permdock 0.4.0 → 0.6.0

package/dist/approvals-DZL76lKW.js

@@ -1,240 +0,0 @@
-import { t as compact } from "./compact-CAf557ZB.js";
-import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
-import { s as rootMembershipId } from "./scopes-tvpa34ep.js";
-import { n as isApprovalError } from "./errors-DRnGZHzF.js";
-import { r as hasCredentials } from "./http-BBoKefeS.js";
-import { u as unauthenticatedProblem } from "./problem-CnWraVhC.js";
-import { n as assertApprover } from "./store-ILkLUj_o.js";
-import { m as approverRelations, p as heldPermissions } from "./helpers-C9YmyBIa.js";
-//#region src/approvals/handler.ts
-function problem(status, title, detail, slug) {
-	const body = {
-		type: `${PROBLEM_BASE}/${slug}`,
-		title,
-		status,
-		detail
-	};
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/problem+json" }
-	});
-}
-function json(status, body) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" }
-	});
-}
-function parseRoute(url, method) {
-	const parts = url.pathname.replace(/\/+$/u, "").split("/").filter(Boolean);
-	const last = parts.at(-1);
-	const prev = parts.at(-2);
-	if (last === void 0) return;
-	if (method === "GET" && last === "pending") return { kind: "pending" };
-	if (method === "GET" && last === "mine") return { kind: "mine" };
-	if (method === "POST" && last === "approve" && prev !== void 0) return {
-		kind: "approve",
-		token: decodeURIComponent(prev)
-	};
-	if (method === "POST" && last === "reject" && prev !== void 0) return {
-		kind: "reject",
-		token: decodeURIComponent(prev)
-	};
-	if (method === "GET" && last !== "pending" && last !== "mine") return {
-		kind: "get",
-		token: decodeURIComponent(last)
-	};
-}
-async function resolveSubject(request, resolve) {
-	try {
-		const subject = await resolve(request);
-		if (subject === null || subject === void 0) return null;
-		return subject;
-	} catch {
-		return null;
-	}
-}
-function membershipTenants(subject) {
-	const principal = subject.principal;
-	if (principal === null) return [];
-	const tenants = /* @__PURE__ */ new Set();
-	if (principal.tenant !== void 0) tenants.add(principal.tenant);
-	for (const membership of principal.memberships ?? []) {
-		const tenant = rootMembershipId(membership);
-		if (tenant !== void 0) tenants.add(tenant);
-	}
-	return [...tenants];
-}
-function belongsToTenant(subject, tenant) {
-	return membershipTenants(subject).includes(tenant);
-}
-async function mayResolve(request, subject, requireDistinct, options) {
-	try {
-		const relations = await approverRelations(request, subject, options);
-		const permissions = await heldPermissions(request, subject, options.permdockFor);
-		assertApprover(request, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* The requester, a tenant member for a tenant request, and for a request
-* without a tenant only who answered it or may answer it.
-*/
-function canView(request, subject, requireDistinct, options) {
-	const principal = subject.principal;
-	if (principal === null) return Promise.resolve(false);
-	if (request.subject.principal?.id === principal.id) return Promise.resolve(true);
-	const tenant = request.subject.principal?.tenant;
-	if (tenant !== void 0) return Promise.resolve(belongsToTenant(subject, tenant));
-	if (request.resolvedBy === principal.id || (request.approvals ?? []).some((item) => item.by === principal.id)) return Promise.resolve(true);
-	return mayResolve(request, subject, requireDistinct, options);
-}
-/**
-* The tenants whose pending requests the approver may list: the requested one,
-* else the active one, else every membership tenant. Requests without a tenant
-* are listed only when no tenant was requested or active.
-*/
-function pageQuery(url) {
-	const limit = url.searchParams.get("limit");
-	const cursor = url.searchParams.get("cursor");
-	return compact({
-		limit: limit === null ? void 0 : Number(limit),
-		cursor: cursor ?? void 0
-	});
-}
-function inboxScope(url, subject) {
-	const requested = url.searchParams.get("tenant");
-	if (requested !== null && requested !== "") {
-		if (!belongsToTenant(subject, requested)) return { ok: false };
-		return {
-			ok: true,
-			tenants: [requested],
-			tenantless: false
-		};
-	}
-	const active = subject.principal?.tenant;
-	if (active !== void 0) return {
-		ok: true,
-		tenants: [active],
-		tenantless: false
-	};
-	return {
-		ok: true,
-		tenants: membershipTenants(subject),
-		tenantless: true
-	};
-}
-function signedApproval(request, signer, audience) {
-	if (signer === void 0 || request.status !== "approved") return Promise.resolve(void 0);
-	const payload = { approval: {
-		token: request.token,
-		permission: request.permission,
-		resource: request.resource,
-		status: request.status
-	} };
-	if (request.subject.principal !== null) payload["sub"] = request.subject.principal.id;
-	return signer.sign(payload, compact({
-		typ: "permdock-approval+jwt",
-		audience,
-		expiresAt: Math.floor(Date.parse(request.expiresAt) / 1e3)
-	}));
-}
-const MAX_BODY_BYTES = 16384;
-const MAX_NOTE_LENGTH = 2e3;
-function tooLarge() {
-	return problem(413, "Payload too large", `request body exceeds ${String(MAX_BODY_BYTES)} bytes`, "payload-too-large");
-}
-/** An unreadable body is no note; an oversized body or note is refused, never truncated. */
-async function readNote(request) {
-	const contentType = request.headers.get("content-type") ?? "";
-	if (request.method !== "POST" || !contentType.includes("application/json")) return {};
-	if (Number(request.headers.get("content-length") ?? 0) > MAX_BODY_BYTES) return { refusal: tooLarge() };
-	try {
-		const text = await request.text();
-		if (text.length > MAX_BODY_BYTES) return { refusal: tooLarge() };
-		const body = JSON.parse(text);
-		if (body !== null && typeof body === "object" && "note" in body && typeof body.note === "string") return body.note.length > MAX_NOTE_LENGTH ? { refusal: problem(400, "Invalid request", `note exceeds ${String(MAX_NOTE_LENGTH)} characters`, "validation") } : { note: body.note };
-	} catch {
-		return {};
-	}
-	return {};
-}
-function mapError(error, credentials) {
-	if (!isApprovalError(error)) return problem(500, "Internal error", "approval store failed", "internal");
-	if (error.code === "approval-not-found") return problem(404, "Not found", error.message, "not-found");
-	if (error.code === "approval-not-pending" || error.code === "approval-expired" || error.code === "approver-repeated") return problem(409, "Conflict", error.message, "conflict");
-	if (error.code === "approver-unauthenticated") return unauthenticatedProblem(credentials);
-	return problem(403, "Permission denied", error.message, "denied");
-}
-function approvalsHandler(store, options) {
-	const requireDistinct = options.requireDistinctApprover === true;
-	return async (request) => {
-		const url = new URL(request.url);
-		const route = parseRoute(url, request.method);
-		if (route === void 0) return problem(405, "Method not allowed", "unknown approvals route", "method-not-allowed");
-		await store.expire();
-		const subject = await resolveSubject(request, options.subject);
-		const principal = subject?.principal ?? null;
-		if (subject === null || principal === null) return unauthenticatedProblem(hasCredentials(request));
-		try {
-			if (route.kind === "pending") {
-				const scoped = inboxScope(url, subject);
-				if (!scoped.ok) return problem(403, "Permission denied", "approver does not belong to that tenant", "denied");
-				const page = await store.list({
-					...pageQuery(url),
-					status: "pending"
-				});
-				const tenants = new Set(scoped.tenants);
-				const eligible = await Promise.all(page.items.map(async (item) => {
-					const tenant = item.subject.principal?.tenant;
-					return (tenant === void 0 ? scoped.tenantless : tenants.has(tenant)) && await mayResolve(item, subject, requireDistinct, options);
-				}));
-				return json(200, compact({
-					items: page.items.filter((_, index) => eligible[index] === true),
-					next: page.next
-				}));
-			}
-			if (route.kind === "mine") {
-				const page = await store.list({
-					...pageQuery(url),
-					principalId: principal.id
-				});
-				return json(200, compact({
-					items: page.items,
-					next: page.next
-				}));
-			}
-			if (route.kind === "get") {
-				const current = await store.get(route.token);
-				if (current === null || !await canView(current, subject, requireDistinct, options)) return problem(404, "Not found", "approval was not found", "not-found");
-				return json(200, current);
-			}
-			const current = await store.get(route.token);
-			if (current === null) return problem(404, "Not found", "approval was not found", "not-found");
-			const relations = await approverRelations(current, subject, options);
-			const permissions = await heldPermissions(current, subject, options.permdockFor);
-			assertApprover(current, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
-			const read = await readNote(request);
-			if (read.refusal !== void 0) return read.refusal;
-			const note = read.note;
-			const resolved = await store.resolve(route.token, compact({
-				status: route.kind === "approve" ? "approved" : "rejected",
-				by: subject,
-				note,
-				relations,
-				permissions
-			}));
-			const signed = await signedApproval(resolved, options.signer, options.audience);
-			return json(200, compact({
-				...resolved,
-				signed
-			}));
-		} catch (error) {
-			return mapError(error, hasCredentials(request));
-		}
-	};
-}
-//#endregion
-export { approvalsHandler as t };

package/dist/arazzo-CD8d0WLb.js

@@ -1,54 +0,0 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/arazzo.ts
-function arazzo(ctx) {
-	return defineCommand({
-		meta: {
-			name: "arazzo",
-			description: COMMAND_DESCRIPTIONS.arazzo
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "check"
-			},
-			doc: {
-				type: "string",
-				description: "Arazzo document",
-				valueHint: "arazzo.json"
-			},
-			openapi: {
-				type: "string",
-				description: "OpenAPI document the workflows call",
-				valueHint: "doc.json"
-			},
-			workflow: {
-				type: "string",
-				description: "Check one workflow",
-				valueHint: "id"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the policy, instead of the config",
-				valueHint: "module"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./arazzo-C4BcskbX.js")).runArazzo({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				doc: listArg(rawArgs, "doc")[0],
-				openapi: stringArg(parsed.openapi),
-				workflow: stringArg(parsed.workflow),
-				from: stringArg(parsed.from),
-				json: ctx.json
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { arazzo };

package/dist/catalog-6yWAX6Ps.js

@@ -1,2 +0,0 @@
-import { t as runCatalog } from "./catalog-tZUyOfOv.js";
-export { runCatalog };

package/dist/catalog-WHG4kBq7.js

@@ -1,48 +0,0 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/catalog.ts
-function catalog(ctx) {
-	return defineCommand({
-		meta: {
-			name: "catalog",
-			description: COMMAND_DESCRIPTIONS.catalog
-		},
-		args: {
-			...globalArgs,
-			format: {
-				type: "enum",
-				options: [
-					"json",
-					"schema",
-					"markdown"
-				],
-				default: "json",
-				description: "Output format"
-			},
-			from: {
-				type: "string",
-				description: "Module exporting the permissions, instead of the config",
-				valueHint: "module"
-			},
-			include: {
-				type: "string",
-				description: "Permission keys or prefixes to keep, repeatable",
-				valueHint: "key"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./catalog-6yWAX6Ps.js")).runCatalog({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				format: parsed.format,
-				from: stringArg(parsed.from),
-				include: listArg(rawArgs, "include"),
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { catalog };

package/dist/cloud-C7bSDgX4.js

@@ -1,50 +0,0 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/cloud.ts
-function cloud(ctx) {
-	return defineCommand({
-		meta: {
-			name: "cloud",
-			description: COMMAND_DESCRIPTIONS.cloud
-		},
-		args: {
-			...globalArgs,
-			action: {
-				type: "positional",
-				required: false,
-				description: "push"
-			},
-			"dry-run": {
-				type: "boolean",
-				description: "Print the payload; send nothing"
-			},
-			url: {
-				type: "string",
-				description: "Cloud API base URL",
-				valueHint: "url"
-			},
-			environment: {
-				type: "string",
-				description: "Target environment",
-				valueHint: "env"
-			}
-		},
-		async run({ args: parsed }) {
-			const result = await (await import("./cloud-PeBN3IEn.js")).runCloud({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				rest: parsed._,
-				url: stringArg(parsed.url),
-				environment: stringArg(parsed.environment),
-				dryRun: parsed["dry-run"] === true,
-				json: ctx.json,
-				env: ctx.io.env ?? process.env,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report(result);
-		}
-	});
-}
-//#endregion
-export { cloud };

package/dist/cloud-PeBN3IEn.js

@@ -1,118 +0,0 @@
-import { t as catalogFingerprint } from "./src-Bb7no-hS.js";
-import { s as snapshotScopes } from "./permdock-L26udHSk.js";
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { i as loadConfiguredPolicy } from "./load-C3_oTHyO.js";
-import { t as parseCatalog } from "./parse-CVFQHk6c.js";
-import { t as runCatalog } from "./catalog-tZUyOfOv.js";
-//#region src/cli/cloud.ts
-function firstNonEmpty(...values) {
-	for (const value of values) if (value !== void 0 && value !== "") return value;
-	return "";
-}
-function pushedGrant(grant) {
-	const entry = {
-		permission: grant.permission.key,
-		effect: grant.effect,
-		role: grant.role,
-		to: grant.to,
-		where: grant.portable ? grant.where : void 0,
-		check: grant.portable ? grant.check : void 0,
-		approval: grant.approval,
-		scope: grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource },
-		portable: grant.portable ? void 0 : false,
-		fields: grant.fields,
-		limit: grant.limit
-	};
-	return Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== void 0));
-}
-/** The code policy as the hosted AuthZEN endpoint evaluates it; closures travel as `portable: false` and deny there. */
-function pushedPolicy(policy) {
-	const scopes = snapshotScopes(policy);
-	return {
-		fingerprint: policy.fingerprint,
-		...scopes === void 0 ? {} : { scopes },
-		grants: policy.grants.filter((grant) => grant.hosted === void 0).map(pushedGrant)
-	};
-}
-async function runCloud(input) {
-	if (input.rest[0] !== "push") return {
-		code: 2,
-		output: `usage: permdock cloud push [--dry-run] [--url <url>] [--environment <env>]`
-	};
-	const built = await runCatalog({
-		cwd: input.cwd,
-		config: input.config,
-		format: "json",
-		from: void 0,
-		include: [],
-		now: input.now,
-		io: input.io
-	});
-	if (built.code !== 0) return {
-		code: built.code,
-		output: built.output
-	};
-	const catalog = parseCatalog(built.output);
-	const fingerprint = catalogFingerprint(catalog);
-	const loaded = await loadConfiguredPolicy(input.cwd, input.config.policy);
-	const policy = loaded === void 0 ? void 0 : pushedPolicy(loaded);
-	const hostable = catalog.permissions.filter((permission) => permission.hostable === true).map((permission) => permission.key);
-	const summary = {
-		fingerprint,
-		permissions: catalog.permissions.length,
-		hostable,
-		roles: (catalog.roles ?? []).length,
-		plans: (catalog.plans ?? []).length,
-		grants: policy?.grants.length ?? 0
-	};
-	const url = firstNonEmpty(input.url, input.env["PERMDOCK_CLOUD_URL"]).replace(/\/$/u, "");
-	const environment = firstNonEmpty(input.environment, input.env["PERMDOCK_CLOUD_ENV"], input.env["VERCEL_ENV"], "production");
-	const describe = (verb) => input.json ? JSON.stringify({
-		...summary,
-		environment,
-		status: verb
-	}) : `${verb} catalog ${fingerprint} (${String(summary.permissions)} permissions, ${String(hostable.length)} hostable) to ${environment}`;
-	if (input.dryRun) return {
-		code: 0,
-		output: describe("would push")
-	};
-	const key = input.env["PERMDOCK_CLOUD_KEY"] ?? "";
-	if (url === "" || key === "") return {
-		code: 2,
-		output: "permdock cloud push needs PERMDOCK_CLOUD_URL (or --url) and PERMDOCK_CLOUD_KEY in the environment"
-	};
-	const fetchFn = input.io.fetch ?? globalThis.fetch.bind(globalThis);
-	let response;
-	try {
-		response = await fetchFn(`${url}/v1/environments/${encodeURIComponent(environment)}/catalog`, {
-			method: "POST",
-			headers: {
-				authorization: `Bearer ${key}`,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify(policy === void 0 ? {
-				fingerprint,
-				catalog
-			} : {
-				fingerprint,
-				catalog,
-				policy
-			})
-		});
-	} catch (error) {
-		return {
-			code: 1,
-			output: `PermDock Cloud unreachable: ${describeError(error)}`
-		};
-	}
-	if (!response.ok) return {
-		code: 1,
-		output: `PermDock Cloud rejected the catalog: HTTP ${String(response.status)}`
-	};
-	return {
-		code: 0,
-		output: describe("pushed")
-	};
-}
-//#endregion
-export { runCloud };

package/dist/collect-Bw2Jdq1q.js

@@ -1,2 +0,0 @@
-import { r as runCollect } from "./collect-2SrB7lfk.js";
-export { runCollect };

package/dist/collect-CQx4hX4N.js

@@ -1,83 +0,0 @@
-import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/collect.ts
-function collect(ctx) {
-	return defineCommand({
-		meta: {
-			name: "collect",
-			description: COMMAND_DESCRIPTIONS.collect
-		},
-		args: {
-			...globalArgs,
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the catalog on disk is stale; write nothing"
-			},
-			src: {
-				type: "string",
-				description: "Source roots or globs, repeatable or comma-separated",
-				valueHint: "path"
-			},
-			out: {
-				type: "string",
-				description: "Catalog file to write",
-				valueHint: "file"
-			},
-			watch: {
-				type: "boolean",
-				description: "Collect again when a source, config or policy file changes"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const src = listArg(rawArgs, "src");
-			const out = stringArg(parsed.out);
-			const overrides = {
-				...src.length > 0 ? { srcPath: src } : {},
-				...out === void 0 ? {} : { out }
-			};
-			if (parsed.watch === true) {
-				if (parsed.check === true) {
-					ctx.report({
-						code: 2,
-						output: "collect: --watch writes the catalog; drop --check"
-					});
-					return;
-				}
-				const { createCollectScheduler } = await import("./watch-C8TpsAl4.js");
-				const scheduler = createCollectScheduler(ctx.cwd, { collect: overrides }, {
-					...ctx.configFile === void 0 ? {} : { configFile: ctx.configFile },
-					report: (message) => {
-						ctx.io.stderr(message ?? "catalog updated");
-					}
-				});
-				let message;
-				try {
-					message = await scheduler.run(false);
-				} catch (error) {
-					message = describeError(error);
-				}
-				scheduler.watch();
-				ctx.report({
-					code: 0,
-					output: message ?? "watching for changes; Ctrl-C to stop"
-				});
-				return;
-			}
-			const result = await (await import("./collect-Bw2Jdq1q.js")).runCollect({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				collect: overrides,
-				check: parsed.check === true,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report({
-				code: result.code,
-				output: result.message
-			});
-		}
-	});
-}
-//#endregion
-export { collect };