permdock 0.3.1 → 0.4.0

package/dist/grantee-match-fxYp9Nmt.js

@@ -0,0 +1,141 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { d as scopeList, t as activeFor } from "./scopes-tvpa34ep.js";
+import { o as flattenGrantee } from "./grantee-CXY-0C87.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
+//#region src/core/grantee-match.ts
+function combineWhere(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	return {
+		op: "and",
+		conditions: [left, right]
+	};
+}
+/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
+function seatsInTenant(subject, scopes) {
+	const principal = subject.principal;
+	if (principal === null) return [];
+	const list = scopeList(scopes);
+	return (principal.memberships ?? []).flatMap((membership) => membership.entitlements !== void 0 && activeFor(membership, list, principal.tenant) ? membership.entitlements : []);
+}
+function matchOne(grantee, subject, now, resource, scopes, resources) {
+	switch (grantee.kind) {
+		case "anyone": return { matched: true };
+		case "authenticated": return subject.principal === null ? {
+			matched: false,
+			reason: "anonymous"
+		} : { matched: true };
+		case "plan":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return (subject.principal.plans ?? []).includes(grantee.plan) || seatsInTenant(subject, scopes).includes(grantee.plan) ? { matched: true } : {
+				matched: false,
+				reason: "not-entitled"
+			};
+		case "actor":
+			if (subject.actor === void 0) return {
+				matched: false,
+				reason: "no-grant"
+			};
+			return subject.actor.kind === grantee.actor ? { matched: true } : {
+				matched: false,
+				reason: "no-grant"
+			};
+		case "assurance": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const principalAssurance = subject.principal.assurance;
+			if (grantee.acr !== void 0 && grantee.acr.length > 0) {
+				const acr = principalAssurance?.acr;
+				if (acr === void 0 || !grantee.acr.includes(acr)) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.amr !== void 0 && grantee.amr.length > 0) {
+				const amr = principalAssurance?.amr ?? [];
+				if (!grantee.amr.every((method) => amr.includes(method))) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.maxAge !== void 0) {
+				const authTime = principalAssurance?.authTime;
+				if (authTime === void 0 || now - authTime > grantee.maxAge) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			return { matched: true };
+		}
+		case "relation": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const where = relationCondition(grantee, resource, scopes, {
+				resources,
+				now: { date: (/* @__PURE__ */ new Date(now * 1e3)).toISOString() }
+			});
+			if (where === void 0 && resource !== void 0) return {
+				matched: false,
+				reason: "condition"
+			};
+			return compact({
+				matched: true,
+				where
+			});
+		}
+		case "inherit": {
+			const where = inheritCondition(grantee, resource, resources);
+			return where === void 0 ? {
+				matched: false,
+				reason: "condition"
+			} : {
+				matched: true,
+				where
+			};
+		}
+		case "role":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return { matched: true };
+		default: return unknownGrantee(grantee);
+	}
+}
+/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
+function unknownGrantee(_grantee) {
+	return {
+		matched: false,
+		reason: "no-grant",
+		unknown: true
+	};
+}
+function matchGrantee(to, subject, now, resource, scopes, resources, unknownMatches = false) {
+	const items = flattenGrantee(to);
+	if (items.length === 0) return {
+		matched: false,
+		reason: "no-grant"
+	};
+	let where;
+	for (const item of items) {
+		const result = matchOne(item, subject, now, resource, scopes, resources);
+		if (!result.matched) {
+			if (unknownMatches && result.unknown === true) continue;
+			return result;
+		}
+		where = combineWhere(where, result.where);
+	}
+	return compact({
+		matched: true,
+		where
+	});
+}
+//#endregion
+export { matchGrantee as n, combineWhere as t };

package/dist/{helpers-H_KARDVC.js → helpers-C9YmyBIa.js}

@@ -1,12 +1,13 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as findPermission, s as getRegistry } from "./permissions-DVoF6dMt.js";
-import { r as approverLeaves } from "./approvers-DT4AVyIg.js";
-import { t as describe } from "./describe-B_gVZEVi.js";
+import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
+import { t as describe } from "./describe-Cgkp7eP0.js";
 import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { i as relationReader, n as pendingRelations, o as resolveRelated } from "./relations-cjOL01hZ.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-BsblpB-z.js";
+import { r as relationReader, t as pendingRelations } from "./relations-CvmSpG67.js";
+import { n as resolveRelated } from "./relation-walk-BXnlLtg2.js";
 import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { f as approverRelationKey, l as APPROVAL_HEADER, n as assertApprover, s as listAllApprovals } from "./store-DMAWwAJV.js";
+import { f as approverRelationKey, l as APPROVAL_HEADER, n as assertApprover, s as listAllApprovals } from "./store-ILkLUj_o.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
 /** Every approver a request names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */

package/dist/hono/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { A as ConnectionOptions, C as verifyWebBotAuth, O as Connection, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,9 +1,9 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as PermDockRevokedError } from "../errors-Cz5zn0mW.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { r as PermDockRevokedError } from "../errors-drnfxYtm.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { r as bindKernel } from "../bind-kk-uyCwH.js";
+import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-BMui98KK.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts
 function socket(connection, events) {
@@ -61,7 +61,7 @@ function mapDownstream(c) {
 	}
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, scopeOf, handlerScope, attach } = bindKernel(policy, options, "hono", (c) => c.req.raw);
+	const { kernel, bind, scopeOf, handlerScope, attach, guard: runGuard } = bindKernel(policy, options, "hono", (c) => c.req.raw);
 	const permdock = () => async (c, next) => {
 		const attached = await attach(c);
 		if (!attached.ok) return attached.response;
@@ -70,7 +70,7 @@ function createPermDock(policy, options) {
 		mapDownstream(c);
 	};
 	const protect = (permission, loadData, protectOptions) => async (c, next) => {
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(c), protectOptions)(bind(c), await scopeOf(c));
+		const guard = await runGuard(permission, loadData, c, protectOptions);
 		if (!guard.ok) return guard.response;
 		c.set("permdock", guard.permdock);
 		c.set("permdockData", guard.data);