permdock 0.3.1 → 0.5.0

package/dist/{schema-D3MnDMxa.js → schema-B4v0Qrac.js}

@@ -1,14 +1,24 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
 //#region src/catalog/schema.ts
 const name = {
 	type: "string",
 	pattern: "^[a-z][a-z0-9_]*$"
 };
+const instant = {
+	type: "string",
+	format: "date-time",
+	pattern: RFC3339_PATTERN
+};
+const seconds = {
+	type: "integer",
+	minimum: 1
+};
 const validity = {
 	type: "object",
 	properties: {
-		from: { type: "integer" },
-		until: { type: "integer" }
+		from: instant,
+		until: instant
 	}
 };
 const strings = {
@@ -44,12 +54,12 @@ const approval = { oneOf: [{ const: "human" }, {
 			type: "integer",
 			minimum: 1
 		},
-		ttl: { type: "string" },
+		ttl: seconds,
 		escalation: {
 			type: "object",
 			required: ["after", "to"],
 			properties: {
-				after: { type: "string" },
+				after: seconds,
 				to: {}
 			}
 		}
@@ -83,10 +93,31 @@ const catalogSchema = freezeDeep({
 					id: { type: "string" },
 					schema: {},
 					definedIn: { type: "string" },
+					parent: {
+						type: "object",
+						required: ["field", "resource"],
+						properties: {
+							field: { type: "string" },
+							resource: { type: "string" }
+						}
+					},
+					links: {
+						type: "object",
+						additionalProperties: {
+							type: "object",
+							required: ["field", "resource"],
+							properties: {
+								field: { type: "string" },
+								resource: { type: "string" }
+							}
+						}
+					},
+					disclosure: { const: "hide" },
 					relations: { type: "object" },
 					version: { type: "string" },
 					restricted: { type: "string" },
-					restrictedStops: strings
+					restrictedStops: strings,
+					meta: { type: "object" }
 				}
 			}
 		},
@@ -116,7 +147,7 @@ const catalogSchema = freezeDeep({
 						type: "object",
 						required: ["justification"],
 						properties: {
-							maxDuration: { type: "string" },
+							maxDuration: seconds,
 							justification: { enum: ["required", "optional"] },
 							approval: { type: "boolean" },
 							assurance: { type: "object" }
@@ -132,7 +163,10 @@ const catalogSchema = freezeDeep({
 						properties: {
 							actorRequired: { type: "boolean" },
 							group: { type: "string" },
-							durations: strings
+							durations: {
+								type: "array",
+								items: seconds
+							}
 						}
 					}
 				}
@@ -217,7 +251,7 @@ const catalogSchema = freezeDeep({
 							overrides: strings,
 							purpose: strings,
 							reason: { type: "boolean" },
-							maxDuration: { type: "string" },
+							maxDuration: seconds,
 							obligations: strings
 						}
 					}
@@ -261,11 +295,12 @@ const catalogSchema = freezeDeep({
 								type: "integer",
 								minimum: 1
 							},
-							per: { type: "string" },
+							per: seconds,
 							mode: { enum: ["hard", "soft"] }
 						}
 					},
-					portable: { const: false }
+					portable: { const: false },
+					meta: { type: "object" }
 				}
 			}
 		},
@@ -293,6 +328,67 @@ const catalogSchema = freezeDeep({
 					validity
 				}
 			}
+		},
+		operations: {
+			type: "array",
+			items: {
+				type: "object",
+				required: [
+					"name",
+					"permission",
+					"meta"
+				],
+				properties: {
+					name: {
+						type: "string",
+						pattern: "^[A-Za-z0-9_.-]{1,128}$"
+					},
+					permission: { type: "string" },
+					results: { type: "string" },
+					meta: {
+						type: "object",
+						additionalProperties: false,
+						properties: {
+							risk: { enum: [
+								"low",
+								"medium",
+								"high",
+								"critical"
+							] },
+							effects: {
+								type: "array",
+								uniqueItems: true,
+								items: { enum: [
+									"read",
+									"write",
+									"delete",
+									"send",
+									"spend",
+									"external"
+								] }
+							},
+							title: {
+								type: "string",
+								minLength: 1
+							}
+						}
+					}
+				}
+			}
+		},
+		oauthScopes: {
+			type: "array",
+			items: {
+				type: "object",
+				required: ["scope", "permissions"],
+				properties: {
+					scope: {
+						type: "string",
+						minLength: 1
+					},
+					permissions: strings
+				}
+			}
 		}
 	}
 });

package/dist/schema-yLuBWWsh.js

@@ -0,0 +1,130 @@
+import { t as require__2020 } from "./2020-C9VN-x8c.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
+import { t as DRAFT_PINS } from "./pins-8ILTftC9.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/cli/openapi/schema.ts
+var import__2020 = require__2020();
+function schemaDir() {
+	return join(packageRoot(), "schemas", "openapi");
+}
+const validators = /* @__PURE__ */ new Map();
+/** Parses a bundled schema file; throws on anything but a JSON object. */
+function parseSchema(text, file) {
+	const parsed = JSON.parse(text.replaceAll("\"$dynamicRef\": \"#meta\"", "\"$ref\": \"#/$defs/schema\""));
+	if (!isRecord(parsed)) throw new TypeError(`PermDock CLI: ${file} is not a JSON Schema`);
+	return parsed;
+}
+function schemaFile(file) {
+	return parseSchema(readFileSync(join(schemaDir(), file), "utf8"), file);
+}
+function child(parent, ...path) {
+	let node = parent;
+	for (const key of path) {
+		const next = node[key];
+		if (!isRecord(next)) throw new TypeError(`PermDock CLI: OpenAPI schema has no ${path.join(".")}`);
+		node = next;
+	}
+	return node;
+}
+const STRINGS = {
+	type: "array",
+	items: { type: "string" }
+};
+/**
+* No official 3.3 schema exists: the 3.2 schema plus the pinned draft's
+* Security Profiles (a `profile` scheme type and
+* `components.securityProfileRequirements`). Mutates and returns `schema`.
+*/
+function patchOas33(schema) {
+	schema["$id"] = `https://permdock.com/schemas/openapi/oas-3.3/${DRAFT_PINS.oas}`;
+	child(schema, "properties", "openapi")["pattern"] = String.raw`^3\.3\.\d+(-.+)?$`;
+	const defs = child(schema, "$defs");
+	const scheme = child(defs, "security-scheme");
+	const type = child(scheme, "properties", "type");
+	type["enum"] = [...Array.isArray(type["enum"]) ? type["enum"] : [], "profile"];
+	scheme["allOf"] = [...Array.isArray(scheme["allOf"]) ? scheme["allOf"] : [], {
+		if: { properties: { type: { const: "profile" } } },
+		then: {
+			properties: { profileMetadata: {
+				type: "object",
+				required: ["name"],
+				properties: {
+					name: { type: "string" },
+					supportedParametersSchema: { type: ["string", "object"] },
+					supportedOperations: {},
+					servers: {
+						type: "array",
+						items: {
+							type: "object",
+							required: ["url"],
+							properties: {
+								name: { type: "string" },
+								url: { type: "string" }
+							}
+						}
+					}
+				}
+			} },
+			required: ["profileMetadata"]
+		}
+	}];
+	child(defs, "components", "properties")["securityProfileRequirements"] = {
+		type: "object",
+		additionalProperties: {
+			type: "object",
+			required: ["securityScheme", "scopes"],
+			properties: {
+				securityScheme: { $ref: "#/$defs/reference" },
+				token_endpoint_auth_methods: STRINGS,
+				grant_types: STRINGS,
+				scopes: STRINGS
+			}
+		}
+	};
+	return schema;
+}
+function validatorFor(file) {
+	const cached = validators.get(file);
+	if (cached !== void 0) return cached;
+	const compiled = new import__2020.Ajv2020({
+		strict: false,
+		allErrors: false,
+		validateFormats: false
+	}).compile(file === "oas-3.3.json" ? patchOas33(schemaFile("oas-3.2.json")) : schemaFile(file));
+	validators.set(file, compiled);
+	return compiled;
+}
+function describeErrors(errors) {
+	return (errors ?? []).slice(0, 5).map((error) => `  ${error.instancePath || "/"} ${error.message ?? ""}`).join("\n");
+}
+/** Validates an OpenAPI 3.1 or 3.2 document against the official JSON Schema, and 3.3 against the pinned patch of 3.2. */
+function validateOpenapi(document) {
+	const version = isRecord(document) ? document["openapi"] : void 0;
+	const match = typeof version === "string" ? /^3\.([123])\.\d+$/u.exec(version) : null;
+	if (match === null) return {
+		ok: false,
+		error: "expected an OpenAPI 3.1, 3.2 or 3.3 document"
+	};
+	const minor = match[1] === "1" ? "3.1" : match[1] === "2" ? "3.2" : "3.3";
+	const validate = validatorFor(`oas-${minor}.json`);
+	if (!validate(document)) return {
+		ok: false,
+		error: `document is not valid OpenAPI ${minor}:\n${describeErrors(validate.errors)}`
+	};
+	return {
+		ok: true,
+		version: minor
+	};
+}
+/** Validates an Overlay 1.1 document against the official JSON Schema. */
+function validateOverlay(document) {
+	const validate = validatorFor("overlay-1.1.json");
+	return validate(document) ? { ok: true } : {
+		ok: false,
+		error: `document is not a valid Overlay 1.1:\n${describeErrors(validate.errors)}`
+	};
+}
+//#endregion
+export { validateOverlay as n, validateOpenapi as t };

