permdock 0.6.0 → 0.8.0

package/dist/parse-1_ZheTW5.js

@@ -0,0 +1,151 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as catalogSchema } from "./schema-BOJjqlWL.js";
+//#region src/catalog/references.ts
+function duplicates(issues, list, name, field) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const [index, entry] of (list ?? []).entries()) {
+		const value = isRecord(entry) ? entry[field] : void 0;
+		if (typeof value !== "string") continue;
+		if (seen.has(value)) issues.push({
+			message: `duplicate ${field} '${value}' in ${name}`,
+			path: [
+				name,
+				index,
+				field
+			]
+		});
+		seen.add(value);
+	}
+}
+/**
+* The cross-references JSON Schema cannot express: role scopes, permission keys
+* named by operations, grants, delegations and OAuth scopes, unique keys, and
+* with `requireMeta` the permission `meta` fields a consumer needs. Runs on a
+* document that already passed the schema.
+*/
+function catalogReferenceIssues(catalog, requireMeta = []) {
+	const issues = [];
+	duplicates(issues, catalog.permissions, "permissions", "key");
+	duplicates(issues, catalog.roles, "roles", "key");
+	duplicates(issues, catalog.scopes, "scopes", "name");
+	duplicates(issues, catalog.plans, "plans", "key");
+	duplicates(issues, catalog.operations, "operations", "name");
+	const keys = new Set(catalog.permissions.map((permission) => permission.key));
+	const declared = (key, path, what) => {
+		if (!keys.has(key)) issues.push({
+			message: `${what} '${key}' is not a declared permission key`,
+			path
+		});
+	};
+	const scopes = scopeList(catalog.scopes);
+	for (const [index, role] of (catalog.roles ?? []).entries()) if (role.on !== void 0 && role.on !== "resource" && resolveScope(scopes, role.on) === void 0) issues.push({
+		message: `role '${role.key}' is on '${role.on}', which is neither a declared scope nor resource`,
+		path: [
+			"roles",
+			index,
+			"on"
+		]
+	});
+	for (const [index, operation] of (catalog.operations ?? []).entries()) {
+		declared(operation.permission, [
+			"operations",
+			index,
+			"permission"
+		], `operation '${operation.name}' permission`);
+		if (operation.results !== void 0) declared(operation.results, [
+			"operations",
+			index,
+			"results"
+		], `operation '${operation.name}' results`);
+	}
+	for (const [index, grant] of (catalog.grants ?? []).entries()) declared(grant.permission, [
+		"grants",
+		index,
+		"permission"
+	], "grant");
+	for (const [index, delegation] of (catalog.delegations ?? []).entries()) for (const [at, key] of delegation.permissions.entries()) declared(key, [
+		"delegations",
+		index,
+		"permissions",
+		at
+	], "delegation");
+	for (const [index, scope] of (catalog.oauthScopes ?? []).entries()) for (const [at, key] of scope.permissions.entries()) declared(key, [
+		"oauthScopes",
+		index,
+		"permissions",
+		at
+	], `OAuth scope '${scope.scope}'`);
+	for (const [index, permission] of catalog.permissions.entries()) for (const field of requireMeta) if (permission.meta[field] === void 0) issues.push({
+		message: `permission '${permission.key}' needs meta.${field}`,
+		path: [
+			"permissions",
+			index,
+			"meta",
+			field
+		]
+	});
+	return issues;
+}
+//#endregion
+//#region src/catalog/parse.ts
+function invalid(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "catalog",
+		issues,
+		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+/**
+* Reads a `permissions.catalog.json` document (parsed, or the JSON text),
+* validates it against `schemas/catalog-v1.json`, then checks its references:
+* role scopes, the permission keys operations, grants, delegations and OAuth
+* scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy built
+* from own keys; throws `PermDockValidationError` with every issue, each with
+* its `path`.
+*/
+function parseCatalog(json, options = {}) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalid([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	let copy;
+	try {
+		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	} catch (error) {
+		invalid([{
+			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
+	if (issues.length > 0) invalid(issues);
+	const catalog = copy;
+	const references = catalogReferenceIssues(catalog, options.requireMeta);
+	if (references.length > 0) invalid(references);
+	return freezeDeep(catalog);
+}
+/**
+* Keys of the permissions the catalog marks `rowConditions: true`: the SQL
+* helpers alone cannot enforce them.
+*/
+function rowConditionKeys(catalog) {
+	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
+}
+//#endregion
+export { rowConditionKeys as n, parseCatalog as t };

package/dist/parse-local-manifest-BQhTlLQS.d.ts

@@ -0,0 +1,10 @@
+import { Ut as LocalSnapshotManifest } from "./policy-types-CCiDRZBH.js";
+//#region src/core/parse-local-manifest.d.ts
+/**
+ * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no
+ * prototype keys. A JSON import widens `v: 1` to `number`; this narrows it back
+ * without a cast.
+ */
+declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
+//#endregion
+export { parseLocalSnapshotManifest as t };

