permdock 0.3.1 → 0.4.0

package/dist/create-CMwIl-w2.js

@@ -1,253 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
-import { n as problemDetails } from "./problem-details-_AMOYz-w.js";
-import { r as challengeScope, t as createPermDock$1 } from "./permdock-CbgvLnuo.js";
-import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as hasCredentials } from "./http-SO7qGttf.js";
-import { a as notFoundProblem, l as unauthenticatedProblem, o as problemFromDecision, r as decisionResponse } from "./problem-B43ztKIm.js";
-import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-tz6D9A2G.js";
-import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-mlWsVGGg.js";
-//#region src/server/create.ts
-async function resolveActor(request, options) {
-	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request)) ?? actorFrom(options.actor, request);
-}
-const NO_TENANT = "\0";
-function routeScopes(value) {
-	if (value === void 0) return;
-	const scopes = Array.isArray(value) ? value : [];
-	const names = scopes.filter((scope) => typeof scope === "string" && scope !== "");
-	if (names.length === 0 || names.length !== scopes.length) throw new TypeError("PermDock: oauthScopes must be a non-empty list of scope names");
-	return names;
-}
-const NOT_DELEGATED = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "not-delegated"
-	}],
-	alternatives: []
-};
-/** The `403` `insufficient_scope` for a token that holds none of a route's OAuth scopes. */
-function scopeProblem(permission, subject, credentials, scope) {
-	return permission === null ? decisionResponse(problemDetails(compact({
-		decision: NOT_DELEGATED,
-		detail: `the token holds none of the OAuth scopes this route needs, such as ${String(scope)}`,
-		scope
-	})), NOT_DELEGATED, compact({
-		credentials,
-		scope
-	})) : problemFromDecision(NOT_DELEGATED, permission, subject, compact({
-		credentials,
-		scope
-	}));
-}
-function createPermDock(policy, options) {
-	return createServerKernel(policy, options);
-}
-function problemFor(decision, init, approval) {
-	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, void 0, compact({
-		instance: init.instance,
-		approval
-	}));
-	if (decision.outcome === "granted") return new Response(null, { status: 204 });
-	return decisionResponse(problemDetails(compact({
-		decision,
-		detail: decision.outcome,
-		instance: init?.instance
-	})), decision);
-}
-/**
-* The kernel behind every HTTP adapter. The subject and actor are resolved
-* once per `Request`; one instance is cached per `(Request, tenant)`, so a
-* global middleware and a later tenant-scoped `protect` never share a tenant.
-*/
-function createServerKernel(policy, options) {
-	const adapter = options.adapter ?? "server";
-	const subjects = /* @__PURE__ */ new WeakMap();
-	const instances = /* @__PURE__ */ new WeakMap();
-	const freshSubject = async (request) => {
-		const actor = await resolveActor(request, options);
-		try {
-			return {
-				user: await options.subject(request),
-				actor
-			};
-		} catch {
-			return {
-				user: null,
-				actor
-			};
-		}
-	};
-	const resolveSubject = (request) => {
-		const hit = subjects.get(request);
-		if (hit !== void 0) return hit;
-		const resolved = freshSubject(request);
-		subjects.set(request, resolved);
-		return resolved;
-	};
-	const instanceFor = async ({ user, actor }, tenant) => {
-		const coreOptions = compact({
-			tenant,
-			...instanceOptions(options),
-			actor
-		});
-		const permdock = await createPermDock$1(policy, user, coreOptions);
-		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, coreOptions);
-		return {
-			permdock: options.wrap === void 0 ? permdock : options.wrap(permdock),
-			remote
-		};
-	};
-	const build = async (request, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		let byTenant = instances.get(request);
-		if (byTenant === void 0) {
-			byTenant = /* @__PURE__ */ new Map();
-			instances.set(request, byTenant);
-		}
-		const key = tenant ?? NO_TENANT;
-		const hit = byTenant.get(key);
-		if (hit !== void 0) return hit;
-		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
-		byTenant.set(key, built);
-		return built;
-	};
-	const connection = async (request, connectionOptions = {}, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		const { openConnection } = await import("./connection-CU8MQxRi.js");
-		return openConnection({
-			open: async () => (await build(request, { tenant })).permdock,
-			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
-			tenant,
-			...options.revocations === void 0 ? {} : { feed: options.revocations },
-			adapter,
-			options: connectionOptions
-		});
-	};
-	const permdock = async (request, scope) => (await build(request, scope)).permdock;
-	const getSnapshot = async (request, query = {}) => {
-		return (await permdock(request, query.tenant === void 0 ? void 0 : { tenant: query.tenant })).snapshot(compact({
-			include: query.include,