package/dist/scim/index.d.ts

@@ -1,2 +1,2 @@
-import { A as ScimPageResult, C as LIST_SCHEMA, D as ScimFilter, E as SCIM_CONTENT_TYPE, M as ScimTokenOptions, N as USER_SCHEMA, O as ScimHandlerOptions, S as GROUP_SCHEMA, T as ROLES_EXTENSION, _ as DirectoryNotFoundError, a as scimHandler, b as DirectoryUser, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryMembershipSourceOptions, h as DirectoryGroup, i as tenantFromPath, j as ScimPatchOp, k as ScimPage, l as resourceTypes, m as DirectoryChange, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryStore, w as PATCH_SCHEMA, x as ERROR_SCHEMA, y as DirectoryUniquenessError } from "../index-C8z4RjQV.js";
-export { type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };
+import { A as ScimPage, C as GROUP_SCHEMA, D as SCIM_CONTENT_TYPE, E as ROLES_EXTENSION, F as isDirectoryNotFoundError, I as isDirectoryUniquenessError, M as ScimPatchOp, N as ScimTokenOptions, O as ScimFilter, P as USER_SCHEMA, S as ERROR_SCHEMA, T as PATCH_SCHEMA, _ as DirectoryMembershipSourceOptions, a as scimHandler, b as DirectoryUniquenessError, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryGroup, h as DirectoryChange, i as tenantFromPath, j as ScimPageResult, k as ScimHandlerOptions, l as resourceTypes, m as APP_DATA_EXTENSION, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryNotFoundError, w as LIST_SCHEMA, x as DirectoryUser, y as DirectoryStore } from "../index-SGdIQyzc.js";
+export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/scim/index.js

@@ -1,2 +1 @@
-import { S as sha256Hex, _ as PATCH_SCHEMA, a as normalizePatchOps, b as USER_SCHEMA, c as parseScimFilter, d as serviceProviderConfig, f as DirectoryNotFoundError, g as LIST_SCHEMA, h as GROUP_SCHEMA, i as tenantFromPath, l as resourceTypes, m as ERROR_SCHEMA, n as directoryMembershipSource, o as filterSupported, p as DirectoryUniquenessError, r as scimHandler, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as ROLES_EXTENSION, x as authenticateScim, y as SCIM_CONTENT_TYPE } from "../scim-BFGBBAqR.js";
-export { DirectoryNotFoundError, DirectoryUniquenessError, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };
+export { f as APP_DATA_EXTENSION, p as DirectoryNotFoundError, m as DirectoryUniquenessError, h as ERROR_SCHEMA, g as GROUP_SCHEMA, _ as LIST_SCHEMA, v as PATCH_SCHEMA, y as ROLES_EXTENSION, b as SCIM_CONTENT_TYPE, x as USER_SCHEMA, w as authenticateScim, n as directoryMembershipSource, o as filterSupported, S as isDirectoryNotFoundError, C as isDirectoryUniquenessError, s as matchFilter, t as memoryDirectoryStore, a as normalizePatchOps, c as parseScimFilter, l as resourceTypes, u as schemas, r as scimHandler, d as serviceProviderConfig, T as sha256Hex, i as tenantFromPath } from "../scim-ClHtpyV3.js";