permdock 0.3.1 → 0.4.0

package/dist/evaluation-items-CfCCejQd.js

@@ -1,40 +0,0 @@
-import { _ as listPermissions, a as formerKeys, o as formerScopes } from "./permissions-DVoF6dMt.js";
-//#region src/server/evaluation-items.ts
-function firstWins(map, name, leaf) {
-	if (!map.has(name)) map.set(name, leaf);
-}
-/**
-* Indexes `tree` once. The lookup tries `action` as a permission key or
-* scope, then `<resource.type>.<action>`, then the leaf with that resource
-* and action; current names win over former ones and earlier leaves over
-* later ones. Anything else is `undefined`, which the caller denies.
-*/
-function permissionLookup(tree) {
-	const current = /* @__PURE__ */ new Map();
-	const former = /* @__PURE__ */ new Map();
-	const byPair = /* @__PURE__ */ new Map();
-	for (const leaf of listPermissions(tree)) {
-		firstWins(current, leaf.key, leaf);
-		firstWins(current, leaf.scope, leaf);
-		for (const name of [...formerKeys(leaf), ...formerScopes(leaf)]) firstWins(former, name, leaf);
-		firstWins(byPair, `${leaf.resource}\u0000${leaf.action}`, leaf);
-	}
-	const named = (name) => current.get(name) ?? former.get(name);
-	return (action, resource) => {
-		if (action === void 0) return;
-		const byKey = named(action);
-		if (byKey !== void 0) return byKey;
-		const type = typeof resource?.type === "string" ? resource.type : void 0;
-		if (type === void 0) return;
-		return named(`${type}.${action}`) ?? byPair.get(`${type}\u0000${action}`);
-	};
-}
-/** The row an item's resource describes: its `properties`, else `{ id }`. */
-function itemResourceData(resource) {
-	const properties = resource?.properties;
-	if (properties !== null && typeof properties === "object") return properties;
-	const id = resource?.id;
-	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
-}
-//#endregion
-export { permissionLookup as n, itemResourceData as t };

package/dist/fields-BMl1RxoX.js

@@ -1,26 +0,0 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { D as ownKeys, E as ownGet, T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
-//#region src/core/fields.ts
-function sanitizeFields(fields) {
-	if (fields === void 0) return;
-	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
-}
-function grantCoversField(fields, field, effect) {
-	if (fields === void 0) return true;
-	if (fields.length === 0) return false;
-	if (field === void 0) return effect === "allow";
-	return fields.includes(field);
-}
-function pickVisible(row, canField) {
-	const out = {};
-	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
-	return freezeDeep(out);
-}
-function sanitizeContext(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
-	const out = {};
-	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
-	return out;
-}
-//#endregion
-export { sanitizeFields as i, pickVisible as n, sanitizeContext as r, grantCoversField as t };

package/dist/grantee-Cv5Sogfv.js

@@ -1,602 +0,0 @@
-import { r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { C as restrictedStops, D as ownKeys, S as restrictedFor, T as isForbiddenKey, _ as listPermissions, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, m as isPrincipalRelation, p as isPermission, r as expandRelation, u as isComputedRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
-import { c as rootScope, d as scopeList, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
-//#region src/core/vocabulary.ts
-const ROLE_KIND = "role";
-const PLAN_KIND = "plan";
-function makeRole(key, init) {
-	assertSafeKey(key, "role");
-	const on = init.on;
-	const leaf = {
-		key,
-		assignable: init.assignable ?? on !== void 0,
-		meta: freezeDeep({ ...init.meta })
-	};
-	if (on !== void 0) Object.assign(leaf, { on });
-	Object.defineProperty(leaf, "kind", {
-		value: ROLE_KIND,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return Object.freeze(leaf);
-}
-function makePlan(key, init) {
-	assertSafeKey(key, "plan");
-	const leaf = {
-		key,
-		meta: freezeDeep({ ...init.meta })
-	};
-	Object.defineProperty(leaf, "kind", {
-		value: PLAN_KIND,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return Object.freeze(leaf);
-}
-function isRole(value) {
-	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "role";
-}
-function isPlan(value) {
-	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "plan";
-}
-function defineRoles(input) {
-	const tree = {};
-	for (const key of Object.keys(input)) {
-		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden role key '${key}'`);
-		tree[key] = makeRole(key, input[key] ?? {});
-	}
-	return freezeDeep(tree);
-}
-function definePlans(input) {
-	const tree = {};
-	for (const key of Object.keys(input)) {
-		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden plan key '${key}'`);
-		tree[key] = makePlan(key, input[key] ?? {});
-	}
-	return freezeDeep(tree);
-}
-function listRoles(tree) {
-	if (tree === void 0) return [];
