permdock 0.6.0 → 0.8.0

package/dist/authzen/index.js

@@ -1,15 +1,14 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { r as ownGet } from "../paths-DXSHAMIa.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { r as ownGet } from "../paths-CUvURzHp.js";
+import { a as problemType, o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { t as fromWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CTviyH5L.js";
-import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
-import { _ as wireResourceId, a as evaluationReasons, c as unknownSemanticProblem, g as permissionLookup, h as itemResourceData, i as evaluateBatch, l as withRequestId, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-beAooV0n.js";
+import { n as readBodyText, t as MAX_BODY_BYTES } from "../body-text-DQhcmqdY.js";
+import { r as hasCredentials } from "../http-DKLXrFGk.js";
+import { d as unauthenticatedProblem, l as problemResponse, o as methodNotAllowed } from "../problem-BVLHFK33.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { a as evaluationReasons, c as withRequestId, g as wireResourceId, h as permissionLookup, i as evaluateBatch, m as itemResourceData, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-IBceAeKT.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {
 	outcome: "denied",
@@ -41,7 +40,10 @@ function permissionOf(lookup, item) {
 function resourceData(item) {
 	return itemResourceData(item.resource);
 }
-/** The row id an item names; `undefined` for none and for the collection sentinel `id: "*"`. */
+/**
+* The row id an item names; `undefined` for none and for the collection
+* sentinel `id: "*"`.
+*/
 function resourceIdOf(item) {
 	return wireResourceId(item.resource?.id);
 }
@@ -123,18 +125,30 @@ function mergeEvaluationItem(shared, item) {
 		context: item["context"] ?? shared.context
 	});
 }
-function pageOf(body) {
-	const page = isRecord(body["page"]) ? body["page"] : {};
-	const raw = typeof page["token"] === "string" ? page["token"] : typeof page["next_token"] === "string" ? page["next_token"] : "0";
+//#endregion
+//#region src/authzen/page.ts
+/** The largest page a search answers; a larger `page.limit` is capped to it. */
+const AUTHZEN_MAX_PAGE = 200;
+const DEFAULT_PAGE = 50;
+/**
+* The page a search body asks for. The token is `page.token`, else
+* `page.next_token`, read as a decimal offset; anything else starts at 0. The
+* size is `page.limit`, else `page.size`, capped at 200 and 50 by default.
+*/
+function readAuthzenPage(body) {
+	const page = isRecord(body) && isRecord(body["page"]) ? body["page"] : void 0;
+	const raw = typeof page?.["token"] === "string" ? page["token"] : typeof page?.["next_token"] === "string" ? page["next_token"] : "0";
 	const parsed = Math.trunc(Number(raw));
-	const sizeRaw = page["limit"] ?? page["size"];
-	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : 50;
+	const sizeRaw = page?.["limit"] ?? page?.["size"];
+	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : DEFAULT_PAGE;
 	return {
 		offset: Number.isFinite(parsed) && parsed > 0 ? parsed : 0,
 		size
 	};
 }
-function paged(items, offset, size) {
+/** One page of `items` with the AuthZEN `page` object. */
+function authzenPage(items, request) {
+	const { offset, size } = request;
 	const slice = items.slice(offset, offset + size);
 	const next = offset + slice.length;
 	return {
@@ -146,43 +160,259 @@ function paged(items, offset, size) {
 		}
 	};
 }
-//#endregion
-//#region src/authzen/create.ts
-function notFound(detail) {
-	return problemResponse(statusProblem(404, detail));
+/** The answer to a search the PDP cannot run: no results and no next page. */
+function emptyAuthzenPage() {
+	return authzenPage([], {
+		offset: 0,
+		size: 1
+	});
 }
-async function readJson(request) {
-	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return validationProblem("AuthZEN requests must use Content-Type: application/json");
-	const read = await readBodyText(request);
-	if (!read.ok) return read.cause === "too-large" ? bodyTooLarge() : validationProblem("AuthZEN body was not valid JSON");
-	try {
-		return JSON.parse(read.text);
-	} catch {
-		return validationProblem("AuthZEN body was not valid JSON");
+//#endregion
+//#region src/authzen/parse.ts
+/** AuthZEN 1.0 sections 5, 6.1 and 10.1.1. */
+const REQUIRED = {
+	evaluation: {
+		subject: "type-id",
+		action: true,
+		resource: "type-id"
+	},
+	evaluations: {
+		subject: "type-id",
+		action: true,
+		resource: "type-id"
+	},
+	"search/action": {
+		subject: "type-id",
+		resource: "type-id"
+	},
+	"search/resource": {
+		subject: "type-id",
+		action: true,
+		resource: "type"
+	},
+	"search/subject": {
+		subject: "type",
+		action: true,
+		resource: "type-id"
 	}
+};
+function invalid(detail) {
+	return {
+		ok: false,
+		problem: compact({
+			type: problemType("validation"),
+			title: "Invalid request",
+			status: 400,
+			detail
+		})
+	};
 }
-/**
-* The 400 for a request missing a required entity or one of its required
-* fields (AuthZEN 1.0 sections 5, 6.1 and 10.1.1), or `undefined`.
