permdock 0.1.0 → 0.3.0

package/dist/{refs-ChLSxbST.js → refs-KYb4ntaz.js}

@@ -1,5 +1,5 @@
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { E as splitPath, T as readPath, x as assertSafeKey } from "./permissions-DC7GROPA.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { O as readPath, k as splitPath, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;
@@ -36,7 +36,8 @@ function hasConditionOp(condition, op) {
 		case "isNull":
 		case "memberOf":
 		case "related":
-		case "opaque": return false;
+		case "opaque":
+		case "liveSession": return false;
 		default:
  /* v8 ignore next */
 		return condition;

package/dist/{relations-r4soIFZB.js → relations-cjOL01hZ.js}

@@ -1,4 +1,5 @@
-import { C as ownGet, l as isComputedRelation, p as isPrincipalRelation, r as expandRelation, s as getRegistry, u as isEdgeRelation } from "./permissions-DC7GROPA.js";
+import { C as restrictedStops, E as ownGet, d as isEdgeRelation, l as groupEntries, m as isPrincipalRelation, r as expandRelation, s as getRegistry, u as isComputedRelation } from "./permissions-DVoF6dMt.js";
+import { t as idText } from "./ids-DC4V4CFu.js";
 import { n as isThenable } from "./thenable-okc2xDsj.js";
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -22,6 +23,10 @@ function asChain(value) {
 		...value["truncated"] === true ? { truncated: true } : {}
 	};
 }
+function asRow(value) {
+	if (value === null || value === void 0) return { row: null };
+	return isRecord(value) ? { row: value } : void 0;
+}
 function asGroup(value) {
 	if (!isRecord(value) || typeof value["resource"] !== "string" || typeof value["id"] !== "string" || typeof value["relation"] !== "string" || value["id"] === "") return;
 	return {
@@ -100,6 +105,17 @@ function relationReader(source, cache, resources) {
 	}), asHolders);
 	return {
 		available: source !== void 0,
+		row(query) {
+			const load = source?.row?.bind(source);
+			return read(cache, JSON.stringify([
+				"row",
+				query.resource,
+				query.id
+			]), load === void 0 ? void 0 : () => load({
+				resource: query.resource,
+				id: query.id
+			}), asRow);
+		},
 		chain(query) {
 			const through = query.through ?? "parent";
 			return read(cache, JSON.stringify([
@@ -142,9 +158,7 @@ function pendingRelations(cache) {
 	return out;
 }
 function relationId(value) {
-	if (typeof value === "string") return value === "" ? void 0 : value;
-	if (typeof value === "number" && Number.isFinite(value)) return String(value);
-	if (typeof value === "bigint") return String(value);
+	return idText(value);
 }
 /** Whether the holder's period covers `now`. */
 function activeNow(holder, now) {
@@ -176,6 +190,27 @@ function followHops(condition, first, reader) {
 	}
 	return { id };
 }
+function restrictedAbove(condition, row, reader) {
+	const above = condition.restrictedAncestors;
+	if (above === void 0) return false;
+	const parent = relationId(ownGet(row, above.parent));
+	if (parent === void 0) return false;
+	const chain = reader.chain({
+		resource: above.resource,
+		id: parent,
+		depth: above.depth - 1
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	if (chain.restricted === true || chain.ancestors.some((ancestor) => ancestor.restricted === true)) return;
+	const own = relationId(ownGet(row, above.id));
+	const ids = [
+		...own === void 0 ? [] : [own],
+		parent,
+		...chain.ancestors.map((ancestor) => ancestor.id)
+	];
+	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
+	return false;
+}
 /** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
 function relationWalk(condition, row, reader) {
 	if (!isRecord(row)) return;
@@ -184,6 +219,8 @@ function relationWalk(condition, row, reader) {
 	const rowRestricted = condition.restricted !== void 0 && ownGet(row, condition.restricted) === true;
 	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
 	if ((condition.parent === true || hopped) && rowRestricted) return;
+	const above = restrictedAbove(condition, row, reader);
+	if (above !== false) return above;
 	const start = hopped ? followHops(condition, first, reader) : { id: first };
 	if (start === void 0 || start === "relation-unavailable") return start;
 	const id = start.id;
@@ -198,10 +235,11 @@ function relationWalk(condition, row, reader) {
 	});
 	if (chain === "pending" || chain === "failed") return "relation-unavailable";
 	const ids = [id];
-	let stopped = chain.restricted === true;
+	const stops = condition.passRestricted !== true;
+	let stopped = stops && chain.restricted === true;
 	if (!stopped) for (const ancestor of chain.ancestors.slice(0, condition.depth)) {
 		ids.push(ancestor.id);
-		if (ancestor.restricted === true) {
+		if (stops && ancestor.restricted === true) {
 			stopped = true;
 			break;
 		}
@@ -218,7 +256,8 @@ function relationWalk(condition, row, reader) {
 * goes on past `depth` with no holder below it. Any read the instance could
 * not answer is `relation-unavailable` unless a holder was found elsewhere.
 */
-function resolveRelated(condition, row, subject, now, reader) {
+function resolveRelated(condition, row, subject, now, reader, permitted) {
+	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
