permdock 0.7.0 → 0.8.0

package/dist/{index-BSfRl0hZ.d.ts → index-B8s204GL.d.ts}

@@ -1,9 +1,8 @@
-import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
-import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
-import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-C4gZUEZy.js";
+import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-zi_4T-rx.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CIlpSA2G.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are
@@ -21,9 +20,9 @@ type ProblemFromErrorOptions = {
 };
 /**
  * Turns a thrown PermDock error into its Problem Details response, with the
- * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
- * same decision. Returns `undefined` for anything else so the framework's own
- * error path takes over.
+ * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the same
+ * decision. Returns `undefined` for anything else so the framework's own error
+ * path takes over.
  */
 declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
 //#endregion
@@ -35,7 +34,10 @@ type ApiKeyParts = {
   readonly id: string;
   readonly secret: string;
 };
-/** What an application stores per key: the credential and the key's hash, never the key. */
+/**
+ * What an application stores per key: the credential and the key's hash, never
+ * the key.
+ */
 type StoredCredential = {
   readonly credential: Credential;
   readonly hash: string;
@@ -43,19 +45,19 @@ type StoredCredential = {
 /**
  * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
  * the secret 43 base62 characters and the checksum the 6 base62 characters of
- * the CRC-32 of everything before it. Anything else, including a checksum
- * that does not match, is `undefined`.
+ * the CRC-32 of everything before it. Anything else, including a checksum that
+ * does not match, is `undefined`.
  */
 declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
 /**
- * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is
- * 26 lowercase base32 characters and the checksum is 6 more. A checksum that
- * does not match is `undefined`.
+ * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is 26
+ * lowercase base32 characters and the checksum is 6 more. A checksum that does
+ * not match is `undefined`.
  */
 declare function parseFeedKey(key: unknown): ApiKeyParts | undefined;
 /**
- * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters
- * (130 bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
+ * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters (130
+ * bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
  */
 declare function generateFeedKey(id: string): string;
 /**
@@ -67,11 +69,11 @@ declare function generateApiKey(id: string): string;
 /** base64url SHA-256 of the whole key, the value to store and compare. */
 declare function hashApiKey(key: string): Promise<string>;
 /**
- * A `CredentialVerifier` over the application's own table: `find` looks a
- * key up by the id in it, and the key's hash is compared in constant time.
- * A record that is not a valid v1 credential, or whose id is not the key's,
- * verifies to `null`. A throwing `find` propagates, so the resolver denies
- * with `source-threw`.
+ * A `CredentialVerifier` over the application's own table: `find` looks a key
+ * up by the id in it, and the key's hash is compared in constant time. A record
+ * that is not a valid v1 credential, or whose id is not the key's, verifies to
+ * `null`. A throwing `find` propagates, so the resolver denies with
+ * `source-threw`.
  */
 declare function apiKeyVerifier(options: {
   readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
@@ -80,14 +82,14 @@ declare function apiKeyVerifier(options: {
 }): CredentialVerifier;
 type MemoryCredentialStore = CredentialVerifier & {
   /** Stores `credential` and returns its key; the key is never stored. */
-  issue(credential: Credential): Promise<string>;
+  issue: (credential: Credential) => Promise<string>;
   /** A new secret for the same id; the old key stops verifying at once. */
-  rotate(id: string): Promise<string | undefined>;
+  rotate: (id: string) => Promise<string | undefined>;
   /** `true` when a credential was removed. */
-  revoke(id: string): boolean;
-  list(): readonly Credential[];
+  revoke: (id: string) => boolean;
+  list: () => readonly Credential[];
   /** When `touch` last recorded a use of `id`, as RFC 3339. */
-  lastUsedAt(id: string): string | undefined;
+  lastUsedAt: (id: string) => string | undefined;
 };
 /**
  * In-process credentials for tests and single-replica apps. `issue`, `rotate`
@@ -99,24 +101,30 @@ declare function memoryCredentialStore(options?: {
 }): MemoryCredentialStore;
 type ApiKeySubjectOptions = {
   readonly verifier: CredentialVerifier;
-  /** The definitions, to turn the credential's permission keys into its delegation. */
+  /**
+   * The definitions, to turn the credential's permission keys into its
+   * delegation.
