ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/read-compatibility.js

@@ -0,0 +1,176 @@
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { AuthorizationValueType, FieldCardinality, FieldUniqueness, } from "./catalog.js";
+import { canonicalizeJson } from "./canonical-json.js";
+import { InvalidIR } from "./failures.js";
+import { ReadCompatibilityHash } from "./identities.js";
+import { OwnerKind } from "./identities.js";
+import { normalizeEntities, normalizeFields, normalizeTraitComposition, normalizeTraits, } from "./install/normalize.js";
+export const READ_COMPATIBILITY_VERSION = 1;
+export const DATABASE_READ_SEMANTICS_VERSION = "ramose.database-read/v1";
+const HASH_DOMAIN = "ramose.read-compatibility/v1\0";
+const UTF8 = new TextEncoder();
+const ReadOwner = Schema.Struct({ kind: OwnerKind, name: Schema.String });
+const ReadRefTarget = Schema.Union([
+    Schema.TaggedStruct("entity", { name: Schema.String }),
+    Schema.TaggedStruct("trait", { name: Schema.String }),
+    Schema.TaggedStruct("self", {}),
+    Schema.TaggedStruct("untargeted", {}),
+]);
+const EntityReadDescriptor = Schema.Struct({
+    name: Schema.String,
+    traits: Schema.Array(Schema.String),
+});
+const TraitReadDescriptor = Schema.Struct({
+    name: Schema.String,
+    traits: Schema.Array(Schema.String),
+});
+const FieldReadDescriptor = Schema.Struct({
+    owner: ReadOwner,
+    localName: Schema.String,
+    cardinality: FieldCardinality,
+    unique: Schema.optionalKey(FieldUniqueness),
+    index: Schema.Boolean,
+    optional: Schema.Boolean,
+    owned: Schema.Boolean,
+    valueType: AuthorizationValueType,
+    refTarget: Schema.optionalKey(ReadRefTarget),
+});
+const TraitCompositionReadDescriptor = Schema.Struct({
+    composer: Schema.String,
+    trait: Schema.String,
+    transitive: Schema.Array(Schema.String),
+});
+export const ReadCompatibilityDescriptor = Schema.Struct({
+    version: Schema.Literal(READ_COMPATIBILITY_VERSION),
+    readSemantics: Schema.Literal(DATABASE_READ_SEMANTICS_VERSION),
+    entities: Schema.Array(EntityReadDescriptor),
+    traits: Schema.Array(TraitReadDescriptor),
+    fields: Schema.Array(FieldReadDescriptor),
+    traitComposition: Schema.Array(TraitCompositionReadDescriptor),
+});
+const failure = (cause) => new InvalidIR({
+    message: `read compatibility hash failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+});
+const base64Url = (bytes) => {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+};
+const readRefTarget = (target) => {
+    switch (target._tag) {
+        case "entity": return { _tag: "entity", name: target.entity.name };
+        case "trait": return { _tag: "trait", name: target.trait.name };
+        case "self": return { _tag: "self" };
+        case "untargeted": return { _tag: "untargeted" };
+    }
+};
+export const readCompatibilityDescriptor = (catalog) => Result.mapError(Result.gen(function* () {
+    const [entities, traits, fields, traitComposition] = yield* Result.all([
+        normalizeEntities(catalog.entities),
+        normalizeTraits(catalog.traits),
+        normalizeFields(catalog.fields),
+        normalizeTraitComposition(catalog.traitComposition),
+    ]);
+    return {
+        version: READ_COMPATIBILITY_VERSION,
+        readSemantics: DATABASE_READ_SEMANTICS_VERSION,
+        entities: entities.map(({ id, traits }) => ({
+            name: id.name,
+            traits: traits.map((trait) => trait.name),
+        })),
+        traits: traits.map(({ id, traits }) => ({
+            name: id.name,
+            traits: traits.map((trait) => trait.name),
+        })),
+        fields: fields.map(({ id, doc: _, ...field }) => ({
+            owner: id.owner,
+            localName: id.localName,
+            cardinality: field.cardinality,
+            ...(field.unique === undefined ? {} : { unique: field.unique }),
+            index: field.index,
+            optional: field.optional,
+            owned: field.owned,
+            valueType: field.valueType,
+            ...(field.valueType === "ref"
+                ? { refTarget: readRefTarget(field.refTarget) }
+                : {}),
+        })),
+        traitComposition: traitComposition.map((row) => ({
+            composer: row.composer.name,
+            trait: row.trait.name,
+            transitive: row.transitive.map((trait) => trait.name),
+        })),
+    };
+}), (error) => new InvalidIR({ message: error.message }));
+export const canonicalizeReadCompatibility = (descriptor) => canonicalizeJson(Schema.encodeUnknownSync(ReadCompatibilityDescriptor)(descriptor));
+export const hashReadCompatibility = Effect.fn("Authorization.hashReadCompatibility")(function* (catalog) {
+    const descriptor = yield* Effect.fromResult(readCompatibilityDescriptor(catalog));
+    const canonical = canonicalizeReadCompatibility(descriptor);
+    const digest = yield* Effect.tryPromise({
+        try: () => crypto.subtle.digest("SHA-256", UTF8.encode(`${HASH_DOMAIN}${canonical}`)),
+        catch: failure,
+    });
+    return ReadCompatibilityHash.make(base64Url(new Uint8Array(digest)));
+});
+const collectReadNames = (value, classes, claims) => {
+    if (value === null || typeof value !== "object")
+        return;
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectReadNames(item, classes, claims);
+        return;
+    }
+    const record = value;
+    if (record._tag === "hasClass" && typeof record.class === "string") {
+        classes.add(record.class);
+    }
+    if (record._tag === "claim" && typeof record.key === "string")
+        claims.add(record.key);
+    for (const child of Object.values(record))
+        collectReadNames(child, classes, claims);
+};
+const withoutCatalogIdentity = (value) => {
+    if (value === null || typeof value !== "object")
+        return value;
+    if (Array.isArray(value))
+        return value.map(withoutCatalogIdentity);
+    const output = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (key !== "catalog")
+            output[key] = withoutCatalogIdentity(child);
+    }
+    return output;
+};
+export const canonicalizeReadPolicy = (policy) => {
+    const decisions = {
+        entities: policy.decisions.entities,
+        traits: policy.decisions.traits,
+        fields: policy.decisions.fields,
+    };
+    const ruleIds = new Set();
+    for (const entries of Object.values(decisions)) {
+        for (const entry of entries) {
+            for (const id of [...entry.decision.allow, ...entry.decision.deny])
+                ruleIds.add(id);
+        }
+    }
+    const rules = policy.rules.filter((rule) => ruleIds.has(rule.id));
+    const classes = new Set();
+    const claims = new Set();
+    for (const rule of rules)
+        collectReadNames(rule.expr, classes, claims);
+    return canonicalizeJson(withoutCatalogIdentity({
+        version: 1,
+        languageVersion: policy.languageVersion,
+        principal: policy.principal,
+        classes: policy.classes.filter((name) => classes.has(name)),
+        claims: policy.claims.filter((claim) => claims.has(claim.key)),
+        rules,
+        decisions,
+        accessPlans: policy.accessPlans.filter((plan) => ruleIds.has(plan.rule)),
+    }));
+};
+//# sourceMappingURL=read-compatibility.js.map

package/dist/internal/authorization/read-compatibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-compatibility.js","sourceRoot":"","sources":["../../../src/internal/authorization/read-compatibility.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,sBAAsB,EACtB,gBAAgB,EAChB,eAAe,GAGhB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EACzB,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAIhC,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAU,CAAC;AACrD,MAAM,CAAC,MAAM,+BAA+B,GAAG,yBAAkC,CAAC;AAClF,MAAM,WAAW,GAAG,gCAAgC,CAAC;AACrD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAE/B,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1E,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;IACjC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACtD,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IACrD,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,MAAM,CAAC,YAAY,CAAC,YAAY,EAAE,EAAE,CAAC;CACtC,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACpC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACpC,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,SAAS;IAChB,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,WAAW,EAAE,gBAAgB;IAC7B,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC;IAC3C,KAAK,EAAE,MAAM,CAAC,OAAO;IACrB,QAAQ,EAAE,MAAM,CAAC,OAAO;IACxB,KAAK,EAAE,MAAM,CAAC,OAAO;IACrB,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC;CAC7C,CAAC,CAAC;AACH,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,KAAK,EAAE,MAAM,CAAC,MAAM;IACpB,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;CACxC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,MAAM,CAAC;IACvD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC;IACnD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC;IAC9D,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC;IAC5C,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACzC,gBAAgB,EAAE,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC;CAC/D,CAAC,CAAC;AAGH,MAAM,OAAO,GAAG,CAAC,KAAc,EAAa,EAAE,CAAC,IAAI,SAAS,CAAC;IAC3D,OAAO,EAAE,mCAAmC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;CACrG,CAAC,CAAC;AAEH,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnF,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,MAAsB,EAA6B,EAAE;IAC1E,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnE,KAAK,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACrC,KAAK,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACnD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,CACzC,OAAuF,EAChC,EAAE,CACzD,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClC,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACrE,iBAAiB,CAAC,OAAO,CAAC,QAAQ,CAAC;QACnC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAC/B,yBAAyB,CAAC,OAAO,CAAC,gBAAgB,CAAC;KACpD,CAAC,CAAC;IACH,OAAO;QACL,OAAO,EAAE,0BAA0B;QACnC,aAAa,EAAE,+BAA+B;QAC9C,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YAC1C,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SAC1C,CAAC,CAAC;QACH,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YAChD,KAAK,EAAE,EAAE,CAAC,KAAK;YACf,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/D,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,KAAK;gBAC3B,CAAC,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI;YAC3B,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;YACrB,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SACtD,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE5D,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,UAAuC,EAC/B,EAAE,CAAC,gBAAgB,CAC3B,MAAM,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC,UAAU,CAAc,CAC/E,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,qCAAqC,CAAC,CACnF,QAAQ,CAAC,EACP,OAAuF;IAEvF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC;IAClF,MAAM,SAAS,GAAG,6BAA6B,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,GAAG,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,WAAW,GAAG,SAAS,EAAE,CAAC,CAAC;QACrF,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;IACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC,CACF,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,KAAc,EAAE,OAAoB,EAAE,MAAmB,EAAQ,EAAE;IAC3F,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IACxD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAClE,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtF,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;QAAE,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAAC,KAAc,EAAW,EAAE;IACzD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACnE,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,MAAgC,EAAU,EAAE;IACjF,MAAM,SAAS,GAAG;QAChB,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,QAAQ;QACnC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;QAC/B,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM;KAChC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACvE,OAAO,gBAAgB,CAAC,sBAAsB,CAAC;QAC7C,OAAO,EAAE,CAAC;QACV,eAAe,EAAE,MAAM,CAAC,eAAe;QACvC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9D,KAAK;QACL,SAAS;QACT,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KACzE,CAAc,CAAC,CAAC;AACnB,CAAC,CAAC"}

package/dist/internal/authorization/read-filter.d.ts

@@ -0,0 +1,48 @@
+import type { InstalledCatalogUnitV2 } from "./catalog-unit.ts";
+import type { AuthorizationPrincipal } from "./principal.ts";
+import type { Datom } from "../core/datom.ts";
+import type { Db, DatomPredicate } from "../core/db.ts";
+import { type WireDatom } from "../core/log.ts";
+export type ReadAuthorizationObservation = {
+    readonly _tag: "type";
+    readonly eid: number;
+    readonly datoms: readonly WireDatom[];
+} | {
+    readonly _tag: "field";
+    readonly eid: number;
+    readonly ident: string;
+    readonly attributeId: number | null;
+    readonly datoms: readonly WireDatom[];
+} | {
+    readonly _tag: "exists";
+    readonly eid: number;
+    readonly value: boolean;
+};
+export type CompileReadFilterInput = {
+    readonly unit: InstalledCatalogUnitV2;
+    readonly principal: AuthorizationPrincipal;
+    readonly currentDb: Db;
+    readonly observe?: (observation: ReadAuthorizationObservation) => void;
+};
+export declare const uniqueCanonicalTypeName: (typeDatoms: readonly Datom[]) => string | undefined;
+export type ReadAccess = {
+    readonly row: (db: Db, eid: number) => Promise<boolean>;
+    readonly field: DatomPredicate;
+    readonly reference: DatomPredicate;
+};
+export declare const compileReadAccess: (input: CompileReadFilterInput) => ReadAccess;
+export declare const compileReadFilter: (input: CompileReadFilterInput) => DatomPredicate;
+export declare const proposedReadView: (before: {
+    readonly unit: InstalledCatalogUnitV2;
+    readonly principal: AuthorizationPrincipal;
+    readonly currentDb: Db;
+}, after: {
+    readonly unit: InstalledCatalogUnitV2;
+    readonly principal: AuthorizationPrincipal;
+    readonly currentDb: Db;
+}, current?: {
+    readonly unit: InstalledCatalogUnitV2;
+    readonly principal: AuthorizationPrincipal;
+    readonly currentDb: Db;
+}) => Db;
+//# sourceMappingURL=read-filter.d.ts.map

package/dist/internal/authorization/read-filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-filter.d.ts","sourceRoot":"","sources":["../../../src/internal/authorization/read-filter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAShE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAsB7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAE9C,OAAO,KAAK,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAe,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG7D,MAAM,MAAM,4BAA4B,GACpC;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;CACvC,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;CACvC,GACC;IACA,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;AAEJ,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,4BAA4B,KAAK,IAAI,CAAC;CACxE,CAAC;AAkHF,eAAO,MAAM,uBAAuB,eACtB,SAAS,KAAK,EAAE,KAC3B,MAAM,GAAG,SAUX,CAAC;AAKF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAC;CACpC,CAAC;AAIF,eAAO,MAAM,iBAAiB,UAAW,sBAAsB,KAAG,UAEjE,CAAC;AAEF,eAAO,MAAM,iBAAiB,UAAW,sBAAsB,KAAG,cAGjE,CAAC;AAwVF,eAAO,MAAM,gBAAgB,WAAY;IACvC,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;CACxB,SAAS;IACR,QAAQ,CAAC,IAAI,EAAE,sBAAsB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;CACxB;mBAPgB,sBAAsB;wBACjB,sBAAsB;wBACtB,EAAE;MAKF,EAkBrB,CAAC"}