permdock 0.3.1 → 0.4.0

package/dist/better-auth/index.js

@@ -1,14 +1,11 @@
-import { n as isReadonlyArray, t as compact } from "../compact-y6vfu2_f.js";
+import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { _ as listPermissions } from "../permissions-DVoF6dMt.js";
-import { m as role, t as allow } from "../policy-xyWg7QdR.js";
-import { t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { r as validateRecord } from "../thenable-QSmvt-vZ.js";
+import { n as role, r as allow } from "../role-builder-B4GbKM-i.js";
+import { c as listPermissions } from "../permission-registry-BsblpB-z.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
-import { i as membershipEvent } from "../sink-Bd9PSyfq.js";
+import { i as membershipEvent } from "../sink-BTtmfPnE.js";
 //#region src/better-auth/parse.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : value.split(",").map((item) => item.trim()).filter((item) => item !== "");
 	if (!Array.isArray(value)) return [];
@@ -205,16 +202,6 @@ const PROFILE_FIELDS = /* @__PURE__ */ new Set([
 	"image",
 	"displayName"
 ]);
-function validateClaims(extra, schema) {
-	const result = schema["~standard"].validate(extra);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return;
-	}
-	if ("issues" in result && result.issues !== void 0) return;
-	const value = result.value;
-	return isRecord(value) ? value : void 0;
-}
 function extraFields(user) {
 	const reserved = /* @__PURE__ */ new Set([
 		"id",
@@ -319,7 +306,7 @@ async function subjectFromBetterAuth(auth, session, options = {}) {
 		const roles = asRoles(user["role"] ?? user["roles"]);
 		const declared = options.declared;
 		const globalRoles = declared === void 0 ? roles : roles.filter((role) => declared.includes(role));
-		const extra = options.schema === void 0 ? {} : validateClaims(extraFields(user), options.schema) ?? {};
+		const extra = options.schema === void 0 ? {} : validateRecord(options.schema, extraFields(user)) ?? {};
 		const memberships = await loadMemberships(auth, session, user, id, tenant, options);
 		const principal = compact({
 			id,

package/dist/better-supabase/index.d.ts

@@ -1,14 +1,14 @@
-import { $t as CredentialPrincipal, C as Policy, Pr as Subject, ln as PermDock, nt as CredentialVerifier } from "../policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-C97IskBw.js";
+import { E as Policy, H as CredentialVerifier, Mt as PermDockOptions, jt as PermDock, kr as Subject, xt as CredentialPrincipal } from "../policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-CqrjB9o6.js";
 import { AuthorizationProvider } from "better-supabase/config";
+import { AuthSession, Authorizer } from "better-supabase/server";
+import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";
+import { ApiKey, ApiKeyClaimsOptions, ApiKeys } from "better-supabase/blocks/api-keys";
 import { AccessTopicPolicy } from "better-supabase/realtime";
 import { AccessBucketPolicy } from "better-supabase/storage";
-import { ApiKey, ApiKeyClaimsOptions, ApiKeys } from "better-supabase/blocks/api-keys";
 import { CredentialProvider } from "better-supabase/credentials";
 import { ToolDecision, ToolRef } from "better-supabase/mcp";
-import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";
-import { AuthSession } from "better-supabase/server";
 //#region src/better-supabase/provider.d.ts
 type AuthorizationProviderOptions = {
   /** `permdock.manifest.json`, parsed or as JSON text, from `permdock supabase inspect --out`. */
@@ -41,6 +41,111 @@ type AuthorizationProviderOptions = {
  */
 export declare function authorizationProvider(options: AuthorizationProviderOptions): AuthorizationProvider;
 //#endregion
+//#region src/better-supabase/api-keys.d.ts
+/** The roles a tenant key holds in its tenant: a list, or one per key. */
+type ServiceRoles<K> = readonly string[] | ((key: K) => readonly string[]);
+type ApiKeyVerifierOptions = {
+  /** `createApiKeys()` over a service transport. */
+  readonly keys: Pick<ApiKeys, "verify">;
+  /**
+   * `permdock.manifest.json`, whose `rls.apiKeys.serviceRoles` is the
+   * default for `serviceRoles`.
+   */
+  readonly manifest?: unknown;
+  /**
+   * The roles a tenant key holds in its tenant, as a `service` principal.
+   * Without it or a manifest with `rls.apiKeys`, a tenant key verifies to
+   * `null`.
+   */
+  readonly serviceRoles?: ServiceRoles<ApiKey>;
+  /** The permissions `*` stands for. Without it, a key with `*` verifies to `null`. */
+  readonly allPermissions?: readonly Permission[];
+};
+/**
+ * better-supabase's API keys as a `CredentialVerifier`, for
+ * `subjectFromApiKey` from `permdock/server`, which reads PermDock's
+ * `pdk_<id>_<secret>` format: create the keys with `prefix: "pdk"`. The
+ * credential id is the key's `publicId`, the id in the token. A personal key
+ * is a `user` credential acting as its user (inside its tenant when the key
+ * is limited to one), a tenant key a `service` credential holding
+ * `serviceRoles` in its tenant, and the key's scopes are the credential's
+ * permissions. better-supabase records the use when it verifies, so there is
+ * no `touch`. A rotated key in its grace period verifies, and its credential
+ * expires when the grace period ends. An invalid, revoked, expired or
+ * rate-limited key, and a failed lookup, are `null`. `permdock/server` exports a different
+ * `apiKeyVerifier`, over the application's own key records.
+ */
+export declare function apiKeyVerifier(options: ApiKeyVerifierOptions): CredentialVerifier;
+/**
+ * The `claim` and `tenantClaim` options of better-supabase's
+ * `apiKeyClaims()`, from the manifest's `rls.apiKeys`, so a key's token
+ * carries the scopes ceiling, tenant and roles the `rls generate` helpers
+ * read. Throws when the manifest has no `rls.apiKeys`.
+ */
+export declare function apiKeyClaimOptions(manifest: unknown): Pick<ApiKeyClaimsOptions, "claim" | "tenantClaim">;
+//#endregion
+//#region src/better-supabase/subject.d.ts
+/** An `AuthSession` of kind `apiKey`, from better-supabase's api-keys middleware. */
+type ApiKeySession = Extract<AuthSession, {
+  readonly kind: "apiKey";
+}>;
+type ApiKeySessionOptions = {
+  /** The definitions: the key's scopes become the subject's delegation, and `*` stands for all of them. */
+  readonly permissions: PermissionTree;
+  /** `permdock.manifest.json`, whose `rls.apiKeys.serviceRoles` is the default for `serviceRoles`. */
+  readonly manifest?: unknown;
+  /** The roles a tenant key holds in its tenant. Without it or a manifest with `rls.apiKeys`, a tenant key is anonymous. */
+  readonly serviceRoles?: ServiceRoles<ApiKeySession>;
+};
+/** The claim, and the short code better-supabase writes for each feature key. */
+type FeatureClaim = EntitlementClaimOptions;
+type BetterSupabaseSubjectOptions = Omit<SupabaseSubjectOptions, "plans"> & {
+  /** How `kind: 'apiKey'` sessions map. Without it they are anonymous. */
+  readonly apiKeys?: ApiKeySessionOptions;
+  /**
+   * The claim `principal.plans` reads: its name (default `features`), or
+   * `{ claim, keys }` with the same `entitlements.claim.keys` better-supabase
+   * writes short codes with, so `plans` holds the feature keys. A code
+   * without a key is dropped.
+   */
+  readonly plans?: string | FeatureClaim;
+};
+/**
+ * `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
+ * `memberships` for the memberships and the entitlements module's `features`
+ * claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
+ * a verified `apiKey` session is the key's credential subject: a personal key
+ * acts as its user within the key's scopes, a tenant key as a `service`
+ * principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
+ * `service` and `invalid` sessions, the subject is anonymous.
+ */
+export declare function subjectFromBetterSupabase(session: SupabaseSessionLike | ApiKeySession | null | undefined, options?: BetterSupabaseSubjectOptions): Subject<SupabasePrincipal> | Subject<CredentialPrincipal> | Subject;
+//#endregion
+//#region src/better-supabase/authorizer.d.ts
+/** The table operations better-supabase's `permissions: true` resolves through `forOperation`. */
+type AuthorizerOperation = "list" | "get" | "create" | "update" | "delete";
+type AuthorizerOptions = {
+  readonly policy: Policy;
+  /** How the verified claims map to a subject; the defaults of `subjectFromBetterSupabase`. */
+  readonly subject?: Omit<BetterSupabaseSubjectOptions, "apiKeys">;
+  /**
+   * The permission of each table operation, so a resource with
+   * `permissions: true` is checked. Without it such a resource is refused.
+   */
+  readonly operations?: Readonly<Record<string, Partial<Record<AuthorizerOperation, Permission>>>>;
+  /** Sources and sinks for each instance. The subject, actor and tenant always come from the verified request. */
+  readonly options?: Omit<PermDockOptions, "tenant" | "actor" | "delegation" | "session" | "expiresAt">;
+};
+/**
+ * better-supabase's `authorizer` for PermDock: every resource, action, route
+ * guard and MCP tool that declares a `permission` is decided with `decide`.
+ * The subject is mapped from the verified claims with
+ * `subjectFromBetterSupabase`; the request's `context.tenant` selects the
+ * active tenant only among the memberships the claims hold. A caller without
+ * claims is anonymous, and a throw denies.
+ */
+export declare function authorizer(options: AuthorizerOptions): Authorizer<Permission>;
+//#endregion
 //#region src/better-supabase/policies.d.ts
 type AccessScope = {
   /** A scope in the policy's scopes (or the manifest's `rls.scopes`), or `platform` for permissions granted globally. */
@@ -93,49 +198,6 @@ export declare function bucketPolicy(access: BucketAccess, options: AccessPolicy
 /** As {@link bucketPolicy}, for a better-supabase Realtime topic. */
 export declare function topicPolicy(access: TopicAccess, options: AccessPolicyOptions): AccessTopicPolicy;
 //#endregion
-//#region src/better-supabase/api-keys.d.ts
-/** The roles a tenant key holds in its tenant: a list, or one per key. */
-type ServiceRoles<K> = readonly string[] | ((key: K) => readonly string[]);
-type ApiKeyVerifierOptions = {
-  /** `createApiKeys()` over a service transport. */
-  readonly keys: Pick<ApiKeys, "verify">;
-  /**
-   * `permdock.manifest.json`, whose `rls.apiKeys.serviceRoles` is the
-   * default for `serviceRoles`.
-   */
-  readonly manifest?: unknown;
-  /**
-   * The roles a tenant key holds in its tenant, as a `service` principal.
-   * Without it or a manifest with `rls.apiKeys`, a tenant key verifies to
-   * `null`.
-   */
-  readonly serviceRoles?: ServiceRoles<ApiKey>;
-  /** The permissions `*` stands for. Without it, a key with `*` verifies to `null`. */
-  readonly allPermissions?: readonly Permission[];
-};
-/**
- * better-supabase's API keys as a `CredentialVerifier`, for
- * `subjectFromApiKey` from `permdock/server`, which reads PermDock's
- * `pdk_<id>_<secret>` format: create the keys with `prefix: "pdk"`. The
- * credential id is the key's `publicId`, the id in the token. A personal key
- * is a `user` credential acting as its user (inside its tenant when the key
- * is limited to one), a tenant key a `service` credential holding
- * `serviceRoles` in its tenant, and the key's scopes are the credential's
- * permissions. better-supabase records the use when it verifies, so there is
- * no `touch`. A rotated key in its grace period verifies, and its credential
- * expires when the grace period ends. An invalid, revoked, expired or
- * rate-limited key, and a failed lookup, are `null`. `permdock/server` exports a different
- * `apiKeyVerifier`, over the application's own key records.
- */
-export declare function apiKeyVerifier(options: ApiKeyVerifierOptions): CredentialVerifier;
-/**
- * The `claim` and `tenantClaim` options of better-supabase's
- * `apiKeyClaims()`, from the manifest's `rls.apiKeys`, so a key's token
- * carries the scopes ceiling, tenant and roles the `rls generate` helpers
- * read. Throws when the manifest has no `rls.apiKeys`.
- */
-export declare function apiKeyClaimOptions(manifest: unknown): Pick<ApiKeyClaimsOptions, "claim" | "tenantClaim">;
-//#endregion
 //#region src/better-supabase/credentials.d.ts
 type CredentialGuardOptions = {
   /** The request's PermDock instance. */
@@ -183,41 +245,4 @@ type ToolPolicy<C> = {
  */
 export declare function toolPolicy<C>(options: ToolPolicyOptions<C>): ToolPolicy<C>;
 //#endregion
-//#region src/better-supabase/subject.d.ts
-/** An `AuthSession` of kind `apiKey`, from better-supabase's api-keys middleware. */
-type ApiKeySession = Extract<AuthSession, {
-  readonly kind: "apiKey";
-}>;
-type ApiKeySessionOptions = {
-  /** The definitions: the key's scopes become the subject's delegation, and `*` stands for all of them. */
-  readonly permissions: PermissionTree;
-  /** `permdock.manifest.json`, whose `rls.apiKeys.serviceRoles` is the default for `serviceRoles`. */
-  readonly manifest?: unknown;
-  /** The roles a tenant key holds in its tenant. Without it or a manifest with `rls.apiKeys`, a tenant key is anonymous. */
-  readonly serviceRoles?: ServiceRoles<ApiKeySession>;
-};
-/** The claim, and the short code better-supabase writes for each feature key. */
-type FeatureClaim = EntitlementClaimOptions;
-type BetterSupabaseSubjectOptions = Omit<SupabaseSubjectOptions, "plans"> & {
-  /** How `kind: 'apiKey'` sessions map. Without it they are anonymous. */
-  readonly apiKeys?: ApiKeySessionOptions;
-  /**
-   * The claim `principal.plans` reads: its name (default `features`), or
-   * `{ claim, keys }` with the same `entitlements.claim.keys` better-supabase
-   * writes short codes with, so `plans` holds the feature keys. A code
-   * without a key is dropped.
-   */
-  readonly plans?: string | FeatureClaim;
-};
-/**
- * `subjectFromSupabaseSession` for better-supabase's `AuthSession`, reading
- * `memberships` for the memberships and the entitlements module's `features`
- * claim for `principal.plans` (`plans` names another claim). With `apiKeys`,
- * a verified `apiKey` session is the key's credential subject: a personal key
- * acts as its user within the key's scopes, a tenant key as a `service`
- * principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
- * `service` and `invalid` sessions, the subject is anonymous.
- */
-export declare function subjectFromBetterSupabase(session: SupabaseSessionLike | ApiKeySession | null | undefined, options?: BetterSupabaseSubjectOptions): Subject<SupabasePrincipal> | Subject<CredentialPrincipal> | Subject;
-//#endregion
-export type { AccessPolicyOptions, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationProviderOptions, BetterSupabaseSubjectOptions, BucketAccess, CredentialGuardOptions, McpToolDecision, McpToolRef, ServiceRoles, SupabasePrincipal, ToolPolicy, ToolPolicyOptions, TopicAccess };
+export type { AccessPolicyOptions, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseSubjectOptions, BucketAccess, CredentialGuardOptions, McpToolDecision, McpToolRef, ServiceRoles, SupabasePrincipal, ToolPolicy, ToolPolicyOptions, TopicAccess };