+   */
   readonly permissions: PermissionTree;
   /**
-   * Loads the live owner of a user-bound key: roles and memberships as of
-   * this request, asked with the key's tenant. `null` (a deleted or
-   * suspended user) is anonymous with `owner-unavailable`, and a throw is
-   * `source-threw`. Without it the owner is `{ id, kind: 'user' }` and its
-   * rights come from the `memberships` source passed to `createPermDock`.
+   * Loads the live owner of a user-bound key: roles and memberships as of this
+   * request, asked with the key's tenant. `null` (a deleted or suspended user)
+   * is anonymous with `owner-unavailable`, and a throw is `source-threw`.
+   * Without it the owner is `{ id, kind: 'user' }` and its rights come from the
+   * `memberships` source passed to `createPermDock`.
    */
   readonly principals?: PrincipalSource;
-  /** The tenant the request acts in: a user key is held to its owner's memberships there. */
+  /**
+   * The tenant the request acts in: a user key is held to its owner's
+   * memberships there.
+   */
   readonly tenant?: string;
   /** `true` when the application revoked the credential id; a throw denies. */
   readonly revoked?: (id: string) => boolean | Promise<boolean>;
   /**
-   * The tenant `credentials` policy, checked on every use so a tightened
-   * policy reaches existing keys: a service key's own tenant, a user key's
-   * the `tenant` the resolver is called with. A throw denies.
+   * The tenant `credentials` policy, checked on every use so a tightened policy
+   * reaches existing keys: a service key's own tenant, a user key's the
+   * `tenant` the resolver is called with. A throw denies.
    */
   readonly settings?: SettingsSource;
   /** Receives a `credential` event with operation `used` for sampled uses. */
@@ -132,10 +140,10 @@ type ApiKeySubjectOptions = {
 };
 /**
  * Resolves an opaque API key (`pdk_<id>_<secret>`) into the subject its
- * credential acts as. Every failure (a malformed or unknown key, a record
- * that is not a valid credential, expiry, a tenant policy the key breaks, a
- * revoked id, a missing owner, a throwing verifier, source or callback) is
- * the anonymous subject, never a throw.
+ * credential acts as. Every failure (a malformed or unknown key, a record that
+ * is not a valid credential, expiry, a tenant policy the key breaks, a revoked
+ * id, a missing owner, a throwing verifier, source or callback) is the
+ * anonymous subject, never a throw.
  */
 declare function subjectFromApiKey(key: string | undefined | null, options: ApiKeySubjectOptions): Promise<Subject<ApiKeyPrincipal>>;
 //#endregion
@@ -145,7 +153,7 @@ type SupportSessionFailureCause = TokenFailureCause | "invalid-claims" | "sessio
 /** The live state of each support session, so one can end before it expires. */
 type SupportSessionSource = {
   /** The session as of now, or `null` for an unknown one. A throw ends it. */
-  session(id: string): {
+  session: (id: string) => {
     readonly id: string;
     readonly ended?: boolean;
   } | null | Promise<{
@@ -176,19 +184,19 @@ type SupportSessionContext = {
 };
 /**
  * Signs a granted `SupportSession` as a `vnd.permdock.support-session+jwt`
- * (`sub` the viewed principal, `act` the support actor, `jti` the session
- * id) that expires with the session. Throws a `TypeError` for a record
+ * (`sub` the viewed principal, `act` the support actor, `jti` the session id)
+ * that expires with the session. Throws a `TypeError` for a record
  * `parseSupportSession` refuses.
  */
 declare function signSupportSession(session: SupportSession, signer: TokenSigner, options?: {
   readonly audience?: string | readonly string[];
 }): Promise<string>;
 /**
- * Resolves a `vnd.permdock.support-session+jwt` into the subject each
- * request of the session acts as: the viewed principal loaded live, a
- * `support` actor, the session's permissions as the delegation and
- * `context.supportSession`. The actor must still exist. Every failure is the
- * anonymous subject, never a throw.
+ * Resolves a `vnd.permdock.support-session+jwt` into the subject each request
+ * of the session acts as: the viewed principal loaded live, a `support` actor,
+ * the session's permissions as the delegation and `context.supportSession`. The
+ * actor must still exist. Every failure is the anonymous subject, never a
+ * throw.
  */
 declare function subjectFromSupportSession(token: string | undefined | null, options: SupportSessionSubjectOptions): Promise<Subject>;
 //#endregion
@@ -196,15 +204,19 @@ declare function subjectFromSupportSession(token: string | undefined | null, opt
 declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
 declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
 declare function validationProblem(detail: string): Response;
-declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
+type DecisionProblemOptions = {
   readonly instance?: string;
   readonly approval?: ApprovalHint;
   /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
   readonly disclosure?: Disclosure;
   /** Whether the request carried credentials, which picks the `401` challenge. */
   readonly credentials?: boolean;
-  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
+  /**
+   * The scope an `insufficient_scope` challenge names; the permission's own
+   * scope when absent.
+   */
   readonly scope?: string;
-}): Response;
+};
+declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: DecisionProblemOptions): Response;
 //#endregion
 export { subjectFromApiKey as C, createPermDock as E, parseFeedKey as S, problemFromError as T, generateApiKey as _, SupportSessionContext as a, memoryCredentialStore as b, SupportSessionSubjectOptions as c, ApiKeyFailureCause as d, ApiKeyParts as f, apiKeyVerifier as g, StoredCredential as h, wwwAuthenticate as i, signSupportSession as l, MemoryCredentialStore as m, problemResponse as n, SupportSessionFailureCause as o, ApiKeySubjectOptions as p, validationProblem as r, SupportSessionSource as s, problemFromDecision as t, subjectFromSupportSession as u, generateFeedKey as v, ProblemFromErrorOptions as w, parseApiKey as x, hashApiKey as y };

package/dist/{index-DH9DUDEM.d.ts → index-BT5-1VsX.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-B-F-qAZk.js";
-import { O as AppData } from "./permission-types-DhNEmoRG.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
-import { t as SqlQuery } from "./sql-CDEPCA0g.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-CCiDRZBH.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as SqlQuery } from "./sql-B80DFdpG.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -12,7 +12,10 @@ declare const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 declare const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 /** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
 declare const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
+/**
+ * The extension that carries the application's own data (`x`) on a User or a
+ * Group.
+ */
 declare const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 type DirectoryMeta = {
   readonly created: string;
@@ -31,7 +34,10 @@ type DirectoryUser = {
   readonly userName: string;
   readonly active: boolean;
   readonly emails?: readonly DirectoryEmail[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -44,7 +50,10 @@ type DirectoryGroup = {
   readonly displayName: string;
   readonly members: readonly DirectoryGroupMember[];
   readonly roles?: readonly string[];
-  /** The application's own data, from the `AppData` extension; plain JSON, never read by a decision. */
+  /**
+   * The application's own data, from the `AppData` extension; plain JSON, never
+   * read by a decision.
+   */
   readonly x?: AppData;
   readonly meta: DirectoryMeta;
 };
@@ -80,17 +89,17 @@ type ScimPatchOp = {
 type DirectoryStore = {
   /** Shown in errors and events; optional, as on every extension interface. */
   readonly name?: string;
-  getUser(tenant: string, id: string): DirectoryUser | null | Promise<DirectoryUser | null>;
-  findUsers(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
-  putUser(tenant: string, user: DirectoryUser): DirectoryUser | Promise<DirectoryUser>;
-  patchUser(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryUser | Promise<DirectoryUser>;
-  deleteUser(tenant: string, id: string): void | Promise<void>;
-  getGroup(tenant: string, id: string): DirectoryGroup | null | Promise<DirectoryGroup | null>;
-  findGroups(tenant: string, filter: ScimFilter | undefined, page: ScimPage): ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
-  putGroup(tenant: string, group: DirectoryGroup): DirectoryGroup | Promise<DirectoryGroup>;
-  patchGroup(tenant: string, id: string, ops: readonly ScimPatchOp[]): DirectoryGroup | Promise<DirectoryGroup>;
-  deleteGroup(tenant: string, id: string): void | Promise<void>;
-  groupsFor(tenant: string, userId: string): readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
+  getUser: (tenant: string, id: string) => DirectoryUser | null | Promise<DirectoryUser | null>;
+  findUsers: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryUser> | Promise<ScimPageResult<DirectoryUser>>;
+  putUser: (tenant: string, user: DirectoryUser) => DirectoryUser | Promise<DirectoryUser>;
+  patchUser: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryUser | Promise<DirectoryUser>;
+  deleteUser: (tenant: string, id: string) => void | Promise<void>;
+  getGroup: (tenant: string, id: string) => DirectoryGroup | null | Promise<DirectoryGroup | null>;
+  findGroups: (tenant: string, filter: ScimFilter | undefined, page: ScimPage) => ScimPageResult<DirectoryGroup> | Promise<ScimPageResult<DirectoryGroup>>;
+  putGroup: (tenant: string, group: DirectoryGroup) => DirectoryGroup | Promise<DirectoryGroup>;
+  patchGroup: (tenant: string, id: string, ops: readonly ScimPatchOp[]) => DirectoryGroup | Promise<DirectoryGroup>;
+  deleteGroup: (tenant: string, id: string) => void | Promise<void>;
+  groupsFor: (tenant: string, userId: string) => readonly DirectoryGroup[] | Promise<readonly DirectoryGroup[]>;
 };
 type ScimTokenOptions = {
   readonly hash: "sha256";
@@ -99,7 +108,10 @@ type ScimTokenOptions = {
 type DirectoryChange = {
   readonly tenant: string;
   readonly userIds: readonly string[];
-  /** `session-revoked` when a user was deactivated or deleted; `changed` otherwise. */
+  /**
+   * `session-revoked` when a user was deactivated or deleted; `changed`
+   * otherwise.
+   */
   readonly kind: "session-revoked" | "changed";
 };
 type ScimHandlerOptions = {
@@ -108,7 +120,10 @@ type ScimHandlerOptions = {
   readonly token?: ScimTokenOptions;
   readonly verifier?: TokenVerifier;
   readonly audience?: string;
-  /** With `verifier`: where the JWT names its tenant (`claims.tenant`); default `tenant`, then `tid`. */
+  /**
+   * With `verifier`: where the JWT names its tenant (`claims.tenant`); default
+   * `tenant`, then `tid`.
+   */
   readonly claims?: Pick<ClaimsMap, "tenant">;
   readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
   readonly assignable?: readonly string[];
@@ -116,8 +131,8 @@ type ScimHandlerOptions = {
   readonly onChange?: (change: DirectoryChange) => void | Promise<void>;
   /**
    * Publishes for each affected user's id, `externalId` and `userName`:
-   * `session-revoked` when a user is deactivated (`active: false`) or
-   * deleted, so open connections end; `changed` otherwise, so they revalidate.
+   * `session-revoked` when a user is deactivated (`active: false`) or deleted,
+   * so open connections end; `changed` otherwise, so they revalidate.
    */
   readonly revocations?: RevocationFeed;
   readonly onUnknownRole?: (name: string) => void;
@@ -139,9 +154,15 @@ declare class DirectoryNotFoundError extends Error {
   readonly code: "not-found";
   constructor(message?: string);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryUniquenessError(error: unknown): error is DirectoryUniquenessError;
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 declare function isDirectoryNotFoundError(error: unknown): error is DirectoryNotFoundError;
 //#endregion
 //#region src/scim/auth.d.ts
@@ -195,15 +216,18 @@ declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
 //#region src/scim/postgres-store.d.ts
 type PostgresDirectoryStoreOptions = {
-  /** Schema of the generated tables (`permdock scim generate --schema`). Default `permdock`. */
+  /**
+   * Schema of the generated tables (`permdock scim generate --schema`). Default
+   * `permdock`.
+   */
   readonly schema?: string;
 };
 /**
  * A `DirectoryStore` over the tables `permdock scim generate` writes, called
- * through a `SqlQuery` that may read and write them (the table owner, or a
- * role granted on them). Every method is one statement, so a pool needs no
- * transaction: a group and its members change together, and a PATCH that
- * races another write re-reads the row and applies its operations again.
+ * through a `SqlQuery` that may read and write them (the table owner, or a role
+ * granted on them). Every method is one statement, so a pool needs no
+ * transaction: a group and its members change together, and a PATCH that races
+ * another write re-reads the row and applies its operations again.
  */
 declare function postgresDirectoryStore(query: SqlQuery, options?: PostgresDirectoryStoreOptions): DirectoryStore;
 //#endregion