permdock 0.6.0 → 0.7.0

package/dist/parse-Ddhz2xf4.js

@@ -0,0 +1,148 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { f as scopeList, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
+import { t as catalogSchema } from "./schema-B4v0Qrac.js";
+//#region src/catalog/references.ts
+function duplicates(issues, list, name, field) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of (list ?? []).entries()) {
+		const value = isRecord(entry) ? entry[field] : void 0;
+		if (typeof value !== "string") continue;
+		if (seen.has(value)) issues.push({
+			message: `duplicate ${field} '${value}' in ${name}`,
+			path: [
+				name,
+				index,
+				field
+			]
+		});
+		seen.add(value);
+	}
+}
+/**
+* The cross-references JSON Schema cannot express: role scopes, permission
+* keys named by operations, grants, delegations and OAuth scopes, unique
+* keys, and with `requireMeta` the permission `meta` fields a consumer needs.
+* Runs on a document that already passed the schema.
+*/
+function catalogReferenceIssues(catalog, requireMeta = []) {
+	const issues = [];
+	duplicates(issues, catalog.permissions, "permissions", "key");
+	duplicates(issues, catalog.roles, "roles", "key");
+	duplicates(issues, catalog.scopes, "scopes", "name");
+	duplicates(issues, catalog.plans, "plans", "key");
+	duplicates(issues, catalog.operations, "operations", "name");
+	const keys = new Set(catalog.permissions.map((permission) => permission.key));
+	const declared = (key, path, what) => {
+		if (!keys.has(key)) issues.push({
+			message: `${what} '${key}' is not a declared permission key`,
+			path
+		});
+	};
+	const scopes = scopeList(catalog.scopes);
+	for (const [index, role] of (catalog.roles ?? []).entries()) if (role.on !== void 0 && role.on !== "resource" && resolveScope(scopes, role.on) === void 0) issues.push({
+		message: `role '${role.key}' is on '${role.on}', which is neither a declared scope nor resource`,
+		path: [
+			"roles",
+			index,
+			"on"
+		]
+	});
+	for (const [index, operation] of (catalog.operations ?? []).entries()) {
+		declared(operation.permission, [
+			"operations",
+			index,
+			"permission"
+		], `operation '${operation.name}' permission`);
+		if (operation.results !== void 0) declared(operation.results, [
+			"operations",
+			index,
+			"results"
+		], `operation '${operation.name}' results`);
+	}
+	for (const [index, grant] of (catalog.grants ?? []).entries()) declared(grant.permission, [
+		"grants",
+		index,
+		"permission"
+	], "grant");
+	for (const [index, delegation] of (catalog.delegations ?? []).entries()) for (const [at, key] of delegation.permissions.entries()) declared(key, [
+		"delegations",
+		index,
+		"permissions",
+		at
+	], "delegation");
+	for (const [index, scope] of (catalog.oauthScopes ?? []).entries()) for (const [at, key] of scope.permissions.entries()) declared(key, [
+		"oauthScopes",
+		index,
+		"permissions",
+		at
+	], `OAuth scope '${scope.scope}'`);
+	for (const [index, permission] of catalog.permissions.entries()) for (const field of requireMeta) if (permission.meta[field] === void 0) issues.push({
+		message: `permission '${permission.key}' needs meta.${field}`,
+		path: [
+			"permissions",
+			index,
+			"meta",
+			field
+		]
+	});
+	return issues;
+}
+//#endregion
+//#region src/catalog/parse.ts
+function invalid(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "catalog",
+		issues,
+		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+/**
+* Reads a `permissions.catalog.json` document (parsed, or the JSON text),
+* validates it against `schemas/catalog-v1.json`, then checks its references:
+* role scopes, the permission keys operations, grants, delegations and OAuth
+* scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy
+* built from own keys; throws `PermDockValidationError` with every issue,
+* each with its `path`.
+*/
+function parseCatalog(json, options = {}) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalid([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	let copy;
+	try {
+		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	} catch (error) {
+		invalid([{
+			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
+	if (issues.length > 0) invalid(issues);
+	const catalog = copy;
+	const references = catalogReferenceIssues(catalog, options.requireMeta);
+	if (references.length > 0) invalid(references);
+	return freezeDeep(catalog);
+}
+/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+function rowConditionKeys(catalog) {
+	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
+}
+//#endregion
+export { rowConditionKeys as n, parseCatalog as t };

package/dist/{parse-local-manifest-CVSs6J9I.js → parse-local-manifest-T1Q8X3A2.js}

@@ -22,13 +22,36 @@ function isGrantTable(value) {
 function isCustomTable(value) {
 	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"]))) && isGrantTable(value["includes"]);
 }
+function isText(value) {
+	return typeof value === "string" && value !== "";
+}
+function isValue(value) {
+	return isRecord(value) && isText(value["column"]) !== isText(value["value"]);
+}
+function isColumn(value) {
+	if (!isRecord(value) || !isText(value["column"])) return false;
+	const through = value["through"];
+	const map = value["map"];
+	if (through !== void 0 && map !== void 0) return false;
+	return (through === void 0 || isRecord(through) && isText(through["table"]) && isText(through["id"]) && isText(through["column"])) && (map === void 0 || isRecord(map) && Object.values(map).every((key) => key === null || isText(key)));
+}
+function isMembershipRows(value) {
+	if (!isRecord(value)) return false;
+	const roles = value["roles"];
+	return isText(value["table"]) && isColumn(value["user"]) && isValue(value["scope"]) && isText(value["id"]) && (Array.isArray(roles) ? roles.length > 0 && roles.every(isColumn) : isRecord(roles) && isStrings(roles["value"])) && (value["via"] === void 0 || isValue(value["via"])) && (value["expiresAt"] === void 0 || isText(value["expiresAt"])) && (value["disabledAt"] === void 0 || isText(value["disabledAt"]));
+}
+function isRows(value) {
+	if (!isRecord(value)) return false;
+	const { memberships, roles, customRoles } = value;
+	return Array.isArray(memberships) && memberships.every(isMembershipRows) && (roles === void 0 || isRecord(roles) && isText(roles["table"]) && isText(roles["user"]) && Array.isArray(roles["roles"]) && roles["roles"].length > 0 && roles["roles"].every(isColumn)) && (customRoles === void 0 || isRecord(customRoles) && isText(customRoles["permissions"]) && isText(customRoles["includes"]));
+}
 /**
 * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
 * no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
 * back without a cast.
 */
 function parseLocalSnapshotManifest(value) {
-	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && safeKeys(value);
+	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && (value["rows"] === void 0 || isRows(value["rows"])) && safeKeys(value);
 }
 //#endregion
 export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/{parse-local-manifest-5ODwqu8b.d.ts → parse-local-manifest-e4mdwAKd.d.ts}

@@ -1,4 +1,4 @@
-import { Bt as LocalSnapshotManifest } from "./policy-types-n0uRTsW8.js";
+import { Ut as LocalSnapshotManifest } from "./policy-types-B-F-qAZk.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with

package/dist/pdp/index.d.ts

@@ -1,6 +1,6 @@
-import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { i as PermDockOptions } from "../permdock-SV8ZINYT.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-_WhUP7ud.js";
+import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { o as PermDockOptions } from "../permdock-Dco6dyCK.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-D3A19w4A.js";
 //#region src/pdp/create.d.ts
 /** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
 export declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): PdpPermDock<V>;

package/dist/pdp/index.js

@@ -3,10 +3,11 @@ import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
 import { n as internalsOf, t as attachInternals } from "../internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-DpPtSKNZ.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BrAscV28.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DvvFzYXe.js";
+import { r as decideAllAsync, t as canAllAsync } from "../checks-BC_0mPIq.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BfWEeMqk.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-C8LjUdVU.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;
@@ -73,6 +74,7 @@ function isLocalShortCircuit(decision) {
 			case "relation-unavailable":
 			case "tenant-mismatch":
 			case "no-membership":
+			case "no-tenant":
 			case "scope":
 			case "expired-membership":
 			case "stale-credentials":
@@ -192,6 +194,8 @@ function wrap(permdock, policy, subject, providers) {
 	const wrapped = {
 		can,
 		decide,
+		canAll: (checks, options) => canAllAsync(can, checks, options),
+		decideAll: (checks, options) => decideAllAsync(decide, checks, options),
 		async decideEach(permission, rows, options) {
 			return Object.freeze(await Promise.all(rows.map((row) => decide(permission, row, options))));
 		},