permdock 0.3.1 → 0.5.0

package/dist/webmcp/index.js

@@ -1,15 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { _ as listPermissions, h as isRegistryTree, s as getRegistry, t as annotationsFor, x as resourceOfNode } from "../permissions-DVoF6dMt.js";
-import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
-import { a as wireDenials } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { n as isThenable, t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
+import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-Br4jSNVi.js";
+import { n as isThenable, t as ignoreRejection } from "../thenable-yD7SabqG.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-CMLN5xhn.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 const CURRENT = Symbol.for("permdock.current");
 function current(permdock) {
 	const latest = permdock[CURRENT];
@@ -100,43 +96,23 @@ function bindTenant(input, tenantKey, tenant) {
 		}
 	};
 }
-function alternativesOf(decision) {
-	return decision.alternatives.map((leaf) => leaf.key);
-}
 function deniedResult(decision, permission, data) {
-	const described = describe(decision);
-	const alternatives = alternativesOf(decision);
-	const suffix = alternatives.length === 0 ? "" : ` You may: ${alternatives.join(", ")}.`;
-	return {
-		isError: true,
-		content: [{
-			type: "text",
-			text: `Denied: ${permission.key}.${suffix}`
-		}],
-		structuredContent: compact({
-			outcome: "denied",
-			permission: permission.key,
-			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
-			denials: wireDenials(decision.denials),
-			alternatives,
-			detail: described.detail
-		})
-	};
+	return toolErrorResult(deniedToolRefusal(decision, permission, refOf(permission, data)));
 }
 function approvalResult(decision, permission, data) {
+	const refusal = approvalToolRefusal(decision, permission, refOf(permission, data));
 	return {
 		content: [{
 			type: "text",
-			text: describe(decision).detail
+			text: refusal.text
 		}],
-		structuredContent: {
-			outcome: "approval-required",
-			permission: permission.key,
-			resource: resourceRef(permission, permission.kind === "collection" ? void 0 : data),
-			token: decision.token
-		}
+		structuredContent: refusal.structured
 	};
 }
+/** A collection permission names the resource type only, never an id from the input. */
+function refOf(permission, data) {
+	return resourceRef(permission, permission.kind === "collection" ? void 0 : data);
+}
 function validationResult(error) {
 	return {
 		isError: true,

package/dist/where-scope-Dv-WTP-w.js

@@ -0,0 +1,306 @@
+import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
+import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+//#region src/core/snapshot-sign.ts
+/**
+* Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
+* `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
+* registered claims are the only times a verifier reads.
+*/
+function signSnapshot(snapshot, signer, options = {}) {
+	const { issuedAt, expiresAt, ...claim } = snapshot;
+	const payload = { snapshot: claim };
+	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
+	const iat = secondsOf(issuedAt);
+	return signer.sign(payload, compact({
+		typ: "vnd.permdock.snapshot+jwt",
+		audience: options.audience,
+		issuedAt: iat === void 0 || iat <= 0 ? void 0 : iat,
+		expiresAt: secondsOf(expiresAt)
+	}));
+}
+/**
+* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt`
+* taken from `iat` and `exp`; `undefined` when the claim is not an object.
+*/
+function snapshotClaim(claims) {
+	const claim = claims["snapshot"];
+	if (!isRecord(claim)) return;
+	const { issuedAt: _issuedAt, expiresAt: _expiresAt, ...rest } = claim;
+	return compact({
+		...rest,
+		issuedAt: rfc3339(typeof claims.iat === "number" ? claims.iat : 0),
+		expiresAt: typeof claims.exp === "number" ? rfc3339(claims.exp) : void 0
+	});
+}
+/**
+* The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
+* `parseSnapshot` parses it, with `issuedAt` and `expiresAt` from `iat` and
+* `exp`. `null` when the claim is missing or not a valid snapshot.
+*/
+function snapshotFromClaims(claims) {
+	const claim = snapshotClaim(claims);
+	if (claim === void 0) return null;
+	try {
+		return parseSnapshot(claim);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/core/decide-for.ts
+function deniedFor(permission, reason) {
+	return freezeDeep({
+		outcome: "denied",
+		permission: permission.key,
+		denials: [{
+			role: null,
+			reason
+		}],
+		alternatives: []
+	});
+}
+/** Rows are checked like `decide`; `call: 'can'` keeps every limit unconsumed. */
+const PEEK = Object.freeze({ call: "can" });
+/**
+* What `permission` on `row` decides for the principal `principalId` in the
+* caller's active tenant. Never throws, never consumes a limit, and grants
+* the caller nothing: the target is a separate instance with its own caches.