package/dist/parse-local-manifest-DEiCF4ah.js

@@ -0,0 +1,69 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+//#region src/core/local-role.ts
+/**
+* The role name custom-role tables in a local snapshot manifest hold their
+* grants under; no declared or tenant role can take it.
+*/
+const LOCAL_CUSTOM_ROLE = "\0custom";
+//#endregion
+//#region src/core/parse-local-manifest.ts
+function isStrings(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function safeKeys(value) {
+	if (Array.isArray(value)) return value.every(safeKeys);
+	if (!isRecord(value)) return true;
+	return Object.entries(value).every(([key, item]) => !isForbiddenKey(key) && safeKeys(item));
+}
+function isGrants(value) {
+	return Array.isArray(value) && value.every((grant) => isRecord(grant) && typeof grant["permission"] === "string" && (grant["effect"] === "allow" || grant["effect"] === "deny") && (grant["role"] === null || typeof grant["role"] === "string") && (isRecord(grant["to"]) || Array.isArray(grant["to"])));
+}
+function isGrantTable(value) {
+	return isRecord(value) && Object.values(value).every(isGrants);
+}
+function isStringTable(value) {
+	return value === void 0 || isRecord(value) && Object.values(value).every(isStrings);
+}
+function isCustomTable(value) {
+	const reach = isRecord(value) ? value["includeReach"] : void 0;
+	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"])) && (row["reach"] === void 0 || isStrings(row["reach"])) && isStringTable(row["levelReach"])) && isGrantTable(value["includes"]) && (reach === void 0 || isRecord(reach) && Object.values(reach).every(isStringTable));
+}
+function isAssignable(value) {
+	if (!isRecord(value)) return false;
+	const { roles, manage, permissions } = value;
+	return Array.isArray(roles) && roles.every((item) => isRecord(item) && typeof item["name"] === "string" && typeof item["on"] === "string" && isStrings(item["allows"])) && isRecord(manage) && isStrings(manage["roles"]) && isStrings(manage["permissions"]) && isStringTable(value["assigns"]) && Array.isArray(permissions) && permissions.every((leaf) => isRecord(leaf) && typeof leaf["key"] === "string") && isStringTable(value["levels"]) && isStringTable(value["grants"]);
+}
+function isText(value) {
+	return typeof value === "string" && value !== "";
+}
+function isValue(value) {
+	return isRecord(value) && isText(value["column"]) !== isText(value["value"]);
+}
+function isColumn(value) {
+	if (!isRecord(value) || !isText(value["column"])) return false;
+	const through = value["through"];
+	const map = value["map"];
+	if (through !== void 0 && map !== void 0) return false;
+	return (through === void 0 || isRecord(through) && isText(through["table"]) && isText(through["id"]) && isText(through["column"])) && (map === void 0 || isRecord(map) && Object.values(map).every((key) => key === null || isText(key)));
+}
+function isMembershipRows(value) {
+	if (!isRecord(value)) return false;
+	const roles = value["roles"];
+	return isText(value["table"]) && isColumn(value["user"]) && isValue(value["scope"]) && isText(value["id"]) && (Array.isArray(roles) ? roles.length > 0 && roles.every(isColumn) : isRecord(roles) && isStrings(roles["value"])) && (value["via"] === void 0 || isValue(value["via"])) && (value["expiresAt"] === void 0 || isText(value["expiresAt"])) && (value["disabledAt"] === void 0 || isText(value["disabledAt"]));
+}
+function isRows(value) {
+	if (!isRecord(value)) return false;
+	const { memberships, roles, customRoles } = value;
+	return Array.isArray(memberships) && memberships.every(isMembershipRows) && (roles === void 0 || isRecord(roles) && isText(roles["table"]) && isText(roles["user"]) && Array.isArray(roles["roles"]) && roles["roles"].length > 0 && roles["roles"].every(isColumn)) && (customRoles === void 0 || isRecord(customRoles) && isText(customRoles["permissions"]) && isText(customRoles["includes"]));
+}
+/**
+* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with no
+* prototype keys. A JSON import widens `v: 1` to `number`; this narrows it back
+* without a cast.
+*/
+function parseLocalSnapshotManifest(value) {
+	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && (value["rows"] === void 0 || isRows(value["rows"])) && (value["assignable"] === void 0 || isAssignable(value["assignable"])) && safeKeys(value);
+}
+//#endregion
+export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/{parse-request-D_tUXG6M.js → parse-request-CwCZpyjV.js}

