permdock 0.1.0 → 0.2.0

package/dist/solid/index.d.ts

@@ -1,9 +1,11 @@
-import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { r as Role } from "../vocabulary-Dk0fs-Jk.js";
-import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
-import { t as approvalHeaders } from "../headers-C8SHQccD.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { r as Role } from "../vocabulary-DA8a8zif.js";
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
@@ -17,15 +19,30 @@ type PermDockProviderProps = {
    * the store `pending` until it settles.
    */
   readonly snapshot: Snapshot | string | Accessor$1<Snapshot | string | undefined> | PromiseLike<Snapshot | string>;
-  readonly endpoint?: string;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
   readonly approvals?: string;
+  /** A change switches the active tenant (`refresh({ tenant })`). */
   readonly tenant?: string;
+  /** `headers`, `fetch` and `verifier` are read on every request, so a rotated token applies without a new store. */
   readonly fetch?: typeof fetch;
   readonly headers?: Readonly<Record<string, string>>;
   readonly maxAge?: number;
   readonly verifier?: TokenVerifier;
   readonly children: unknown;
 };
+type PermissionBoundaryProps = {
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: SolidChild | ((state: PermissionBoundaryState) => SolidChild);
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: SolidChild | ((state: PermissionBoundaryState) => SolidChild);
+  readonly children: unknown;
+};
 type ProtectedProps = {
   readonly permission: Permission;
   readonly data?: unknown;
@@ -50,14 +67,27 @@ export declare function useRoles(options?: Accessor<UseRolesOptions>): Accessor<
 export declare function useAssignableRoles(): Accessor<readonly Role[]>;
 export declare function useAssignablePermissions(options?: {
   readonly tenant?: string;
-}): Accessor<readonly Permission[]>;
+} | Accessor<{
+  readonly tenant?: string;
+}>): Accessor<readonly Permission[]>;
 export declare function useSubject(): Accessor<SubjectView>;
 export declare function useApproval(decision: Accessor<Decision>): Accessor<ApprovalHandle>;
 //#endregion
+//#region src/solid/boundary.d.ts
+/**
+ * Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+ * below it and renders `denied`, or `approval` for an approval request
+ * (default `denied`), with the refused permission and `retry()`. Any other
+ * error goes to the next `ErrorBoundary` up.
+ */
+export declare function PermissionBoundary(props: PermissionBoundaryProps): JSX.Element;
+/** Inside a `PermissionBoundary` fallback: what was refused and `retry()`. */
+export declare function usePermissionBoundary(): PermissionBoundaryState | null;
+//#endregion
 //#region src/solid/protected.d.ts
 export declare function Protected(props: ProtectedProps): JSX.Element;
 //#endregion
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockProviderProps, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };

package/dist/solid/index.js

@@ -1,10 +1,12 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
-import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
-import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
-import { t as createClientStore } from "../store-C6hFW6ta.js";
-import { t as isPromiseLike } from "../source-DoBBYJi2.js";
-import { createComponent, createComputed, createContext, createMemo, createSignal, on, onCleanup, useContext } from "solid-js";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { i as isPromiseLike } from "../store-options-yO0V6gRn.js";
+import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-DNyC1y48.js";
+import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
 function useStore() {
@@ -15,6 +17,7 @@ function useStore() {
 //#endregion
 //#region src/solid/hooks.ts
 function useVersion(store) {
+	if (getOwner() === null) throw new Error("PermDock: call hooks inside a component or createRoot, which removes their store subscription.");
 	const [tick, setTick] = createSignal(0);
 	onCleanup(store.subscribe(() => {
 		setTick((current) => current + 1);
@@ -24,10 +27,10 @@ function useVersion(store) {
 function usePermDock() {
 	const store = useStore();
 	const version = useVersion(store);
-	return new Proxy({}, { get(_target, prop, _receiver) {
+	return livePermDock(() => {
 		version();
-		return Reflect.get(store.get(), prop);
-	} });
+		return store.get();
+	});
 }
 function usePermission(permission, data) {
 	const store = useStore();
@@ -43,40 +46,16 @@ function usePermissions(permissions, data) {
 	const version = useVersion(store);
 	return createMemo(() => {
 		version();
-		const granted = [];
-		const byKey = {};
-		for (const permission of permissions()) {
-			const next = store.permissionState(permission, data?.());
-			byKey[permission.key] = next;
-			if (next.allowed) granted.push(permission);
-		}
-		return new Proxy({
-			granted,
-			get(permission) {
-				return byKey[permission.key];
-			}
-		}, { get(target, prop, receiver) {
-			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
-			return Reflect.get(target, prop, receiver);
-		} });
+		return permissionSet(store, permissions(), data?.());
 	});
 }
 function useFilter(permission, rows) {
 	const permdock = usePermDock();
-	return createMemo(() => {
-		const next = permdock.filter(permission, rows());
-		next.partial = permdock.where(permission).partial;
-		return next;
-	});
+	return createMemo(() => filterResult(permdock, permission, rows()));
 }
 function useTenant() {
 	const permdock = usePermDock();
-	return createMemo(() => ({
-		tenant: permdock.subject.principal?.tenant ?? null,
-		tenants: permdock.tenants(),
-		switchTo: (id) => permdock.refresh({ tenant: id }),
-		status: permdock.status()
-	}));
+	return createMemo(() => tenantView(permdock));
 }
 function useMemberships() {
 	const permdock = usePermDock();
@@ -84,10 +63,7 @@ function useMemberships() {
 }
 function useRoles(options = () => ({})) {
 	const permdock = usePermDock();
-	return createMemo(() => {
-		const next = options();
-		return { roles: (next.team === void 0 ? permdock : permdock.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
-	});
+	return createMemo(() => rolesView(permdock, options()));
 }
 function useAssignableRoles() {
 	const permdock = usePermDock();
@@ -95,64 +71,73 @@ function useAssignableRoles() {
 }
 function useAssignablePermissions(options = {}) {
 	const permdock = usePermDock();
-	return createMemo(() => permdock.assignablePermissions(options));
+	return createMemo(() => permdock.assignablePermissions(typeof options === "function" ? options() : options));
 }
 function useSubject() {
 	const permdock = usePermDock();
-	return createMemo(() => {
-		const snapshot = permdock.snapshot();
-		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
-		return {
-			principal: permdock.subject.principal,
-			actor: permdock.subject.actor,
-			delegation: permdock.subject.delegation,
-			expiresAt: permdock.subject.expiresAt,
-			simulated
-		};
-	});
+	return createMemo(() => subjectView(permdock));
 }
 function useApproval(decision) {
 	const store = useStore();
 	const version = useVersion(store);
 	return createMemo(() => {
 		version();
-		const next = decision();
-		return {
-			state: store.approvalState(next),
-			token: next.outcome === "approval-required" ? next.token : void 0,
-			request: (note) => store.requestApproval(next, note)
-		};
+		return approvalHandle(store, decision());
+	});
+}
+//#endregion
+//#region src/solid/boundary.ts
+const BoundaryContext = createContext(null);
+/**
+* Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+* below it and renders `denied`, or `approval` for an approval request
+* (default `denied`), with the refused permission and `retry()`. Any other
+* error goes to the next `ErrorBoundary` up.
+*/
+function PermissionBoundary(props) {
+	return createComponent(ErrorBoundary, {
+		fallback: (error, reset) => {
+			const digest = boundaryDigest(error);
+			if (digest === null) throw error;
+			const state = {
+				...digest,
+				retry: reset
+			};
+			return createComponent(BoundaryContext.Provider, {
+				value: state,
+				get children() {
+					const chosen = boundaryFallback(digest, props);
+					return typeof chosen === "function" ? chosen(state) : chosen ?? null;
+				}
+			});
+		},
+		get children() {
+			return props.children;
+		}
 	});
 }
+/** Inside a `PermissionBoundary` fallback: what was refused and `retry()`. */
+function usePermissionBoundary() {
+	return useContext(BoundaryContext);
+}
 //#endregion
 //#region src/solid/protected.ts
 function Protected(props) {
 	const root = usePermDock();
 	const local = usePermission(() => props.permission, () => props.data);
-	const view = createMemo(() => {
-		if (props.tenant === void 0) return local();
-		return tenantView(root.tenant(props.tenant), props.permission, props.data);
-	});
+	const scoped = createMemo(() => scopedTenant(root, props.tenant));
+	const view = createMemo(() => protectedView(local(), root, props.permission, props.data, scoped()));
 	const render = () => {
-		const scoped = view();
-		if (scoped.status === "pending") return props.pending ?? null;
-		if (!scoped.allowed || scoped.decision.outcome !== "granted") {
-			if (typeof props.fallback === "function") return props.fallback(scoped.decision);
-			return props.fallback ?? null;
+		const current = view();
+		switch (current.slot) {
+			case "pending": return props.pending ?? null;
+			case "fallback": return typeof props.fallback === "function" ? props.fallback(current.decision) : props.fallback ?? null;
+			case "default": return typeof props.children === "function" ? props.children(current.decision) : props.children;
+			default: return current;
 		}
-		if (typeof props.children === "function") return props.children(scoped.decision);
-		return props.children;
 	};
 	return render;
 }
-function tenantView(permdock, permission, data) {
-	const decision = permdock.decide(permission, data);
-	return {
-		allowed: decision.outcome === "granted",
-		status: "ready",
-		decision
-	};
-}
 //#endregion
 //#region src/solid/provider.ts
 function PermDockProvider(props) {
@@ -160,18 +145,24 @@ function PermDockProvider(props) {
 	const promised = isPromiseLike(source);
 	const read = typeof source === "function" ? source : void 0;
 	const initial = promised ? void 0 : read === void 0 ? source : read();
-	const store = createClientStore(compact({
-		snapshot: initial ?? emptySnapshot(),
+	const store = providerStore(compact({
 		endpoint: props.endpoint,
+		snapshotUrl: props.snapshotUrl,
 		approvals: props.approvals,
 		tenant: props.tenant,
-		fetch: props.fetch,
+		maxAge: props.maxAge
+	}), () => ({
 		headers: props.headers,
-		maxAge: props.maxAge,
+		fetch: props.fetch,
 		verifier: props.verifier
-	}));
-	if (promised) store.follow(source);
-	else if (read !== void 0) {
+	}), promised ? source : initial);
+	createComputed(on(() => props.tenant, (next) => {
+		switchTenant(store, next);
+	}, { defer: true }));
+	onCleanup(() => {
+		store.dispose();
+	});
+	if (!promised && read !== void 0) {
 		let arrive;
 		if (initial === void 0) store.follow(new Promise((resolve) => {
 			arrive = resolve;
@@ -194,4 +185,4 @@ function PermDockProvider(props) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };