permdock 0.1.0 → 0.3.0

package/dist/store-C6hFW6ta.js

@@ -1,508 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as parseSnapshot } from "./snapshot-DE8dE_hz.js";
-import { s as nowSeconds } from "./validity-D0uRmJKJ.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
-import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-//#region src/react/store.ts
-/** Milliseconds a decision, refresh or approval request may take; a slower one is an error like a failed request. */
-const STORE_TIMEOUT_MS = 1e4;
-function cacheKey(permission, data) {
-	if (data === null || typeof data !== "object") return `${permission.key}:*`;
-	const id = data["id"];
-	return `${permission.key}:${typeof id === "string" || typeof id === "number" ? String(id) : "*"}`;
-}
-function withTenant(source, tenant) {
-	if (tenant === void 0) return source;
-	const hashAt = source.indexOf("#");
-	const hash = hashAt === -1 ? "" : source.slice(hashAt);
-	const rest = hashAt === -1 ? source : source.slice(0, hashAt);
-	const queryAt = rest.indexOf("?");
-	const path = queryAt === -1 ? rest : rest.slice(0, queryAt);
-	const params = new URLSearchParams(queryAt === -1 ? "" : rest.slice(queryAt + 1));
-	params.set("tenant", tenant);
-	return `${path}?${params.toString()}${hash}`;
-}
-function refKey(ref) {
-	if ("key" in ref && typeof ref.key === "string") return ref.key;
-	return "";
-}
-function isJws(value) {
-	const parts = value.split(".");
-	return parts.length === 3 && parts.every((part) => part.length > 0);
-}
-const CURRENT = Symbol.for("permdock.current");
-const SERVER_ONLY = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "opaque-condition"
-	}],
-	alternatives: []
-};
-/** The client has no endpoint to ask (`endpoint: false`, or none given). */
-const NO_ENDPOINT = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "server-only"
-	}],
-	alternatives: []
-};
-function needsEndpoint(decision) {
-	return decision.outcome === "denied" && decision.denials.some((denial) => denial.reason === "opaque-condition");
-}
-function createClientStore(options) {
-	const fetchImpl = options.fetch ?? globalThis.fetch.bind(globalThis);
-	const server = options.server ?? globalThis.window === void 0;
-	const listeners = /* @__PURE__ */ new Set();
-	const answers = /* @__PURE__ */ new Map();
-	let queued = [];
-	let flushScheduled = false;
-	let emitScheduled = false;
-	let snapshot = emptySnapshot();
-	let tenant = options.tenant;
-	let base = "server-only";
-	let instance = fromSnapshot(snapshot, compact({ tenant }));
-	let cached;
-	let verifying = false;
-	let refreshing = 0;
-	let following = 0;
-	let refreshSeq = 0;
-	let silent = false;
-	let adopted;
-	let generation = 0;
-	const emit = () => {
-		cached = wrap(instance);
-		if (silent) return;
-		for (const listener of listeners) listener();
-	};
-	const emitSoon = () => {
-		if (emitScheduled) return;
-		emitScheduled = true;
-		queueMicrotask(() => {
-			emitScheduled = false;
-			emit();
-		});
-	};
-	const reset = () => {
-		generation += 1;
-		answers.clear();
-		queued = [];
-	};
-	const hydrate = (next) => {
-		reset();
-		snapshot = next;
-		instance = fromSnapshot(snapshot, compact({ tenant }));
-		base = "ready";
-		options.onSnapshot?.(next, tenant);
-		emit();
-	};
-	const storeStatus = () => {
-		if (verifying || refreshing > 0 || following > 0) return "pending";
-		if (base === "server-only") return "server-only";
-		if (base === "stale" || isStale()) return "stale";
-		for (const entry of answers.values()) if (entry.status === "pending") return "pending";
-		return "ready";
-	};
-	const isStale = () => {
-		const maxAge = snapshot.issuedAt > 0 ? options.maxAge : void 0;
-		if (snapshot.expiresAt === void 0 && maxAge === void 0) return false;
-		const now = nowSeconds();
-		if (snapshot.expiresAt !== void 0 && snapshot.expiresAt <= now) return true;
-		return maxAge !== void 0 && now - snapshot.issuedAt > maxAge;
-	};
-	const serverOnly = () => {
-		hydrate(emptySnapshot());
-		base = "server-only";
-		emit();
-	};
-	const applyParsed = (value) => {
-		try {
-			hydrate(parseSnapshot(value));
-		} catch {
-			serverOnly();
-		}
-	};
-	const verifyJws = async (raw) => {
-		if (options.verifier === void 0) return;
-		try {
-			const verified = await options.verifier.verify(raw, { typ: "permdock-snapshot+jwt" });
-			return verified.ok ? verified.claims["snapshot"] : void 0;
-		} catch {
-			return;
-		}
-	};
-	const bootJws = async (raw) => {
-		if (options.verifier === void 0) {
-			serverOnly();
-			return;
-		}
-		const started = generation;
-		verifying = true;
-		emit();
-		const claim = await verifyJws(raw);
-		verifying = false;
-		if (started !== generation) {
-			emit();
-			return;
-		}
-		if (claim === void 0) {
-			serverOnly();
-			return;
-		}
-		applyParsed(claim);
-	};
-	const scheduleFlush = () => {
-		if (flushScheduled || options.endpoint === void 0) return;
-		flushScheduled = true;
-		queueMicrotask(() => {
-			flushScheduled = false;
-			flush();
-		});
-	};
-	const flush = async () => {
-		const batch = queued;
-		queued = [];
-		if (batch.length === 0 || options.endpoint === void 0) return;
-		const started = generation;
-		if (snapshot.simulated === true) {
-			for (const item of batch) answers.set(item.key, {
-				decision: SERVER_ONLY,
-				status: "server-only"
-			});
-			emit();
-			return;
-		}
-		try {
-			const response = await fetchImpl(options.endpoint, {
-				method: "POST",
-				credentials: "include",
-				signal: timeoutSignal(STORE_TIMEOUT_MS),
-				headers: {
-					accept: "application/json",
-					"content-type": "application/json",
-					...options.headers
-				},
-				body: JSON.stringify({ evaluations: batch.map((item) => ({
-					subject: {
-						type: instance.subject.principal?.kind ?? "user",
-						id: instance.subject.principal?.id ?? ""
-					},
-					action: { name: item.permission.action },
-					resource: {
-						type: item.permission.resource,
-						id: item.data !== null && typeof item.data === "object" && "id" in item.data ? String(item.data.id ?? "") : void 0,
-						properties: item.data
-					}
-				})) })
-			});
-			if (!response.ok) throw new Error("evaluations failed");
-			const body = await response.json();
-			if (started !== generation) return;
-			for (const [index, item] of batch.entries()) {
-				const decision = (body.evaluations?.[index])?.context?.permdock ?? SERVER_ONLY;
-				answers.set(item.key, {
-					decision,
-					status: "ready"
-				});
-			}
-		} catch {
-			if (started !== generation) return;
-			for (const item of batch) answers.set(item.key, {
-				decision: SERVER_ONLY,
-				status: "server-only"
-			});
-		}
-		emit();
-	};
-	const enqueue = (key, permission, data) => {
-		if (answers.has(key)) return;
-		if (options.endpoint === void 0) {
-			answers.set(key, {
-				decision: NO_ENDPOINT,
-				status: "server-only"
-			});
-			options.onServerOnly?.(permission);
-			emitSoon();
-			return;
-		}
-		answers.set(key, {
-			decision: SERVER_ONLY,
-			status: "pending"
-		});
-		queued.push({
-			permission,
-			data,
-			key
-		});
-		emitSoon();
-		scheduleFlush();
-	};
-	const permissionState = (permission, data) => {
-		const key = `${tenant ?? ""}|${cacheKey(permission, data)}`;
-		const hit = answers.get(key);
-		if (hit !== void 0) return {
-			allowed: hit.decision.outcome === "granted",
-			status: hit.status,
-			decision: hit.decision
-		};
-		const decision = instance.decide(permission, data);
-		if (needsEndpoint(decision)) {
-			if (server && options.endpoint !== void 0) return {
-				allowed: false,
-				status: "pending",
-				decision: SERVER_ONLY
-			};
-			enqueue(key, permission, data);
-			const next = answers.get(key);
-			if (next !== void 0) return {
-				allowed: false,
-				status: next.status,
-				decision: next.decision
-			};
-			return {
-				allowed: false,
-				status: "server-only",
-				decision: NO_ENDPOINT
-			};
-		}
-		return {
-			allowed: decision.outcome === "granted",
-			status: verifying || following > 0 ? "pending" : isStale() ? "stale" : "ready",
-			decision
-		};
-	};
-	const approvalInterval = options.approvalInterval ?? 2e3;
-	const approvals = /* @__PURE__ */ new Map();
-	const polls = /* @__PURE__ */ new Map();
-	let approvalEpoch = 0;
-	const TERMINAL = /* @__PURE__ */ new Set([
-		"approved",
-		"rejected",
-		"expired"
-	]);
-	const stopPolls = () => {
-		for (const timer of polls.values()) clearTimeout(timer);
-		polls.clear();
-	};
-	const schedulePoll = (token) => {
-		if (server || options.approvals === void 0 || polls.has(token) || listeners.size === 0) return;
-		const epoch = approvalEpoch;
-		const href = `${options.approvals.replace(/\/+$/u, "")}/${encodeURIComponent(token)}`;
-		polls.set(token, setTimeout(() => {
-			(async () => {
-				let next;
-				try {
-					const response = await fetchImpl(href, {
-						method: "GET",
-						credentials: "include",
-						signal: timeoutSignal(STORE_TIMEOUT_MS),
-						headers: {
-							accept: "application/json",
-							...options.headers
-						}
-					});
-					if (response.status === 404) next = "expired";
-					else if (response.ok) {
-						const body = await response.json();
-						next = body.status === "pending" || body.status === "approved" || body.status === "rejected" || body.status === "expired" ? body.status : void 0;
-					}
-				} catch {
-					next = void 0;
-				}
-				if (epoch !== approvalEpoch) return;
-				polls.delete(token);
-				if (next !== void 0 && approvals.get(token) !== next) {
-					approvals.set(token, next);
-					emit();
-				}
-				if (!TERMINAL.has(approvals.get(token) ?? "required")) schedulePoll(token);
-			})();
-		}, approvalInterval));
-	};
-	const approvalState = (decision) => {
-		if (decision.outcome !== "approval-required") return "not-needed";
-		const current = approvals.get(decision.token) ?? "required";
-		if (!TERMINAL.has(current)) schedulePoll(decision.token);
-		return current;
-	};
-	const subscribe = (listener) => {
-		listeners.add(listener);
-		return () => {
-			listeners.delete(listener);
-			if (listeners.size === 0) stopPolls();
-		};
-	};
-	const wrap = (permdock) => {
-		const client = {
-			...permdock,
-			status(permission, data) {
-				if (permission === void 0) return storeStatus();
-				return permissionState(permission, data).status;
-			},
-			invalidate(ref) {
-				const prefix = refKey(ref);
-				for (const key of answers.keys()) {
-					const unscoped = key.slice(key.indexOf("|") + 1);
-					if (prefix === "" || unscoped === prefix || unscoped.startsWith(`${prefix}:`) || unscoped.startsWith(`${prefix}.`)) answers.delete(key);
-				}
-				base = "stale";
-				emit();
-			},
-			async refresh(query) {
-				const requested = query?.tenant;
-				const source = options.snapshotUrl ?? options.endpoint;
-				if (requested !== void 0 && (snapshot.tenants.includes(requested) || source === void 0)) {
-					tenant = requested;
-					hydrate(snapshot);
-					return;
-				}
-				if (source === void 0) return;
-				const started = generation;
-				refreshSeq += 1;
-				const seq = refreshSeq;
-				refreshing += 1;
-				emit();
-				let body;
-				let ok = false;
-				try {
-					const response = await fetchImpl(withTenant(source, requested), {
-						method: "GET",
-						credentials: "include",
-						signal: timeoutSignal(STORE_TIMEOUT_MS),
-						headers: {
-							accept: "application/json",
-							...options.headers
-						}
-					});
-					if (response.ok) {
-						body = await response.json();
-						ok = true;
-					}
-				} catch {
-					ok = false;
-				}
-				if (ok && typeof body === "string" && isJws(body)) {
-					body = await verifyJws(body);
-					ok = body !== void 0;
-				}
-				refreshing -= 1;
-				if (started !== generation || seq !== refreshSeq) {
-					emit();
-					return;
-				}
