permdock 0.3.1 → 0.5.0

package/dist/{scopes-CVdPrWN-.js → scopes-CUPSjo9q.js}

@@ -1,5 +1,8 @@
-import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
-import { t as idText } from "./ids-DC4V4CFu.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { i as idText, n as expirySeconds } from "./expiry-D4_YKRKD.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
 //#region src/core/scopes.ts
 const RESERVED = /* @__PURE__ */ new Set(["global", "resource"]);
 const NAME = /^[a-z][a-z0-9_]*$/u;
@@ -94,7 +97,8 @@ function tenantOf(membership, scopes) {
 	const root = rootScope(scopes);
 	return root === void 0 ? void 0 : scopeIdOf(membership, root);
 }
-function isId(value) {
+/** A non-empty string. Unlike `isId` in `./ids.ts` it has no length cap: membership fields come from the app, not the wire. */
+function isNonEmptyString(value) {
 	return typeof value === "string" && value !== "";
 }
 function roleList(value) {
@@ -114,13 +118,22 @@ function normalizeMembership(input, scopes) {
 	const roles = roleList(raw["roles"]);
 	if (roles === void 0) return;
 	const extra = {};
+	if (raw["x"] !== void 0) {
+		const x = readAppData(void 0, raw["x"]);
+		if (x !== void 0) extra.x = freezeCopy(x);
+	}
 	if (typeof raw["via"] === "string") extra.via = raw["via"];
-	if (typeof raw["expiresAt"] === "number") extra.expiresAt = raw["expiresAt"];
+	if (raw["expiresAt"] !== void 0 && raw["expiresAt"] !== null) {
+		const expiresAt = expirySeconds(raw["expiresAt"]);
+		if (expiresAt === void 0) return;
+		extra.expiresAt = expiresAt;
+	}
 	if (typeof raw["grantedBy"] === "string" && raw["grantedBy"] !== "") extra.grantedBy = raw["grantedBy"];
 	if (typeof raw["reason"] === "string" && raw["reason"] !== "") extra.reason = raw["reason"];
 	const eligible = roleList(raw["eligible"]);
 	if (eligible !== void 0 && eligible.length > 0) extra.eligible = Object.freeze([...eligible]);
-	const member = raw["member"] !== null && typeof raw["member"] === "object" && !Array.isArray(raw["member"]) ? raw["member"]["group"] : void 0;
+	const rawMember = raw["member"];
+	const member = isRecord(rawMember) ? rawMember["group"] : void 0;
 	if (typeof member === "string" && member !== "") extra.member = Object.freeze({ group: member });
 	if (raw["managedBy"] === "idp") extra.managedBy = "idp";
 	if (Array.isArray(raw["entitlements"])) {
@@ -128,7 +141,7 @@ function normalizeMembership(input, scopes) {
 		if (seats.length > 0) extra.entitlements = Object.freeze(seats);
 	}
 	if (raw["keep"] !== void 0) {
-		if (!Array.isArray(raw["keep"]) || !raw["keep"].every((key) => typeof key === "string" && key !== "")) return;
+		if (!Array.isArray(raw["keep"]) || !raw["keep"].every(isNonEmptyString)) return;
 		extra.keep = Object.freeze([...raw["keep"]]);
 	}
 	const named = raw["scope"] !== void 0 || raw["id"] !== void 0;
@@ -138,7 +151,7 @@ function normalizeMembership(input, scopes) {
 		if (named || legacy || on === null || typeof on !== "object") return;
 		const target = on;
 		const targetId = idText(target["id"]);
-		if (!isId(target["resource"]) || targetId === void 0) return;
+		if (!isNonEmptyString(target["resource"]) || targetId === void 0) return;
 		return Object.freeze({
 			on: Object.freeze({
 				resource: target["resource"],

package/dist/server/index.d.ts

@@ -1,134 +1,13 @@
-import { $t as CredentialPrincipal, Ct as SettingsSource, Kt as Credential, Nr as Principal, Pr as Subject, Yn as Decision, at as DecisionSink, et as AuthEvent, jt as SubjectResolver, nt as CredentialVerifier } from "../policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Ba264OaJ.js";
-import { t as Disclosure } from "../problem-details-DX075l9V.js";
-import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DPdqI50v.js";
-import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, C as invalidSignatureResponse, D as tenantScope, E as TenantScope, O as Connection, S as invalidSignatureProblem, T as TenantOption, _ as WebBotAuthKeyLookup, a as ScopeGuard, b as WebBotAuthVerifier, c as ServerPermDock, d as createPermDock, f as createServerKernel, g as WebBotAuthJwk, h as InvalidSignatureError, i as ProtectOptions, k as ConnectionData, l as ServerPermDockOptions, m as DiscoverViaSignatureAgentOptions, n as OpenApiHooks, o as ServerKernel, p as createEvaluationsHandler, r as OperationScopes, s as ServerKernelOptions, t as Guard, u as SnapshotQuery, v as WebBotAuthKeys, w as verifyWebBotAuth, x as discoverViaSignatureAgent, y as WebBotAuthOptions } from "../create-B1d519XK.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-B-LxUahj.js";
