permdock 0.3.0 → 0.4.0

package/dist/protected-xAr24FEC.d.ts

@@ -1,40 +0,0 @@
-import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { s as PermissionState } from "./types-CKNSyIf_.js";
-import { t as ClientStore } from "./store-jOBYpiXC.js";
-import { Snippet } from "svelte";
-//#region src/svelte/boundary.d.ts
-type PermissionBoundaryProps = {
-  readonly children?: Snippet;
-  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
-  readonly denied?: Snippet<[PermissionBoundaryState]>;
-  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
-  readonly approval?: Snippet<[PermissionBoundaryState]>;
-};
-//#endregion
-//#region src/client/views.d.ts
-/** What `Protected` renders: `pending` while an endpoint answer is in flight, `fallback` unless granted. */
-type ProtectedView = (PermissionState & {
-  readonly slot: "pending" | "fallback";
-}) | {
-  readonly allowed: true;
-  readonly status: PermissionState["status"];
-  readonly decision: GrantedDecision;
-  readonly slot: "default";
-};
-//#endregion
-//#region src/svelte/protected.d.ts
-type ProtectedProps = {
-  readonly permission: Permission;
-  readonly data?: unknown;
-  readonly tenant?: string;
-  readonly children?: Snippet<[Decision]>;
-  readonly pending?: Snippet;
-  readonly fallback?: Snippet<[Decision]>;
-};
-/** The instance for `tenant`, built once per store change rather than once per check. */
-declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
-declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
-//#endregion
-export { PermissionBoundaryProps as i, scopedFor as n, viewFor as r, ProtectedProps as t };

package/dist/relations-cjOL01hZ.js

@@ -1,505 +0,0 @@
-import { C as restrictedStops, E as ownGet, d as isEdgeRelation, l as groupEntries, m as isPrincipalRelation, r as expandRelation, s as getRegistry, u as isComputedRelation } from "./permissions-DVoF6dMt.js";
-import { t as idText } from "./ids-DC4V4CFu.js";
-import { n as isThenable } from "./thenable-okc2xDsj.js";
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isInstant(value) {
-	return value === void 0 || typeof value === "number" && Number.isFinite(value);
-}
-function asChain(value) {
-	if (!isRecord(value) || !Array.isArray(value["ancestors"])) return;
-	const ancestors = [];
-	for (const item of value["ancestors"]) {
-		if (!isRecord(item) || typeof item["id"] !== "string" || item["id"] === "") return;
-		ancestors.push(item["restricted"] === true ? {
-			id: item["id"],
-			restricted: true
-		} : { id: item["id"] });
-	}
-	return {
-		ancestors,
-		...value["restricted"] === true ? { restricted: true } : {},
-		...value["truncated"] === true ? { truncated: true } : {}
-	};
-}
-function asRow(value) {
-	if (value === null || value === void 0) return { row: null };
-	return isRecord(value) ? { row: value } : void 0;
-}
-function asGroup(value) {
-	if (!isRecord(value) || typeof value["resource"] !== "string" || typeof value["id"] !== "string" || typeof value["relation"] !== "string" || value["id"] === "") return;
-	return {
-		resource: value["resource"],
-		id: value["id"],
-		relation: value["relation"]
-	};
-}
-function asHolders(value) {
-	if (!Array.isArray(value)) return;
-	const holders = [];
-	for (const item of value) {
-		if (!isRecord(item) || !isInstant(item["startsAt"]) || !isInstant(item["expiresAt"])) return;
-		const period = {
-			...item["startsAt"] === void 0 ? {} : { startsAt: item["startsAt"] },
-			...item["expiresAt"] === void 0 ? {} : { expiresAt: item["expiresAt"] }
-		};
-		if (isRecord(item["principal"]) && typeof item["principal"]["id"] === "string") {
-			holders.push({
-				principal: { id: item["principal"]["id"] },
-				...period
-			});
-			continue;
-		}
-		const group = asGroup(item["group"]);
-		if (group === void 0) return;
-		holders.push({
-			group,
-			...period
-		});
-	}
-	return holders;
-}
-function read(cache, key, call, validate) {
-	const entry = cache.get(key);
-	if (entry !== void 0) return entry.state === "ready" ? entry.value : entry.state;
-	if (call === void 0) return "failed";
-	const settle = (value) => {
-		const valid = validate(value);
-		cache.set(key, valid === void 0 ? { state: "failed" } : {
-			state: "ready",
-			value: valid
-		});
-	};
-	let result;
-	try {
-		result = call();
-	} catch {
-		cache.set(key, { state: "failed" });
-		return "failed";
-	}
-	if (isThenable(result)) {
-		const promise = Promise.resolve(result).then(settle, () => {
-			cache.set(key, { state: "failed" });
-		});
-		cache.set(key, {
-			state: "pending",
-			promise
-		});
-		return "pending";
-	}
-	settle(result);
-	const settled = cache.get(key);
-	return settled?.state === "ready" ? settled.value : "failed";
-}
-function relationReader(source, cache, resources) {
-	const concrete = (resource, id, relation) => read(cache, JSON.stringify([
-		"holders",
-		resource,
-		id,
-		relation
-	]), source === void 0 ? void 0 : () => source.related({
-		resource,
-		id,
-		relation
-	}), asHolders);
-	return {
-		available: source !== void 0,
-		row(query) {
-			const load = source?.row?.bind(source);
