permdock 0.1.0 → 0.3.0

package/dist/supabase/middleware.js

@@ -1,23 +1,60 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { o as invalidSignatureResponse } from "../evaluations-DsAU9ppl.js";
-import { t as createKernel } from "../create-CSkhDU9T.js";
+import { r as credentialSubject } from "../credential-8P81ff4u.js";
+import { i as methodNotAllowed } from "../problem-B43ztKIm.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createServerKernel } from "../create-CMwIl-w2.js";
+import { n as attached } from "../bind-CuzGytRf.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
+const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;
+function secretKeySubjects(keys, permissions) {
+	const subjects = /* @__PURE__ */ new Map();
+	for (const [name, key] of Object.entries(keys ?? {})) {
+		if (!SECRET_KEY_NAME.test(name)) throw new Error(`PermDock: secretKeys name '${name}' must be a key name from SUPABASE_SECRET_KEYS, not a pattern`);
+		if (key.id === "" || key.tenant === "") throw new Error(`PermDock: secretKeys.${name} needs a non-empty id and tenant`);
+		const credential = {
+			v: 1,
+			id: `supabase-secret:${name}`,
+			kind: "service",
+			principal: key.id,
+			tenant: key.tenant,
+			roles: [...key.roles],
+			permissions: key.permissions.map((permission) => ({ permission: permission.key })),
+			createdBy: key.id,
+			createdAt: 0,
+			name
+		};
+		subjects.set(name, credentialSubject(credential, { permissions }));
+	}
+	return subjects;
+}
+function readString(ctx, key) {
+	const value = Reflect.get(ctx, key);
+	return typeof value === "string" ? value : void 0;
+}
+/**
+* `authMode` and `authKeyName` are optional upstream contributions (only
+* `withSupabase` makes them), so they are read here instead of being part of
+* the entry's declared prerequisites.
+*/
+function secretKeySubject(subjects, ctx) {
+	if (subjects.size === 0 || ctx.jwtClaims !== null || readString(ctx, "authMode") !== "secret") return;
+	const name = readString(ctx, "authKeyName");
+	return name === void 0 ? void 0 : subjects.get(name);
+}
 function createPermDock(policy, options) {
 	const contexts = /* @__PURE__ */ new WeakMap();
 	const tenantOption = options.tenant;
 	const contextFor = (request) => contexts.get(request) ?? { jwtClaims: null };
-	const kernel = createKernel(policy, compact({
-		subject: (request) => options.subject(contextFor(request), request),
+	const secretKeys = secretKeySubjects(options.secretKeys, policy.permissions);
+	const kernel = createServerKernel(policy, compact({
+		subject: (request) => {
+			const ctx = contextFor(request);
+			return secretKeySubject(secretKeys, ctx) ?? options.subject(ctx, request);
+		},
 		tenant: typeof tenantOption === "function" ? (request) => tenantOption(contextFor(request), request) : tenantOption,
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
+		...instanceOptions(options),
 		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
 		pdp: options.pdp,
 		webBotAuth: options.webBotAuth,
 		adapter: "supabase-middleware",
@@ -31,15 +68,15 @@ function createPermDock(policy, options) {
 		key: "permdock",
 		run: (config) => async (request, ctx) => {
 			bind(request, ctx);
-			if (config?.protect === void 0) try {
-				return { permdock: await kernel.permdock(request) };
-			} catch (error) {
-				const response = invalidSignatureResponse(error);
-				if (response !== void 0) return response;
-				throw error;
+			if (config?.protect === void 0 && config?.oauthScopes === void 0) {
+				const instance = await attached(() => kernel.permdock(request));
+				return instance.ok ? { permdock: instance.permdock } : instance.response;
 			}
 			const loadData = config.data;
-			const guard = await kernel.protect(config.protect, loadData === void 0 ? void 0 : () => loadData(ctx, request), compact({ trusted: config.trusted }))(request);
+			const guard = await kernel.protect(config.protect ?? null, loadData === void 0 ? void 0 : () => loadData(ctx, request), compact({
+				trusted: config.trusted,
+				oauthScopes: config.oauthScopes
+			}))(request);
 			if (!guard.ok) return guard.response;
 			return { permdock: guard.permdock };
 		}
@@ -51,10 +88,7 @@ function createPermDock(policy, options) {
 			switch (request.method) {
 				case "POST": return POST(request);
 				case "GET": return GET(request);
-				default: return Promise.resolve(new Response(null, {
-					status: 405,
-					headers: { Allow: "GET, POST" }
-				}));
+				default: return Promise.resolve(methodNotAllowed("GET, POST"));
 			}
 		};
 	};

package/dist/{supabase-D8UlBA7Z.js → supabase-Boqb9a_Y.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/supabase.ts
 function supabase(ctx) {
@@ -50,7 +50,7 @@ function supabase(ctx) {
 			},
 			"grants-out": {
 				type: "string",
-				description: "File for the supabase_auth_admin grants",
+				description: "File for the privileges db diff drops",
 				valueHint: "file"
 			}
 		},
@@ -61,7 +61,7 @@ function supabase(ctx) {
 			const budget = stringArg(parsed.budget);
 			const schema = stringArg(parsed.schema);
 			const grantsOut = stringArg(parsed["grants-out"]);
-			const { runSupabase } = await import("./supabase-hook-DW-xP4hU.js");
+			const { runSupabase } = await import("./supabase-hook-6sYLXg_u.js");
 			ctx.report(await runSupabase({
 				cwd: ctx.cwd,
 				config: ctx.config,