-	return ownKeys(tree).flatMap((key) => {
-		const leaf = tree[key];
-		return leaf === void 0 ? [] : [leaf];
-	});
-}
-function listPlans(tree) {
-	if (tree === void 0) return [];
-	return ownKeys(tree).flatMap((key) => {
-		const leaf = tree[key];
-		return leaf === void 0 ? [] : [leaf];
-	});
-}
-function findRole(tree, key) {
-	if (tree === void 0 || isForbiddenKey(key)) return;
-	return tree[key];
-}
-function synthesiseRole(key, options) {
-	const on = options?.on;
-	const assignable = options?.assignable ?? false;
-	const meta = options?.meta;
-	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
-		assignable,
-		meta
-	});
-	return makeRole(key, meta === void 0 ? {
-		on,
-		assignable
-	} : {
-		on,
-		assignable,
-		meta
-	});
-}
-//#endregion
-//#region src/core/grantee.ts
-const DEFAULT_RELATION_DEPTH = 16;
-function isGrantee(value) {
-	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";
-}
-function anyone() {
-	return freezeDeep({ kind: "anyone" });
-}
-function authenticated() {
-	return freezeDeep({ kind: "authenticated" });
-}
-function relation(resource, name, options) {
-	const resourceName = listPermissions(resource)[0]?.resource;
-	if (resourceName === void 0) throw new Error("PermDock: relation() requires a resource tree");
-	const through = options?.through;
-	if (Array.isArray(through)) {
-		if (through.length === 0) throw new Error("PermDock: relation() through needs at least one link");
-		for (const link of through) if (typeof link !== "string" || link === "" || link === "parent") throw new Error("PermDock: relation() through lists link names; walk parents with through: 'parent' or depth");
-	} else if (through !== void 0 && through !== "parent") throw new Error(`PermDock: relation() through must be 'parent' or a list of link names (got '${String(through)}')`);
-	const depth = options?.depth;
-	if (depth !== void 0) {
-		if (through === void 0) throw new Error("PermDock: relation() depth needs through: 'parent' or a link list");
-		const hops = Array.isArray(through) ? through.length : 0;
-		if (!Number.isInteger(depth) || depth < 0 || depth + hops > 32) throw new Error(`PermDock: relation() depth must be an integer from 0 to 32, counting each link`);
-	}
-	return freezeDeep(compact({
-		kind: "relation",
-		resource: resourceName,
-		relation: name,
-		through: through === void 0 || through === "parent" ? through : [...through],
-		depth
-	}));
-}
-function inherit(permission, options) {
-	if (!isPermission(permission) || permission.kind === "collection") throw new Error("PermDock: inherit() takes an instance permission leaf");
-	const through = options.through;
-	const links = Array.isArray(through) ? through : void 0;
-	if (through !== "parent" && (links === void 0 || links.length === 0 || !links.every((link) => typeof link === "string" && link !== "" && link !== "parent"))) throw new Error("PermDock: inherit() through must be 'parent' or a non-empty list of link names");
-	return freezeDeep({
-		kind: "inherit",
-		permission: permission.key,
-		resource: permission.resource,
-		through: links === void 0 ? "parent" : links.map(String)
-	});
-}
-function plan(name) {
-	return freezeDeep({
-		kind: "plan",
-		plan: typeof name === "string" ? name : name.key
-	});
-}
-function actor(kind) {
-	return freezeDeep({
-		kind: "actor",
-		actor: kind
-	});
-}
-function assurance(options) {
-	const acr = options.acr === void 0 ? void 0 : typeof options.acr === "string" ? [options.acr] : options.acr;
-	const amr = options.amr === void 0 ? void 0 : typeof options.amr === "string" ? [options.amr] : options.amr;
-	return freezeDeep(compact({
-		kind: "assurance",
-		acr,
-		amr,
-		maxAge: options.maxAge
-	}));
-}
-function resolveRoleScope(on) {
-	return typeof on === "string" ? on : "global";
-}
-function asGrantee(input) {
-	if (Array.isArray(input)) {
-		const items = [];
-		for (const item of input) items.push(...flattenGrantee(asGrantee(item)));
-		return items;
-	}
-	if (typeof input === "string") return freezeDeep({
-		kind: "role",
-		role: input,
-		scope: "global"
-	});
-	if (isRole(input)) return freezeDeep({
-		kind: "role",
-		role: input.key,
-		scope: resolveRoleScope(input.on)
-	});
-	if (isPlan(input)) return freezeDeep({
-		kind: "plan",
-		plan: input.key
-	});
-	if (isGrantee(input)) return input;
-	throw new Error("PermDock: invalid grantee");
-}
-function flattenGrantee(input) {
-	if (input === void 0) return [];
-	if (Array.isArray(input)) return input;
-	return [input];
-}
-function roleNameOf(to) {
-	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.role;
-	return null;
-}
-function roleScopeOf(to, fallback = "global") {
-	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.scope;
-	return fallback;
-}
-/**
-* Where a graph relation starts on the row: its own id when the relation is
-* on the row's resource, the parent field when it is on the parent resource.
