permdock 0.6.0 → 0.8.0

package/dist/prisma/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere, u as restrictedRowsSql } from "../compile-CMqMx_IN.js";
-import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-CkEwrw3W.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { t as assertSafeKey } from "../paths-CUvURzHp.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-EzEMB-7v.js";
+import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-8sH5HlII.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {
 	const mapped = (field) => fieldName(field, options.fields);
@@ -139,8 +139,9 @@ function permdockExtension() {
 	};
 }
 /**
-* Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
-* the generated RLS policies decide for the same subject as the in-process checks.
+* Runs `fn` in an interactive transaction whose role and claims are
+* `permdock.subject`'s, so the generated RLS policies decide for the same
+* subject as the in-process checks.
 */
 function withSubject(prisma, permdock, fn, options = {}) {
 	const statements = subjectStatements(permdock, options);
@@ -150,9 +151,10 @@ function withSubject(prisma, permdock, fn, options = {}) {
 	});
 }
 /**
-* Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
-* filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
-* filter keeps the row. One query when granted, two otherwise.
+* Checks one row by its unique key, for `findUnique`, `update` and `delete`,
+* which take no filter: `{ found: false }` when `unique` matches nothing,
+* otherwise whether the permission filter keeps the row. One query when
+* granted, two otherwise.
 */
 async function checkRow(delegate, input, unique, options = {}) {
 	const filter = toWhere(input, options);
@@ -233,7 +235,8 @@ function render(node, model, options, ops) {
 }
 /**
 * Compiles a condition into a Prisma 8 ORM predicate: pass the result to
-* `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+* `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that
+* matches no row.
 */
 function toPredicate(input, options = {}) {
 	const compiled = compileWhere(input, compact({
@@ -292,8 +295,9 @@ function fromDatamodel(datamodel, model) {
 	};
 }
 /**
-* Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
-* the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+* Reads a model's required and list fields from `schema.prisma` text or a DMMF
+* datamodel, for the `model` option of `toWhere` and `toPredicate`. Relation
+* fields are skipped.
 */
 function prismaModelFields(datamodel, model) {
 	assertSafeKey(model, "Prisma model");
@@ -334,10 +338,10 @@ function refused(detail) {
 	});
 }
 /**
-* `where` with every `related` node replaced by the ids it reaches, read in
-* one query per node, so an ORM without raw subqueries (Prisma) filters the
-* graph with a plain `in`. The ids are read now: run the filtered query right
-* after, in the same transaction when the graph may change in between.
+* `where` with every `related` node replaced by the ids it reaches, read in one
+* query per node, so an ORM without raw subqueries (Prisma) filters the graph
+* with a plain `in`. The ids are read now: run the filtered query right after,
+* in the same transaction when the graph may change in between.
 */
 async function resolveRelated(where, options) {
 	const resources = where.resources;

package/dist/{problem-CTviyH5L.js → problem-BVLHFK33.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { a as problemType, i as stepUpOf, n as problemDetails, o as statusProblem, t as notFoundDetails } from "./problem-details-cn5X30gZ.js";
-import { a as deniedMessage, i as approvalMessage } from "./errors-BKy0EfhN.js";
-import { a as durationOf, g as secondsOf, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { a as problemType, i as stepUpOf, n as problemDetails, o as statusProblem, t as notFoundDetails } from "./problem-details-CLDgX1KV.js";
+import { a as deniedMessage, i as approvalMessage } from "./errors-B6R_lg2a.js";
+import { a as durationOf, g as secondsOf, p as nowSeconds } from "./time-nR1JesoH.js";
 //#region src/server/problem.ts
 function quoted(value) {
 	return `"${value.replaceAll(/["\\]/gu, "")}"`;
@@ -31,7 +31,10 @@ function protectedResourceMetadataUrl(resource) {
 	const path = resource.pathname === "/" ? "" : resource.pathname;
 	return `${resource.origin}/.well-known/oauth-protected-resource${path}`;
 }
-/** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
+/**
+* The `error_description` of every `invalid_token` challenge (RFC 6750 section
+* 3.1).
+*/
 const INVALID_TOKEN = "The access token is invalid";
 function wwwAuthenticate(decision, permission, credentials = true) {
 	return challengeFor(decision, permission?.scope, credentials);
@@ -111,9 +114,9 @@ function rateLimitHeaders(decision, now) {
 	};
 }
 /**
-* The response for a decision's Problem Details: `WWW-Authenticate` for a
-* `401` or a missing delegation, and the rate-limit fields for a `429`. A
-* hidden row's `404` carries neither, so it reads like a missing one.
+* The response for a decision's Problem Details: `WWW-Authenticate` for a `401`
+* or a missing delegation, and the rate-limit fields for a `429`. A hidden
+* row's `404` carries neither, so it reads like a missing one.
 */
 function decisionResponse(details, decision, options = {}) {
 	const headers = new Headers({
@@ -127,13 +130,15 @@ function decisionResponse(details, decision, options = {}) {
 		headers
 	});
 }
-function problemFromDecision(decision, permission, subject, options = {}) {
-	if (decision.outcome === "granted") return new Response(null, { status: 204 });
-	const validation = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
-	if (options.disclosure !== "hide" && validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
-		...permission,
-		scope: options.scope
-	}, decision);
+function validationOf(decision, disclosure) {
+	const detail = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
+	return disclosure !== "hide" && detail instanceof PermDockValidationError ? detail : void 0;
+}
+/** The Problem Details body `problemFromDecision` answers with. */
+function decisionProblem(decision, permission, subject, options = {}) {
+	return validationOf(decision, options.disclosure)?.toProblemDetails() ?? refusalDetails(decision, permission, subject, options);
+}
+function refusalDetails(decision, permission, subject, options) {
 	const details = problemDetails(compact({
 		decision,
 		detail: decision.outcome === "approval-required" ? approvalMessage(permission.key, decision.reason, decision.token) : deniedMessage(permission.key, subject?.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key), subject !== void 0),
@@ -147,10 +152,19 @@ function problemFromDecision(decision, permission, subject, options = {}) {
 		at: options.approval.at,
 		hint: options.approval.hint
 	});
-	return decisionResponse(approval === void 0 ? details : {
+	return approval === void 0 ? details : {
 		...details,
 		approval
-	}, decision, compact({
+	};
+}
+function problemFromDecision(decision, permission, subject, options = {}) {
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	const validation = validationOf(decision, options.disclosure);
+	if (validation !== void 0) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
+		...permission,
+		scope: options.scope
+	}, decision);
+	return decisionResponse(refusalDetails(decision, permission, subject, options), decision, compact({
 		scope: options.scope ?? permission.scope,
 		credentials: options.credentials
 	}));
@@ -167,16 +181,22 @@ const ANONYMOUS = freezeDeep({
 	}],
 	alternatives: []
 });
-/** The `401` for a request with no subject, with the RFC 6750 challenge its credentials call for. */
+/**
+* The `401` for a request with no subject, with the RFC 6750 challenge its
+* credentials call for.
+*/
 function unauthenticatedProblem(credentials) {
 	return decisionResponse(problemDetails({
 		decision: ANONYMOUS,
 		detail: "anonymous"
 	}), ANONYMOUS, { credentials });
 }
-/** RFC 9110 section 15.5.6: a `405` lists the methods the resource supports in `Allow`. */
+/**
+* RFC 9110 section 15.5.6: a `405` lists the methods the resource supports in
+* `Allow`.
+*/
 function methodNotAllowed(allow) {
 	return problemResponse(statusProblem(405, `use ${allow}`), void 0, void 0, { Allow: allow });
 }
 //#endregion
-export { methodNotAllowed as a, problemResponse as c, validationProblem as d, wwwAuthenticate as f, decisionResponse as i, protectedResourceMetadataUrl as l, batchTooLarge as n, notFoundProblem as o, bearerChallenge as r, problemFromDecision as s, ANONYMOUS as t, unauthenticatedProblem as u };
+export { decisionResponse as a, problemFromDecision as c, unauthenticatedProblem as d, validationProblem as f, decisionProblem as i, problemResponse as l, batchTooLarge as n, methodNotAllowed as o, wwwAuthenticate as p, bearerChallenge as r, notFoundProblem as s, ANONYMOUS as t, protectedResourceMetadataUrl as u };

package/dist/{problem-details-cn5X30gZ.js → problem-details-CLDgX1KV.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { t as PROBLEM_BASE } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 //#region src/core/problem-types.ts
 /** The `type` URI of a PermDock problem type. */
@@ -38,7 +38,10 @@ function statusProblem(status, detail, extra = {}) {
 }
 //#endregion
 //#region src/core/problem-details.ts
-/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
+/**
+* Reasons that only arise once a matching grant was found, so they reveal
+* nothing hidden.
+*/
 const HOLDS_GRANT = /* @__PURE__ */ new Set([
 	"insufficient-user-authentication",
 	"limit",
@@ -48,14 +51,20 @@ function granteesOf(to) {
 	if (to === void 0) return [];
 	return Array.isArray(to) ? to : [to];
 }
-/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+/**
+* The plans a `not-entitled` denial asks for; empty unless every denial is
+* `not-entitled`.
+*/
 function requiredPlans(decision) {
 	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => denial.reason !== "not-entitled")) return [];
 	const plans = /* @__PURE__ */ new Set();
 	for (const denial of decision.denials) for (const item of granteesOf(denial.to)) if (item.kind === "plan") plans.add(item.plan);
 	return [...plans];
 }
-/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
+/**
+* The `acr` values and the tightest `maxAge` the failing assurance grants ask
+* for.
+*/
 function stepUpOf(decision) {
 	if (decision.outcome !== "denied") return {};
 	const acr = /* @__PURE__ */ new Set();

package/dist/{problem-types-CJ2325SZ.js → problem-types-DSsRfONQ.js}

@@ -1,5 +1,8 @@
 //#region src/cli/cloud/problem-types.ts
-/** The Problem `type` of `GET /v1/projects/{id}/policy` before the first `cloud push`. */
+/**
+* The Problem `type` of `GET /v1/projects/{id}/policy` before the first `cloud
+* push`.
+*/
 const POLICY_NOT_PUBLISHED = "https://permdock.com/problems/policy-not-published";
 //#endregion
 export { POLICY_NOT_PUBLISHED as t };