permdock 0.1.0 → 0.3.0

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { E as PolicyVocabulary, Zt as PermDock } from "../policy-CInmNGkM.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-B9dmiiab.js";
+import { D as PolicyVocabulary, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-QCuYJh4q.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/parse-BuyjxhZV.js

@@ -0,0 +1,53 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { t as catalogSchema } from "./schema-D3MnDMxa.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BsAflUGW.js";
+//#region src/catalog/parse.ts
+function invalid(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "catalog",
+		issues,
+		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+/**
+* Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
+* validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
+* built from own keys; throws `PermDockValidationError` with every issue.
+*/
+function parseCatalog(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalid([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	let copy;
+	try {
+		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	} catch (error) {
+		invalid([{
+			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
+	if (issues.length > 0) invalid(issues);
+	return freezeDeep(copy);
+}
+/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+function rowConditionKeys(catalog) {
+	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
+}
+//#endregion
+export { rowConditionKeys as n, parseCatalog as t };

package/dist/parse-local-manifest-BrMozJCo.js

@@ -0,0 +1,36 @@
+import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+//#region src/core/local-role.ts
+/** The role name custom-role tables in a local snapshot manifest hold their grants under; no declared or tenant role can take it. */
+const LOCAL_CUSTOM_ROLE = "\0custom";
+//#endregion
+//#region src/core/parse-local-manifest.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStrings(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function safeKeys(value) {
+	if (Array.isArray(value)) return value.every(safeKeys);
+	if (!isRecord(value)) return true;
+	return Object.entries(value).every(([key, item]) => !isForbiddenKey(key) && safeKeys(item));
+}
+function isGrants(value) {
+	return Array.isArray(value) && value.every((grant) => isRecord(grant) && typeof grant["permission"] === "string" && (grant["effect"] === "allow" || grant["effect"] === "deny") && (grant["role"] === null || typeof grant["role"] === "string") && (isRecord(grant["to"]) || Array.isArray(grant["to"])));
+}
+function isGrantTable(value) {
+	return isRecord(value) && Object.values(value).every(isGrants);
+}
+function isCustomTable(value) {
+	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"]))) && isGrantTable(value["includes"]);
+}
+/**
+* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
+* no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
+* back without a cast.
+*/
+function parseLocalSnapshotManifest(value) {
+	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && safeKeys(value);
+}
+//#endregion
+export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/parse-local-manifest-JLnaBH0S.d.ts

@@ -0,0 +1,10 @@
+import { pt as LocalSnapshotManifest } from "./policy-IB6yxpC3.js";
+//#region src/core/parse-local-manifest.d.ts
+/**
+ * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
+ * no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
+ * back without a cast.
+ */
+declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
+//#endregion
+export { parseLocalSnapshotManifest as t };

package/dist/pdp/index.d.ts

@@ -1,5 +1,5 @@
-import { C as Policy, E as PolicyVocabulary, Q as DecisionProvider, Qt as PermDockOptions, mr as Principal } from "../policy-CInmNGkM.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-BvBk1wgn.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-IB6yxpC3.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-DxiCGmmd.js";
 //#region src/pdp/create.d.ts
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
 //#endregion

