permdock 0.6.0 → 0.8.0

package/dist/{postgrest-DAjUkF9w.js → postgrest-D4nuPXIQ.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as validateRecord } from "./thenable-yD7SabqG.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as validateRecord } from "./thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
-import { t as clientNameOf } from "./clients-DjU5ABMy.js";
-import "./budget-NbEtbJC_.js";
-import { a as hookApiNames } from "./sources-vs5dGOsS.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { t as clientNameOf } from "./clients-DYr3U86j.js";
+import "./budget-BELja5A9.js";
+import { a as hookApiNames } from "./sources-CMAM-2A3.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -28,14 +28,20 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"client_id",
 	"scope"
 ]);
-/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+/**
+* Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook
+* writes `null` for a user with no role row.
+*/
 function claimNamed(claims, name) {
 	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
 	if (top !== void 0 && top !== null) return top;
 	const meta = claims["app_metadata"];
 	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
 }
-/** A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a function over the claims. */
+/**
+* A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a
+* function over the claims.
+*/
 function claimAt(claims, path) {
 	return typeof path === "string" ? claimNamed(claims, path) : readClaim(claims, path);
 }
@@ -45,7 +51,10 @@ function asRoles(value, declared) {
 	const allowed = new Set(declared);
 	return raw.filter((role) => allowed.has(role));
 }
-/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+/**
+* Reads the `memberships` claim; an entry it cannot read is dropped and its
+* index reported.
+*/
 function readMemberships(value) {
 	if (!Array.isArray(value)) return {
 		memberships: [],
@@ -106,7 +115,10 @@ function memberOf(value) {
 function asStrings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+/**
+* `claims[plans][tenant]`: only the active tenant's entry, never another
+* tenant's.
+*/
 function plansFor(claims, name, tenant) {
 	if (name === void 0 || tenant === void 0) return [];
 	const byTenant = claimAt(claims, name);
@@ -127,11 +139,13 @@ function isToolList(value) {
 	return Array.isArray(value) && value.every((tool) => typeof tool === "string" && tool !== "");
 }
 /**
-* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
-* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
-* as the user, `agent` an agent run with the `tools` it may call. Any other `kind`, a support level
-* without `session_id`, and an agent level with `session_id`, `tools` that are not non-empty
-* strings or a `read_only` that is not a boolean are invalid, as better-supabase reads them.
+* The outer `act` level by its `kind`, the marker a support tool writes: none
+* is an OAuth client or agent chain, `support` a support session (with
+* `session_id`), `impersonation` an admin acting as the user, `agent` an agent
+* run with the `tools` it may call. Any other `kind`, a support level without
+* `session_id`, and an agent level with `session_id`, `tools` that are not
+* non-empty strings or a `read_only` that is not a boolean are invalid, as
+* better-supabase reads them.
 */
 function actingParty(outer, id) {
 	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
@@ -214,14 +228,15 @@ function readActor(claims) {
 	return NO_ACTOR;
 }
 /**
-* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
-* actor; nested levels are prior actors, kept on `chain` for audit), else the
-* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
-* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
-* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
-* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
-* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
-* is `{ ok: false }` and must deny.
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the
+* current actor; nested levels are prior actors, kept on `chain` for audit),
+* else the OAuth `client_id` of a third-party app. The outer level's `kind`
+* names the actor: none is `oauth-client`, `support` a support session,
+* `impersonation` an admin acting as the user. Reads only `act` and
+* `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a
+* chain of objects each with a non-empty `sub`, that names another `kind`, or a
+* support level without `session_id`, is `{ ok: false }` and must deny.
 */
 function actorOf(claims) {
 	try {
@@ -370,8 +385,9 @@ function subjectFromSupabase(claims, options = {}) {
 	}
 }
 /**
-* A verified session object (`{ kind, claims }`) in, `Subject` out.
-* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+* A verified session object (`{ kind, claims }`) in, `Subject` out. Only `kind:
+* 'user'` sessions map; `anon`, `service`, `invalid` and anything else are
+* anonymous.
 */
 function subjectFromSupabaseSession(session, options = {}) {
 	try {
@@ -442,7 +458,10 @@ function versionOf(value) {
 	const version = typeof value === "string" ? Number(value) : value;
 	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
 }
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+* Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+* malformed record is no record.
+*/
 function readSubjectRecord(value) {
 	if (!isRecord(value) || typeof value["id"] !== "string") return;
 	if (value["active"] !== true) return {
@@ -462,20 +481,21 @@ function readSubjectRecord(value) {
 			const role = customRoleOf(item);
 			return role === void 0 ? [] : [role];
 		}) : [],
-		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
+		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0,
+		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
 * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
+* `permdock supabase hook generate` writes, for a backend that reaches Postgres
+* only through PostgREST. `memberships.version` reads only the version, so
+* `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+* stale token; when the version function is missing it falls back to
+* `subject_for`. With `policy`, a token that claims a custom role has its
 * subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
+* only for a subject that holds one. Each user and each instance is read once
+* per `postgrestSources` call, so create it per request or per job.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;
@@ -534,7 +554,10 @@ function postgrestSources(client, options = {}) {
 			version(principal) {
 				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
 			},
-			list
+			list,
+			async globalRolesFor(principal) {
+				return [...(await live(principal.id))?.roles ?? []];
+			}
 		},
 		customRoles(principal) {
 			return {
@@ -563,11 +586,40 @@ function postgrestSources(client, options = {}) {
 					id: found.id,
 					roles: found.roles,
 					memberships: found.memberships,
-					authzVersion: found.authzVersion
+					authzVersion: found.authzVersion,
+					claims: found.claims
 				}),
 				context: {}
 			};
 		},
+		async refresh(subject) {
+			const current = subject.principal;
+			if (current === null) return subject;
+			const found = await live(current.id);
+			if (found === void 0) {
+				const { stale: _stale, ...kept } = subject;
+				return {
+					...kept,
+					principal: null
+				};
+			}
+			const { membershipsTruncated: _truncated, ...rest } = current;
+			const { stale: _stale, ...kept } = subject;
+			const principal = compact({
+				...rest,
+				roles: found.roles,
+				memberships: found.memberships,
+				authzVersion: found.authzVersion,
+				claims: found.claims === void 0 ? rest["claims"] : {
+					...isRecord(rest["claims"]) ? rest["claims"] : {},
+					...found.claims
+				}
+			});
+			return {
+				...kept,
+				principal
+			};
+		},
 		record
 	};
 }

