pyric 0.1.0-alpha.17 → 0.1.0-alpha.18
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md
CHANGED
|
@@ -14,12 +14,38 @@ Pyric adds a development-only resolution layer to a Firebase application. Run th
|
|
|
14
14
|
|
|
15
15
|
The mirrored data services do not connect to a production Firebase project. Local writes cannot delete production data or create Firebase usage charges, and local rules changes do not deploy. Pyric owns the development sandbox and verification workflow. Firebase owns production, with `firebase-tools` or the Firebase Console handling deployment.
|
|
16
16
|
|
|
17
|
-
## Start a
|
|
17
|
+
## Start with a coding agent
|
|
18
|
+
|
|
19
|
+
Install the Pyric plugin:
|
|
20
|
+
|
|
21
|
+
```bash
|
|
22
|
+
npx plugins add davideast/pyric
|
|
23
|
+
```
|
|
24
|
+
|
|
25
|
+
Antigravity CLI and OpenCode use the standalone skill installer:
|
|
26
|
+
|
|
27
|
+
```bash
|
|
28
|
+
# Antigravity CLI
|
|
29
|
+
npx skills add https://github.com/davideast/pyric/tree/main/pyric-plugin/skills/pyric-start --agent antigravity-cli
|
|
30
|
+
|
|
31
|
+
# OpenCode
|
|
32
|
+
npx skills add https://github.com/davideast/pyric/tree/main/pyric-plugin/skills/pyric-start --agent opencode
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
Then ask your agent:
|
|
36
|
+
|
|
37
|
+
```text
|
|
38
|
+
Use the pyric-start skill to set up and run Pyric in this project.
|
|
39
|
+
```
|
|
40
|
+
|
|
41
|
+
The skill chooses the project launcher, starts one local sandbox bridge, opens the application, and confirms that the browser sandbox is connected.
|
|
42
|
+
|
|
43
|
+
## Start from the terminal
|
|
18
44
|
|
|
19
45
|
Create a Vite application with canonical Firebase imports, Firestore rules, and the Pyric development plugin already configured:
|
|
20
46
|
|
|
21
47
|
```bash
|
|
22
|
-
npm create pyric my-app
|
|
48
|
+
npm create pyric@latest my-app
|
|
23
49
|
cd my-app
|
|
24
50
|
npm install
|
|
25
51
|
npm run dev
|
|
@@ -41,7 +67,7 @@ import { defineConfig } from 'vite';
|
|
|
41
67
|
import { pyric } from '@pyric/cli/vite';
|
|
42
68
|
|
|
43
69
|
export default defineConfig({
|
|
44
|
-
plugins: [
|
|
70
|
+
plugins: [pyric()],
|
|
45
71
|
});
|
|
46
72
|
```
|
|
47
73
|
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-record.d.ts","sourceRoot":"","sources":["../../src/sandbox/operation-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAGV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,KAAK,cAAc,GAAG,CAAC,YAAY,GAAG,qBAAqB,GAAG,oBAAoB,CAAC,GAAG,eAAe,CAAC;AAEtG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,cAAc,CAU7E;AAED;;iBAEiB;AACjB,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAQrF;AAED;iCACiC;AACjC,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAQxF;AASD;;;uEAGuE;AACvE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,gBAAgB,CA6BlB;AAED;8EAC8E;AAC9E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC,GACjF,gBAAgB,CAElB;
|
|
1
|
+
{"version":3,"file":"operation-record.d.ts","sourceRoot":"","sources":["../../src/sandbox/operation-record.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAGV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACtB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,WAAW,GAAG,UAAU,CAAC;IACzD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,CAAC,QAAQ,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAC5G,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC;IACnC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED,KAAK,cAAc,GAAG,CAAC,YAAY,GAAG,qBAAqB,GAAG,oBAAoB,CAAC,GAAG,eAAe,CAAC;AAEtG,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,cAAc,CAU7E;AAED;;iBAEiB;AACjB,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,gBAAgB,CAQrF;AAED;iCACiC;AACjC,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,gBAAgB,GAAG,eAAe,CAQxF;AASD;;;uEAGuE;AACvE,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,eAAe,GAAG,SAAS,EACnC,QAAQ,EAAE,eAAe,GAAG,SAAS,GACpC,gBAAgB,CA6BlB;AAED;8EAC8E;AAC9E,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,eAAe,EAAE,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,QAAQ,CAAC,GACjF,gBAAgB,CAElB;AAoBD;;qCAEqC;AACrC,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,cAAc,GAAG,gBAAgB,CAoC3E;AA8BD,qEAAqE;AACrE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,YAAY,GAAG,eAAe,GAAG,IAAI,CA+B7E"}
