}

@@ -1,4 +1,4 @@
-//#region src/react/headers.d.ts
+//#region src/client/headers.d.ts
 declare function approvalHeaders(token: string): {
   readonly "PermDock-Approval": string;
 };