permdock 0.4.0 → 0.5.0

package/dist/{supabase-C1TWlnYt.js → supabase-Dxlp8A94.js}

@@ -1,13 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { o as parseCapability } from "./capability-txATtKV4.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-ILkLUj_o.js";
-import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { s as ApprovalError } from "./types-DqzsnlSA.js";
+import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-4u_hxjWa.js";
+import { a as parseCapability } from "./capability-N1K9IpqS.js";
+import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
-import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-B1-b-R0t.js";
-import { i as readMemberships } from "./manifest-BngWKryL.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
+import { t as callRpc } from "./postgrest-CW0IqC-U.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -29,15 +30,19 @@ async function exchangeCapability(subject, options) {
 	if (principal === null || principal.kind !== "link") return;
 	const capability = parseCapability(principal["capability"]);
 	if (capability?.holder !== "link" || capability.id !== principal.id) return;
-	const now = Math.floor(options.now ?? Date.now() / 1e3);
+	const now = nowSeconds(options.now);
 	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
 	const exp = Math.min(now + ttl, Math.floor(capability.expiresAt));
 	if (exp <= now) return;
+	const { id: _id, expiresAt: _expiresAt, cnf: _cnf, ...claim } = capability;
 	const jose = await loadJose();
 	const key = isSecret(options.key) ? new TextEncoder().encode(options.key.secret) : await jose.importJWK(options.key, alg);
 	const jwt = new jose.SignJWT({
 		role: "anon",
-		capability
+		capability: {
+			...claim,
+			expires_at: exp
+		}
 	}).setProtectedHeader(secret ? {
 		alg: "HS256",
 		typ: "JWT"
@@ -93,14 +98,14 @@ function checkMembership(item, path, issues) {
 		"tenant",
 		"team",
 		"via",
-		"grantedBy",
+		"granted_by",
 		"reason"
 	]) optional(item, key, path, issues, isString, "a string");
 	optional(item, "within", path, issues, (value) => isRecord(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
 	optional(item, "on", path, issues, (value) => isRecord(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
-	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
+	optional(item, "expires_at", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
 	optional(item, "member", path, issues, (value) => isRecord(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
-	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
+	optional(item, "managed_by", path, issues, (value) => value === "idp", "'idp'");
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
 	optional(item, "grants", path, issues, isRecord, "an object");
@@ -123,14 +128,20 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
-/** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
+/** The outer level's `kind`: none, `support` with a `session_id`, `impersonation`, or `agent` with optional `tools` and `read_only` and no `session_id`. */
 function checkActKind(level, path, issues) {
 	const marked = own(level, "kind");
 	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
 	optional(level, "reason", path, issues, isString, "a string");
 	if (kind === void 0 || kind === "impersonation") return;
+	if (kind === "agent") {
+		if (own(level, "session_id") !== void 0) issue(issues, [...path, "session_id"], "Expected no session_id on an agent level");
+		optional(level, "tools", path, issues, (value) => isStrings(value) && value.every((tool) => tool !== ""), "an array of non-empty strings");
+		optional(level, "read_only", path, issues, (value) => typeof value === "boolean", "a boolean");
+		return;
+	}
 	if (kind !== "support") {
-		issue(issues, [...path, "kind"], "Expected 'support' or 'impersonation'");
+		issue(issues, [...path, "kind"], "Expected 'support', 'impersonation' or 'agent'");
 		return;
 	}
 	const session = own(level, "session_id");
@@ -222,187 +233,6 @@ function supabaseClaims(options = {}) {
 	});
 }
 //#endregion
-//#region src/supabase/postgrest.ts
-function callRpc(client, schema, fn, args) {
-	return client.schema(schema).rpc(fn, args);
-}
-function strings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-function grantOf(value) {
-	if (!isRecord(value) || typeof value["permission"] !== "string") return;
-	return compact({
-		permission: value["permission"],
-		effect: value["effect"] === "deny" ? "deny" : "allow",
-		level: typeof value["level"] === "string" ? value["level"] : void 0
-	});
-}
-function customRoleOf(value) {
-	if (!isRecord(value) || typeof value["name"] !== "string") return;
-	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
-		const grant = grantOf(item);
-		return grant === void 0 ? [] : [grant];
-	}) : [];
-	const includes = strings(value["includes"]);
