permdock 0.3.0 → 0.4.0

package/dist/hosted-DJQw46hn.js

@@ -1,266 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { T as isForbiddenKey, c as getResource, g as isSelfParented, i as findPermission, k as splitPath } from "./permissions-DVoF6dMt.js";
-import { c as indexPolicy, i as declaredRoleNames, m as role, o as deny, r as completeGrant, t as allow, v as normalizeWhere } from "./policy-xyWg7QdR.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { S as findRole, T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-//#region src/core/hosted.ts
-function memoryPolicySource(document = null) {
-	const current = document === null ? null : parsePolicyDocument(document);
-	return Object.freeze({
-		current: () => current,
-		refresh: () => Promise.resolve()
-	});
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function rejectUnsafe(value) {
-	if (value === null || typeof value !== "object") return;
-	if (Array.isArray(value)) {
-		for (const item of value) rejectUnsafe(item);
-		return;
-	}
-	for (const key of Object.keys(value)) {
-		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
-		rejectUnsafe(value[key]);
-	}
-}
-/** Validates the document envelope; per-grant checks happen at merge time. */
-function parsePolicyDocument(json) {
-	const input = typeof json === "string" ? JSON.parse(json) : json;
-	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
-	const copy = JSON.parse(JSON.stringify(input));
-	rejectUnsafe(copy);
-	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
-	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
-	return freezeDeep(copy);
-}
-const COMPARISONS = /* @__PURE__ */ new Set([
-	"eq",
-	"ne",
-	"gt",
-	"gte",
-	"lt",
-	"lte",
-	"contains"
-]);
-function safePath(path) {
-	if (typeof path !== "string" || path.length === 0) return false;
-	return splitPath(path).every((segment) => !isForbiddenKey(segment));
-}
-function portableValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
-	if (Array.isArray(value)) return value.every(portableValue);
-	if (!isRecord(value)) return false;
-	const keys = Object.keys(value);
-	if (keys.length !== 1) return false;
-	if (keys[0] === "ref") return safePath(value["ref"]);
-	return keys[0] === "date" && typeof value["date"] === "string";
-}
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
-function isPortableCondition(value) {
-	if (!isRecord(value) || typeof value["op"] !== "string") return false;
-	const op = value["op"];
-	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
-	switch (op) {
-		case "in":
-		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
-		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
-		case "and":
-		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
-		case "not": return isPortableCondition(value["condition"]);
-		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
-		default: return false;
-	}
-}
-function approvalRank(approval) {
-	if (approval === void 0) return;
-	if (approval === "human") return {
-		distinct: true,
-		stale: false,
-		quorum: 1,
-		ttl: Number.POSITIVE_INFINITY,
-		escalates: false
-	};
-	return {
-		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
-		distinct: approval.distinct !== false,
-		stale: approval.staleOn === "resource-change",
-		quorum: approval.quorum ?? 1,
-		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
-		escalates: approval.escalation !== void 0
-	};
-}
-/** A hosted approval must meet every approval a code allow requires on the permission. */
-function approvalAtLeast(hosted, code) {
-	const mine = approvalRank(hosted);
-	for (const required of code) {
-		const theirs = approvalRank(required);
-		if (theirs === void 0) continue;
-		if (mine === void 0) return false;
-		if (theirs.distinct && !mine.distinct) return false;
-		if (theirs.stale && !mine.stale) return false;
-		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
-		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
-		if (mine.escalates && !theirs.escalates) return false;
-	}
-	return true;
-}
-/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
-function undeclaredKind(_grantee) {
-	return false;
-}
-function declaredGrantee(policy, grantee, permissionResource) {
-	switch (grantee.kind) {
-		case "role": return declaredRoleNames(policy).has(grantee.role);
-		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
-		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