-			tenants: query.tenants
-		}));
-	};
-	const protectRoute = (permission, loadData, protectOptions = {}) => {
-		if (permission === null && routeScopes(protectOptions.oauthScopes) === void 0 && options.operations === void 0) throw new TypeError("PermDock: protect(null) needs oauthScopes, in its options or an operations entry");
-		return async (request, scope) => {
-			let instance;
-			let remote;
-			try {
-				({permdock: instance, remote} = await build(request, scope));
-			} catch (error) {
-				if (error instanceof InvalidSignatureError) return {
-					ok: false,
-					response: error.response
-				};
-				throw error;
-			}
-			return guardOn(instance, remote, request, permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions);
-		};
-	};
-	const guardOn = async (instance, remote, request, permission, load, protectOptions) => {
-		const declared = routeScopes(protectOptions.oauthScopes ?? (request === void 0 ? void 0 : options.operations?.oauthScopesForRequest(request.method, new URL(request.url).pathname)));
-		const credentials = request === void 0 ? false : hasCredentials(request);
-		if (permission === null) {
-			if (declared === void 0) throw new TypeError(request === void 0 ? "PermDock: protect(null) needs oauthScopes" : `PermDock: protect(null) needs oauthScopes, and no operation declares them for ${request.method} ${new URL(request.url).pathname}`);
-			if (instance.subject.principal === null) return {
-				ok: false,
-				response: unauthenticatedProblem(credentials)
-			};
-		}
-		const held = instance.subject.delegation?.scopes;
-		if (declared !== void 0 && held !== void 0 && !declared.some((granted) => held.includes(granted))) return {
-			ok: false,
-			response: scopeProblem(permission, instance.subject, credentials, declared[0])
-		};
-		let data;
-		if (load !== void 0) {
-			const loaded = await load();
-			if (loaded === null || loaded === void 0) return {
-				ok: false,
-				response: notFoundProblem()
-			};
-			data = loaded;
-		}
-		if (permission === null) return {
-			ok: true,
-			permdock: instance,
-			data
-		};
-		const decideOptions = compact({
-			source: "adapter",
-			adapter,
-			...protectOptions.trusted === true ? { trusted: true } : {
-				trusted: false,
-				boundary: "http-body"
-			}
-		});
-		const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
-			outcome: "denied",
-			denials: [{
-				role: null,
-				reason: "pdp-unavailable"
-			}],
-			alternatives: []
-		}));
-		const decision = await applyApprovalResume(raw, permission, instance, options.store, request, resourceRef(permission, data), adapter);
-		if (decision.outcome === "granted") return {
-			ok: true,
-			permdock: instance,
-			decision,
-			data
-		};
-		return {
-			ok: false,
-			response: problemFromDecision(decision, permission, instance.subject, compact({
-				approval: options.approval,
-				credentials,
-				scope: declared?.[0] ?? challengeScope(policy, permission),
-				disclosure: data === void 0 ? void 0 : policy.resources.get(permission.resource)?.disclosure
-			}))
-		};
-	};
-	const protect = protectRoute;
-	const openapi = {
-		security: (permission) => ({
-			security: [{ oauth2: [permission.scope] }],
-			"x-permdock-permissions": [permission.key]
-		}),
-		securitySchemes: () => {
-			const scopes = {};
-			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
-			return { oauth2: {
-				type: "oauth2",
-				flows: {},
-				scopes
-			} };
-		}
-	};
-	const permdockHandler = (scope) => createEvaluationsHandler(compact({
-		policy,
-		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
-		store: options.store,
-		adapter
-	}));
-	return {
-		permdock,
-		getSnapshot,
-		protect,
-		protectOn: (instance, permission, load, protectOptions = {}, request) => guardOn(instance, void 0, request, permission, load, protectOptions),
-		connection,
-		shareSubject: (from, to) => {
-			const resolved = subjects.get(from);
-			if (resolved !== void 0 && !subjects.has(to)) subjects.set(to, resolved);
-		},
-		problem: (decision, init) => problemFor(decision, init, options.approval),
-		openapi,
-		permdockHandler
-	};
-}
-//#endregion
-export { createServerKernel as n, createPermDock as t };

package/dist/delegation-D8pUEuce.js

@@ -1,103 +0,0 @@
-import { i as findPermission, o as formerScopes, t as annotationsFor } from "./permissions-DVoF6dMt.js";
-import { d as matchGrantee, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { t as isActive } from "./validity-uOp8UpYn.js";
-//#region src/core/delegation.ts
-/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
-function scopeNames(permission) {
-	return [permission.scope, ...formerScopes(permission)];
-}
-/**
-* Whether a delegated caller may use a permission its principal holds, through
-* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
-* `undefined` means covered; otherwise the denial reason `decide` would add.