-	const body = {
-		name: value["name"],
-		grants,
-		...includes.length === 0 ? {} : { includes }
-	};
-	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
-		...body,
-		scope: "global"
-	} : void 0;
-	if (typeof value["tenant"] !== "string") return;
-	return compact({
-		...body,
-		tenant: value["tenant"],
-		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
-		id: typeof value["id"] === "string" ? value["id"] : void 0
-	});
-}
-function readMemberEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((item) => {
-		if (!isRecord(item) || !isRecord(item["principal"])) return [];
-		const id = item["principal"]["id"];
-		const [membership] = readMemberships([item["membership"]]).memberships;
-		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
-			principal: { id },
-			membership
-		}] : [];
-	});
-}
-function versionOf(value) {
-	const version = typeof value === "string" ? Number(value) : value;
-	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
-}
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
-function readSubjectRecord(value) {
-	if (!isRecord(value) || typeof value["id"] !== "string") return;
-	if (value["active"] !== true) return {
-		id: value["id"],
-		active: false,
-		roles: [],
-		memberships: [],
-		customRoles: []
-	};
-	const version = value["authzVersion"];
-	return compact({
-		id: value["id"],
-		active: true,
-		roles: strings(value["roles"]),
-		memberships: readMemberships(value["memberships"]).memberships,
-		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
-			const role = customRoleOf(item);
-			return role === void 0 ? [] : [role];
-		}) : [],
-		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
-	});
-}
-/**
-* Membership, custom-role and subject sources over the `subject_for(p_user)`,
-* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
-* subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
-*/
-function postgrestSources(client, options = {}) {
-	const api = options.api;
-	const names = api === void 0 ? void 0 : hookApiNames(api.prefix);
-	const schema = options.schema ?? (api === void 0 ? "permdock" : api.schema ?? "public");
-	const fn = options.fn ?? names?.subjectFor ?? "subject_for";
-	const membersFn = options.membersFn ?? names?.membersOf ?? "members_of";
-	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
-	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
-	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const loaded = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const listed = /* @__PURE__ */ new Map();
-	const list = (query) => {
-		const key = JSON.stringify([query.scope, query.id]);
-		const cached = listed.get(key);
-		if (cached !== void 0) return cached.then((entries) => [...entries]);
-		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
-			p_scope: query.scope,
-			p_id: query.id
-		})).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
-			return readMemberEntries(result.data);
-		});
-		listed.set(key, pending);
-		return pending.then((entries) => [...entries]);
-	};
-	const record = (userId) => {
-		const cached = loaded.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
-			return readSubjectRecord(result.data);
-		});
-		loaded.set(userId, pending);
-		return pending;
-	};
-	const version = (userId) => {
-		const read = loaded.get(userId);
-		if (read !== void 0) return read.then((found) => found?.authzVersion);
-		const cached = versions.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
-		versions.set(userId, pending);
-		return pending;
-	};
-	const live = async (userId) => {
-		const found = await record(userId);
-		return found?.active === true ? found : void 0;
-	};
-	return {
-		memberships: {
-			async membershipsFor(principal) {
-				return [...(await live(principal.id))?.memberships ?? []];
-			},
-			version(principal) {
-				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
-			},
-			list
-		},
-		customRoles(principal) {
-			return {
-				async rolesFor(tenant, context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
-				},
-				async globalRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
-				}
-			};
-		},
-		async subject(userId) {
-			const found = await live(userId);
-			if (found === void 0) return {
-				principal: null,
-				context: {}
-			};
-			return {
-				principal: compact({
-					id: found.id,
-					roles: found.roles,
-					memberships: found.memberships,
-					authzVersion: found.authzVersion
-				}),
-				context: {}
-			};
-		},
-		record
-	};
-}
-//#endregion
 //#region src/supabase/approval-store.ts
 /** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
 function requestOf(value) {
@@ -456,10 +286,10 @@ function supabaseApprovalStore(client, options = {}) {
 			if (written === null) throw new ApprovalError("approval-not-pending", "approval is not pending");
 			return written;
 		},
-		async consume(token, now = /* @__PURE__ */ new Date()) {
+		async consume(token, now) {
 			return requestOf(await call("permdock_approval_consume", {
 				p_token: token,
-				p_now: now.toISOString()
+				p_now: dateAt(now).toISOString()
 			}));
 		},
 		async list(query) {
@@ -483,8 +313,8 @@ function supabaseApprovalStore(client, options = {}) {
 				next: encodeApprovalCursor(last)
 			} : { items };
 		},
-		async expire(now = /* @__PURE__ */ new Date()) {
-			const count = await call("permdock_approval_expire", { p_now: now.toISOString() });
+		async expire(now) {
+			const count = await call("permdock_approval_expire", { p_now: dateAt(now).toISOString() });
 			return typeof count === "number" ? count : 0;
 		},
 		async cancel(filter, meta) {
@@ -492,13 +322,76 @@ function supabaseApprovalStore(client, options = {}) {
 				p_filter: filterOf(filter),
 				p_by: meta.by,
 				p_note: meta.note ?? null,
-				p_now: (/* @__PURE__ */ new Date()).toISOString()
+				p_now: isoNow()
 			});
 			return typeof count === "number" ? count : 0;
 		}
 	};
 }
 //#endregion
+//#region src/supabase/approval-delegations.ts
+function rowsOf(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+function instant(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? void 0 : value.toISOString();
+	if (typeof value !== "string") return;
+	const ms = Date.parse(value);
+	return Number.isNaN(ms) ? void 0 : isoAt(ms);
+}
+function list(value) {
+	if (value === null || value === void 0) return;
+	if (!Array.isArray(value)) return false;
+	const items = [];
+	for (const item of value) {
+		if (typeof item !== "string") return false;
+		items.push(item);
+	}
+	return items;
+}
+function delegationOf(row) {
+	const { id, delegator, delegate, tenant } = row;
+	const from = instant(row["from"]);
+	const until = instant(row["until"]);
+	const permissions = list(row["permissions"]);
+	const resources = list(row["resources"]);
+	if (typeof id !== "string" || typeof delegator !== "string" || typeof delegate !== "string" || tenant !== null && typeof tenant !== "string" || from === void 0 || until === void 0 || permissions === false || resources === false) return;
+	return {
+		id,
+		delegator,
+		delegate,
+		...typeof tenant === "string" ? { tenant } : {},
+		...permissions === void 0 ? {} : { permissions },
+		...resources === void 0 ? {} : { resources },
+		from,
+		until
+	};
+}
+/**
+* Approval delegations (out-of-office covers) from the table
+* `rls.approvals.delegations` generates, so `approvalsHandler` and
+* `permdock_is_approver` read the same rows. A cover without a tenant
+* applies everywhere; a malformed row is skipped.
+*/
+function tableApprovalDelegationSource(options) {
+	const table = quoteQualifiedTable(options.table ?? "permdock.approval_delegations");
+	return {
+		name: "table",
+		async delegationsFor(query) {
+			const values = [query.delegate, query.at];
+			let tenant = "d.tenant is null";
+			if (query.tenant !== void 0) {
+				values.push(query.tenant);
+				tenant = "(d.tenant is null or d.tenant = $3)";
+			}
+			return rowsOf(await options.query(`select d.id::text as id, d.delegator::text as delegator, d.delegate::text as delegate, d.tenant::text as tenant, d.permissions, d.resources, d."from", d."until" from ${table} d where d.delegate::text = $1 and d."from" <= $2::timestamptz and $2::timestamptz < d."until" and ${tenant} order by d.id`, values)).flatMap((row) => {
+				const entry = delegationOf(row);
+				return entry === void 0 ? [] : [entry];
+			});
+		}
+	};
+}
+//#endregion
 //#region src/supabase/rls.ts
 function isTable(value) {
 	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
@@ -656,9 +549,9 @@ ${tenantBranch}
     and not ${global("deny")};
 end;`;
 }
-/** A claim membership whose `expiresAt` (epoch seconds) has passed no longer holds its roles. */
-const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expiresAt')
-          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+/** A claim membership whose `expires_at` (epoch seconds) has passed no longer holds its roles. */
+const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expires_at')
+          when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
           else true
         end`;
 function jwtBody(q, scope, custom, suspension) {
@@ -757,4 +650,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-export { readSubjectRecord as a, postgrestSources as i, supabaseRls as n, supabaseClaims as o, supabaseApprovalStore as r, exchangeCapability as s, authorizeSql as t };
+export { supabaseClaims as a, supabaseApprovalStore as i, supabaseRls as n, exchangeCapability as o, tableApprovalDelegationSource as r, authorizeSql as t };

package/dist/supabase-hook-CXcGpHqq.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-DdDQhMlw.js";