-			return read(cache, JSON.stringify([
-				"row",
-				query.resource,
-				query.id
-			]), load === void 0 ? void 0 : () => load({
-				resource: query.resource,
-				id: query.id
-			}), asRow);
-		},
-		chain(query) {
-			const through = query.through ?? "parent";
-			return read(cache, JSON.stringify([
-				"chain",
-				query.resource,
-				query.id,
-				query.depth,
-				through
-			]), source === void 0 ? void 0 : () => source.ancestors({
-				resource: query.resource,
-				id: query.id,
-				depth: query.depth,
-				through
-			}), asChain);
-		},
-		holders(query) {
-			const node = resources?.get(query.resource);
-			const names = node === void 0 ? [query.relation] : expandRelation(node, query.relation);
-			const out = [];
-			let unread;
-			for (const name of names) {
-				const answer = concrete(query.resource, query.id, name);
-				if (answer === "pending" || answer === "failed") {
-					unread = answer === "failed" || unread === "failed" ? "failed" : "pending";
-					continue;
-				}
-				for (const holder of answer) out.push({
-					...holder,
-					relation: name
-				});
-			}
-			return unread ?? out;
-		}
-	};
-}
-/** The loads still in flight, for an instance that awaits them before deciding. */
-function pendingRelations(cache) {
-	const out = [];
-	for (const entry of cache.values()) if (entry.state === "pending") out.push(entry.promise);
-	return out;
-}
-function relationId(value) {
-	return idText(value);
-}
-/** Whether the holder's period covers `now`. */
-function activeNow(holder, now) {
-	return (holder.startsAt === void 0 || holder.startsAt <= now) && (holder.expiresAt === void 0 || holder.expiresAt > now);
-}
-function holdsNow(holder, principalId, now) {
-	return "principal" in holder && holder.principal.id === principalId && activeNow(holder, now);
-}
-/** Where the walk starts after following `hops`, or why it cannot. */
-function followHops(condition, first, reader) {
-	const hops = condition.hops ?? [];
-	let id = first;
-	for (let index = 1; index < hops.length; index += 1) {
-		const from = hops[index - 1];
-		const hop = hops[index];
-		if (from === void 0 || hop === void 0)
- /* v8 ignore next */
-		return;
-		const chain = reader.chain({
-			resource: from.resource,
-			id,
-			depth: 1,
-			through: hop.link
-		});
-		if (chain === "pending" || chain === "failed") return "relation-unavailable";
-		const next = chain.ancestors[0]?.id;
-		if (next === void 0) return;
-		id = next;
-	}
-	return { id };
-}
-function restrictedAbove(condition, row, reader) {
-	const above = condition.restrictedAncestors;
-	if (above === void 0) return false;
-	const parent = relationId(ownGet(row, above.parent));
-	if (parent === void 0) return false;
-	const chain = reader.chain({
-		resource: above.resource,
-		id: parent,
-		depth: above.depth - 1
-	});
-	if (chain === "pending" || chain === "failed") return "relation-unavailable";
-	if (chain.restricted === true || chain.ancestors.some((ancestor) => ancestor.restricted === true)) return;
-	const own = relationId(ownGet(row, above.id));
-	const ids = [
-		...own === void 0 ? [] : [own],
-		parent,
-		...chain.ancestors.map((ancestor) => ancestor.id)
-	];
-	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
-	return false;
-}
-/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
-function relationWalk(condition, row, reader) {
-	if (!isRecord(row)) return;
-	const first = relationId(ownGet(row, condition.field));
-	if (first === void 0) return;
-	const rowRestricted = condition.restricted !== void 0 && ownGet(row, condition.restricted) === true;
-	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
-	if ((condition.parent === true || hopped) && rowRestricted) return;
-	const above = restrictedAbove(condition, row, reader);
-	if (above !== false) return above;
-	const start = hopped ? followHops(condition, first, reader) : { id: first };
-	if (start === void 0 || start === "relation-unavailable") return start;
-	const id = start.id;
-	if (condition.depth === 0 || rowRestricted) return {
-		ids: [id],
-		truncated: false
-	};
-	const chain = reader.chain({
-		resource: condition.resource,
-		id,
-		depth: condition.depth
-	});
-	if (chain === "pending" || chain === "failed") return "relation-unavailable";
-	const ids = [id];
-	const stops = condition.passRestricted !== true;
-	let stopped = stops && chain.restricted === true;
-	if (!stopped) for (const ancestor of chain.ancestors.slice(0, condition.depth)) {
-		ids.push(ancestor.id);
-		if (stops && ancestor.restricted === true) {
-			stopped = true;
-			break;
-		}
-	}
-	if (new Set(ids).size !== ids.length) return "relation-depth";
-	return {
-		ids,
-		truncated: !stopped && (chain.ancestors.length > condition.depth || chain.truncated === true)
-	};
-}
-/**
-* Whether the subject holds the relation on the row's instance or an
-* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
-* goes on past `depth` with no holder below it. Any read the instance could
-* not answer is `relation-unavailable` unless a holder was found elsewhere.
