permdock 0.16.0 → 0.18.0

package/dist/{parse-local-manifest-DEiCF4ah.js → parse-local-manifest-CxcSMQgl.js}

@@ -54,8 +54,8 @@ function isMembershipRows(value) {
 }
 function isRows(value) {
 	if (!isRecord(value)) return false;
-	const { memberships, roles, customRoles } = value;
-	return Array.isArray(memberships) && memberships.every(isMembershipRows) && (roles === void 0 || isRecord(roles) && isText(roles["table"]) && isText(roles["user"]) && Array.isArray(roles["roles"]) && roles["roles"].length > 0 && roles["roles"].every(isColumn)) && (customRoles === void 0 || isRecord(customRoles) && isText(customRoles["permissions"]) && isText(customRoles["includes"]));
+	const { memberships, roles, customRoles, version } = value;
+	return Array.isArray(memberships) && memberships.every(isMembershipRows) && (roles === void 0 || isRecord(roles) && isText(roles["table"]) && isText(roles["user"]) && Array.isArray(roles["roles"]) && roles["roles"].length > 0 && roles["roles"].every(isColumn)) && (customRoles === void 0 || isRecord(customRoles) && isText(customRoles["permissions"]) && isText(customRoles["includes"])) && (version === void 0 || isRecord(version) && isText(version["table"]) && isText(version["user"]) && isText(version["version"]));
 }
 /**
 * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no

package/dist/{parse-local-manifest-CCmbhnxP.d.ts → parse-local-manifest-DvjTQNuO.d.ts}

@@ -1,4 +1,4 @@
-import { Yt as LocalSnapshotManifest } from "./policy-types-DGIO_gxq.js";
+import { Zt as LocalSnapshotManifest } from "./policy-types-D-GwfQTc.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no

package/dist/{parse-request-CwCZpyjV.js → parse-request-DOBVaeiQ.js}

@@ -1,6 +1,6 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMP8Cmxd.js";
 //#region src/approvals/parse-request.ts
 /**
 * Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or

package/dist/pdp/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal, q as DecisionProvider } from "../policy-types-DGIO_gxq.js";
-import { o as PermDockOptions } from "../permdock-CprAPN3w.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-DlelvQk4.js";
+import { E as Policy, J as DecisionProvider, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
+import { o as PermDockOptions } from "../permdock-ffY4CMd9.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-B8qUkGja.js";
 //#region src/pdp/create.d.ts
 /**
  * The PDP-aware instance, built synchronously like core `getPermDockSync`; use

package/dist/pdp/index.js

@@ -5,9 +5,9 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { n as internalsOf, t as attachInternals } from "../internals-B3IgHrvo.js";
 import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { r as decideAllAsync, t as canAllAsync } from "../checks-CGkP3Z7A.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BvjivVb9.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-l0oGGetg.js";
+import { r as decideAllAsync, t as canAllAsync } from "../checks-fyDOhcz0.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-D-_WrdKu.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-BRmCJxDK.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;

package/dist/{peer-Q0fuZ6hx.js → peer-BuK9F53f.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { createRequire } from "node:module";

package/dist/{peer-C9LvBCcb.js → peer-n-swIV4H.js}

@@ -1 +1 @@
-export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-Q0fuZ6hx.js";
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-BuK9F53f.js";