-* `undefined` when `through` cannot reach the relation's resource.
-*/
-function relationStart(grantee, resource, target) {
-	if (resource === void 0 || target === void 0 || Array.isArray(grantee.through)) return;
-	const walks = grantee.through === "parent" && isSelfParented(target);
-	const requested = grantee.depth ?? DEFAULT_RELATION_DEPTH;
-	const depth = walks ? Number.isInteger(requested) ? Math.min(Math.max(requested, 0), 32) : 0 : 0;
-	if (target.name === resource.name) return {
-		field: resource.id,
-		parent: false,
-		depth
-	};
-	if (grantee.through === "parent" && resource.parent?.resource === target.name) return {
-		field: resource.parent.field,
-		parent: true,
-		depth
-	};
-}
-/**
-* A resource role held on self-parented `membershipResource` instances
-* (`ids`) reaches rows below them: the row itself when it is of that
-* resource, its parent field when its parent is, walked up to the default
-* depth. `undefined` when the row is not on such a chain.
-*/
-function resourceRoleCondition(resource, membershipResource, ids, resources) {
-	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
-	const start = resource.name === membershipResource ? {
-		field: resource.id,
-		parent: false
-	} : resource.parent?.resource === membershipResource ? {
-		field: resource.parent.field,
-		parent: true
-	} : void 0;
-	if (start === void 0) return;
-	return compact({
-		op: "related",
-		resource: membershipResource,
-		relation: "",
-		ids: [...new Set(ids)].toSorted(),
-		field: start.field,
-		depth: DEFAULT_RELATION_DEPTH,
-		parent: start.parent ? true : void 0,
-		restricted: restrictedFor(resource, "parent"),
-		passRestricted: passesRestricted(resources.get(membershipResource))
-	});
-}
-function passesRestricted(node) {
-	return node?.restricted !== void 0 && !restrictedStops(node, "parent") ? true : void 0;
-}
-function linkStop(resource, link) {
-	const restricted = restrictedFor(resource, link);
-	if (restricted === void 0) return {};
-	const parent = resource.parent;
-	if (parent === void 0 || !isSelfParented(resource)) return { restricted };
-	return {
-		restricted,
-		restrictedAncestors: {
-			resource: resource.name,
-			id: resource.id,
-			parent: parent.field,
-			field: restricted,
-			depth: 32
-		}
-	};
-}
-/**
-* The link path from the row to the grantee's resource: the row field of
-* the first link and each hop. `undefined` when a link is not declared or
-* the path ends on another resource.
-*/
-function relationHops(grantee, resource, resources) {
-	const through = grantee.through;
-	if (!Array.isArray(through) || resource === void 0) return;
-	const hops = [];
-	let current = resource;
-	let field;
-	for (const link of through) {
-		const spec = current !== void 0 && Object.hasOwn(current.links, link) ? current.links[link] : void 0;
-		if (spec === void 0) return;
-		field ??= spec.field;
-		hops.push({
-			link,
-			resource: spec.resource
-		});
-		current = resources?.get(spec.resource);
-	}
-	if (field === void 0 || current === void 0 || current.name !== grantee.resource) return;
-	const depth = grantee.depth ?? 0;
-	if (depth > 0 && !isSelfParented(current)) return;
-	return {
-		field,
-		hops,
-		depth
-	};
-}
-/**
-* Whether the grantee needs the relation graph: a `through` walk, an edge
-* table, or an `includes` that reaches one.
-*/
-function isGraphRelation(grantee, resources) {
-	if (grantee.through !== void 0) return true;
-	const node = resources?.get(grantee.resource);
-	return expandRelation(node, grantee.relation).some((name) => isEdgeRelation(node?.relations[name]));
-}
-function periodConditions(spec, now) {
-	const out = [];
-	const startsAt = spec.period?.startsAt;
-	if (startsAt !== void 0) out.push({
-		op: "or",
-		conditions: [{
-			op: "isNull",
-			field: startsAt,
-			value: true
-		}, {
-			op: "lte",
-			field: startsAt,
-			value: now
-		}]
-	});
-	const expiresAt = spec.period?.expiresAt;
-	if (expiresAt !== void 0) out.push({
-		op: "or",
-		conditions: [{
-			op: "isNull",
-			field: expiresAt,
-			value: true
-		}, {
-			op: "gt",
-			field: expiresAt,
-			value: now
-		}]
-	});
-	return out;
-}
-function relationCondition(grantee, resource, scopes = scopeList(void 0), options = {}) {
-	const target = grantee.resource === resource?.name ? resource : options.resources?.get(grantee.resource);
-	if (isGraphRelation(grantee, options.resources ?? targetMap(target))) {
-		const spec = target?.relations[grantee.relation];
-		if (spec === void 0 || isFieldRelation(spec) && spec.memberOf !== void 0) return;
-		if (Array.isArray(grantee.through)) {
-			const path = relationHops(grantee, resource, options.resources);
-			if (path === void 0 || target === void 0) return;
-			return compact({
-				op: "related",
-				resource: target.name,
-				relation: grantee.relation,
-				field: path.field,
-				depth: path.depth,
-				hops: path.hops,
-				...resource === void 0 ? {} : linkStop(resource, firstLink(path)),
-				passRestricted: path.depth > 0 ? passesRestricted(target) : void 0
-			});
-		}
-		const start = relationStart(grantee, resource, target);
-		if (start === void 0 || target === void 0) return;
-		return compact({
-			op: "related",
-			resource: target.name,
-			relation: grantee.relation,
-			field: start.field,
-			depth: start.depth,
-			parent: start.parent ? true : void 0,
-			restricted: start.parent || start.depth > 0 ? restrictedFor(resource, "parent") : void 0,
-			passRestricted: start.depth > 0 ? passesRestricted(target) : void 0
-		});
-	}
-	const spec = resource?.relations?.[grantee.relation];
-	if (spec === void 0 || isEdgeRelation(spec)) return;
-	if (spec.includes !== void 0 && options.includes !== false) {
-		const parts = expandRelation(resource, grantee.relation).flatMap((name) => {
-			const part = relationCondition({
-				...grantee,
-				relation: name
-			}, resource, scopes, {
-				...options,
-				includes: false
-			});
-			return part === void 0 ? [] : [part];
-		});
-		return sole(parts) ?? {
-			op: "or",
-			conditions: parts
-		};
-	}
-	if (isComputedRelation(spec)) return;
-	if (isPrincipalRelation(spec)) {
-		const owner = {
-			op: "eq",
-			field: spec.principal,
-			value: { ref: "principal.id" }
-		};
-		const period = periodConditions(spec, options.now ?? { date: (/* @__PURE__ */ new Date()).toISOString() });
-		return period.length === 0 ? owner : {
-			op: "and",
-			conditions: [owner, ...period]
-		};
-	}
-	if (spec.memberOf !== void 0) {
-		const scope = resolveScope(scopes, spec.memberOf);
-		if (scope === void 0) return {
-			op: "or",
-			conditions: []
-		};
-		if (scope === rootScope(scopes)) return {
-			op: "eq",
-			field: spec.field,
-			value: { ref: "principal.tenant" }
-		};
-		return {
-			op: "memberOf",
-			scope,
-			field: spec.field,
-			roles: []
-		};
-	}
-	return {
-		op: "eq",
-		field: spec.field,
-		value: { ref: "principal.id" }
-	};
-}
-function inheritCondition(grantee, resource, resources) {
-	if (resource === void 0) return;
-	if (grantee.through === "parent") {
-		const parent = resource.parent;
-		if (parent === void 0 || parent.resource !== grantee.resource) return;
-		return compact({
-			op: "related",
-			resource: grantee.resource,
-			relation: "",
-			permission: grantee.permission,
-			field: parent.field,
-			depth: 0,
-			parent: true,
-			restricted: restrictedFor(resource, "parent")
-		});
-	}
-	const path = relationHops({
-		kind: "relation",
-		resource: grantee.resource,
-		relation: "",
-		through: grantee.through
-	}, resource, resources);
-	if (path === void 0) return;
-	return compact({
-		op: "related",
-		resource: grantee.resource,
-		relation: "",
-		permission: grantee.permission,
-		field: path.field,
-		depth: 0,
-		hops: path.hops,
-		...linkStop(resource, firstLink(path))
-	});
-}
-function firstLink(path) {
-	return path.hops[0]?.link ?? "";
-}
-function targetMap(target) {