-*/
-function missingProblem(body, required) {
+/** The first missing entity or field, checked subject, resource, then action. */
+function missing(body, required) {
 	for (const name of ["subject", "resource"]) {
 		const needs = required[name];
 		if (needs === void 0) continue;
 		const entity = body[name];
-		if (!isRecord(entity) || typeof entity["type"] !== "string") return validationProblem(`${name}.type is required`);
-		if (needs === "type-id" && typeof entity["id"] !== "string") return validationProblem(`${name}.id is required`);
+		if (!isRecord(entity) || typeof entity["type"] !== "string") return invalid(`${name}.type is required`);
+		if (needs === "type-id" && typeof entity["id"] !== "string") return invalid(`${name}.id is required`);
 	}
 	if (required.action === true) {
 		const action = body["action"];
-		if (!isRecord(action) || typeof action["name"] !== "string") return validationProblem("action.name is required");
+		if (!isRecord(action) || typeof action["name"] !== "string") return invalid("action.name is required");
 	}
 }
-const EVALUATION = {
-	subject: "type-id",
-	action: true,
-	resource: "type-id"
-};
+function evaluations(body, maxEvaluations) {
+	const items = body["evaluations"] ?? [];
+	if (!Array.isArray(items)) return invalid("evaluations must be an array");
+	if (items.length === 0) return missing(body, REQUIRED.evaluations) ?? {
+		ok: true,
+		request: {
+			kind: "evaluation",
+			item: body
+		}
+	};
+	if (items.length > maxEvaluations) return {
+		ok: false,
+		problem: statusProblem(413, `evaluations batch exceeds ${String(maxEvaluations)}`)
+	};
+	const semantic = evaluationsSemantic(body);
+	if (semantic === void 0) return invalid(`options.evaluations_semantic must be one of ${EVALUATIONS_SEMANTICS.join(", ")}`);
+	const shared = compact({
+		subject: isRecord(body["subject"]) ? body["subject"] : void 0,
+		action: isRecord(body["action"]) ? body["action"] : void 0,
+		resource: isRecord(body["resource"]) ? body["resource"] : void 0,
+		context: body["context"]
+	});
+	return {
+		ok: true,
+		request: {
+			kind: "evaluations",
+			semantic,
+			items: items.map((item) => mergeEvaluationItem(shared, item))
+		}
+	};
+}
+/**
+* Checks a parsed AuthZEN body the way `permdock/authzen` answers it: the body
+* is an object, then each required entity and field in a fixed order, then the
+* `evaluations` array, batch size and semantic. A failure is the 400 (or 413)
+* Problem Details the handler sends, with the same `detail`.
+*/
+function parseAuthzenRequest(kind, body, options = {}) {
+	return parseAny(kind, body, options);
+}
+function parseAny(kind, body, options) {
+	if (!isRecord(body)) return invalid(`${kind} body must be an object`);
+	switch (kind) {
+		case "evaluation": return missing(body, REQUIRED.evaluation) ?? {
+			ok: true,
+			request: {
+				kind,
+				item: body
+			}
+		};
+		case "evaluations": return evaluations(body, options.maxEvaluations ?? 256);
+		case "search/action":
+		case "search/resource":
+		case "search/subject": return missing(body, REQUIRED[kind]) ?? {
+			ok: true,
+			request: {
+				kind,
+				item: body,
+				page: readAuthzenPage(body)
+			}
+		};
+		default: return kind;
+	}
+}
+/**
+* Reads `request` as an AuthZEN body: `Content-Type: application/json`, at most
+* 1 MiB (a 413 above it), valid JSON, then `parseAuthzenRequest`.
+*/
+async function readAuthzenRequest(kind, request, options = {}) {
+	if (request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase() !== "application/json") return invalid("AuthZEN requests must use Content-Type: application/json");
+	const read = await readBodyText(request);
+	if (!read.ok) return read.cause === "too-large" ? {
+		ok: false,
+		problem: statusProblem(413, `request body exceeds ${String(MAX_BODY_BYTES)} bytes`)
+	} : invalid("AuthZEN body was not valid JSON");
+	let body;
+	try {
+		body = JSON.parse(read.text);
+	} catch {
+		return invalid("AuthZEN body was not valid JSON");
+	}
+	return parseAuthzenRequest(kind, body, options);
+}
+//#endregion
+//#region src/authzen/search.ts
+/** The one `decide` call every AuthZEN evaluation and search makes. */
+function decideAuthzen(permdock, permission, data, trusted) {
+	const decide = permdock.decide;
+	return decide(permission, data, trusted ? {
+		call: "endpoint",
+		adapter: "authzen",
+		trusted: true
+	} : {
+		call: "endpoint",
+		adapter: "authzen",
+		trusted: false,
+		boundary: "decision-endpoint"
+	});
+}
+/** Every permission of resource type `type`, in catalog order. */
+function permissionsOfType(tree, type) {
+	return listPermissions(tree).filter((leaf) => leaf.resource === type);
+}
+/** The distinct actions of the granted `leaves`, in catalog order. */
+async function grantedActions(leaves, decide) {
+	const decisions = await Promise.all(leaves.map(async (leaf) => ({
+		leaf,
+		decision: await decide(leaf)
+	})));
+	const names = [];
+	for (const { leaf, decision } of decisions) if (decision.outcome === "granted" && !names.includes(leaf.action)) names.push(leaf.action);
+	return names.map((name) => ({ name }));
+}
+/** The granted ids among `records`; any subject type but `user` matches none. */
+async function grantedSubjects(type, records, decide) {
+	if (typeof type === "string" && type !== "user") return [];
+	return (await Promise.all(records.map(async (record) => {
+		const properties = {};
+		for (const [key, value] of Object.entries(record)) if (key !== "id") properties[key] = value;
+		return {
+			id: record.id,
+			decision: await decide({
+				type: "user",
+				id: record.id,
+				properties
+			})
+		};
+	}))).flatMap(({ id, decision }) => decision.outcome === "granted" ? [{
+		type: "user",
+		id
+	}] : []);
+}
+function scopeOf(options) {
+	return {
+		tenant: options.tenant,
+		actor: options.actor,
+		delegation: options.delegation
+	};
+}
+/**
+* The AuthZEN `search/action` answer for `user` on `resource`: every permission
+* of `resource.type` in the policy is decided, and the distinct actions of the
+* granted ones are returned in catalog order. Paging is the caller's
+* (`authzenPage`).
+*/
+async function searchActions(policy, user, resource, options = {}) {
+	const { permdock } = await buildInstance({
+		policy,
+		user,
+		sources: options,
+		scope: scopeOf(options)
+	});
+	const trusted = "data" in options;
+	const data = trusted ? options.data : resourceData({ resource });
+	return grantedActions(permissionsOfType(policy.permissions, resource.type), (leaf) => decideAuthzen(permdock, leaf, data, trusted));
+}
+/**
+* The AuthZEN `search/subject` answer: the candidates `lister` returns for
+* `request`, each decided as itself, filtered to those granted `action` on
+* `resource`. An unknown action, a subject type other than `user`, or a lister
+* that throws answers none.
+*/
+async function searchSubjects(policy, lister, request, options = {}) {
+	const permission = permissionOf(permissionLookup(policy.permissions), request);
+	if (permission === void 0) return [];
+	let records;
+	try {
+		records = await lister.list(compact({
+			type: request.subject.type,
+			action: request.action,
+			resource: request.resource,
+			context: request.context
+		}));
+	} catch {
+		return [];
+	}
+	const data = resourceData(request);
+	return grantedSubjects(request.subject.type, records, async (subject) => {
+		const { permdock } = await buildInstance({
+			policy,
+			user: userFromEntity(subject),
+			sources: options,
+			scope: scopeOf(options)
+		});
+		return decideAuthzen(permdock, permission, data, false);
+	});
+}
+//#endregion
+//#region src/authzen/create.ts
+function notFound(detail) {
+	return problemResponse(statusProblem(404, detail));
+}
 const WELL_KNOWN = "/.well-known/authzen-configuration";
 /** The name an item's action gives, for the reasons of an unknown permission. */
 function actionName(item) {
@@ -249,73 +479,41 @@ const createPermDock = (policy, options) => {
 		if (resolved === void 0) return UNAVAILABLE;
 		const { data, trusted } = resolved;
 		const permdock = await instantiate(pep, item);
-		const decide = permdock.decide;
-		const decision = decide(permission, data, trusted ? {
-			call: "endpoint",
-			adapter: "authzen",
-			trusted: true
-		} : {
-			call: "endpoint",
-			adapter: "authzen",
-			trusted: false,
-			boundary: "decision-endpoint"
-		});
-		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, resourceIdOf(item)), "authzen");
+		return applyApprovalResume(decideAuthzen(permdock, permission, data, trusted), permission, permdock, options.store, request, resourceRef(permission, data, resourceIdOf(item)), "authzen");
 	}
 	async function rowOf(request, pep, item) {
 		return evaluationRow(await decideItem(request, pep, item), permissionOf(lookup, item)?.key ?? actionName(item));
 	}
+	function read(kind, request) {
+		return readAuthzenRequest(kind, request, { maxEvaluations });
+	}
 	async function evaluation(request, pep) {
-		const body = await readJson(request);
-		if (body instanceof Response) return body;
-		if (!isRecord(body)) return validationProblem("evaluation body must be an object");
-		const missing = missingProblem(body, EVALUATION);
-		if (missing !== void 0) return missing;
-		return Response.json(await rowOf(request, pep, body));
+		const parsed = await read("evaluation", request);
+		if (!parsed.ok) return problemResponse(parsed.problem);
+		return Response.json(await rowOf(request, pep, parsed.request.item));
 	}
 	async function evaluations(request, pep) {
-		const body = await readJson(request);
-		if (body instanceof Response) return body;
-		if (!isRecord(body)) return validationProblem("evaluations body must be an object");
-		const items = body["evaluations"] ?? [];
-		if (!Array.isArray(items)) return validationProblem("evaluations must be an array");
-		if (items.length === 0) return missingProblem(body, EVALUATION) ?? Response.json(await rowOf(request, pep, body));
-		if (items.length > maxEvaluations) return batchTooLarge(maxEvaluations);
-		const semantic = evaluationsSemantic(body);
-		if (semantic === void 0) return unknownSemanticProblem();
-		const shared = compact({
-			subject: isRecord(body["subject"]) ? body["subject"] : void 0,
-			action: isRecord(body["action"]) ? body["action"] : void 0,
-			resource: isRecord(body["resource"]) ? body["resource"] : void 0,
-			context: body["context"]
-		});
-		return Response.json({ evaluations: await evaluateBatch(items, semantic, (item) => rowOf(request, pep, mergeEvaluationItem(shared, item))) });
+		const parsed = await read("evaluations", request);
+		if (!parsed.ok) return problemResponse(parsed.problem);
+		const body = parsed.request;
+		switch (body.kind) {
+			case "evaluation": return Response.json(await rowOf(request, pep, body.item));
+			case "evaluations": return Response.json({ evaluations: await evaluateBatch(body.items, body.semantic, (item) => rowOf(request, pep, item)) });
+			default: return body;
+		}
 	}
 	async function searchAction(request, pep) {
-		const body = await readJson(request);
-		if (body instanceof Response) return body;
-		if (!isRecord(body)) return validationProblem("search/action body must be an object");
-		const missingAction = missingProblem(body, {
-			subject: "type-id",
-			resource: "type-id"
-		});
-		if (missingAction !== void 0) return missingAction;
-		const item = body;
-		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
-		const leaves = listPermissions(policy.permissions).filter((leaf) => type === void 0 || leaf.resource === type);
-		const decisions = await Promise.all(leaves.map(async (leaf) => ({
-			leaf,
-			decision: await decideItem(request, pep, compact({
-				subject: item.subject,
-				context: item.context,
-				resource: item.resource,
-				action: { name: leaf.key }
-			}))
+		const parsed = await read("search/action", request);
+		if (!parsed.ok) return problemResponse(parsed.problem);