package/dist/{permdock-BvjivVb9.js → permdock-D-_WrdKu.js}

@@ -6,18 +6,18 @@ import { t as attachInternals } from "./internals-B3IgHrvo.js";
 import { _ as keyToScope, a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "./thenable-BNSM1U2R.js";
 import { i as readAppData } from "./app-data-UNNm07jV.js";
-import { f as scopeList, h as tenantOf, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, o as normalizeMemberships, p as tenantOf } from "./scopes-BSdYaGHs.js";
 import { o as pickVisible, s as sanitizeContext } from "./validity-Buc7w8E9.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-5d1zVBvK.js";
-import { d as policyX } from "./policy-CLQ8__GF.js";
-import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-BAmf_AQd.js";
-import { c as heldRoleNames, d as audiencesOf, g as asMembershipSource, i as assignableIn, l as roleLeaf, o as collectSnapshotGrants, s as whereGrant, t as snapshotOf, u as applyRoleKinds } from "./instance-snapshot-DuWf1cT3.js";
+import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DvOHHk3-.js";
+import { d as policyX } from "./policy-cV_wwPb8.js";
+import { r as isSubject, t as anonymousSubject } from "./subject-C7RddW0G.js";
+import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-Czbj7thS.js";
+import { c as heldRoleNames, d as audiencesOf, g as asMembershipSource, i as assignableIn, l as roleLeaf, o as collectSnapshotGrants, s as whereGrant, t as snapshotOf, u as applyRoleKinds } from "./instance-snapshot-BWa71my8.js";
 import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK.js";
-import { i as snapshotGrant } from "./snapshot-CXlzi69u.js";
-import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-DlCdCM_8.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
-import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { i as snapshotGrant } from "./snapshot-DN_8J27z.js";
+import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-BKrqUDVk.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-fyDOhcz0.js";
 //#region src/core/app.ts
 const APP = Symbol.for("permdock.app");
 /**
@@ -41,6 +41,197 @@ function withApp(policy, options) {
 	return merged;
 }
 //#endregion
+//#region src/core/freshness.ts
+function versionQuery(principal, issuedAt) {
+	return compact({
+		id: principal.id,
+		roles: principal.roles,
+		memberships: principal.memberships,
+		authzVersion: principal.authzVersion,
+		issuedAt
+	});
+}
+/** `known` when it is a version, otherwise the source's answer. */
+function currentVersion(source, query, context, known) {
+	return known !== void 0 && Number.isSafeInteger(known) && known >= 0 ? known : source.version?.(query, context);
+}
+function threw(source, auth) {
+	auth.push({
+		reason: "source-threw",
+		source: "memberships",
+		...sourceName(source)
+	});
+}
+/**
+* `onStale: 'reread'`: a token behind the source's version has its memberships
+* (and global roles, with `readRoles`) read live; a version that cannot be read
+* keeps the claims and marks the subject stale.
+*/
+function rereadStale(source, principal, issuedAt, context, read, auth, readRoles, known) {
+	const claims = principal.memberships ?? [];
+	const claimed = principal.authzVersion;
+	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
+	const unknown = () => {
+		threw(source, auth);
+		return "unknown";
+	};
+	let freshness;
+	try {
+		const current = currentVersion(source, versionQuery(principal, issuedAt), context, known);
+		freshness = isThenable(current) ? Promise.resolve(current).then(judge, unknown) : judge(current);
+	} catch {
+		freshness = unknown();
+	}
+	const failed = () => {
+		threw(source, auth);
+		return [];
+	};
+	const rolesOf = (found) => {
+		if (found !== "reread" || readRoles === void 0) return;
+		try {
+			const roles = readRoles();
+			return isThenable(roles) ? Promise.resolve(roles).catch(failed) : roles;
+		} catch {
+			return failed();
+		}
+	};
+	if (isThenable(freshness)) {
+		const settled = freshness.then((found) => ({
+			found,
+			roles: rolesOf(found)
+		}));
+		return {
+			memberships: settled.then(({ found }) => found === "reread" ? read() : claims),
+			stale: settled.then(({ found }) => found === "unknown"),
+			roles: settled.then(({ roles }) => roles)
+		};
+	}
+	return compact({
+		memberships: freshness === "reread" ? read() : claims,
+		stale: freshness === "unknown",
+		roles: rolesOf(freshness)
+	});
+}
+/**
+* Whether the token's memberships are behind the source for `fresh`
+* permissions. Live memberships are never stale; token memberships are stale
+* unless a source reports a version the token's `authzVersion` has reached.
+*/
+function staleness(policy, principal, source, given, auth) {
+	if ((policy.fresh ?? []).length === 0 || principal === null || given.live) return false;
+	if (given.stale !== void 0) return given.stale;
+	const claimed = principal.authzVersion;
+	if (source?.version === void 0 || typeof claimed !== "number") return true;
+	const compare = (current) => current === void 0 || claimed < current;
+	try {
+		const current = currentVersion(source, versionQuery(principal, given.issuedAt), given.context, given.known);
+		return isThenable(current) ? Promise.resolve(current).then(compare, () => {
+			threw(source, auth);
+			return true;
+		}) : compare(current);
+	} catch {
+		threw(source, auth);
+		return true;
+	}
+}
+//#endregion
+//#region src/core/cached-instance.ts
+/** Options that shape an instance by value; the rest by identity. */
+const DATA_KEYS = /* @__PURE__ */ new Set([
+	"tenant",
+	"actor",
+	"delegation",
+	"session",
+	"expiresAt",
+	"context"
+]);
+function principalOf(policy, user) {
+	if (user === null || user === void 0) return null;
+	if (isSubject(user)) return user.principal === null ? null : compact({
+		principal: user.principal,
+		issuedAt: user.issuedAt
+	});
+	try {
+		const principal = policy.subject(user);
+		return principal === null ? null : { principal };
+	} catch {
+		return null;
+	}
+}
+function isVersion(value) {
+	return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+/**
+* The cache key of an instance, with the options to build it with: the version
+* read for the key is passed on as `version.known`, so the build reads none.
+* `undefined` when the subject or its version is unknown.
+*/
+async function cacheKey(policy, user, options) {
+	const resolved = principalOf(policy, user);
+	if (resolved === null) return;
+	const intent = options.intent ?? "write";
+	let version = options.version?.known;
+	if (!isVersion(version) && options.memberships !== void 0) try {
+		version = await asMembershipSource(options.memberships).version?.(versionQuery(resolved.principal, resolved.issuedAt), { intent });
+	} catch {
+		return;
+	}
+	if (!isVersion(version)) return;
+	const data = { intent };
+	const owners = [policy];
+	for (const name of Object.keys(options).toSorted()) {
+		const value = Reflect.get(options, name);
+		if (DATA_KEYS.has(name)) data[name] = value;
+		else if (name !== "version" && name !== "intent") owners.push(value);
+	}
+	return {
+		key: compact({
+			principal: resolved.principal.id,
+			version,
+			tenant: options.tenant,
+			intent,
+			parts: {
+				user,
+				data
+			}
+		}),
+		owners,
+		options: {
+			...options,
+			version: { known: version }
+		}
+	};
+}
+function cachedFactory(factory, instances) {
+	return (subject) => {
+		const source = factory(subject);
+		const principal = subject.principal?.id;
+		return source === void 0 || principal === void 0 ? source : instances.customRoles(source, {
+			owner: factory,
+			principal
+		});
+	};
+}
+function cachedSources(options, instances) {
+	const { customRoles, entitlements } = options;
+	return {
+		...options,
+		...customRoles === void 0 ? {} : { customRoles: typeof customRoles === "function" ? cachedFactory(customRoles, instances) : instances.customRoles(customRoles) },
+		...entitlements === void 0 ? {} : { entitlements: instances.entitlements(entitlements) }
+	};
+}
+/**
+* `create` through `instances`: a subject whose authorization version is known
+* gets the instance built for it at that version, with the cache's custom-role
+* and entitlement memos; a custom-role factory's answers are kept per factory
+* and principal. Any other subject gets a new one.
+*/
+async function cachedInstance(policy, user, options, instances, create) {
+	const cached = await cacheKey(policy, user, options);
+	if (cached === void 0) return create(options);
+	return instances.instance(cached.key, cached.owners, () => Promise.resolve(create(cachedSources(cached.options, instances))));
+}
+//#endregion
 //#region src/core/assert-decision.ts
 /**
 * `assert`'s outcome: the granted decision, or the error a refusal throws after
@@ -512,96 +703,6 @@ function buildInstance(policy, subject, envBase, team) {
 	return Object.freeze(instance);
 }
 //#endregion
-//#region src/core/freshness.ts
-function versionQuery(principal, issuedAt) {
-	return compact({
-		id: principal.id,
-		roles: principal.roles,