-	return target === void 0 ? void 0 : /* @__PURE__ */ new Map([[target.name, target]]);
-}
-function combineWhere(left, right) {
-	if (left === void 0) return right;
-	if (right === void 0) return left;
-	return {
-		op: "and",
-		conditions: [left, right]
-	};
-}
-/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
-function seatsInTenant(subject, scopes) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const list = scopeList(scopes);
-	return (principal.memberships ?? []).flatMap((membership) => membership.entitlements !== void 0 && activeFor(membership, list, principal.tenant) ? membership.entitlements : []);
-}
-function matchOne(grantee, subject, now, resource, scopes, resources) {
-	switch (grantee.kind) {
-		case "anyone": return { matched: true };
-		case "authenticated": return subject.principal === null ? {
-			matched: false,
-			reason: "anonymous"
-		} : { matched: true };
-		case "plan":
-			if (subject.principal === null) return {
-				matched: false,
-				reason: "anonymous"
-			};
-			return (subject.principal.plans ?? []).includes(grantee.plan) || seatsInTenant(subject, scopes).includes(grantee.plan) ? { matched: true } : {
-				matched: false,
-				reason: "not-entitled"
-			};
-		case "actor":
-			if (subject.actor === void 0) return {
-				matched: false,
-				reason: "no-grant"
-			};
-			return subject.actor.kind === grantee.actor ? { matched: true } : {
-				matched: false,
-				reason: "no-grant"
-			};
-		case "assurance": {
-			if (subject.principal === null) return {
-				matched: false,
-				reason: "anonymous"
-			};
-			const principalAssurance = subject.principal.assurance;
-			if (grantee.acr !== void 0 && grantee.acr.length > 0) {
-				const acr = principalAssurance?.acr;
-				if (acr === void 0 || !grantee.acr.includes(acr)) return {
-					matched: false,
-					reason: "insufficient-user-authentication"
-				};
-			}
-			if (grantee.amr !== void 0 && grantee.amr.length > 0) {
-				const amr = principalAssurance?.amr ?? [];
-				if (!grantee.amr.every((method) => amr.includes(method))) return {
-					matched: false,
-					reason: "insufficient-user-authentication"
-				};
-			}
-			if (grantee.maxAge !== void 0) {
-				const authTime = principalAssurance?.authTime;
-				if (authTime === void 0 || now - authTime > grantee.maxAge) return {
-					matched: false,
-					reason: "insufficient-user-authentication"
-				};
-			}
-			return { matched: true };
-		}
-		case "relation": {
-			if (subject.principal === null) return {
-				matched: false,
-				reason: "anonymous"
-			};
-			const where = relationCondition(grantee, resource, scopes, {
-				resources,
-				now: { date: (/* @__PURE__ */ new Date(now * 1e3)).toISOString() }
-			});
-			if (where === void 0 && resource !== void 0) return {
-				matched: false,
-				reason: "condition"
-			};
-			return compact({
-				matched: true,
-				where
-			});
-		}
-		case "inherit": {
-			const where = inheritCondition(grantee, resource, resources);
-			return where === void 0 ? {
-				matched: false,
-				reason: "condition"
-			} : {
-				matched: true,
-				where
-			};
-		}
-		case "role":
-			if (subject.principal === null) return {
-				matched: false,
-				reason: "anonymous"
-			};
-			return { matched: true };
-		default: return unknownGrantee(grantee);
-	}
-}
-/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
-function unknownGrantee(_grantee) {
-	return {
-		matched: false,
-		reason: "no-grant",
-		unknown: true
-	};
-}
-function matchGrantee(to, subject, now, resource, scopes, resources, unknownMatches = false) {
-	const items = flattenGrantee(to);
-	if (items.length === 0) return {
-		matched: false,
-		reason: "no-grant"
-	};
-	let where;
-	for (const item of items) {
-		const result = matchOne(item, subject, now, resource, scopes, resources);
-		if (!result.matched) {
-			if (unknownMatches && result.unknown === true) continue;
-			return result;
-		}
-		where = combineWhere(where, result.where);
-	}
-	return compact({
-		matched: true,
-		where
-	});
-}
-//#endregion
-export { isPlan as C, synthesiseRole as D, listRoles as E, findRole as S, listPlans as T, resourceRoleCondition as _, authenticated as a, definePlans as b, inherit as c, matchGrantee as d, plan as f, relationStart as g, relationHops as h, assurance as i, inheritCondition as l, relationCondition as m, anyone as n, combineWhere as o, relation as p, asGrantee as r, flattenGrantee as s, actor as t, isGraphRelation as u, roleNameOf as v, isRole as w, defineRoles as x, roleScopeOf as y };