|
|
@@ -76,6 +76,23 @@ export function resolveOperationContext(issued, executed) {
|
|
|
76
76
|
export function operationContextFor(event) {
|
|
77
77
|
return resolveOperationContext(undefined, event);
|
|
78
78
|
}
|
|
79
|
+
function isPermissionDeniedError(event) {
|
|
80
|
+
if (event.result === 'deny') {
|
|
81
|
+
return true;
|
|
82
|
+
}
|
|
83
|
+
if (!('error' in event) || !event.error || typeof event.error !== 'object') {
|
|
84
|
+
return false;
|
|
85
|
+
}
|
|
86
|
+
const code = event.error.code;
|
|
87
|
+
if (typeof code !== 'string') {
|
|
88
|
+
return false;
|
|
89
|
+
}
|
|
90
|
+
const normalized = code.toLowerCase();
|
|
91
|
+
if (normalized === 'permission_denied' || normalized === 'permission-denied' || normalized === 'auth/permission-denied') {
|
|
92
|
+
return true;
|
|
93
|
+
}
|
|
94
|
+
return false;
|
|
95
|
+
}
|
|
79
96
|
/** Normalize the legacy per-service markers exactly once, at the sandbox
|
|
80
97
|
* stream seam. Consumers must not inspect `detail.admin`, `origin`, or the
|
|
81
98
|
* presence of a trace themselves. */
|
|
@@ -89,6 +106,9 @@ export function rulesDispositionFor(event) {
|
|
|
89
106
|
if (event.detail?.admin === true) {
|
|
90
107
|
return { kind: 'bypassed', reason: 'admin' };
|
|
91
108
|
}
|
|
109
|
+
if (isPermissionDeniedError(event)) {
|
|
110
|
+
return { kind: 'evaluated', verdict: 'deny' };
|
|
111
|
+
}
|
|
92
112
|
if (event.result === 'unsupported') {
|
|
93
113
|
return { kind: 'not-evaluated', reason: 'unsupported' };
|
|
94
114
|
}
|
|
@@ -99,20 +119,11 @@ export function rulesDispositionFor(event) {
|
|
|
99
119
|
return { kind: 'not-evaluated', reason: 'not-a-rules-operation' };
|
|
100
120
|
}
|
|
101
121
|
if (event.kind === 'listener') {
|
|
102
|
-
if (event.result === 'deny') {
|
|
103
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
104
|
-
}
|
|
105
|
-
if (event.error?.code === 'PERMISSION_DENIED') {
|
|
106
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
107
|
-
}
|
|
108
122
|
if (event.rules) {
|
|
109
123
|
return { kind: 'evaluated', verdict: 'deny' };
|
|
110
124
|
}
|
|
111
125
|
return { kind: 'not-evaluated', reason: 'runtime-error' };
|
|
112
126
|
}
|
|
113
|
-
if (event.result === 'deny') {
|
|
114
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
115
|
-
}
|
|
116
127
|
if (event.kind === 'request') {
|
|
117
128
|
return { kind: 'evaluated', verdict: 'allow' };
|
|
118
129
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"operation-record.js","sourceRoot":"","sources":["../../src/sandbox/operation-record.ts"],"names":[],"mappings":"AAsCA,MAAM,UAAU,gBAAgB,CAAC,KAAmB;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;iBAEiB;AACjB,MAAM,UAAU,yBAAyB,CAAC,OAAyB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAe,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAa,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED;iCACiC;AACjC,MAAM,UAAU,6BAA6B,CAAC,OAAyB;IACrE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK;QACvB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAuC;IAC1D,MAAM,aAAa,GAAG,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC;IAC3D,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,aAAa,CAAC;IACjF,IAAI,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;uEAGuE;AACvE,MAAM,UAAU,uBAAuB,CACrC,MAAmC,EACnC,QAAqC;IAErC,MAAM,cAAc,GAAG,MAAM,EAAE,gBAAgB,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC;IACzE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,EAAE,KAAK,CAAC;IAC/E,OAAO,yBAAyB,CAAC;QAC/B,MAAM,EACJ,WAAW,CAAC,MAAM,CAAC;eAChB,WAAW,CAAC,QAAQ,CAAC;eACrB,cAAc;eACd,gBAAgB;eAChB,EAAE,IAAI,EAAE,cAAc,EAAE;QAC7B,QAAQ,EACN,QAAQ,EAAE,gBAAgB,EAAE,QAAQ;eACjC,QAAQ,EAAE,QAAQ;eAClB,MAAM,EAAE,gBAAgB,EAAE,QAAQ;eAClC,MAAM,EAAE,QAAQ;eAChB,EAAE,IAAI,EAAE,aAAa,EAAE;QAC5B,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM;eAChC,MAAM,EAAE,MAAM;eACd,QAAQ,EAAE,gBAAgB,EAAE,MAAM;eAClC,QAAQ,EAAE,MAAM,CAAC,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EACJ,MAAM,EAAE,gBAAgB,EAAE,MAAM;uBAC7B,MAAM,EAAE,MAAM;uBACd,QAAQ,EAAE,gBAAgB,EAAE,MAAM;uBAClC,QAAQ,EAAE,MAAM;aACtB,CAAC;KACP,CAAC,CAAC;AACL,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,KAAkF;IAElF,OAAO,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,IAAI,kBAAkB,IAAI,KAAK,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,gBAAgB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;
|
|
1
|
+
{"version":3,"file":"operation-record.js","sourceRoot":"","sources":["../../src/sandbox/operation-record.ts"],"names":[],"mappings":"AAsCA,MAAM,UAAU,gBAAgB,CAAC,KAAmB;IAClD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;iBAEiB;AACjB,MAAM,UAAU,yBAAyB,CAAC,OAAyB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAe,CAAC;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAa,CAAC;IACpE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,MAAM;QACN,QAAQ;QACR,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED;iCACiC;AACjC,MAAM,UAAU,6BAA6B,CAAC,OAAyB;IACrE,MAAM,KAAK,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,MAAM;QACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK;QACvB,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;KAChE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,UAAuC;IAC1D,MAAM,aAAa,GAAG,UAAU,EAAE,gBAAgB,EAAE,MAAM,CAAC;IAC3D,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,aAAa,CAAC;IACjF,IAAI,UAAU,EAAE,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC3F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;uEAGuE;AACvE,MAAM,UAAU,uBAAuB,CACrC,MAAmC,EACnC,QAAqC;IAErC,MAAM,cAAc,GAAG,MAAM,EAAE,gBAAgB,EAAE,MAAM,IAAI,MAAM,EAAE,KAAK,CAAC;IACzE,MAAM,gBAAgB,GAAG,QAAQ,EAAE,gBAAgB,EAAE,MAAM,IAAI,QAAQ,EAAE,KAAK,CAAC;IAC/E,OAAO,yBAAyB,CAAC;QAC/B,MAAM,EACJ,WAAW,CAAC,MAAM,CAAC;eAChB,WAAW,CAAC,QAAQ,CAAC;eACrB,cAAc;eACd,gBAAgB;eAChB,EAAE,IAAI,EAAE,cAAc,EAAE;QAC7B,QAAQ,EACN,QAAQ,EAAE,gBAAgB,EAAE,QAAQ;eACjC,QAAQ,EAAE,QAAQ;eAClB,MAAM,EAAE,gBAAgB,EAAE,QAAQ;eAClC,MAAM,EAAE,QAAQ;eAChB,EAAE,IAAI,EAAE,aAAa,EAAE;QAC5B,GAAG,CAAC,CAAC,MAAM,EAAE,gBAAgB,EAAE,MAAM;eAChC,MAAM,EAAE,MAAM;eACd,QAAQ,EAAE,gBAAgB,EAAE,MAAM;eAClC,QAAQ,EAAE,MAAM,CAAC,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC;gBACE,MAAM,EACJ,MAAM,EAAE,gBAAgB,EAAE,MAAM;uBAC7B,MAAM,EAAE,MAAM;uBACd,QAAQ,EAAE,gBAAgB,EAAE,MAAM;uBAClC,QAAQ,EAAE,MAAM;aACtB,CAAC;KACP,CAAC,CAAC;AACL,CAAC;AAED;8EAC8E;AAC9E,MAAM,UAAU,mBAAmB,CACjC,KAAkF;IAElF,OAAO,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAqB;IACpD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAI,KAAK,CAAC,KAA4B,CAAC,IAAI,CAAC;IACtD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACtC,IAAI,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,wBAAwB,EAAE,CAAC;QACxH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;qCAEqC;AACrC,MAAM,UAAU,mBAAmB,CAAC,KAAqB;IACvD,IAAI,kBAAkB,IAAI,KAAK,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC,gBAAgB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,EAAE,KAAK,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC/C,CAAC;IACD,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC3D,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACpE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAChD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC5D,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAe;IACzC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,QAAQ,GAAwC,SAAS,CAAC;IAC9D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,KAAK,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IAC1E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,eAAe,CAAC,KAAgC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,iBAAiB,CAAC,KAAmB;IACnD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,SAAS,GAAG,QAAQ,CAAC;IACzB,IAAI,OAAO,GAAuB,SAAS,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC3D,SAAS,GAAG,KAAK,CAAC,MAAM,CAAC;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACrC,SAAS,GAAG,QAAQ,CAAC;QACrB,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,UAAU,GAAiB,WAAW,CAAC;IAC3C,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAChC,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,OAAO,EAAE,UAAU;QACnB,MAAM,EAAE,SAAS;QACjB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,IAAI,EAAE,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC"}
|
package/package.json
CHANGED
|
@@ -126,6 +126,24 @@ export function operationContextFor(
|
|
|
126
126
|
return resolveOperationContext(undefined, event);
|
|
127
127
|
}
|
|
128
128
|
|
|
129
|
+
function isPermissionDeniedError(event: OperationEvent): boolean {
|
|
130
|
+
if (event.result === 'deny') {
|
|
131
|
+
return true;
|
|
132
|
+
}
|
|
133
|
+
if (!('error' in event) || !event.error || typeof event.error !== 'object') {
|
|
134
|
+
return false;
|
|
135
|
+
}
|
|
136
|
+
const code = (event.error as { code?: unknown }).code;
|
|
137
|
+
if (typeof code !== 'string') {
|
|
138
|
+
return false;
|
|
139
|
+
}
|
|
140
|
+
const normalized = code.toLowerCase();
|
|
141
|
+
if (normalized === 'permission_denied' || normalized === 'permission-denied' || normalized === 'auth/permission-denied') {
|
|
142
|
+
return true;
|
|
143
|
+
}
|
|
144
|
+
return false;
|
|
145
|
+
}
|
|
146
|
+
|
|
129
147
|
/** Normalize the legacy per-service markers exactly once, at the sandbox
|
|
130
148
|
* stream seam. Consumers must not inspect `detail.admin`, `origin`, or the
|
|
131
149
|
* presence of a trace themselves. */
|
|
@@ -139,6 +157,9 @@ export function rulesDispositionFor(event: OperationEvent): RulesDisposition {
|
|
|
139
157
|
if (event.detail?.admin === true) {
|
|
140
158
|
return { kind: 'bypassed', reason: 'admin' };
|
|
141
159
|
}
|
|
160
|
+
if (isPermissionDeniedError(event)) {
|
|
161
|
+
return { kind: 'evaluated', verdict: 'deny' };
|
|
162
|
+
}
|
|
142
163
|
|
|
143
164
|
if (event.result === 'unsupported') {
|
|
144
165
|
return { kind: 'not-evaluated', reason: 'unsupported' };
|
|
@@ -150,20 +171,11 @@ export function rulesDispositionFor(event: OperationEvent): RulesDisposition {
|
|
|
150
171
|
return { kind: 'not-evaluated', reason: 'not-a-rules-operation' };
|
|
151
172
|
}
|
|
152
173
|
if (event.kind === 'listener') {
|
|
153
|
-
if (event.result === 'deny') {
|
|
154
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
155
|
-
}
|
|
156
|
-
if (event.error?.code === 'PERMISSION_DENIED') {
|
|
157
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
158
|
-
}
|
|
159
174
|
if (event.rules) {
|
|
160
175
|
return { kind: 'evaluated', verdict: 'deny' };
|
|
161
176
|
}
|
|
162
177
|
return { kind: 'not-evaluated', reason: 'runtime-error' };
|
|
163
178
|
}
|
|
164
|
-
if (event.result === 'deny') {
|
|
165
|
-
return { kind: 'evaluated', verdict: 'deny' };
|
|
166
|
-
}
|
|
167
179
|
if (event.kind === 'request') {
|
|
168
180
|
return { kind: 'evaluated', verdict: 'allow' };
|
|
169
181
|
}
|