package/dist/{postgrest-CEgRbefE.d.ts → postgrest-DicQyqm-.d.ts}

@@ -1,6 +1,9 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, Zn as CustomRole, ar as Subject, et as MembershipSource, nr as Membership } from "./policy-types-n0uRTsW8.js";
+import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-CCiDRZBH.js";
 //#region src/supabase/postgrest.d.ts
-/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+/**
+ * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
+ * message.
+ */
 type SupabaseRpcResult = {
   readonly data: unknown;
   readonly error: {
@@ -13,13 +16,13 @@ type SupabaseRpcResult = {
  * function, such as a `service_role` client after the grant the docs show.
  */
 type SupabaseRpcClient = {
-  schema(name: string): {
-    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  schema: (name: string) => {
+    rpc: (fn: string, args: Readonly<Record<string, unknown>>) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type SupabaseRpcCaller = {
-  schema(name: never): {
-    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  schema: (name: never) => {
+    rpc: (fn: never, args: never) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type PostgrestSourcesOptions = {
@@ -34,18 +37,24 @@ type PostgrestSourcesOptions = {
     readonly schema?: string;
     readonly prefix?: string;
   };
-  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  /**
+   * Schema of the functions. Default `permdock`, where the hook generates
+   * `subject_for` and `members_of`.
+   */
   readonly schema?: string;
   /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
   readonly fn?: string;
   readonly membersFn?: string;
-  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  /**
+   * The version-only function `memberships.version` calls. Default
+   * `authz_version_for`.
+   */
   readonly versionFn?: string;
   /**
    * The policy whose declared roles tell custom roles apart. With it,
-   * `customRoles` reads nothing while every role the subject holds is
-   * declared, and `memberships.version` reads the whole subject in one call
-   * when the token claims a custom role, which the custom roles need anyway.
+   * `customRoles` reads nothing while every role the subject holds is declared,
+   * and `memberships.version` reads the whole subject in one call when the
+   * token claims a custom role, which the custom roles need anyway.
    */
   readonly policy?: Policy;
 };
@@ -58,42 +67,63 @@ type SubjectRecord = {
   readonly memberships: readonly Membership[];
   readonly customRoles: readonly CustomRole[];
   readonly authzVersion?: number;
+  /**
+   * The token claims the hook adds besides the memberships: `team_ids` and each
+   * `supabase.hook.claims` entry.
+   */
+  readonly claims?: Readonly<Record<string, unknown>>;
 };
 type PostgrestSources = {
   /**
-   * Memberships and the authorization version of any principal, and `list`,
-   * the live members of one scope instance through `members_of`, for
-   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
-   * the token was truncated.
+   * Memberships and the authorization version of any principal, and `list`, the
+   * live members of one scope instance through `members_of`, for `countHolders`
+   * and `whoCan`. Wrap it in `claimsFirst` to read only when the token was
+   * truncated.
    */
   readonly memberships: MembershipSource & {
-    list(query: {
+    list: (query: {
       readonly scope: string;
       readonly id: string;
-    }): Promise<MemberEntry[]>;
+    }) => Promise<MemberEntry[]>;
   };
   /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
-  customRoles(principal: {
+  customRoles: (principal: {
     readonly id: string;
-  }): CustomRoleSource;
-  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
-  subject(userId: string): Promise<Subject>;
+  }) => CustomRoleSource;
+  /**
+   * The subject the hook would mint for `userId`: anonymous when the user is
+   * unknown or suspended.
+   */
+  subject: (userId: string) => Promise<Subject>;
+  /**
+   * `subject` with its principal read again: roles, memberships and
+   * authorization version come from the database, the token's other claims
+   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context are
+   * kept as they were, so a refreshed OAuth client keeps its ceiling. An
+   * unknown or suspended user becomes a subject with no principal that still
+   * carries the actor and delegation. A subject with no principal is returned
+   * as is.
+   */
+  refresh: <P extends Principal>(subject: Subject<P>) => Promise<Subject<P>>;
   /** The raw record, `undefined` for an unknown user. */
-  record(userId: string): Promise<SubjectRecord | undefined>;
+  record: (userId: string) => Promise<SubjectRecord | undefined>;
 };
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+ * Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+ * malformed record is no record.
+ */
 declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
 /**
  * Membership, custom-role and subject sources over the `subject_for(p_user)`,
  * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
- * `permdock supabase hook generate` writes, for a backend that reaches
- * Postgres only through PostgREST. `memberships.version` reads only the
- * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
- * only for a stale token; when the version function is missing it falls back
- * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * `permdock supabase hook generate` writes, for a backend that reaches Postgres
+ * only through PostgREST. `memberships.version` reads only the version, so
+ * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+ * stale token; when the version function is missing it falls back to
+ * `subject_for`. With `policy`, a token that claims a custom role has its
  * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once per
- * `postgrestSources` call, so create it per request or per job.
+ * only for a subject that holds one. Each user and each instance is read once
+ * per `postgrestSources` call, so create it per request or per job.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion