permdock 0.6.0 → 0.8.0

package/dist/{index-Ch8LpNDp.d.ts → index-BT5-1VsX.d.ts}

@@ -1,7 +1,8 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-n0uRTsW8.js";
-import { V as AppData } from "./vocabulary-CN8H_9UF.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-CCiDRZBH.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as SqlQuery } from "./sql-B80DFdpG.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -11,7 +12,10 @@ declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 /** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
 declare const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
+/**
+ * The extension that carries the application's own data (`x`) on a User or a
+ * Group.
+ */
 declare const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 type DirectoryMeta = {
   readonly created: string;
@@ -30,7 +34,10 @@ type DirectoryUser = {
   readonly userName: string;
   readonly active: boolean;
   readonly emails?: readonly DirectoryEmail[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -43,7 +50,10 @@ type DirectoryGroup = {
   readonly displayName: string;
   readonly members: readonly DirectoryGroupMember[];
   readonly roles?: readonly string[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -79,17 +89,17 @@ type ScimPatchOp = {
 type DirectoryStore = {
   /** Shown in errors and events; optional, as on every extension interface. */
   readonly name?: string;
-  getUser(tenant: string, id: string): DirectoryUser | null | Promise<DirectoryUser | null>;
-  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
-  putUser(tenant: string, user: DirectoryUser): DirectoryUser | Promise<DirectoryUser>;
-  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryUser | Promise<DirectoryUser>;
-  deleteUser(tenant: string, id: string): void | Promise<void>;
-  getGroup(tenant: string, id: string): DirectoryGroup | null | Promise<DirectoryGroup | null>;
-  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
-  putGroup(tenant: string, group: DirectoryGroup): DirectoryGroup | Promise<DirectoryGroup>;
-  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryGroup | Promise<DirectoryGroup>;
-  deleteGroup(tenant: string, id: string): void | Promise<void>;
-  groupsFor(tenant: string, userId: string): readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
+  getUser: (tenant: string, id: string) => DirectoryUser | null | Promise<DirectoryUser | null>;
+  findUsers: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
+  putUser: (tenant: string, user: DirectoryUser) => DirectoryUser | Promise<DirectoryUser>;
+  patchUser: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryUser | Promise<DirectoryUser>;
+  deleteUser: (tenant: string, id: string) => void | Promise<void>;
+  getGroup: (tenant: string, id: string) => DirectoryGroup | null | Promise<DirectoryGroup | null>;
+  findGroups: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup: (tenant: string, group: DirectoryGroup) => DirectoryGroup | Promise<DirectoryGroup>;
+  patchGroup: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryGroup | Promise<DirectoryGroup>;
+  deleteGroup: (tenant: string, id: string) => void | Promise<void>;
+  groupsFor: (tenant: string, userId: string) => readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
 };
 type ScimTokenOptions = {
   readonly hash: "sha256";
@@ -98,7 +108,10 @@ type ScimTokenOptions = {
 type DirectoryChange = {
   readonly tenant: string;
   readonly userIds: readonly string[];
-  /** `session-revoked` when a user was deactivated or deleted; `changed` otherwise. */
+  /**
+   * `session-revoked` when a user was deactivated or deleted; `changed`
+   * otherwise.
+   */
   readonly kind: "session-revoked" | "changed";
 };
 type ScimHandlerOptions = {
@@ -107,7 +120,10 @@ type ScimHandlerOptions = {
   readonly token?: ScimTokenOptions;
   readonly verifier?: TokenVerifier;
   readonly audience?: string;
-  /** With `verifier`: where the JWT names its tenant (`claims.tenant`); default `tenant`, then `tid`. */
+  /**
+   * With `verifier`: where the JWT names its tenant (`claims.tenant`); default
+   * `tenant`, then `tid`.
+   */
   readonly claims?: Pick<ClaimsMap, "tenant">;
   readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
   readonly assignable?: readonly string[];
@@ -115,8 +131,8 @@ type ScimHandlerOptions = {
   readonly onChange?: (change: DirectoryChange) => void | Promise<void>;
   /**
    * Publishes for each affected user's id, `externalId` and `userName`:
-   * `session-revoked` when a user is deactivated (`active: false`) or
-   * deleted, so open connections end; `changed` otherwise, so they revalidate.
+   * `session-revoked` when a user is deactivated (`active: false`) or deleted,
+   * so open connections end; `changed` otherwise, so they revalidate.
    */
   readonly revocations?: RevocationFeed;
   readonly onUnknownRole?: (name: string) => void;
@@ -138,9 +154,15 @@ declare class DirectoryNotFoundError extends Error {
   readonly code: "not-found";
   constructor(message?: string);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryUniquenessError(error: unknown): error is DirectoryUniquenessError;
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryNotFoundError(error: unknown): error is DirectoryNotFoundError;
 //#endregion
 //#region src/scim/auth.d.ts
@@ -192,4 +214,21 @@ declare function directoryMembershipSource(store: DirectoryStore, options?: Dire
 //#region src/scim/store.d.ts
 declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
-export { ScimPage as A, GROUP_SCHEMA as C, SCIM_CONTENT_TYPE as D, ROLES_EXTENSION as E, isDirectoryNotFoundError as F, isDirectoryUniquenessError as I, ScimPatchOp as M, ScimTokenOptions as N, ScimFilter as O, USER_SCHEMA as P, ERROR_SCHEMA as S, PATCH_SCHEMA as T, DirectoryMembershipSourceOptions as _, scimHandler as a, DirectoryUniquenessError as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryGroup as g, DirectoryChange as h, tenantFromPath as i, ScimPageResult as j, ScimHandlerOptions as k, resourceTypes as l, APP_DATA_EXTENSION as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryNotFoundError as v, LIST_SCHEMA as w, DirectoryUser as x, DirectoryStore as y };
+//#region src/scim/postgres-store.d.ts
+type PostgresDirectoryStoreOptions = {
+  /**
+   * Schema of the generated tables (`permdock scim generate --schema`). Default
+   * `permdock`.
+   */
+  readonly schema?: string;
+};
+/**
+ * A `DirectoryStore` over the tables `permdock scim generate` writes, called
+ * through a `SqlQuery` that may read and write them (the table owner, or a role
+ * granted on them). Every method is one statement, so a pool needs no
+ * transaction: a group and its members change together, and a PATCH that races
+ * another write re-reads the row and applies its operations again.
+ */
+declare function postgresDirectoryStore(query: SqlQuery, options?: PostgresDirectoryStoreOptions): DirectoryStore;
+//#endregion
+export { ScimFilter as A, DirectoryUser as C, PATCH_SCHEMA as D, LIST_SCHEMA as E, ScimTokenOptions as F, USER_SCHEMA as I, isDirectoryNotFoundError as L, ScimPage as M, ScimPageResult as N, ROLES_EXTENSION as O, ScimPatchOp as P, isDirectoryUniquenessError as R, DirectoryUniquenessError as S, GROUP_SCHEMA as T, DirectoryChange as _, normalizePatchOps as a, DirectoryNotFoundError as b, filterSupported as c, resourceTypes as d, schemas as f, APP_DATA_EXTENSION as g, sha256Hex as h, directoryMembershipSource as i, ScimHandlerOptions as j, SCIM_CONTENT_TYPE as k, matchFilter as l, authenticateScim as m, postgresDirectoryStore as n, tenantFromPath as o, serviceProviderConfig as p, memoryDirectoryStore as r, scimHandler as s, PostgresDirectoryStoreOptions as t, parseScimFilter as u, DirectoryGroup as v, ERROR_SCHEMA as w, DirectoryStore as x, DirectoryMembershipSourceOptions as y };