-				let next;
-				try {
-					next = ok ? parseSnapshot(body) : void 0;
-				} catch {
-					next = void 0;
-				}
-				if (next === void 0) {
-					base = "stale";
-					emit();
-					return;
-				}
-				if (requested !== void 0) tenant = requested;
-				hydrate(next);
-			},
-			clear() {
-				reset();
-				tenant = options.tenant;
-				snapshot = emptySnapshot();
-				instance = fromSnapshot(snapshot, compact({ tenant }));
-				base = "server-only";
-				approvalEpoch += 1;
-				stopPolls();
-				approvals.clear();
-				options.onClear?.();
-				emit();
-			},
-			subscribe
-		};
-		Object.defineProperty(client, CURRENT, { value: () => cached });
-		return client;
-	};
-	const boot = (value) => {
-		if (typeof value === "string" && isJws(value)) {
-			cached = wrap(instance);
-			bootJws(value);
-		} else {
-			applyParsed(value);
-			cached = wrap(instance);
-		}
-	};
-	boot(options.snapshot);
-	return {
-		get() {
-			return cached;
-		},
-		subscribe,
-		permissionState,
-		approvalState,
-		replace(value) {
-			if (typeof value === "string" && isJws(value)) {
-				bootJws(value);
-				return;
-			}
-			applyParsed(value);
-		},
-		follow(value) {
-			const started = generation;
-			following += 1;
-			emit();
-			const settle = (next) => {
-				following -= 1;
-				if (started !== generation) {
-					emit();
-					return;
-				}
-				if (next === void 0) serverOnly();
-				else if (typeof next === "string" && isJws(next)) bootJws(next);
-				else applyParsed(next);
-			};
-			Promise.resolve(value).then(settle, () => {
-				settle(void 0);
-			});
-		},
-		adopt(value, source) {
-			if (adopted === source) return;
-			adopted = source;
-			reset();
-			silent = true;
-			try {
-				boot(value);
-			} finally {
-				silent = false;
-			}
-			queueMicrotask(emit);
-		},
-		snapshot() {
-			return snapshot;
-		},
-		async requestApproval(decision, note) {
-			if (decision.outcome !== "approval-required" || snapshot.simulated === true) return;
-			const href = options.approvals ?? options.endpoint;
-			if (href === void 0) return;
-			if ((await fetchImpl(href, {
-				method: "POST",
-				credentials: "include",
-				signal: timeoutSignal(STORE_TIMEOUT_MS),
-				headers: {
-					accept: "application/json",
-					"content-type": "application/json",
-					...options.headers
-				},
-				body: JSON.stringify({
-					permission: decision.grant.permission,
-					token: decision.token,
-					note
-				})
-			})).ok && !TERMINAL.has(approvals.get(decision.token) ?? "required")) {
-				approvals.set(decision.token, "pending");
-				emit();
-			}
-		}
-	};
-}
-//#endregion
-export { createClientStore as t };

package/dist/subject-settings-xt7V845g.js

@@ -1,82 +0,0 @@
-//#region src/conditions/row-check.ts
-const MISSING = Object.freeze({ found: false });
-const GRANTED = Object.freeze({
-	found: true,
-	granted: true
-});
-const DENIED = Object.freeze({
-	found: true,
-	granted: false
-});
-function rowCheckOf(found, granted) {
-	return found ? granted ? GRANTED : DENIED : MISSING;
-}
-/** Reads `select <filter> as granted ... where <key> limit 2`; only a boolean `true` or `1` grants. */
-function rowCheckFrom(rows) {
-	if (rows.length > 1) throw new Error("PermDock: checkRow key matches more than one row");
-	const [row] = rows;
-	return rowCheckOf(row !== void 0, row?.granted === true || row?.granted === 1);
-}
-//#endregion
-//#region src/conditions/subject-settings.ts
-const NAME = /^[a-z_][a-z0-9_]*$/u;
-function settingName(name, what) {
-	if (!NAME.test(name)) throw new Error(`PermDock: unsafe ${what} '${name}'`);
-	return name;
-}
-function setConfig(name, value) {
-	return {
-		strings: [`select set_config('${name}', `, ", true)"],
-		values: [value]
-	};
-}
-/**
-* The transaction preamble that makes Postgres see `permdock.subject`: the role, then the
-* claims the generated policies read. Runs inside the caller's transaction, so every setting
-* is local to it.
-*/
-function subjectStatements(permdock, options = {}) {
-	const principal = permdock.subject.principal;
-	const role = options.role ?? (principal === null ? "anon" : "authenticated");
-	if (role !== false && role !== "authenticated" && role !== "anon") throw new Error(`PermDock: withSubject sets role authenticated or anon, not '${String(role)}'`);
-	const tenantClaim = settingName(options.tenantClaim ?? "tenant_id", "tenant claim");
-	const claims = Object.fromEntries(Object.entries(options.claims ?? {}).filter(([name]) => name !== "sub" && name !== "role" && name !== tenantClaim));
-	if (principal !== null) {
-		claims["sub"] = principal.id;
-		if (principal.tenant !== void 0) claims[tenantClaim] = principal.tenant;
-	}
-	if (role !== false) claims["role"] = role;
-	const statements = role === false ? [] : [{
-		strings: [`set local role ${role}`],
-		values: []
-	}];
-	const dialect = options.dialect ?? "supabase";
-	switch (dialect) {
-		case "supabase":
-		case "neon":
-			statements.push(setConfig("request.jwt.claims", JSON.stringify(claims)), setConfig("request.jwt.claim.sub", principal?.id ?? ""));
-			return statements;
-		case "guc": {
-			const prefix = settingName(options.gucPrefix ?? "app", "setting prefix");
-			statements.push(setConfig(`${prefix}.user_id`, principal?.id ?? ""));
-			for (const [name, value] of Object.entries(claims)) {
-				if (name === "sub") continue;
-				statements.push(setConfig(`${prefix}.${settingName(name, "claim name")}`, typeof value === "string" ? value : JSON.stringify(value)));
-			}
-			return statements;
-		}
-		default: return dialect;
-	}
-}
-/** A statement as text with `$1`, `$2` placeholders, for raw executors. */
-function statementText(statement) {
-	let text = "";
-	for (const [index, part] of statement.strings.entries()) text = index === 0 ? part : `${text}$${String(index)}${part}`;
-	return text;
-}
-/** A statement as a template-strings array, for `sql` tags. */
-function statementTemplate(statement) {
-	return Object.assign([...statement.strings], { raw: [...statement.strings] });
-}
-//#endregion
-export { rowCheckOf as a, rowCheckFrom as i, statementText as n, subjectStatements as r, statementTemplate as t };

package/dist/supabase-hook-DW-xP4hU.js

@@ -1,2 +0,0 @@
-import { o as runSupabase } from "./supabase-hook-D_OqGb_V.js";
-export { runSupabase };

package/dist/types-DbWdEfcm.d.ts

@@ -1,87 +0,0 @@
-import { E as PolicyVocabulary, Et as TokenVerifier, Mn as Decision, Zt as PermDock, gt as Snapshot, ir as Actor, mr as Principal, ur as Delegation } from "./policy-CInmNGkM.js";
-import { d as Permission } from "./permissions-B4apnahQ.js";
-import { ReactNode } from "react";
-//#region src/react/types.d.ts
-type ClientStatus = "ready" | "pending" | "stale" | "server-only";
-type PermissionState = {
-  readonly allowed: boolean;
-  readonly status: ClientStatus;
-  readonly decision: Decision;
-};
-type PermissionSet = {
-  readonly granted: readonly Permission[];
-  get(permission: Permission): PermissionState | undefined;
-};
-type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
-  status(permission?: Permission, data?: unknown): ClientStatus;
-  invalidate(ref: Permission | {
-    readonly [key: string]: unknown;
-  }): void;
-  refresh(options?: {
-    readonly tenant?: string;
-  }): Promise<void>;
-  clear(): void;
-  subscribe(listener: () => void): () => void;
-};
-type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
-type ApprovalHandle = {
-  readonly state: ApprovalState;
-  readonly token: string | undefined;
-  readonly request: (note?: string) => Promise<void>;
-};
-type SubjectView = {
-  readonly principal: Principal | null;
-  readonly actor: Actor | undefined;
-  readonly delegation: Delegation | undefined;
-  readonly expiresAt: number | undefined;
-  readonly simulated: boolean;
-};
-type TenantView = {
-  readonly tenant: string | null;
-  readonly tenants: readonly string[];
-  readonly switchTo: (id: string) => Promise<void>;
-  readonly status: ClientStatus;
-};
-type FilterResult<T> = readonly T[] & {
-  readonly partial: boolean;
-};
-type PermDockProviderProps = ({
-  readonly snapshot: Snapshot | string;
-  readonly snapshotPromise?: never;
-} | {
-  /**
-   * An unawaited snapshot from a Server Component. Hooks suspend until it resolves, so only
-   * the components that read permissions wait. A rejection reaches the nearest error boundary.
-   */
-  readonly snapshotPromise: PromiseLike<Snapshot | string>;
-  readonly snapshot?: never;
-}) & {
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer. `false` never
-   * fetches: those checks answer `denied` with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  readonly children: ReactNode;
-};
-type UseRolesOptions = {
-  readonly tenant?: string;
-  readonly team?: string;
-};
-type ProtectedProps = {
-  readonly permission: Permission;
-  readonly data?: unknown;
-  readonly tenant?: string;
-  readonly pending?: ReactNode;
-  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
-  readonly children: ReactNode | ((decision: Extract<Decision, {
-    readonly outcome: "granted";
-  }>) => ReactNode);
-};
-//#endregion
-export { FilterResult as a, PermissionState as c, TenantView as d, UseRolesOptions as f, ClientStatus as i, ProtectedProps as l, ApprovalState as n, PermDockProviderProps as o, ClientPermDock as r, PermissionSet as s, ApprovalHandle as t, SubjectView as u };