-*/
-function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
-	const unscoped = hasActor ? "no-delegation" : void 0;
-	if (delegation === void 0) return unscoped;
-	const hasScopes = delegation.scopes !== void 0;
-	const hasDetails = delegation.authorizationDetails !== void 0;
-	const hasAccess = delegation.access !== void 0;
-	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
-	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
-	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
-	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
-	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
-	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
-	const scopes = scopeNames(permission);
-	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
-	const detailOk = delegation.authorizationDetails?.some((detail) => {
-		if (detail.type !== permission.resource) return false;
-		const identifier = detail["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		const actions = detail.actions;
-		if (actions === void 0) return true;
-		return Array.isArray(actions) && actions.includes(permission.action);
-	}) ?? false;
-	const accessOk = accessCovers(permission, delegation.access, resourceId);
-	if (scopeOk || detailOk || accessOk) return;
-	return "not-delegated";
-}
-function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
-	return (requires ?? []).every((key) => {
-		const leaf = findPermission(tree, key);
-		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
-	});
-}
-function requiresStandIn(grant) {
-	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
-}
-function accessCovers(permission, access, resourceId) {
-	if (access === void 0) return false;
-	return access.some((entry) => {
-		if (typeof entry === "string") return scopeNames(permission).includes(entry);
-		if (entry === null || typeof entry !== "object") return false;
-		const type = entry["type"];
-		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
-		const actions = entry["actions"];
-		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
-		const identifier = entry["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		return true;
-	});
-}
-function typeMatches(type, resource) {
-	if (type === resource) return true;
-	return type.endsWith(`/${resource}`);
-}
-/**
-* Whether the subject's principal is a `from` of the delegation: every item
-* matches, with roles checked against the roles the principal holds here
-* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
-* row.
-*/
-function handsOver(delegation, subject, heldRoles, now) {
-	const items = flattenGrantee(delegation.from);
-	if (items.length === 0 || subject.principal === null) return false;
-	return items.every((item) => {
-		if (item.kind === "role") return heldRoles.has(item.role);
-		if (item.kind === "relation") return false;
-		const match = matchGrantee(item, subject, now, void 0);
-		return match.matched && match.where === void 0;
-	});
-}
-/**
-* The permission keys the policy's delegations let `subject.actor` use for
-* `subject.principal` right now: the union over every active delegation whose
-* `to` matches the actor and whose `from` the principal holds. `undefined`
-* when none applies, so the call falls back to the token delegation alone.
-* An actor with `readOnly: true` gets only each delegation's read-only keys.
-* Attenuation only: a key here still needs a matching allow and no deny.
-*/
-function delegatedPermissions(delegations, subject, heldRoles, now) {
-	const actor = subject.actor;
-	if (actor === void 0 || delegations === void 0) return;
-	let keys;
-	for (const delegation of delegations) {
-		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
-		keys ??= /* @__PURE__ */ new Set();
-		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
-	}
-	return keys;
-}
-//#endregion
-export { requiresStandIn as i, coversRequirements as n, delegatedPermissions as r, coveredByDelegation as t };