-		case "anyone":
-		case "authenticated":
-		case "actor":
-		case "assurance":
-		case "inherit": return false;
-		default: return undeclaredKind(grantee);
-	}
-}
-/** Approvers are declared roles, plans or relations, or any authenticated human. */
-function approvalAcceptable(policy, approval, permissionResource) {
-	if (approval === void 0 || approval === "human") return true;
-	if (!isRecord(approval)) return false;
-	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
-	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
-	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
-	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
-	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
-	const escalation = approval["escalation"];
-	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
-	if (approval["by"] === void 0) return true;
-	return granteesAcceptable(policy, approval["by"], permissionResource);
-}
-function granteesAcceptable(policy, raw, permissionResource) {
-	if (raw === void 0) return false;
-	const items = flattenGrantee(raw);
-	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
-}
-function buildGrant(policy, document, raw) {
-	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
-		ok: false,
-		reason: "invalid"
-	};
-	const permission = findPermission(policy.permissions, raw["permission"]);
-	if (permission === void 0) return {
-		ok: false,
-		reason: "unknown-permission"
-	};
-	if (!policy.hostable.includes(permission.key)) return {
-		ok: false,
-		reason: "not-hostable"
-	};
-	const to = flattenGrantee(raw["to"]);
-	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
-		ok: false,
-		reason: "unknown-grantee"
-	};
-	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
-		ok: false,
-		reason: "non-portable"
-	};
-	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
-		ok: false,
-		reason: "invalid"
-	};
-	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
-		ok: false,
-		reason: "invalid"
-	};
-	const effect = raw["effect"] ?? "allow";
-	const options = compact({
-		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
-		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
-		approval: raw["approval"],
-		fields: raw["fields"]
-	});
-	let built;
-	try {
-		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
-		if (roleItem === null) {
-			const partial = (effect === "allow" ? allow : deny)(permission, {
-				...options,
-				to
-			});
-			built = completeGrant(partial);
-		} else {
-			const binding = policy.rolesByName.get(roleItem.role);
-			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
-			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
-			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
-			built = first;
-		}
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid"
-		};
-	}
-	if (effect === "allow") {
-		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
-		if (!approvalAtLeast(built.approval, codeApprovals)) return {
-			ok: false,
-			reason: "weaker-approval"
-		};
-	}
-	return {
-		ok: true,
-		grant: freezeDeep({
-			...built,
-			hosted: {
-				document: document.fingerprint,
-				grant: raw["id"]
-			}
-		})
-	};
-}
-/**
-* The code policy plus the hosted grants that pass every rule. Hosted
-* allows OR with code allows and any deny still wins, so a hosted grant can
-* never override a code deny; one that fails a rule is dropped, not thrown.
-*/
-function mergeHostedGrants(policy, document) {
-	if (document === null || document.grants.length === 0) return {
-		policy,
-		dropped: []
-	};
-	const merged = [];
-	const dropped = [];
-	for (const raw of document.grants) {
-		const result = buildGrant(policy, document, raw);
-		if (result.ok) {
-			merged.push(result.grant);
-			continue;
-		}
-		dropped.push(freezeDeep({
-			kind: "hosted-grant-dropped",
-			document: document.fingerprint,
-			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
-			reason: result.reason
-		}));
-	}
-	if (merged.length === 0) return {
-		policy,
-		dropped
-	};
-	const grants = [...policy.grants, ...merged];
-	return {
-		policy: freezeDeep({
-			...policy,
-			grants,
-			index: indexPolicy(policy.roles, grants, policy.vocabulary),
-			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
-		}),
-		dropped
-	};
-}
-//#endregion
-export { parsePolicyDocument as i, memoryPolicySource as n, mergeHostedGrants as r, isPortableCondition as t };