-//#region src/server/credentials.d.ts
-/** `on('auth')` causes for an API key that resolves to the anonymous subject. */
-type ApiKeyFailureCause = "malformed" | "unknown-credential" | "invalid-claims" | "expired" | "credential-policy" | "credential-revoked" | "owner-unavailable";
-/** An opaque key split at its last `_`: `pdk_<id>_<secret><checksum>`. */
-type ApiKeyParts = {
-  readonly id: string;
-  readonly secret: string;
-};
-/** What an application stores per key: the credential and the key's hash, never the key. */
-type StoredCredential = {
-  readonly credential: Credential;
-  readonly hash: string;
-};
-/**
- * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
- * the secret 43 base62 characters and the checksum the 6 base62 characters of
- * the CRC-32 of everything before it. Anything else, including a checksum
- * that does not match, is `undefined`.
- */
-export declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
-/**
- * A fresh `pdk_<id>_<secret><checksum>`: a 43-character base62 secret (about
- * 256 bits) and a 6-character CRC-32 checksum, so a secret scanner can tell a
- * real key from a lookalike without calling the issuer.
- */
-export declare function generateApiKey(id: string): string;
-/** base64url SHA-256 of the whole key, the value to store and compare. */
-export declare function hashApiKey(key: string): Promise<string>;
-/**
- * A `CredentialVerifier` over the application's own table: `find` looks a
- * key up by the id in it, and the key's hash is compared in constant time.
- * A record that is not a valid v1 credential, or whose id is not the key's,
- * verifies to `null`. A throwing `find` propagates, so the resolver denies
- * with `source-threw`.
- */
-export declare function apiKeyVerifier(options: {
-  readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
-  /** Passed through as the verifier's `touch`, for a `lastUsedAt` column. */
-  readonly touch?: CredentialVerifier["touch"];
-}): CredentialVerifier;
-type MemoryCredentials = CredentialVerifier & {
-  /** Stores `credential` and returns its key; the key is never stored. */
-  issue(credential: Credential): Promise<string>;
-  /** A new secret for the same id; the old key stops verifying at once. */
-  rotate(id: string): Promise<string | undefined>;
-  /** `true` when a credential was removed. */
-  revoke(id: string): boolean;
-  list(): readonly Credential[];
-  /** When `touch` last recorded a use of `id`, in Unix seconds. */
-  lastUsedAt(id: string): number | undefined;
-};
-/**
- * In-process credentials for tests and single-replica apps. `issue`, `rotate`
- * and `revoke` write `credential` events to `sink` when one is given.
- */
-export declare function memoryCredentials(options?: {
-  readonly sink?: DecisionSink;
-  readonly source?: string;
-}): MemoryCredentials;
-type ApiKeySubjectOptions = {
-  readonly verifier: CredentialVerifier;
-  /** The definitions, to turn the credential's permission keys into its delegation. */
-  readonly permissions: PermissionTree;
-  /**
-   * The live owner of a user-bound key: roles and memberships as of this
-   * request. `null` (a deleted or suspended user) is anonymous. Without it
-   * the owner is `{ id, kind: 'user' }` and its rights come from the
-   * `memberships` source passed to `createPermDock`.
-   */
-  readonly owner?: (id: string) => Principal | null | undefined | Promise<Principal | null | undefined>;
-  /** `true` when the application revoked the credential id; a throw denies. */
-  readonly revoked?: (id: string) => boolean | Promise<boolean>;
-  /**
-   * The tenant `credentials` policy, checked on every use so a tightened
-   * policy reaches existing keys: a service key's own tenant, a user key's
-   * the `tenant` the resolver is called with. A throw denies.
-   */
-  readonly settings?: SettingsSource;
-  /** Receives a `credential` event with operation `used` for sampled uses. */
-  readonly sink?: DecisionSink;
-  /** Fraction of uses reported to `sink`, in `(0, 1]`; defaults to 1. */
-  readonly sample?: number;
-  /** The `source` of `used` events; defaults to `permdock`. */
-  readonly source?: string;
-  readonly onAuth?: (event: AuthEvent) => void;
-  readonly requestId?: string;
-};
-/**
- * A `SubjectResolver` for opaque API keys (`pdk_<id>_<secret>`): each call
- * resolves a key into the subject its credential acts as. Every failure (a
- * malformed or unknown key, a record that is not a valid credential, expiry,
- * a tenant policy the key breaks, a revoked id, a missing owner, a throwing
- * verifier or callback) is the anonymous subject, never a throw.
- */
-export declare function subjectFromApiKey(options: ApiKeySubjectOptions): SubjectResolver<string | undefined | null, CredentialPrincipal>;
-//#endregion
-//#region src/server/map-error.d.ts
-type ProblemFromErrorOptions = {
-  readonly instance?: string;
-  /** Whether the request carried credentials, which picks the `401` challenge. */
-  readonly credentials?: boolean;
-};
-/**
- * Turns a thrown PermDock error into its Problem Details response, with the
- * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
- * same decision. Returns `undefined` for anything else so the framework's own
- * error path takes over.
- */
-export declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
-//#endregion
-//#region src/server/problem.d.ts
-export declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
-export declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
-export declare function validationProblem(detail: string): Response;
-export declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
-  readonly instance?: string;
-  readonly approval?: ApprovalHint;
-  /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
-  readonly disclosure?: Disclosure;
-  /** Whether the request carried credentials, which picks the `401` challenge. */
-  readonly credentials?: boolean;
-  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
-  readonly scope?: string;
-}): Response;
-//#endregion
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentials, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type RevocationEvent, type RevocationFeed, type ScopeGuard, type ServerKernel, type ServerKernelOptions, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type TenantOption, type TenantScope, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, invalidSignatureProblem, invalidSignatureResponse, memoryRevocationFeed, snapshotHeaders, snapshotTag, tenantScope, verifyWebBotAuth };
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Bg5Tpluk.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-C2PXIv4c.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-R07lFBnX.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-BLd4MnBX.js";
+import { i as evaluationsHandler } from "../evaluations-16UqqQ6W.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-Chrs5fQ-.js";
+import { l as ReplayStore } from "../types-DiQjupG2.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-6lg8v_is.js";
+import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DqK9eDmM.js";
+import { a as RunKind, c as RunTicketAutomations, d as RunTicketOptions, f as RunTicketSubjectOptions, h as subjectFromRunTicket, i as RunContext, l as RunTicketFailureCause, m as signRunTicket, n as RunAutomation, o as RunPrincipal, p as parseRunTicket, r as RunBinding, s as RunTicket, t as RunActClaim, u as RunTicketInput } from "../run-ticket-BjhTOi6u.js";
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -1,11 +1,14 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-ZfUHbKvf.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
-import { d as wwwAuthenticate, o as problemFromDecision, s as problemResponse, u as validationProblem } from "../problem-B43ztKIm.js";
-import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
-import { a as invalidSignatureProblem, i as discoverViaSignatureAgent, n as createEvaluationsHandler, o as invalidSignatureResponse, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { n as tenantScope } from "../adapter-context-mlWsVGGg.js";
-import { n as createServerKernel, t as createPermDock } from "../create-CMwIl-w2.js";
-import { a as parseApiKey, i as memoryCredentials, n as generateApiKey, o as subjectFromApiKey, r as hashApiKey, t as apiKeyVerifier } from "../server-DlZ28Oz5.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createEvaluationsHandler, createPermDock, createServerKernel, discoverViaSignatureAgent, generateApiKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentials, memoryRevocationFeed, parseApiKey, problemFromDecision, problemFromError, problemResponse, snapshotHeaders, snapshotTag, subjectFromApiKey, tenantScope, validationProblem, verifyWebBotAuth, wwwAuthenticate };
+import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CTviyH5L.js";
+import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DZHQ0KF6.js";
+import { d as discoverViaSignatureAgent, f as invalidSignatureProblem, m as webBotAuthVerifier, o as evaluationsHandler, p as invalidSignatureResponse, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { n as tenantScope } from "../adapter-context-CRhqyzCk.js";
+import { t as createPermDock } from "../create-DnrmLnLW.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-DqCT4CgZ.js";
+import { n as signRunTicket, r as subjectFromRunTicket, t as parseRunTicket } from "../run-ticket-sxFI6LAk.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-DgFFD-Ga.js";
+export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };