permdock 0.5.0 → 0.7.0

package/dist/testing/fixtures/index.js

@@ -0,0 +1,770 @@
+import { n as parseSupabaseManifest } from "../../manifest-B79YuF2T.js";
+import { t as parseCatalog } from "../../parse-Ddhz2xf4.js";
+//#region src/testing/fixtures/better-supabase.catalog.json
+var better_supabase_catalog_default = {
+	$schema: "https://permdock.com/schemas/catalog-v1.json",
+	version: 1,
+	generatedAt: "2026-10-21T08:41:54.277Z",
+	generator: "permdock@0.6.0",
+	fingerprint: "sha-256:xLa3QGuqXtLe6WtPEyf2NaV_qr0vBW2qg2jRN5rBJdA",
+	resources: {
+		"staff": {
+			"id": "id",
+			"schema": {
+				"$schema": "https://json-schema.org/draft/2020-12/schema",
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"organization_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"user_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"name": { "type": "string" },
+					"title": { "type": "string" }
+				},
+				"required": [
+					"id",
+					"organization_id",
+					"user_id",
+					"name",
+					"title"
+				],
+				"additionalProperties": false
+			},
+			"definedIn": "src/permissions.ts",
+			"relations": { "organization": {
+				"field": "organization_id",
+				"memberOf": "organization"
+			} }
+		},
+		"quotes": {
+			"id": "id",
+			"schema": {
+				"$schema": "https://json-schema.org/draft/2020-12/schema",
+				"type": "object",
+				"properties": {
+					"id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"organization_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"customer_id": {
+						"type": "string",
+						"format": "uuid",
+						"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
+					},
+					"title": { "type": "string" },
+					"amount_minor": {
+						"type": "integer",
+						"minimum": -9007199254740991,
+						"maximum": 9007199254740991
+					},
+					"currency": {
+						"type": "string",
+						"minLength": 3,
+						"maxLength": 3
+					}
+				},
+				"required": [
+					"id",
+					"organization_id",
+					"customer_id",
+					"title",
+					"amount_minor",
+					"currency"
+				],
+				"additionalProperties": false
+			},
+			"definedIn": "src/permissions.ts",
+			"relations": {
+				"organization": {
+					"field": "organization_id",
+					"memberOf": "organization"
+				},
+				"customer": {
+					"field": "customer_id",
+					"memberOf": "customer"
+				}
+			}
+		},
+		"audit": {
+			"id": "id",
+			"schema": null,
+			"definedIn": "src/permissions.ts"
+		}
+	},
+	permissions: [
+		{
+			"key": "audit.revert",
+			"scope": "audit:revert",
+			"resource": "audit",
+			"action": "revert",
+			"arity": "collection",
+			"meta": {},
+			"usages": [{
+				"file": "src/policy.ts",
+				"line": 29,
+				"call": "reference"
+			}],
+			"rowConditions": false
+		},
+		{
+			"key": "audit.view",
+			"scope": "audit:view",
+			"resource": "audit",
+			"action": "view",
+			"arity": "collection",
+			"meta": {},
+			"usages": [{
+				"file": "src/policy.ts",
+				"line": 28,
+				"call": "reference"
+			}],
+			"rowConditions": false
+		},
+		{
+			"key": "quotes.list",
+			"scope": "quotes:list",
+			"resource": "quotes",
+			"action": "list",
+			"arity": "collection",
+			"meta": {},
+			"usages": [
+				{
+					"file": "src/agent/tools.ts",
+					"line": 80,
+					"call": "tools"
+				},
+				{
+					"file": "src/app/[locale]/(app)/[orgSlug]/nav.tsx",
+					"line": 29,
+					"call": "tools"
+				},
+				{
+					"file": "src/app/[locale]/(app)/[orgSlug]/quotes/page.tsx",
+					"line": 16,
+					"call": "reference"
+				},
+				{
+					"file": "src/app/[locale]/(portal)/portal/[orgSlug]/quotes/page.tsx",
+					"line": 16,
+					"call": "reference"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 26,
+					"call": "reference"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 41,
+					"call": "reference"
+				}
+			],
+			"rowConditions": false
+		},
+		{
+			"key": "quotes.read",
+			"scope": "quotes:read",
+			"resource": "quotes",
+			"action": "read",
+			"arity": "instance",
+			"meta": {},
+			"usages": [
+				{
+					"file": "src/lib/share.ts",
+					"line": 51,
+					"call": "can"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 25,
+					"call": "reference"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 41,
+					"call": "reference"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 45,
+					"call": "allow"
+				}
+			],
+			"rowConditions": false
+		},
+		{
+			"key": "quotes.update",
+			"scope": "quotes:update",
+			"resource": "quotes",
+			"action": "update",
+			"arity": "instance",
+			"meta": {},
+			"usages": [{
+				"file": "src/agent/tools.ts",
+				"line": 82,
+				"call": "tools"
+			}, {
+				"file": "src/policy.ts",
+				"line": 27,
+				"call": "reference"
+			}],
+			"rowConditions": false
+		},
+		{
+			"key": "staff.list",
+			"scope": "staff:list",
+			"resource": "staff",
+			"action": "list",
+			"arity": "collection",
+			"meta": {},
+			"usages": [
+				{
+					"file": "src/app/[locale]/(app)/[orgSlug]/nav.tsx",
+					"line": 23,
+					"call": "tools"
+				},
+				{
+					"file": "src/app/[locale]/(app)/[orgSlug]/staff/page.tsx",
+					"line": 50,
+					"call": "reference"
+				},
+				{
+					"file": "src/app/api/staff/route.ts",
+					"line": 12,
+					"call": "tools"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 24,
+					"call": "reference"
+				},
+				{
+					"file": "src/policy.ts",
+					"line": 36,
+					"call": "reference"
+				}
+			],
+			"rowConditions": false
+		},
+		{
+			"key": "staff.read",
+			"scope": "staff:read",
+			"resource": "staff",
+			"action": "read",
+			"arity": "instance",
+			"meta": {},
+			"usages": [{
+				"file": "src/policy.ts",
+				"line": 23,
+				"call": "reference"
+			}, {
+				"file": "src/policy.ts",
+				"line": 36,
+				"call": "reference"
+			}],
+			"rowConditions": false
+		}
+	],
+	scopes: [{
+		"name": "organization",
+		"key": "organization_id"
+	}, {
+		"name": "customer",
+		"key": "customer_id",
+		"within": "organization"
+	}],
+	roles: [
+		{
+			"key": "contact",
+			"on": "customer",
+			"assignable": false
+		},
+		{
+			"key": "guest",
+			"on": "resource",
+			"assignable": true
+		},
+		{
+			"key": "member",
+			"on": "organization",
+			"assignable": true
+		},
+		{
+			"key": "owner",
+			"on": "organization",
+			"assignable": true,
+			"min": 1
+		}
+	],
+	grants: [
+		{
+			"permission": "audit.revert",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "audit.view",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "quotes.list",
+			"effect": "allow",
+			"role": "contact",
+			"to": {
+				"kind": "role",
+				"role": "contact",
+				"scope": "customer"
+			},
+			"scope": "customer"
+		},
+		{
+			"permission": "quotes.list",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "quotes.read",
+			"effect": "allow",
+			"role": "contact",
+			"to": {
+				"kind": "role",
+				"role": "contact",
+				"scope": "customer"
+			},
+			"scope": "customer"
+		},
+		{
+			"permission": "quotes.read",
+			"effect": "allow",
+			"role": "guest",
+			"to": {
+				"kind": "role",
+				"role": "guest",
+				"scope": { "resource": "quotes" }
+			},
+			"scope": { "resource": "quotes" }
+		},
+		{
+			"permission": "quotes.read",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "quotes.update",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "staff.list",
+			"effect": "allow",
+			"role": "member",
+			"to": {
+				"kind": "role",
+				"role": "member",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "staff.list",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "staff.read",
+			"effect": "allow",
+			"role": "member",
+			"to": {
+				"kind": "role",
+				"role": "member",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
+		{
+			"permission": "staff.read",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		}
+	],
+	delegations: [{
+		"from": {
+			"kind": "role",
+			"role": "owner",
+			"scope": "organization"
+		},
+		"to": { "kind": "agent" },
+		"permissions": [
+			"quotes.list",
+			"quotes.read",
+			"quotes.update"
+		]
+	}, {
+		"from": {
+			"kind": "role",
+			"role": "owner",
+			"scope": "organization"
+		},
+		"to": { "kind": "support" },
+		"permissions": [
+			"quotes.list",
+			"quotes.read",
+			"quotes.update"
+		]
+	}]
+};
+//#endregion
+//#region src/testing/fixtures/better-supabase.manifest.json
+var better_supabase_manifest_default = {
+	$schema: "https://permdock.com/schemas/supabase-manifest-v1.json",
+	version: 1,
+	hook: {
+		"schema": "permdock",
+		"function": "custom_access_token_hook",
+		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
+		"schemas": "pg-delta"
+	},
+	helpers: {
+		"schema": "permdock",
+		"functions": [
+			"permdock_has",
+			"permitted_organization_ids",
+			"member_organization_ids",
+			"member_organization_ids_for",
+			"permitted_customer_ids",
+			"member_customer_ids",
+			"member_customer_ids_for"
+		]
+	},
+	tenantClaim: "tenant_id",
+	budget: {
+		"bytes": 1024,
+		"measure": "octet_length(memberships::text) + octet_length(attrs::text)"
+	},
+	claims: [
+		{
+			"name": "user_role",
+			"source": "permdock",
+			"budget": false
+		},
+		{
+			"name": "roles",
+			"source": "permdock",
+			"budget": false
+		},
+		{
+			"name": "memberships",
+			"source": "permdock",
+			"budget": true
+		},
+		{
+			"name": "memberships_truncated",
+			"source": "permdock",
+			"budget": false
+		},
+		{
+			"name": "tenant_id",
+			"source": "permdock",
+			"budget": false
+		},
+		{
+			"name": "authz_ver",
+			"source": "permdock",
+			"budget": false
+		},
+		{
+			"name": "datetime_preferences",
+			"source": "public.datetime_preference_claims",
+			"budget": false
+		},
+		{
+			"name": "features",
+			"source": "public.feature_claims",
+			"budget": false
+		}
+	],
+	authzVersion: true,
+	authzVersionBump: {
+		"schema": "permdock",
+		"function": "permdock_bump_authz_version_for",
+		"args": "p_users uuid[]"
+	},
+	memberships: [{
+		"table": "public.memberships",
+		"user": { "column": "user_id" },
+		"scope": { "column": "scope" },
+		"id": { "column": "scope_id" },
+		"role": { "column": "role" },
+		"columns": [
+			"user_id",
+			"scope",
+			"scope_id",
+			"role"
+		]
+	}, {
+		"table": "public.contacts",
+		"user": { "column": "user_id" },
+		"scope": { "value": "customer" },
+		"id": { "column": "customer_id" },
+		"role": { "value": ["contact"] },
+		"within": { "columns": { "organization": "organization_id" } },
+		"via": { "value": "contact" },
+		"columns": [
+			"user_id",
+			"customer_id",
+			"organization_id"
+		]
+	}],
+	rls: {
+		"schema": "permdock",
+		"mode": "database",
+		"tenantClaim": "tenant_id",
+		"scopes": [{
+			"name": "organization",
+			"type": "uuid"
+		}, {
+			"name": "customer",
+			"type": "uuid",
+			"within": "organization"
+		}],
+		"helpers": [
+			{
+				"name": "permdock_has",
+				"args": "p_grant text",
+				"returns": "boolean",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "permitted_organization_ids",
+				"args": "p_grant text",
+				"returns": "setof uuid",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "member_organization_ids",
+				"args": "",
+				"returns": "setof uuid",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "member_organization_ids_for",
+				"args": "p_user uuid",
+				"returns": "setof uuid",
+				"execute": ["supabase_auth_admin"]
+			},
+			{
+				"name": "permitted_customer_ids",
+				"args": "p_grant text",
+				"returns": "setof uuid",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "member_customer_ids",
+				"args": "",
+				"returns": "setof uuid",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "member_customer_ids_for",