package/dist/instance-options-Dhhcnm3y.js

@@ -1,22 +0,0 @@
-//#region src/core/instance-options.ts
-const INSTANCE_KEYS = {
-	memberships: true,
-	relations: true,
-	entitlements: true,
-	customRoles: true,
-	policies: true,
-	approvalPolicies: true,
-	sink: true,
-	limits: true
-};
-/** The `InstanceOptions` set on `options`, without the adapter's own keys. */
-function instanceOptions(options) {
-	const picked = {};
-	for (const key of Object.keys(INSTANCE_KEYS)) {
-		const name = key;
-		if (options[name] !== void 0) picked[name] = options[name];
-	}
-	return picked;
-}
-//#endregion
-export { instanceOptions as t };

package/dist/load-DwJUafYN.js

@@ -1,2 +0,0 @@
-import { a as loadModule, o as pickNamed } from "./load-DhWEB9P1.js";
-export { loadModule, pickNamed };

package/dist/map-AcxK9o_D.js

@@ -1,147 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as itemResourceData } from "./evaluation-items-CfCCejQd.js";
-//#region src/authzen/map.ts
-const UNKNOWN = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "no-grant",
-		detail: "unknown-permission"
-	}],
-	alternatives: []
-};
-const UNAVAILABLE = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "no-grant",
-		detail: "resource-unavailable"
-	}],
-	alternatives: []
-};
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function actionNameOf(item) {
-	if (typeof item.action?.name === "string") return item.action.name;
-	if (!isRecord(item.action?.properties)) return;
-	const scope = item.action.properties["scope"];
-	return typeof scope === "string" ? scope : void 0;
-}
-function permissionOf(lookup, item) {
-	return lookup(actionNameOf(item), item.resource);
-}
-function resourceData(item) {
-	return itemResourceData(item.resource);
-}
-function resourceIdOf(item) {
-	const id = item.resource?.id;
-	if (typeof id === "string" || typeof id === "number") return String(id);
-}
-function userFromEntity(entity) {
-	if (entity === void 0) return null;
-	const result = {};
-	if (typeof entity.id === "string" || typeof entity.id === "number") result["id"] = String(entity.id);
-	if (isRecord(entity.properties)) for (const [key, value] of Object.entries(entity.properties)) {
-		if (key === "actor" || key === "delegation") continue;
-		result[key] = value;
-	}
-	return Object.keys(result).length === 0 ? null : result;
-}
-function actorOf(item) {
-	const context = isRecord(item.context) ? item.context : {};
-	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["actor"] : void 0;
-	const raw = context["actor"] ?? fromSubject;
-	if (!isRecord(raw) || typeof raw["id"] !== "string") return;
-	const kind = typeof raw["kind"] === "string" ? raw["kind"] : "oauth-client";
-	return {
-		id: raw["id"],
-		kind
-	};
-}
-function delegationOf(item) {
-	const context = isRecord(item.context) ? item.context : {};
-	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["delegation"] : void 0;
-	const raw = context["delegation"] ?? fromSubject;
-	if (!isRecord(raw)) return;
-	const scopes = raw["scopes"];
-	const authorizationDetails = raw["authorizationDetails"];
-	return compact({
-		scopes: Array.isArray(scopes) ? scopes.filter((scope) => typeof scope === "string") : void 0,
-		authorizationDetails: Array.isArray(authorizationDetails) ? authorizationDetails : void 0
-	});
-}
-function tenantOf(item) {
-	if (!isRecord(item.context) || typeof item.context["tenant"] !== "string") return;
-	return item.context["tenant"];
-}
-function permdockContext(decision) {
-	switch (decision.outcome) {
-		case "granted": return { outcome: "granted" };
-		case "denied": {
-			const unknown = decision.denials.some((denial) => denial.detail === "unknown-permission");
-			return compact({
-				outcome: "denied",
-				denials: decision.denials.map((denial) => ({
-					role: denial.role,
-					reason: denial.reason
-				})),
-				reason: unknown ? "unknown-permission" : void 0
-			});
-		}
-		case "approval-required": return {
-			outcome: "approval-required",
-			token: decision.token
-		};
-		default: return decision;
-	}
-}
-function evaluationContext(decision) {
-	return { permdock: permdockContext(decision) };
-}
-function evaluationRow(decision) {
-	return {
-		decision: decision.outcome === "granted",
-		context: evaluationContext(decision)
-	};
-}
-function pathnameOf(request) {
-	return new URL(request.url).pathname;
-}
-function endsWithPath(pathname, suffix) {
-	return pathname === suffix || pathname.endsWith(suffix);
-}
-function mergeItem(shared, item) {
-	if (!isRecord(item)) return shared;
-	return compact({
-		subject: isRecord(item["subject"]) ? item["subject"] : shared.subject,
-		action: isRecord(item["action"]) ? item["action"] : shared.action,
-		resource: isRecord(item["resource"]) ? item["resource"] : shared.resource,
-		context: item["context"] ?? shared.context
-	});
-}
-function pageOf(body) {
-	const page = isRecord(body["page"]) ? body["page"] : {};
-	const raw = typeof page["token"] === "string" ? page["token"] : typeof page["next_token"] === "string" ? page["next_token"] : "0";
-	const parsed = Math.trunc(Number(raw));
-	const sizeRaw = page["limit"] ?? page["size"];
-	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : 50;
-	return {
-		offset: Number.isFinite(parsed) && parsed > 0 ? parsed : 0,
-		size
-	};
-}
-function paged(items, offset, size) {
-	const slice = items.slice(offset, offset + size);
-	const next = offset + slice.length;
-	return {
-		results: slice,
-		page: {
-			next_token: next < items.length ? String(next) : "",
-			count: slice.length,
-			total: items.length
-		}
-	};
-}
-//#endregion
-export { endsWithPath as a, mergeItem as c, pathnameOf as d, permissionOf as f, userFromEntity as g, tenantOf as h, delegationOf as i, pageOf as l, resourceIdOf as m, UNKNOWN as n, evaluationRow as o, resourceData as p, actorOf as r, isRecord as s, UNAVAILABLE as t, paged as u };