 	const principal = subject.principal;
 	if (principal === null) return false;
 	const walk = relationWalk(condition, row, reader);
@@ -245,6 +284,19 @@ function resolveRelated(condition, row, subject, now, reader) {
 	if (unavailable) return "relation-unavailable";
 	return walk.truncated || deep ? "relation-depth" : false;
 }
+function resolveInherited(condition, permission, row, reader, permitted) {
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (permitted === void 0) return "relation-unavailable";
+	let unknown = false;
+	for (const id of walk.ids) {
+		const verdict = permitted(condition.resource, id, permission);
+		if (verdict === true) return true;
+		if (verdict !== false && unknown === false) unknown = verdict;
+	}
+	return unknown;
+}
 function groupKey(group) {
 	return JSON.stringify([
 		group.resource,
@@ -288,29 +340,51 @@ function holdsRelation(at, principalId, now, reader, budget, seen, explored) {
 	if (unavailable) return "relation-unavailable";
 	return deep ? "relation-depth" : false;
 }
-/** The holder one edge-table row names for `spec`, or `undefined` when the row does not belong to it. */
-function tableHolder(resourceName, spec, row, id) {
-	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return;
-	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return;
-	const subject = relationId(ownGet(row, spec.subject ?? "user_id"));
-	if (subject === void 0) return;
+/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+function tableHolders(resourceName, spec, row, id) {
+	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
+	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
 	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
 	const period = expiresAt === void 0 ? {} : { expiresAt };
 	const groups = spec.groups;
-	const kind = groups === void 0 ? null : ownGet(row, groups.column);
-	if (groups === void 0 || kind === null || kind === void 0 || kind === groups.direct) return {
-		principal: { id: subject },
+	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
+	if (groups === void 0) return direct === void 0 ? [] : [{
+		principal: { id: direct },
 		...period
-	};
-	const relation = typeof kind === "string" && Object.hasOwn(groups.resources, kind) ? groups.resources[kind] : void 0;
-	return relation === void 0 ? void 0 : {
+	}];
+	if (groups.column === void 0) {
+		const out = direct === void 0 ? [] : [{
+			principal: { id: direct },
+			...period
+		}];
+		for (const group of groupEntries(spec)) {
+			const groupId = relationId(ownGet(row, group.subject));
+			if (groupId !== void 0) out.push({
+				group: {
+					resource: group.resource,
+					id: groupId,
+					relation: group.relation
+				},
+				...period
+			});
+		}
+		return out;
+	}
+	const kind = ownGet(row, groups.column);
+	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	const group = groupEntries(spec).find((entry) => entry.resource === kind);
+	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
+	return group === void 0 || groupId === void 0 ? [] : [{
 		group: {
-			resource: kind,
-			id: subject,
-			relation
+			resource: group.resource,
+			id: groupId,
+			relation: group.relation
 		},
 		...period
-	};
+	}];
 }
 function seconds(value) {
 	if (value instanceof Date) {
@@ -350,6 +424,9 @@ function memoryRelations(permissions, data = {}) {
 	}
 	const rowOf = (resource, id) => byId.get(resource)?.get(id);
 	return {
+		row({ resource, id }) {
+			return rowOf(resource, id) ?? null;
+		},
 		ancestors({ resource, id, depth, through }) {
 			const node = registry.get(resource);
 			const start = rowOf(resource, id);
@@ -361,7 +438,8 @@ function memoryRelations(permissions, data = {}) {
 				return { ancestors: [{ id: next }] };
 			}
 			const restricted = restrictedOf(node, start);
-			if (restricted || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
+			const stops = restrictedStops(node, "parent");
+			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
 				restricted: true,
 				ancestors: []
 			} : { ancestors: [] };
@@ -380,15 +458,19 @@ function memoryRelations(permissions, data = {}) {
 					id: next,
 					restricted: true
 				} : { id: next });
-				if (seen.has(next) || hidden) {
+				if (seen.has(next) || hidden && stops) {
 					next = void 0;
 					break;
 				}
 				seen.add(next);
 				next = relationId(ownGet(row, field));
 			}
-			return next === void 0 ? { ancestors } : {
-				ancestors,
+			const chain = restricted ? {
+				restricted: true,
+				ancestors
+			} : { ancestors };
+			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
+				...chain,
 				truncated: true
 			};
 		},
@@ -397,10 +479,7 @@ function memoryRelations(permissions, data = {}) {
 			if (spec === void 0 || isComputedRelation(spec)) return [];
 			if (isEdgeRelation(spec)) {
 				const table = data.tables?.[spec.edge];
-				if (table !== void 0) return table.flatMap((row) => {
-					const holder = tableHolder(resource, spec, row, id);
-					return holder === void 0 ? [] : [holder];
-				});
+				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
 				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
 			}
 			const row = rowOf(resource, id);

package/dist/replay-BsOyTrdV.js

@@ -0,0 +1,28 @@
+//#region src/ssf/replay.ts
+function memoryReplayStore() {
+	const seen = /* @__PURE__ */ new Map();
+	function evict(now = Date.now() / 1e3) {
+		for (const [jti, expiresAt] of seen) if (expiresAt !== void 0 && expiresAt <= now) seen.delete(jti);
+	}
+	return {
+		seen(jti) {
+			evict();
+			return seen.has(jti);
+		},
+		remember(jti, expiresAt) {
+			evict();
+			seen.set(jti, expiresAt);
+		},
+		claim(key, expiresAt) {
+			evict();
+			if (seen.has(key)) return false;
+			seen.set(key, expiresAt);
+			return true;
+		},
+		release(key) {
+			seen.delete(key);
+		}
+	};
+}
+//#endregion
+export { memoryReplayStore as t };

package/dist/replay-CYyiLiwO.d.ts

@@ -0,0 +1,5 @@
+import { g as ReplayStore } from "./types-Cq_H8N_X.js";
+//#region src/ssf/replay.d.ts
+declare function memoryReplayStore(): ReplayStore;
+//#endregion
+export { memoryReplayStore as t };

package/dist/resource-ref-CaS9yVPi.js

@@ -0,0 +1,20 @@
+//#region src/core/resource-ref.ts
+/** The row's `id` as a string, when it is a string or a number. */
+function resourceIdOf(data) {
+	if (data === null || typeof data !== "object" || !("id" in data)) return;
+	const id = data.id;
+	return typeof id === "string" || typeof id === "number" ? String(id) : void 0;
+}
+/**
+* The `resource` of a decision event: the permission's resource type and the
+* row's `id`, or `wireId` (the id the request named) when the row has none.
+*/
+function resourceRef(permission, data, wireId) {
+	const id = resourceIdOf(data) ?? (typeof wireId === "string" || typeof wireId === "number" ? String(wireId) : void 0);
+	return id === void 0 ? { type: permission.resource } : {
+		type: permission.resource,
+		id
+	};
+}
+//#endregion
+export { resourceRef as n, resourceIdOf as t };

package/dist/revocations-Bhr0aMIC.js

@@ -0,0 +1,27 @@
+//#region src/core/revocations.ts
+function isRevocationEvent(value) {
+	if (value === null || typeof value !== "object") return false;
+	const event = value;
+	return typeof event["principal"] === "string" && event["principal"].length > 0 && (event["kind"] === "session-revoked" || event["kind"] === "changed") && (event["session"] === void 0 || typeof event["session"] === "string") && (event["tenant"] === void 0 || typeof event["tenant"] === "string");
+}
+/** In-process feed; a multi-replica app bridges `revoke` to its own pub/sub. */
+function memoryRevocationFeed() {
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		revoke(event) {
+			if (!isRevocationEvent(event)) throw new TypeError("PermDock: invalid revocation event.");
+			const frozen = Object.freeze({ ...event });
+			for (const listener of listeners) try {
+				listener(frozen);
+			} catch {}
+		}
+	});
+}
+//#endregion
+export { memoryRevocationFeed as t };

package/dist/{rls-BOFU3chG.js → rls-B4ur8nKQ.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/rls.ts
 function rls(ctx) {
@@ -156,6 +156,10 @@ function rls(ctx) {
 				type: "boolean",
 				description: "verify: compare against the live database"
 			},
+			advisors: {
+				type: "boolean",
+				description: "verify: run the Supabase security advisors"
+			},
 			split: {
 				type: "string",
 				description: "Write helpers, seeds, policies and hook as separate parts",
@@ -163,7 +167,7 @@ function rls(ctx) {
 			},
 			"grants-out": {
 				type: "string",
-				description: "File for the supabase_auth_admin grants",
+				description: "File for the helper and hook privileges db diff drops",
 				valueHint: "file"
 			},
 			"seeds-out": {
@@ -185,7 +189,7 @@ function rls(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./rls-CJVja9Ww.js")).runRls({
+			const result = await (await import("./rls-DQtdgTHB.js")).runRls({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,
@@ -216,6 +220,7 @@ function rls(ctx) {
 				revokeColumns: parsed["revoke-columns"] === true,
 				tree: parsed.tree === true,
 				introspect: parsed.introspect === true,
+				advisors: parsed.advisors === true,
 				split: stringArg(parsed.split),
 				grantsOut: stringArg(parsed["grants-out"]),
 				seedsOut: stringArg(parsed["seeds-out"]),