permdock 0.5.0 → 0.7.0

package/dist/{postgrest-NUqZT-RB.d.ts → postgrest-CYacM_u7.d.ts}

@@ -1,4 +1,4 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, Zn as CustomRole, et as MembershipSource, ir as Subject, nr as Membership } from "./policy-types-DzwivBgR.js";
+import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-B-F-qAZk.js";
 //#region src/supabase/postgrest.d.ts
 /** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
 type SupabaseRpcResult = {
@@ -58,6 +58,8 @@ type SubjectRecord = {
   readonly memberships: readonly Membership[];
   readonly customRoles: readonly CustomRole[];
   readonly authzVersion?: number;
+  /** The token claims the hook adds besides the memberships: `team_ids` and each `supabase.hook.claims` entry. */
+  readonly claims?: Readonly<Record<string, unknown>>;
 };
 type PostgrestSources = {
   /**
@@ -78,6 +80,15 @@ type PostgrestSources = {
   }): CustomRoleSource;
   /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
   subject(userId: string): Promise<Subject>;
+  /**
+   * `subject` with its principal read again: roles, memberships and
+   * authorization version come from the database, the token's other claims
+   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context
+   * are kept as they were, so a refreshed OAuth client keeps its ceiling. An
+   * unknown or suspended user becomes a subject with no principal that still
+   * carries the actor and delegation. A subject with no principal is returned as is.
+   */
+  refresh<P extends Principal>(subject: Subject<P>): Promise<Subject<P>>;
   /** The raw record, `undefined` for an unknown user. */
   record(userId: string): Promise<SubjectRecord | undefined>;
 };

package/dist/{postgrest-CW0IqC-U.js → postgrest-r5faDIzD.js}

@@ -5,7 +5,7 @@ import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
 import { t as clientNameOf } from "./clients-DjU5ABMy.js";
 import "./budget-NbEtbJC_.js";
-import { a as hookApiNames } from "./sources-vs5dGOsS.js";
+import { a as hookApiNames } from "./sources-B-zYB4GS.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -409,10 +409,15 @@ function customRoleOf(value) {
 		grants,
 		...includes.length === 0 ? {} : { includes }
 	};
-	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
+	if (value["scope"] === "global") return value["tenant"] === void 0 && value["shared"] === void 0 ? {
 		...body,
 		scope: "global"
 	} : void 0;
+	if (value["shared"] === true) return value["tenant"] === void 0 && value["id"] === void 0 ? compact({
+		...body,
+		shared: true,
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0
+	}) : void 0;
 	if (typeof value["tenant"] !== "string") return;
 	return compact({
 		...body,
@@ -457,7 +462,8 @@ function readSubjectRecord(value) {
 			const role = customRoleOf(item);
 			return role === void 0 ? [] : [role];
 		}) : [],
-		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
+		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0,
+		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
 /**
@@ -529,7 +535,10 @@ function postgrestSources(client, options = {}) {
 			version(principal) {
 				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
 			},
-			list
+			list,
+			async globalRolesFor(principal) {
+				return [...(await live(principal.id))?.roles ?? []];
+			}
 		},
 		customRoles(principal) {
 			return {
@@ -540,6 +549,10 @@ function postgrestSources(client, options = {}) {
 				async globalRoles(context) {
 					if (onlyDeclared(context?.held)) return [];
 					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
+				},
+				async sharedRoles(context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.shared === true);
 				}
 			};
 		},
@@ -554,11 +567,40 @@ function postgrestSources(client, options = {}) {
 					id: found.id,
 					roles: found.roles,
 					memberships: found.memberships,
-					authzVersion: found.authzVersion
+					authzVersion: found.authzVersion,
+					claims: found.claims
 				}),
 				context: {}
 			};
 		},
+		async refresh(subject) {
+			const current = subject.principal;
+			if (current === null) return subject;
+			const found = await live(current.id);
+			if (found === void 0) {
+				const { stale: _stale, ...kept } = subject;
+				return {
+					...kept,
+					principal: null
+				};
+			}
+			const { membershipsTruncated: _truncated, ...rest } = current;
+			const { stale: _stale, ...kept } = subject;
+			const principal = compact({
+				...rest,
+				roles: found.roles,
+				memberships: found.memberships,
+				authzVersion: found.authzVersion,
+				claims: found.claims === void 0 ? rest["claims"] : {
+					...isRecord(rest["claims"]) ? rest["claims"] : {},
+					...found.claims
+				}
+			});
+			return {
+				...kept,
+				principal
+			};
+		},
 		record
 	};
 }

package/dist/{powersync-BHfuehf3.js → powersync-13odBwiM.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,