-		memberships: principal.memberships,
-		authzVersion: principal.authzVersion,
-		issuedAt
-	});
-}
-function threw(source, auth) {
-	auth.push({
-		reason: "source-threw",
-		source: "memberships",
-		...sourceName(source)
-	});
-}
-/**
-* `onStale: 'reread'`: a token behind the source's version has its memberships
-* (and global roles, with `readRoles`) read live; a version that cannot be read
-* keeps the claims and marks the subject stale.
-*/
-function rereadStale(source, principal, issuedAt, context, read, auth, readRoles) {
-	const claims = principal.memberships ?? [];
-	const claimed = principal.authzVersion;
-	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
-	const unknown = () => {
-		threw(source, auth);
-		return "unknown";
-	};
-	let freshness;
-	try {
-		const current = source.version?.(versionQuery(principal, issuedAt), context);
-		freshness = isThenable(current) ? Promise.resolve(current).then(judge, unknown) : judge(current);
-	} catch {
-		freshness = unknown();
-	}
-	const failed = () => {
-		threw(source, auth);
-		return [];
-	};
-	const rolesOf = (found) => {
-		if (found !== "reread" || readRoles === void 0) return;
-		try {
-			const roles = readRoles();
-			return isThenable(roles) ? Promise.resolve(roles).catch(failed) : roles;
-		} catch {
-			return failed();
-		}
-	};
-	if (isThenable(freshness)) {
-		const settled = freshness.then((found) => ({
-			found,
-			roles: rolesOf(found)
-		}));
-		return {
-			memberships: settled.then(({ found }) => found === "reread" ? read() : claims),
-			stale: settled.then(({ found }) => found === "unknown"),
-			roles: settled.then(({ roles }) => roles)
-		};
-	}
-	return compact({
-		memberships: freshness === "reread" ? read() : claims,
-		stale: freshness === "unknown",
-		roles: rolesOf(freshness)
-	});
-}
-/**
-* Whether the token's memberships are behind the source for `fresh`
-* permissions. Live memberships are never stale; token memberships are stale
-* unless a source reports a version the token's `authzVersion` has reached.
-*/
-function staleness(policy, principal, source, given, auth) {
-	if ((policy.fresh ?? []).length === 0 || principal === null || given.live) return false;
-	if (given.stale !== void 0) return given.stale;
-	const claimed = principal.authzVersion;
-	if (source?.version === void 0 || typeof claimed !== "number") return true;
-	const compare = (current) => current === void 0 || claimed < current;
-	try {
-		const current = source.version(versionQuery(principal, given.issuedAt), given.context);
-		return isThenable(current) ? Promise.resolve(current).then(compare, () => {
-			threw(source, auth);
-			return true;
-		}) : compare(current);
-	} catch {
-		threw(source, auth);
-		return true;
-	}
-}
-//#endregion
 //#region src/core/oauth-scopes.ts
 /**
 * Every OAuth scope a token may carry to the permission keys it reaches: each
@@ -763,7 +864,7 @@ function assemblePrincipal(policy, user, options, auth, memo) {
 		}, () => read(source, principal), auth, source.globalRolesFor === void 0 ? void 0 : () => source.globalRolesFor?.(compact({
 			id: principal.id,
 			kind: principal.kind
-		}), { memo }) ?? []);
+		}), { memo }) ?? [], options.version?.known);
 		memberships = reread.memberships;
 		stale = reread.stale;
 		roles = reread.roles;
@@ -942,7 +1043,8 @@ function resolveAssembled(policy, assembled, options, auth, memo) {
 		context: {
 			memo,
 			intent: options.intent ?? "write"
-		}
+		},
+		known: options.version?.known
 	}, auth);
 	const withPlans = (resolved) => entitlementsOf(assembled, activeTenantOf(policy, assembled, applyRoleKinds(policy, assembled.principal?.roles, normalizeMemberships(resolved, scopeList(policy.scopes))).memberships, options), options, auth);
 	if (isThenable(assembled.context) || isThenable(memberships) || isThenable(stale)) return Promise.all([
@@ -1050,7 +1152,8 @@ function getPermDockSync(policy, user, options = {}) {
 * `getPermDockSync` is the synchronous twin.
 */
 function getPermDock(policy, user, options = {}) {
-	return Promise.resolve().then(() => create(policy, user, options));
+	const { instances, ...rest } = options;
+	return Promise.resolve().then(() => instances === void 0 ? create(policy, user, rest) : cachedInstance(policy, user, rest, instances, (cached) => create(policy, user, cached)));
 }
 //#endregion
 export { delegatedScopeMap as a, APP as c, challengeScope as i, withApp as l, getPermDockSync as n, hasScope as o, resolveSubject as r, scopesReaching as s, getPermDock as t };