-*/
-function resolveRelated(condition, row, subject, now, reader, permitted) {
-	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
-	const principal = subject.principal;
-	if (principal === null) return false;
-	const walk = relationWalk(condition, row, reader);
-	if (walk === void 0) return false;
-	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
-	if (condition.ids !== void 0) {
-		const held = new Set(condition.ids);
-		if (walk.ids.some((id) => held.has(id))) return true;
-		return walk.truncated ? "relation-depth" : false;
-	}
-	let unavailable = false;
-	let deep = false;
-	const explored = /* @__PURE__ */ new Map();
-	for (const id of walk.ids) {
-		const verdict = holdsRelation({
-			resource: condition.resource,
-			id,
-			relation: condition.relation
-		}, principal.id, now, reader, 16, /* @__PURE__ */ new Set(), explored);
-		if (verdict === true) return true;
-		if (verdict === "relation-unavailable") unavailable = true;
-		else if (verdict === "relation-depth") deep = true;
-	}
-	if (unavailable) return "relation-unavailable";
-	return walk.truncated || deep ? "relation-depth" : false;
-}
-function resolveInherited(condition, permission, row, reader, permitted) {
-	const walk = relationWalk(condition, row, reader);
-	if (walk === void 0) return false;
-	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
-	if (permitted === void 0) return "relation-unavailable";
-	let unknown = false;
-	for (const id of walk.ids) {
-		const verdict = permitted(condition.resource, id, permission);
-		if (verdict === true) return true;
-		if (verdict !== false && unknown === false) unknown = verdict;
-	}
-	return unknown;
-}
-function groupKey(group) {
-	return JSON.stringify([
-		group.resource,
-		group.id,
-		group.relation
-	]);
-}
-/**
-* Whether the principal holds `at.relation` on one instance, directly or
-* through a group whose members hold it. Groups of `at`'s own resource nest
-* at most `budget` deep; a group of another resource gets a fresh budget
-* (declarations rule out cycles across resources). A group met twice on one
-* path, or one past the budget, is `relation-depth`. `explored` holds the
-* budget each group was walked with across the whole walk: a group already
-* walked with as much budget adds nothing, since its verdict already reached
-* the caller, so shared sub-groups cost one walk rather than one per path.
-*/
-function holdsRelation(at, principalId, now, reader, budget, seen, explored) {
-	const key = groupKey(at);
-	const walked = explored.get(key);
-	if (walked !== void 0 && walked >= budget) return false;
-	explored.set(key, budget);
-	const holders = reader.holders(at);
-	if (holders === "pending" || holders === "failed") return "relation-unavailable";
-	if (holders.some((holder) => holdsNow(holder, principalId, now))) return true;
-	const path = new Set(seen).add(key);
-	let unavailable = false;
-	let deep = false;
-	for (const holder of holders) {
-		if (!("group" in holder) || !activeNow(holder, now)) continue;
-		const nested = holder.group.resource === at.resource;
-		if (nested && budget <= 0 || path.has(groupKey(holder.group))) {
-			deep = true;
-			continue;
-		}
-		const verdict = holdsRelation(holder.group, principalId, now, reader, nested ? budget - 1 : 16, path, explored);
-		if (verdict === true) return true;
-		if (verdict === "relation-unavailable") unavailable = true;
-		else if (verdict === "relation-depth") deep = true;
-	}
-	if (unavailable) return "relation-unavailable";
-	return deep ? "relation-depth" : false;
-}
-/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
-function tableHolders(resourceName, spec, row, id) {
-	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
-	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
-	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
-	const period = expiresAt === void 0 ? {} : { expiresAt };
-	const groups = spec.groups;
-	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
-	if (groups === void 0) return direct === void 0 ? [] : [{
-		principal: { id: direct },
-		...period
-	}];
-	if (groups.column === void 0) {
-		const out = direct === void 0 ? [] : [{
-			principal: { id: direct },
-			...period
-		}];
-		for (const group of groupEntries(spec)) {
-			const groupId = relationId(ownGet(row, group.subject));
-			if (groupId !== void 0) out.push({
-				group: {
-					resource: group.resource,
-					id: groupId,
-					relation: group.relation
-				},
-				...period
-			});
-		}
-		return out;
-	}
-	const kind = ownGet(row, groups.column);