+*/
+async function decideForTarget(caller, principals, create, principalId, permission, row) {
+	if (caller.principal === null) return deniedFor(permission, "anonymous");
+	const tenant = caller.principal.tenant;
+	try {
+		const principal = await loadPrincipal(principals, principalId, tenant);
+		if (principal === null) return deniedFor(permission, "anonymous");
+		const target = await create(principal, tenant);
+		if (tenant !== void 0 && target.subject.principal?.tenant !== tenant && (principal.kind !== "contact" || target.tenants().length > 0)) return deniedFor(permission, "tenant-mismatch");
+		if (row !== void 0) await target.prefetchRelations(permission, [row]);
+		return target.decide(permission, row, PEEK);
+	} catch {
+		return deniedFor(permission, "anonymous");
+	}
+}
+//#endregion
+//#region src/core/may-use.ts
+function delegationMayCover(permission, delegation, hasActor) {
+	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);
+}
+function blocksEveryRow(grant) {
+	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
+}
+/**
+* Whether `permission` could be granted to this instance's subject for some
+* row: the grants its snapshot carries for the active tenant, minus an
+* unconditional deny, within its delegation. A listing hint for tools and
+* skills, never a decision; the call itself is decided in full.
+*/
+function mayUse(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		if (!("grants" in snapshot)) return false;
+		const ceiling = snapshot.delegated;
+		if (ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission)) return false;
+		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		const tenant = permdock.subject.principal?.tenant;
+		const scopes = scopeList(snapshot.scopes);
+		const grants = snapshot.grants.filter((grant) => {
+			if (grant.permission !== permission.key) return false;
+			const owner = grant.membership === void 0 ? void 0 : tenantOf(grant.membership, scopes);
+			return owner === void 0 || owner === tenant;
+		});
+		if (grants.some(blocksEveryRow)) return false;
+		return grants.some((grant) => grant.effect === "allow");
+	} catch {
+		return false;
+	}
+}
+function isConditioned(grant) {
+	return grant.where !== void 0 || grant.check !== void 0 || grant.validity !== void 0 || grant.portable === false;
+}
+/**
+* The instances of `scope` in which the subject holds `permission`, from its
+* live memberships of exactly that scope, within its delegation: by default
+* those with an allow that carries no row condition (`where`, `check`, a
+* validity window or a non-portable test; a `fields` limit is not a row
+* condition), minus the instances any deny of the permission reaches. The
+* in-process mirror of the SQL `permitted_<scope>_ids_by_permission`. With
+* `conditioned: true` it also lists the instances where a conditioned allow
+* applies, minus only unconditional denies, as
+* `permitted_<scope>_ids_by_permission(p_permission, true)` does. A listing,
+* never a decision: a row's own check still runs `can`.
+*/
+function permittedIds(permdock, permission, scope, options = {}) {
+	try {
+		const snapshot = permdock.snapshot({ tenants: "all" });
+		if (!("grants" in snapshot)) return [];
+		const scopes = scopeList(snapshot.scopes);
+		const name = resolveScope(scopes, scope);
+		const ceiling = snapshot.delegated;
+		if (name === void 0 || ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission) || !delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return [];
+		const conditioned = options.conditioned === true;
+		const now = nowSeconds();
+		const allowed = /* @__PURE__ */ new Set();
+		const denied = /* @__PURE__ */ new Set();
+		for (const grant of snapshot.grants) {
+			const membership = grant.membership;
+			if (grant.permission !== permission.key || grant.scope !== name || membership?.scope !== name || membership.id === void 0 || isMembershipExpired(membership, now) || options.within !== void 0 && tenantOf(membership, scopes) !== options.within) continue;
+			if (grant.effect === "deny") {
+				if (!conditioned || !isConditioned(grant)) denied.add(membership.id);
+			} else if ((conditioned || !isConditioned(grant)) && isActive(readWireValidity(grant.validity), now)) allowed.add(membership.id);
+		}
+		return [...allowed].filter((id) => !denied.has(id)).toSorted();
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/core/where-scope.ts
+const ALWAYS = freezeDeep({
+	op: "eq",
+	field: "_",
+	value: true
+});
+function eq(field, value) {
+	return value === void 0 ? {
+		op: "or",
+		conditions: []
+	} : {
+		op: "eq",
+		field,
+		value
+	};
+}
+/** One equality per partitioning scope key on the membership's chain, outermost first. */
+function namedFilters(membership, scope) {
+	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
+	const filters = [];
+	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
+		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
+		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
+	}
+	return filters;
+}
+/**
+* The row filters a grant's membership implies, or `null` when the grant
+* reaches no row in this scope (another tenant, no active tenant, expired).