@@ -1,13 +1,12 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-CMreVuFM.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "./request-schema-DhX7UbfQ.js";
 //#region src/approvals/parse-request.ts
 /**
-* Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store
-* or the Cloud returns it, validated against
-* `schemas/approval-request-v1.json`. Returns a deep-frozen copy, or `null`
-* for anything that does not match, including a `__proto__`, `constructor`
-* or `prototype` key.
+* Reads an `ApprovalRequest` (parsed, or the JSON text) as an approval store or
+* the Cloud returns it, validated against `schemas/approval-request-v1.json`.
+* Returns a deep-frozen copy, or `null` for anything that does not match,
+* including a `__proto__`, `constructor` or `prototype` key.
 */
 function parseApprovalRequest(value) {
 	let input = value;

package/dist/{paths-DXSHAMIa.js → paths-CUvURzHp.js}

@@ -15,7 +15,10 @@ function ownGet(object, key) {
 	if (!Object.hasOwn(object, key)) return;
 	return object[key];
 }
-/** A copy holding only own enumerable properties, so a prototype never supplies a field. */
+/**
+* A copy holding only own enumerable properties, so a prototype never supplies
+* a field.
+*/
 function ownRecord(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
 	const record = {};

package/dist/pdp/index.d.ts

@@ -1,8 +1,11 @@
-import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { i as PermDockOptions } from "../permdock-SV8ZINYT.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-_WhUP7ud.js";
+import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { o as PermDockOptions } from "../permdock-B6Sf4T_S.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-B4uqKDnp.js";
 //#region src/pdp/create.d.ts
-/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+/**
+ * The PDP-aware instance, built synchronously like core `getPermDockSync`; use
+ * `getPermDock` for asynchronous inputs.
+ */
 export declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): PdpPermDock<V>;
 /** The PDP-aware instance once every source has answered. */
 export declare function getPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
@@ -14,8 +17,8 @@ export declare function getPermDock<TUser, TPrincipal extends Principal = Princi
  */
 export declare function openfga(options: OpenFgaOptions): DecisionProvider;
 /**
- * A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides
- * one row and `LookupResources` lists the ids `filter` and `where` use. A
+ * A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides one
+ * row and `LookupResources` lists the ids `filter` and `where` use. A
  * conditional permissionship (a caveat missing context) is a denial.
  */
 export declare function spicedb(options: SpiceDbOptions): DecisionProvider;

package/dist/pdp/index.js

@@ -1,12 +1,13 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { n as internalsOf, t as attachInternals } from "../internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { n as internalsOf, t as attachInternals } from "../internals-B3IgHrvo.js";
+import { a as getResource, c as listPermissions } from "../permission-registry-B8tYxPIt.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BrAscV28.js";
-import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DvvFzYXe.js";
+import { r as decideAllAsync, t as canAllAsync } from "../checks-CGkP3Z7A.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-L-_I_3zP.js";
+import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-l0oGGetg.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {
 	if (policy.providers === void 0 || policy.providers.length === 0) return policy;
@@ -73,6 +74,7 @@ function isLocalShortCircuit(decision) {
 			case "relation-unavailable":
 			case "tenant-mismatch":
 			case "no-membership":
+			case "no-tenant":
 			case "scope":
 			case "expired-membership":
 			case "stale-credentials":
@@ -112,7 +114,10 @@ function wrap(permdock, policy, subject, providers) {
 			return denied("pdp-unavailable");
 		}
 	};
-	/** The local trace; a remote decision evaluated no local grant, so its trace is empty. */
+	/**
+	* The local trace; a remote decision evaluated no local grant, so its trace
+	* is empty.
+	*/
 	const explain = async (permission, data, options) => {
 		const decision = await decide(permission, data, {
 			...options,
@@ -143,7 +148,8 @@ function wrap(permdock, policy, subject, providers) {
 	};
 	const can = async (permission, data, options) => {
 		try {
-			return (await decide(permission, data, options)).outcome === "granted";
+			const { outcome } = await decide(permission, data, options);
+			return outcome === "granted";
 		} catch {
 			return false;
 		}
@@ -192,6 +198,8 @@ function wrap(permdock, policy, subject, providers) {
 	const wrapped = {
 		can,
 		decide,
+		canAll: (checks, options) => canAllAsync(can, checks, options),
+		decideAll: (checks, options) => decideAllAsync(decide, checks, options),
 		async decideEach(permission, rows, options) {
 			return Object.freeze(await Promise.all(rows.map((row) => decide(permission, row, options))));
 		},
@@ -287,7 +295,10 @@ function wrap(permdock, policy, subject, providers) {
 	if (internals !== void 0) attachInternals(wrapped, internals);
 	return wrapped;
 }
-/** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
+/**
+* The PDP-aware instance, built synchronously like core `getPermDockSync`; use
+* `getPermDock` for asynchronous inputs.
+*/
 function getPermDockSync(policy, user, options = {}) {
 	const localPolicy = withoutProviders(policy);
 	const permdock = getPermDockSync$1(localPolicy, user, options);
@@ -421,8 +432,8 @@ function subjectReference(check) {
 	});
 }
 /**
-* A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides
-* one row and `LookupResources` lists the ids `filter` and `where` use. A
+* A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides one
+* row and `LookupResources` lists the ids `filter` and `where` use. A
 * conditional permissionship (a caveat missing context) is a denial.
 */
 function spicedb(options) {

package/dist/{peer-CRvC7Hg1.js → peer-C9LvBCcb.js}

@@ -1 +1 @@
-export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-C8swJ2GH.js";
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-Q0fuZ6hx.js";