-	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
-		principal: { id: direct },
-		...period
-	}];
-	const group = groupEntries(spec).find((entry) => entry.resource === kind);
-	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
-	return group === void 0 || groupId === void 0 ? [] : [{
-		group: {
-			resource: group.resource,
-			id: groupId,
-			relation: group.relation
-		},
-		...period
-	}];
-}
-function seconds(value) {
-	if (value instanceof Date) {
-		const time = value.getTime();
-		return Number.isNaN(time) ? void 0 : time / 1e3;
-	}
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	if (typeof value === "string") {
-		const parsed = Date.parse(value);
-		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
-	}
-}
-function restrictedOf(node, row) {
-	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
-}
-function edgeHolder(edge) {
-	const holder = { principal: { id: edge.principal } };
-	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
-	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
-	return holder;
-}
-/**
-* An in-process `RelationSource` over plain rows and edges, read against the
-* resource definitions in `permissions`. For tests, fixtures and small apps.
-*/
-function memoryRelations(permissions, data = {}) {
-	const registry = getRegistry(permissions);
-	const byId = /* @__PURE__ */ new Map();
-	for (const [name, rows] of Object.entries(data.rows ?? {})) {
-		const node = registry.get(name);
-		const index = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			const id = relationId(ownGet(row, node?.id ?? "id"));
-			if (id !== void 0) index.set(id, row);
-		}
-		byId.set(name, index);
-	}
-	const rowOf = (resource, id) => byId.get(resource)?.get(id);
-	return {
-		row({ resource, id }) {
-			return rowOf(resource, id) ?? null;
-		},
-		ancestors({ resource, id, depth, through }) {
-			const node = registry.get(resource);
-			const start = rowOf(resource, id);
-			if (node === void 0 || start === void 0) return { ancestors: [] };
-			if (through !== "parent") {
-				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
-				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
-				if (next === void 0 || depth < 1) return { ancestors: [] };
-				return { ancestors: [{ id: next }] };
-			}
-			const restricted = restrictedOf(node, start);
-			const stops = restrictedStops(node, "parent");
-			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
-				restricted: true,
-				ancestors: []
-			} : { ancestors: [] };
-			const field = node.parent.field;
-			const seen = /* @__PURE__ */ new Set([id]);
-			const ancestors = [];
-			let next = relationId(ownGet(start, field));
-			while (next !== void 0 && ancestors.length < depth) {
-				const row = rowOf(resource, next);
-				if (row === void 0) {
-					next = void 0;
-					break;
-				}
-				const hidden = restrictedOf(node, row);
-				ancestors.push(hidden ? {
-					id: next,
-					restricted: true
-				} : { id: next });
-				if (seen.has(next) || hidden && stops) {
-					next = void 0;
-					break;
-				}
-				seen.add(next);
-				next = relationId(ownGet(row, field));
-			}
-			const chain = restricted ? {
-				restricted: true,
-				ancestors
-			} : { ancestors };
-			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
-				...chain,
-				truncated: true
-			};
-		},
-		related({ resource, id, relation }) {
-			const spec = registry.get(resource)?.relations[relation];
-			if (spec === void 0 || isComputedRelation(spec)) return [];
-			if (isEdgeRelation(spec)) {
-				const table = data.tables?.[spec.edge];
-				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
-				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
-			}
-			const row = rowOf(resource, id);
-			if (row === void 0) return [];
-			if (isPrincipalRelation(spec)) {
-				const holder = relationId(ownGet(row, spec.principal));
-				if (holder === void 0) return [];
-				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
-				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
-				return [{
-					principal: { id: holder },
-					...startsAt === void 0 ? {} : { startsAt },
-					...expiresAt === void 0 ? {} : { expiresAt }
-				}];
-			}
-			if (spec.memberOf !== void 0) return [];
-			const holder = relationId(ownGet(row, spec.field));
-			return holder === void 0 ? [] : [{ principal: { id: holder } }];
-		}
-	};
-}
-//#endregion
-export { relationWalk as a, relationReader as i, pendingRelations as n, resolveRelated as o, relationId as r, memoryRelations as t };