+*/
+function scopeFilters(grant, scope) {
+	if (grant.scope === void 0) return [];
+	const membership = grant.membership;
+	if (membership === void 0 || isMembershipExpired(membership, scope.now)) return null;
+	if (typeof grant.scope === "string") return membership.scope === grant.scope ? namedFilters(membership, scope) : null;
+	const on = membership.on;
+	if (on === void 0) return null;
+	if (scope.resources === void 0) return on.resource === grant.scope.resource && on.resource === scope.resource ? [eq("id", on.id)] : null;
+	const roleResource = scope.resources.get(grant.scope.resource);
+	if (on.resource !== grant.scope.resource && membershipField(roleResource, on.resource, scope.resources) === void 0) return null;
+	const walked = scope.graph === true ? resourceRoleCondition(scope.resources.get(scope.resource), on.resource, [on.id], scope.resources) : void 0;
+	if (walked !== void 0) return [walked];
+	const field = membershipField(scope.resources.get(scope.resource), on.resource, scope.resources);
+	return field === void 0 ? null : [eq(field, on.id)];
+}
+function all(conditions) {
+	if (conditions.length === 0) return ALWAYS;
+	return sole(conditions) ?? {
+		op: "and",
+		conditions: [...conditions]
+	};
+}
+function scopedCondition(grant, scope) {
+	const filters = scopeFilters(grant, scope);
+	if (filters === null) return null;
+	const parts = grant.where === void 0 ? filters : [...filters, grant.where];
+	return parts.length === 0 ? "always" : all(parts);
+}
+/** Whether an unconditional `deny` removes every row `allow` could reach. */
+function covers(deny, allow, scopes) {
+	if (deny.where !== void 0) return false;
+	const denied = deny.membership;
+	if (deny.scope === void 0 || denied === void 0) return deny.scope === void 0;
+	const allowed = allow.membership;
+	if (allowed === void 0) return false;
+	if (typeof deny.scope === "object") return typeof allow.scope === "object" && denied.on?.resource === allowed.on?.resource && denied.on?.id === allowed.on?.id;
+	if (typeof allow.scope !== "string" || allowed.scope === void 0) return false;
+	const chain = scopeChain(scopes, deny.scope);
+	return scopeChain(scopes, allowed.scope).includes(deny.scope) && chain.every((name) => scopeIdOf(allowed, name) === scopeIdOf(denied, name));
+}
+/**
+* The portable filter for one permission's grants: allows OR together, each
+* narrowed to its membership's tenant, team or resource; any applicable
+* portable deny is subtracted, and an unconditional one empties the result.
+*/
+function collect(grants, scope) {
+	const none = {
+		op: "or",
+		conditions: []
+	};
+	const partial = grants.some((grant) => grant.portable === false);
+	const denies = [];
+	for (const grant of grants) {
+		if (grant.effect !== "deny" || grant.portable === false || !isActive(readWireValidity(grant.validity, "deny"), scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === "always") return {
+			condition: none,
+			partial
+		};
+		if (condition !== null) denies.push({
+			grant,
+			condition
+		});
+	}
+	const parts = [];
+	for (const grant of grants) {
+		if (grant.effect !== "allow" || grant.portable === false || !isActive(readWireValidity(grant.validity), scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === null || denies.some((deny) => covers(deny.grant, grant, scope.scopes))) continue;
+		parts.push(all([...condition === "always" ? [] : [condition], ...denies.map((deny) => ({
+			op: "not",
+			condition: deny.condition
+		}))]));
+	}
+	if (parts.length === 0) return {
+		condition: none,
+		partial
+	};
+	return {
+		condition: sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		},
+		partial
+	};
+}
+/**
+* `collect`, with every subject ref bound to `scope.subject` and the subject
+* attached (not enumerable) for `memberOf`, which needs its memberships.
+*/
+function whereFromGrants(grants, scope) {
+	const { condition, partial } = collect(grants, scope);
+	const result = {
+		condition: bindConditionRefs(condition, scope.subject),
+		partial
+	};
+	Object.defineProperty(result, "subject", {
+		value: scope.subject,
+		enumerable: false
+	});
+	Object.defineProperty(result, "scopes", {
+		value: scope.scopes,
+		enumerable: false
+	});
+	if (scope.resources !== void 0) Object.defineProperty(result, "resources", {
+		value: scope.resources,
+		enumerable: false
+	});
+	return freezeDeep(result);
+}
+//#endregion
+export { deniedFor as a, snapshotFromClaims as c, decideForTarget as i, mayUse as n, signSnapshot as o, permittedIds as r, snapshotClaim as s, whereFromGrants as t };