+		const { item, page } = parsed.request;
+		const type = typeof item.resource?.type === "string" ? item.resource.type : "";
+		const actions = await grantedActions(permissionsOfType(policy.permissions, type), (leaf) => decideItem(request, pep, compact({
+			subject: item.subject,
+			context: item.context,
+			resource: item.resource,
+			action: { name: leaf.key }
 		})));
-		const names = [];
-		for (const { leaf, decision } of decisions) if (decision.outcome === "granted" && !names.includes(leaf.action)) names.push(leaf.action);
-		const { offset, size } = pageOf(body);
-		return Response.json(paged(names.map((name) => ({ name })), offset, size));
+		return Response.json(authzenPage(actions, page));
 	}
 	async function listRows(type, where) {
 		const list = options.resources?.[type]?.list;
@@ -327,19 +525,12 @@ const createPermDock = (policy, options) => {
 		}
 	}
 	async function searchResource(request, pep) {
-		const body = await readJson(request);
-		if (body instanceof Response) return body;
-		if (!isRecord(body)) return validationProblem("search/resource body must be an object");
-		const missingResource = missingProblem(body, {
-			subject: "type-id",
-			action: true,
-			resource: "type"
-		});
-		if (missingResource !== void 0) return missingResource;
-		const item = body;
+		const parsed = await read("search/resource", request);
+		if (!parsed.ok) return problemResponse(parsed.problem);
+		const { item, page } = parsed.request;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
 		const permission = permissionOf(lookup, item);
-		if (type === void 0 || permission === void 0) return Response.json(paged([], 0, 1));
+		if (type === void 0 || permission === void 0) return Response.json(emptyAuthzenPage());
 		const rows = await listRows(type, isRecord(item.resource?.properties) ? item.resource.properties : void 0);
 		const permdock = await instantiate(pep, item);
 		let permitted = [];
@@ -353,51 +544,32 @@ const createPermDock = (policy, options) => {
 				id: String(id)
 			}] : [];
 		});
-		const { offset, size } = pageOf(body);
-		return Response.json(paged(entities, offset, size));
+		return Response.json(authzenPage(entities, page));
 	}
 	async function searchSubject(request, pep) {
-		if (options.subjects?.list === void 0) return notFound("search/subject is not configured");
-		const body = await readJson(request);
-		if (body instanceof Response) return body;
-		if (!isRecord(body)) return validationProblem("search/subject body must be an object");
-		const missingSubject = missingProblem(body, {
-			subject: "type",
-			action: true,
-			resource: "type-id"
-		});
-		if (missingSubject !== void 0) return missingSubject;
+		const lister = options.subjects;
+		if (lister?.list === void 0) return notFound("search/subject is not configured");
+		const parsed = await read("search/subject", request);
+		if (!parsed.ok) return problemResponse(parsed.problem);
+		const { item, page } = parsed.request;
 		let records;
 		try {
-			records = await options.subjects.list();
+			records = await lister.list(compact({
+				type: typeof item.subject?.type === "string" ? item.subject.type : "",
+				action: item.action ?? {},
+				resource: item.resource ?? {},
+				context: item.context
+			}));
 		} catch {
-			return Response.json(paged([], 0, 1));
+			return Response.json(emptyAuthzenPage());
 		}
-		const item = body;
-		const wanted = item.subject?.type;
-		if (typeof wanted === "string" && wanted !== "user") return Response.json(paged([], 0, 1));
-		const matches = (await Promise.all(records.map(async (record) => {
-			const properties = {};
-			for (const [key, value] of Object.entries(record)) if (key !== "id") properties[key] = value;
-			return {
-				id: record.id,
-				decision: await decideItem(request, pep, compact({
-					action: item.action,
-					resource: item.resource,
-					context: item.context,
-					subject: {
-						type: "user",
-						id: record.id,
-						properties
-					}
-				}))
-			};
-		}))).flatMap(({ id, decision }) => decision.outcome === "granted" ? [{
-			type: "user",
-			id
-		}] : []);
-		const { offset, size } = pageOf(body);
-		return Response.json(paged(matches, offset, size));
+		const matches = await grantedSubjects(item.subject?.type, records, (subject) => decideItem(request, pep, compact({
+			action: item.action,
+			resource: item.resource,
+			context: item.context,
+			subject
+		})));
+		return Response.json(authzenPage(matches, page));
 	}
 	function discovery(request, pathname) {
 		const pdp = `${new URL(request.url).origin}${pathname.slice(pathname.indexOf(WELL_KNOWN) + 34).replace(/\/+$/u, "")}`;
@@ -452,4 +624,4 @@ const createPermDock = (policy, options) => {
 	return { permdockHandler: () => handler };
 };
 //#endregion
-export { EVALUATIONS_SEMANTICS, createPermDock, evaluateBatch, evaluationsSemantic, mergeEvaluationItem };
+export { AUTHZEN_MAX_PAGE, EVALUATIONS_SEMANTICS, authzenPage, createPermDock, emptyAuthzenPage, evaluateBatch, evaluationsSemantic, mergeEvaluationItem, parseAuthzenRequest, readAuthzenPage, readAuthzenRequest, searchActions, searchSubjects };