package/dist/pdp/index.js

@@ -1,131 +1,13 @@
 import { n as isReadonlyArray, t as compact } from "../compact-y6vfu2_f.js";
-import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
-import { c as getResource, g as listPermissions } from "../permissions-DC7GROPA.js";
-import { a as approvalMessage, i as PermDockValidationError, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
-import { m as isArazzoSimulateInput, o as decisionToken } from "../snapshot-DE8dE_hz.js";
-import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
-import { s as isRecord } from "../map-DowSO96j.js";
-//#region src/pdp/shared.ts
-const MAX_CACHE_TTL_MS = 3e4;
-const CACHE_MAX = 1e3;
-/** Milliseconds, clamped to `[0, 30s]`; anything unparseable disables the cache. */
-function ttlMs(cache) {
-	if (cache === void 0) return 0;
-	const raw = typeof cache.ttl === "number" ? cache.ttl : cache.ttl.endsWith("ms") ? Number(cache.ttl.slice(0, -2)) : Number(cache.ttl.slice(0, -1)) * 1e3;
-	if (!Number.isFinite(raw) || raw <= 0) return 0;
-	return Math.min(raw, MAX_CACHE_TTL_MS);
-}
-function denied(reason) {
-	return {
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason
-		}],
-		alternatives: []
-	};
-}
-function resourceIdOf(data, field = "id") {
-	if (data === null || typeof data !== "object") return "*";
-	const id = Object.hasOwn(data, field) ? data[field] : void 0;
-	if (typeof id === "string" || typeof id === "number") return String(id);
-	return "*";
-}
-function granted(provider, permission, subject, data) {
-	const principal = subject.principal;
-	if (principal === null) return denied("anonymous");
-	return {
-		outcome: "granted",
-		subject: {
-			...subject,
-			principal
-		},
-		matched: {
-			role: provider,
-			permission: permission.key,
-			provider
-		},
-		token: decisionToken({
-			key: permission.key,
-			resourceId: resourceIdOf(data),
-			principal,
-			actor: subject.actor,
-			fingerprint: provider
-		})
-	};
-}
-/**
-* The request that would be sent, plus what a custom mapping may drop
-* (issuer, tenant, actor): a tenant switch or a changed row never reuses a
-* cached answer.
-*/
-function cacheKey(subject, permission, body) {
-	return JSON.stringify([
-		permission.key,
-		subject.principal?.issuer ?? null,
-		subject.principal?.tenant ?? null,
-		subject.actor === void 0 ? null : [subject.actor.id, subject.actor.kind],
-		body
-	]);
-}
-function ttlCache(ttl) {
-	const entries = /* @__PURE__ */ new Map();
-	return {
-		get(key) {
-			if (ttl <= 0) return;
-			const hit = entries.get(key);
-			if (hit !== void 0 && Date.now() - hit.at < ttl) return hit.value;
-			entries.delete(key);
-		},
-		set(key, value) {
-			if (ttl <= 0) return;
-			entries.set(key, {
-				at: Date.now(),
-				value
-			});
-			if (entries.size > CACHE_MAX) {
-				const oldest = entries.keys().next();
-				if (oldest.done !== true) entries.delete(oldest.value);
-			}
-		}
-	};
-}
-async function bearerOf(auth) {
-	if (auth === void 0) return null;
-	try {
-		const token = typeof auth.bearer === "function" ? await auth.bearer() : auth.bearer;
-		return token === "" ? null : token;
-	} catch {
-		return null;
-	}
-}
-async function postJson(fetcher, url, body, options) {
-	const token = await bearerOf(options.auth);
-	const headers = {
-		"content-type": "application/json",
-		accept: "application/json"
-	};
-	if (token !== null) headers["authorization"] = `Bearer ${token}`;
-	try {
-		const response = await fetcher(url, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(body),
-			signal: AbortSignal.timeout(options.timeout)
-		});
-		return response.ok ? {
-			ok: true,
-			response
-		} : { ok: false };
-	} catch {
-		return { ok: false };
-	}
-}
-function joinUrl(base, path) {
-	if (path.startsWith("http://") || path.startsWith("https://")) return path;
-	return `${base.endsWith("/") ? base.slice(0, -1) : base}${path.startsWith("/") ? path : `/${path}`}`;
-}
-//#endregion
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { d as isArazzoSimulateInput } from "../snapshot-Enxd0n-s.js";
+import { n as isThenable } from "../thenable-okc2xDsj.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
+import { s as isRecord } from "../map-AcxK9o_D.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DRu8VFVM.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;
@@ -379,12 +261,17 @@ function wrap(permdock, policy, subject, providers) {
 			const next = permdock.team(id);
 			return wrap(next, policy, next.subject, providers);
 		},
+		derive: (options) => {
+			const next = permdock.derive(options);
+			return isThenable(next) ? next.then((derived) => wrap(derived, policy, derived.subject, providers)) : wrap(next, policy, next.subject, providers);
+		},
 		memberships: permdock.memberships.bind(permdock),
 		tenants: permdock.tenants.bind(permdock),
 		heldRoles: permdock.heldRoles.bind(permdock),
 		audiences: permdock.audiences.bind(permdock),
 		assignableRoles: permdock.assignableRoles.bind(permdock),
 		assignablePermissions: permdock.assignablePermissions.bind(permdock),
+		assignableLevels: permdock.assignableLevels.bind(permdock),
 		decideRoleChange: permdock.decideRoleChange.bind(permdock),
 		loadRelations: permdock.loadRelations.bind(permdock),
 		whoCan: permdock.whoCan.bind(permdock),