+				"args": "p_user uuid",
+				"returns": "setof uuid",
+				"execute": ["supabase_auth_admin"]
+			},
+			{
+				"name": "permdock_user_id",
+				"args": "",
+				"returns": "uuid",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "permdock_actor_may_write",
+				"args": "",
+				"returns": "boolean",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "permdock_is_approver",
+				"args": "p_approvers jsonb, p_tenant text, p_requester text, p_resource text",
+				"returns": "boolean",
+				"execute": ["authenticated"]
+			},
+			{
+				"name": "permdock_has_for",
+				"args": "p_user uuid, p_grant text",
+				"returns": "boolean",
+				"execute": []
+			},
+			{
+				"name": "permitted_organization_ids_for",
+				"args": "p_user uuid, p_grant text",
+				"returns": "setof uuid",
+				"execute": []
+			},
+			{
+				"name": "permitted_customer_ids_for",
+				"args": "p_user uuid, p_grant text",
+				"returns": "setof uuid",
+				"execute": []
+			},
+			{
+				"name": "permitted_organization_permission_keys_for",
+				"args": "p_user uuid, p_id uuid",
+				"returns": "setof text",
+				"execute": []
+			},
+			{
+				"name": "permitted_customer_permission_keys_for",
+				"args": "p_user uuid, p_id uuid",
+				"returns": "setof text",
+				"execute": []
+			},
+			{
+				"name": "permitted_organization_users",
+				"args": "p_permission text, p_id uuid",
+				"returns": "setof uuid",
+				"execute": []
+			},
+			{
+				"name": "permitted_customer_users",
+				"args": "p_permission text, p_id uuid",
+				"returns": "setof uuid",
+				"execute": []
+			}
+		],
+		"memberships": [{
+			"table": "public.memberships",
+			"user": { "column": "user_id" },
+			"scope": { "column": "scope" },
+			"id": { "column": "scope_id" },
+			"role": { "column": "role" },
+			"columns": [
+				"user_id",
+				"scope",
+				"scope_id",
+				"role"
+			]
+		}, {
+			"table": "public.contacts",
+			"user": { "column": "user_id" },
+			"scope": { "value": "customer" },
+			"id": { "column": "customer_id" },
+			"role": { "value": ["contact"] },
+			"within": { "columns": { "organization": "organization_id" } },
+			"via": { "value": "contact" },
+			"columns": [
+				"user_id",
+				"customer_id",
+				"organization_id"
+			]
+		}],
+		"customRoles": true,
+		"roles": {
+			"table": "permdock.user_roles",
+			"user": { "column": "user_id" },
+			"role": { "column": "role" }
+		}
+	},
+	decidingColumns: [
+		"public.contacts.customer_id",
+		"public.contacts.organization_id",
+		"public.contacts.user_id",
+		"public.memberships.role",
+		"public.memberships.scope",
+		"public.memberships.scope_id",
+		"public.memberships.user_id"
+	],
+	markers: {
+		"hook": "v1",
+		"grants": "v1"
+	},
+	requires: {
+		"matrix": "capability-matrix-v1.12.0",
+		"capabilities": [
+			"auth.session.get_claims",
+			"realtime.subscriptions.private_channel",
+			"storage.file_buckets.download",
+			"storage.file_buckets.list_files",
+			"storage.file_buckets.move",
+			"storage.file_buckets.remove",
+			"storage.file_buckets.update_file",
+			"storage.file_buckets.upload"
+		]
+	},
+	managementApi: {
+		"hook_custom_access_token_enabled": true,
+		"hook_custom_access_token_uri": "pg-functions://postgres/permdock/custom_access_token_hook",
+		"jwt_exp": 3600
+	}
+};
+//#endregion
+//#region src/testing/fixtures/index.ts
+/**
+* The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a
+* `catalog-v1` document with resources, permissions, scopes, roles, grants
+* and delegations, for testing a catalog consumer such as a Cloud.
+*/
+const betterSupabaseCatalog = parseCatalog(better_supabase_catalog_default);
+/** The `permdock.manifest.json` of the same app, a `supabase-manifest-v1` document. */
+const betterSupabaseManifest = parseSupabaseManifest(better_supabase_manifest_default);
+//#endregion
+export { betterSupabaseCatalog, betterSupabaseManifest };