permdock 0.4.0 → 0.5.0

package/dist/delegation-DaXVdDhM.js

@@ -0,0 +1,286 @@
+import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-K6eWUJ0H.js";
+import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
+import { t as isoInstant } from "./instant-BluqDvyS.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { t as isActive } from "./validity-CZ7-y0Cj.js";
+import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+//#region src/conditions/evaluate.ts
+function resolveRef(ref, subject) {
+	return resolveConditionRef(ref, subject);
+}
+function unwrap(value, subject) {
+	if (isConditionRef(value)) return resolveRef(value.ref, subject);
+	if (isConditionDate(value)) return new Date(isoInstant(value.date) ?? NaN);
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+function instantOf(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") return isoInstant(value);
+}
+function comparablePair(left, right) {
+	if (left instanceof Date || right instanceof Date) {
+		const a = instantOf(left);
+		const b = instantOf(right);
+		return a === void 0 || b === void 0 ? void 0 : [a, b];
+	}
+	const kind = typeof left;
+	if (kind === typeof right && (kind === "string" || kind === "number" || kind === "boolean")) return [left, right];
+}
+function compare(op, left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	const comparable = comparablePair(left, right);
+	if (comparable === void 0) return false;
+	const [a, b] = comparable;
+	switch (op) {
+		case "eq": return a === b;
+		case "ne": return a !== b;
+		case "gt": return a > b;
+		case "gte": return a >= b;
+		case "lt": return a < b;
+		case "lte": return a <= b;
+		default: return op;
+	}
+}
+function contains(left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	if (typeof left === "string" && typeof right === "string") return left.includes(right);
+	if (Array.isArray(left)) return left.includes(right);
+	return false;
+}
+function inList(left, right) {
+	if (left === void 0 || left === null || !Array.isArray(right)) return false;
+	return right.includes(left);
+}
+function matchesParentHop(data, parents, on) {
+	for (const parent of parents ?? []) {
+		const hop = parentHop(parent);
+		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
+		if (sameId(ownGet(data, hop.field), on.id)) return true;
+	}
+	return false;
+}
+function evaluateMemberOf(condition, data, subject, now, scopes) {
+	if (data === null || typeof data !== "object") return false;
+	const rowValue = ownGet(data, condition.field);
+	if (rowValue === void 0 || rowValue === null) return false;
+	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return false;
+	for (const membership of memberships) {
+		if (expiredAt(membership, now)) continue;
+		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
+		if (scope !== void 0) {
+			if (membership.scope !== scope || !sameId(membership.id, rowValue)) continue;
+			const tenant = tenantOf(membership, scopes);
+			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
+			return true;
+		}
+		if (membership.on === void 0) continue;
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) {
+			if (matchesParentHop(data, condition.parents, membership.on)) return true;
+			continue;
+		}
+		if (sameId(membership.on.id, rowValue)) return true;
+		if (matchesParentHop(data, condition.parents, membership.on)) return true;
+	}
+	return false;
+}
+function evaluateCondition(condition, data, subject, now = epochSeconds(), scopes = scopeList(void 0), related, onOpaque) {
+	switch (condition.op) {
+		case "and": return condition.conditions.every((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "or": return condition.conditions.some((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "not": return !evaluateCondition(condition.condition, data, subject, now, scopes, related, onOpaque);
+		case "isNull": {
+			if (data === null || typeof data !== "object") return false;
+			const value = ownGet(data, condition.field);
+			const isNull = value === null || value === void 0;
+			return condition.value ? isNull : !isNull;
+		}
+		case "in":
+		case "notIn": {
+			if (data === null || typeof data !== "object") return false;
+			const left = ownGet(data, condition.field);
+			const matched = inList(left, unwrap(condition.value, subject));
+			return condition.op === "in" ? matched : !matched && left !== void 0 && left !== null;
+		}
+		case "contains":
+			if (data === null || typeof data !== "object") return false;
+			return contains(ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (condition.field === "_" && condition.op === "eq") return condition.value === true;
+			if (data === null || typeof data !== "object") return false;
+			return compare(condition.op, ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "memberOf": return evaluateMemberOf(condition, data, subject, now, scopes);
+		case "related": return related?.(condition, data) === true;
+		case "sqlFunction": return evaluateCondition(condition.twin, data, subject, now, scopes, related, onOpaque);
+		case "opaque":
+			onOpaque?.();
+			return false;
+		case "liveSession": return subject.liveSession === true;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/core/row-pair.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+/**
+* The row a `where` reads and the row a `check` reads. An instance check
+* takes a `{ current, next }` pair or one row for both; a collection check
+* has no current row, only the input it creates.
+*/
+function rowValues(permission, data) {
+	if (permission.kind === "collection") return {
+		current: void 0,
+		next: data
+	};
+	if (permission.kind === "instance" && isRowPair(data)) return {
+		current: data.current,
+		next: data.next
+	};
+	return {
+		current: data,
+		next: data
+	};
+}
+/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+function rowIdOf(row, field = "id") {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
+	const id = Reflect.get(row, field);
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+}
+//#endregion
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+/** A `readOnly` actor never uses a permission without `readOnlyHint`, delegated or not. */
+function readOnlyActorRefuses(actor, permission) {
+	return actor?.readOnly === true && !annotationsFor(permission).readOnlyHint;
+}
+/**
+* Whether an `agent` actor may call the tool `name`: its `tools` list names it.
+* An agent without a `tools` list and any other actor kind are not restricted
+* here; a `tools` value that is not a list of strings refuses every tool.
+*/
+function actorMayCallTool(actor, name) {
+	if (actor?.kind !== "agent" || !Object.hasOwn(actor, "tools")) return true;
+	const tools = actor["tools"];
+	return Array.isArray(tools) && tools.some((tool) => typeof tool === "string" && tool === name);
+}
+function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
+	return (requires ?? []).every((key) => {
+		const leaf = findPermission(tree, key);
+		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
+	});
+}
+function requiresStandIn(grant) {
+	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
+export { readOnlyActorRefuses as a, rowIdOf as c, delegatedPermissions as i, rowValues as l, coveredByDelegation as n, requiresStandIn as o, coversRequirements as r, isRowPair as s, actorMayCallTool as t, evaluateCondition as u };

package/dist/delivery/index.d.ts

@@ -0,0 +1,5 @@
+import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-DzwivBgR.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-DX0LaKTb.js";
+import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-BcHcPyIo.js";
+export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, type ChatMessage, type ChatTransport, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type Recipient, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -0,0 +1,5 @@
+import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+import { n as subscribersFor, t as audience } from "../audience-Dg8XsRaO.js";
+import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
+import { n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-DCAgNyCn.js";
+export { approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };