ramosedb 0.0.1 → 0.4.0

package/dist/internal/authorization/validation/decisions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decisions.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/decisions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAQxC,OAAO,EACL,cAAc,EACd,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,aAAa,GAEd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAwB,MAAM,aAAa,CAAC;AAEzG,MAAM,iBAAiB,GAAG,CACxB,GAA0B,EAC1B,KAAa,EACyB,EAAE;IACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,KAAmC,EACnC,IAAgC,EAChC,MAAgB,EACP,EAAE;IACX,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC;IAChG,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAmC,EACnC,IAAgC,EAChC,MAAe,EACN,EAAE;IACX,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAmC,EACnC,IAAgC,EAChC,KAAsB,EACb,EAAE;IACX,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1F,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,KAAK,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,KAAK,KAAK,SAAS,IAAI,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAClE,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACxB,IAAgC,EAChC,MAAmB,EACV,EAAE,CACX,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;IAC/B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,YAAY,CAAC,MAAM,CAAC,CAAC;AAE9D,MAAM,UAAU,GAAG,CACjB,KAAsD,EACtD,EAAU,EACkD,EAAE;IAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAC5B,QAAkB,EAClB,KAAsD,EACtD,UAAsF,EAChD,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClD,KAAK,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;QAC7E,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC1C,KAAK,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,KAAmC,EACnC,SAA0C,EAC1C,KAAsD,EAChB,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;QACnF,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrF,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,cAAc,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;YACjC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAClF,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;QACjF,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QAClF,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,OAAO,CAAC,gDAAgD,CAAC,CAC9D,CAAC;IACJ,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CACpC,KAAK,EACL,KAAK,CAAC,MAAM,EACZ,2BAA2B,CAC5B,CAAC;QACF,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QAC/D,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAC3D,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;YAC3B,CAAC,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAClE,CAAC;IACJ,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/internal/authorization/validation/descriptors.d.ts

@@ -0,0 +1,8 @@
+import * as Result from "effect/Result";
+import type { OperationInputShape } from "../catalog.ts";
+import { type ClaimDescriptor } from "../principal.ts";
+import { type ValidateFailure } from "./common.ts";
+export declare const validateVocabularies: (subjectClaim: string, classes: ReadonlyArray<string>, claims: ReadonlyArray<ClaimDescriptor>) => Result.Result<void, ValidateFailure>;
+export declare const validateInputShapeKeys: (shape: OperationInputShape) => Result.Result<void, ValidateFailure>;
+export declare const claimByKey: (claims: ReadonlyArray<ClaimDescriptor>, key: string) => Result.Result<ClaimDescriptor, ValidateFailure>;
+//# sourceMappingURL=descriptors.d.ts.map

package/dist/internal/authorization/validation/descriptors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/descriptors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAGzD,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAO5D,eAAO,MAAM,oBAAoB,iBACjB,MAAM,WACX,aAAa,CAAC,MAAM,CAAC,UACtB,aAAa,CAAC,eAAe,CAAC,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAKlC,CAAC;AAEL,eAAO,MAAM,sBAAsB,UAC1B,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAGlC,CAAC;AAEL,eAAO,MAAM,UAAU,WACb,aAAa,CAAC,eAAe,CAAC,OACjC,MAAM,KACV,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,eAAe,CAKhD,CAAC"}

package/dist/internal/authorization/validation/descriptors.js

@@ -0,0 +1,24 @@
+import * as Result from "effect/Result";
+import * as Schema from "effect/Schema";
+import { OperationInputShape as OperationInputShapeSchema } from "../catalog.js";
+import { InvalidIR } from "../failures.js";
+import { ClaimVocabulary, ClassVocabulary, SubjectClaim, } from "../principal.js";
+import { invalid } from "./common.js";
+const schemaResult = (result) => Result.mapError(result, (error) => new InvalidIR({ message: error.message }));
+export const validateVocabularies = (subjectClaim, classes, claims) => Result.gen(function* () {
+    yield* schemaResult(Schema.decodeResult(SubjectClaim)(subjectClaim));
+    yield* schemaResult(Schema.decodeResult(ClassVocabulary)(classes));
+    yield* schemaResult(Schema.decodeResult(ClaimVocabulary)(claims));
+});
+export const validateInputShapeKeys = (shape) => Result.gen(function* () {
+    yield* schemaResult(Schema.decodeResult(OperationInputShapeSchema)(shape));
+});
+export const claimByKey = (claims, key) => {
+    const found = claims.filter((claim) => claim.key === key);
+    if (found.length === 0)
+        return invalid(`undeclared claim '${key}'`);
+    if (found.length > 1)
+        return invalid(`ambiguous claim '${key}'`);
+    return Result.succeed(found[0]);
+};
+//# sourceMappingURL=descriptors.js.map

package/dist/internal/authorization/validation/descriptors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"descriptors.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/descriptors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,mBAAmB,IAAI,yBAAyB,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,eAAe,EACf,eAAe,EACf,YAAY,GAEb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,OAAO,EAAwB,MAAM,aAAa,CAAC;AAE5D,MAAM,YAAY,GAAG,CACnB,MAAsD,EACnB,EAAE,CACrC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,YAAoB,EACpB,OAA8B,EAC9B,MAAsC,EACA,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IACrE,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,KAA0B,EACY,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7E,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,MAAsC,EACtC,GAAW,EACsC,EAAE;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,oBAAoB,GAAG,GAAG,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;AACnC,CAAC,CAAC"}

package/dist/internal/authorization/validation/expression.d.ts

@@ -0,0 +1,11 @@
+import * as Result from "effect/Result";
+import type { CanonicalAuthorizationExpr } from "../expr.ts";
+import type { EntityId } from "../identities.ts";
+import type { CanonicalAuthorizationRule } from "../ir.ts";
+import type { ClaimDescriptor, InstalledPrincipalResolution } from "../principal.ts";
+import { type PreparedAuthorizationCatalog, type RowFocus } from "./catalog.ts";
+import { type ValidationLimits, type ValidateFailure } from "./common.ts";
+import { type Derived, type StaticWork } from "./types.ts";
+export declare const walkExpr: (index: PreparedAuthorizationCatalog, expr: CanonicalAuthorizationExpr, resource: RowFocus, me: EntityId | undefined, classes: ReadonlySet<string>, claims: ReadonlyArray<ClaimDescriptor>, limits: ValidationLimits, spent: StaticWork) => Result.Result<Derived, ValidateFailure>;
+export declare const validateRule: (index: PreparedAuthorizationCatalog, rule: CanonicalAuthorizationRule, principal: InstalledPrincipalResolution, classes: ReadonlySet<string>, claims: ReadonlyArray<ClaimDescriptor>, limits: ValidationLimits) => Result.Result<CanonicalAuthorizationRule, ValidateFailure>;
+//# sourceMappingURL=expression.d.ts.map

package/dist/internal/authorization/validation/expression.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/expression.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,0BAA0B,EAAsB,MAAM,UAAU,CAAC;AAC/E,OAAO,KAAK,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAKL,KAAK,4BAA4B,EACjC,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAW,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,QAAQ,UACZ,4BAA4B,QAC7B,0BAA0B,YACtB,QAAQ,MACd,QAAQ,GAAG,SAAS,WACf,WAAW,CAAC,MAAM,CAAC,UACpB,aAAa,CAAC,eAAe,CAAC,UAC9B,gBAAgB,SACjB,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAqErC,CAAC;AAyCL,eAAO,MAAM,YAAY,UAChB,4BAA4B,QAC7B,0BAA0B,aACrB,4BAA4B,WAC9B,WAAW,CAAC,MAAM,CAAC,UACpB,aAAa,CAAC,eAAe,CAAC,UAC9B,gBAAgB,KACvB,MAAM,CAAC,MAAM,CAAC,0BAA0B,EAAE,eAAe,CA6BxD,CAAC"}

package/dist/internal/authorization/validation/expression.js

@@ -0,0 +1,114 @@
+import * as Result from "effect/Result";
+import { requireEntity, requireField, requireOperation, requireTrait, } from "./catalog.js";
+import { invalid } from "./common.js";
+import { meEntity, resourceFocus, walkValue } from "./traversal.js";
+import { charge, collectionElement, emptyDerived, eqCompatible, mergeDerived, } from "./types.js";
+export const walkExpr = (index, expr, resource, me, classes, claims, limits, spent) => Result.gen(function* () {
+    const derived = emptyDerived();
+    yield* charge(derived, spent, 1, limits.maxStaticWork);
+    switch (expr._tag) {
+        case "const":
+            return derived;
+        case "hasClass":
+            if (!classes.has(expr.class))
+                return yield* invalid(`undeclared class '${expr.class}'`);
+            return derived;
+        case "and":
+        case "or": {
+            for (const child of expr.exprs) {
+                const part = yield* walkExpr(index, child, resource, me, classes, claims, limits, spent);
+                mergeDerived(derived, part);
+            }
+            return derived;
+        }
+        case "not": {
+            const child = yield* walkExpr(index, expr.expr, resource, me, classes, claims, limits, spent);
+            mergeDerived(derived, child);
+            return derived;
+        }
+        case "eq": {
+            const left = yield* walkValue(index, expr.left, resource, me, claims, limits, spent);
+            const right = yield* walkValue(index, expr.right, resource, me, claims, limits, spent);
+            mergeDerived(derived, left.derived);
+            mergeDerived(derived, right.derived);
+            if (!eqCompatible(index, left.shape, right.shape)) {
+                return yield* invalid("incompatible equality operands");
+            }
+            return derived;
+        }
+        case "has": {
+            const term = yield* walkValue(index, expr.term, resource, me, claims, limits, spent);
+            mergeDerived(derived, term.derived);
+            return derived;
+        }
+        case "in": {
+            const value = yield* walkValue(index, expr.value, resource, me, claims, limits, spent);
+            const collection = yield* walkValue(index, expr.collection, resource, me, claims, limits, spent);
+            mergeDerived(derived, value.derived);
+            mergeDerived(derived, collection.derived);
+            const element = yield* collectionElement(collection.shape);
+            if (element === undefined)
+                return yield* invalid("membership requires a collection");
+            if (!eqCompatible(index, value.shape, element)) {
+                return yield* invalid("incompatible membership operands");
+            }
+            return derived;
+        }
+    }
+});
+const compareDerived = (rule, derived, limits) => {
+    if (rule.usesResource !== derived.usesResource)
+        return invalid("tampered usesResource");
+    if (rule.usesMe !== derived.usesMe)
+        return invalid("tampered usesMe");
+    if (rule.usesSubject !== derived.usesSubject)
+        return invalid("tampered usesSubject");
+    if (rule.traversalDepth !== derived.traversalDepth)
+        return invalid("tampered traversalDepth");
+    if (derived.traversalDepth > limits.maxTraversalDepth) {
+        return invalid(`traversal depth ${derived.traversalDepth} exceeds ${limits.maxTraversalDepth}`);
+    }
+    if (derived.staticWork > limits.maxStaticWork) {
+        return invalid(`static work ${derived.staticWork} exceeds ${limits.maxStaticWork}`);
+    }
+    return Result.succeed(undefined);
+};
+const validateFocus = (index, focus) => Result.gen(function* () {
+    switch (focus._tag) {
+        case "entity":
+            yield* requireEntity(index, focus.entity, "rule focus entity");
+            return;
+        case "trait":
+            yield* requireTrait(index, focus.trait, "rule focus trait");
+            return;
+        case "field":
+            yield* requireField(index, focus.field, "rule focus field");
+            return;
+        case "operation":
+            yield* requireOperation(index, focus.operation, "rule focus operation");
+            return;
+    }
+});
+export const validateRule = (index, rule, principal, classes, claims, limits) => Result.gen(function* () {
+    yield* validateFocus(index, rule.focus);
+    const resource = yield* resourceFocus(index, rule.focus);
+    const me = yield* meEntity(index, principal);
+    const derived = yield* walkExpr(index, rule.expr, resource, me, classes, claims, limits, {
+        count: 0,
+    });
+    if (rule.focus._tag === "operation" &&
+        (derived.usesResource || derived.usesMe || derived.traversalDepth !== 0)) {
+        return yield* invalid("operation grants may use only principal classes, claims, and subject identity");
+    }
+    yield* compareDerived(rule, derived, limits);
+    return {
+        id: rule.id,
+        focus: rule.focus,
+        expr: rule.expr,
+        usesResource: derived.usesResource,
+        usesMe: derived.usesMe,
+        usesSubject: derived.usesSubject,
+        traversalDepth: derived.traversalDepth,
+    };
+});
+//# sourceMappingURL=expression.js.map

package/dist/internal/authorization/validation/expression.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expression.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/expression.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAKxC,OAAO,EACL,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,GAGb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAA+C,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACpE,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,YAAY,EACZ,YAAY,EACZ,YAAY,GAGb,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,KAAmC,EACnC,IAAgC,EAChC,QAAkB,EAClB,EAAwB,EACxB,OAA4B,EAC5B,MAAsC,EACtC,MAAwB,EACxB,KAAiB,EACwB,EAAE,CAC3C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAEvD,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU;YACb,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qBAAqB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC;QACjB,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,EAAE,CAAC;YACV,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;gBACzF,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC9B,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,QAAQ,CAC3B,KAAK,EACL,IAAI,CAAC,IAAI,EACT,QAAQ,EACR,EAAE,EACF,OAAO,EACP,MAAM,EACN,MAAM,EACN,KAAK,CACN,CAAC;YACF,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrF,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACvF,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACrF,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACpC,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;YACV,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;YACvF,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,SAAS,CACjC,KAAK,EACL,IAAI,CAAC,UAAU,EACf,QAAQ,EACR,EAAE,EACF,MAAM,EACN,MAAM,EACN,KAAK,CACN,CAAC;YACF,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACrC,YAAY,CAAC,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;YACrF,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC/C,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;YAC5D,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,cAAc,GAAG,CACrB,IAAgC,EAChC,OAAgB,EAChB,MAAwB,EACc,EAAE;IACxC,IAAI,IAAI,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACxF,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtE,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrF,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAAE,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9F,IAAI,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACtD,OAAO,OAAO,CAAC,mBAAmB,OAAO,CAAC,cAAc,YAAY,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,eAAe,OAAO,CAAC,UAAU,YAAY,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CACpB,KAAmC,EACnC,KAAyB,EACa,EAAE,CACxC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAC/D,OAAO;QACT,KAAK,OAAO;YACV,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC5D,OAAO;QACT,KAAK,OAAO;YACV,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC5D,OAAO;QACT,KAAK,WAAW;YACd,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;YACxE,OAAO;IACX,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAmC,EACnC,IAAgC,EAChC,SAAuC,EACvC,OAA4B,EAC5B,MAAsC,EACtC,MAAwB,EACoC,EAAE,CAC9D,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAE7C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE;QACvF,KAAK,EAAE,CAAC;KACT,CAAC,CAAC;IAEH,IACE,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW;QAC/B,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,cAAc,KAAK,CAAC,CAAC,EACxE,CAAC;QACD,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/internal/authorization/validation/traversal.d.ts

@@ -0,0 +1,19 @@
+import * as Result from "effect/Result";
+import type { CanonicalRefTerm, CanonicalValueTerm } from "../expr.ts";
+import type { EntityId } from "../identities.ts";
+import type { CanonicalRuleFocus } from "../ir.ts";
+import type { ClaimDescriptor, InstalledPrincipalResolution } from "../principal.ts";
+import { type PreparedAuthorizationCatalog, type RowFocus } from "./catalog.ts";
+import { type ValidationLimits, type ValidateFailure } from "./common.ts";
+import { type Derived, type StaticWork, type TermShape } from "./types.ts";
+export declare const resourceFocus: (index: PreparedAuthorizationCatalog, focus: CanonicalRuleFocus) => Result.Result<RowFocus, ValidateFailure>;
+export declare const meEntity: (index: PreparedAuthorizationCatalog, principal: InstalledPrincipalResolution) => Result.Result<EntityId | undefined, ValidateFailure>;
+export declare const walkRef: (index: PreparedAuthorizationCatalog, term: CanonicalRefTerm, resource: RowFocus, me: EntityId | undefined, limits: ValidationLimits, spent: StaticWork) => Result.Result<{
+    readonly shape: TermShape;
+    readonly derived: Derived;
+}, ValidateFailure>;
+export declare const walkValue: (index: PreparedAuthorizationCatalog, term: CanonicalValueTerm, resource: RowFocus, me: EntityId | undefined, claims: ReadonlyArray<ClaimDescriptor>, limits: ValidationLimits, spent: StaticWork) => Result.Result<{
+    readonly shape: TermShape;
+    readonly derived: Derived;
+}, ValidateFailure>;
+//# sourceMappingURL=traversal.d.ts.map

package/dist/internal/authorization/validation/traversal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traversal.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/traversal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,iBAAiB,CAAC;AACrF,OAAO,EAOL,KAAK,4BAA4B,EACjC,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AACtB,OAAO,EAAW,KAAK,gBAAgB,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnF,OAAO,EAML,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,KAAK,SAAS,EACf,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,aAAa,UACjB,4BAA4B,SAC5B,kBAAkB,KACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAwBtC,CAAC;AAEL,eAAO,MAAM,QAAQ,UACZ,4BAA4B,aACxB,4BAA4B,KACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,SAAS,EAAE,eAAe,CAgBlD,CAAC;AAEL,eAAO,MAAM,OAAO,UACX,4BAA4B,QAC7B,gBAAgB,YACZ,QAAQ,MACd,QAAQ,GAAG,SAAS,UAChB,gBAAgB,SACjB,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,eAAe,CAoFtF,CAAC;AAEL,eAAO,MAAM,SAAS,UACb,4BAA4B,QAC7B,kBAAkB,YACd,QAAQ,MACd,QAAQ,GAAG,SAAS,UAChB,aAAa,CAAC,eAAe,CAAC,UAC9B,gBAAgB,SACjB,UAAU,KAChB,MAAM,CAAC,MAAM,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,eAAe,CAwBzF,CAAC"}

package/dist/internal/authorization/validation/traversal.js

@@ -0,0 +1,141 @@
+import * as Result from "effect/Result";
+import { fieldAccessibleFrom, ownerFocus, requireEntity, requireField, requireOperation, requireTrait, } from "./catalog.js";
+import { invalid } from "./common.js";
+import { claimByKey } from "./descriptors.js";
+import { emptyDerived, litScalar, resolveRefTarget, rowFromRefTarget, takeWork, } from "./types.js";
+export const resourceFocus = (index, focus) => Result.gen(function* () {
+    switch (focus._tag) {
+        case "entity": {
+            const entity = yield* requireEntity(index, focus.entity, "rule focus entity");
+            return { _tag: "entity", entity };
+        }
+        case "trait": {
+            const trait = yield* requireTrait(index, focus.trait, "rule focus trait");
+            return { _tag: "trait", trait };
+        }
+        case "field": {
+            const field = yield* requireField(index, focus.field, "rule focus field");
+            return yield* ownerFocus(index, field.id.owner);
+        }
+        case "operation": {
+            const operation = yield* requireOperation(index, focus.operation, "rule focus operation");
+            return yield* ownerFocus(index, operation.id.owner);
+        }
+    }
+});
+export const meEntity = (index, principal) => Result.gen(function* () {
+    if (principal.entity === undefined)
+        return undefined;
+    const field = yield* requireField(index, principal.entity, "principal field");
+    if (field.unique === undefined) {
+        return yield* invalid("principal field is not unique");
+    }
+    if (field.id.owner.kind !== "entity") {
+        return yield* invalid("principal field must be entity-owned");
+    }
+    if (field.valueType !== "string" && field.valueType !== "uuid") {
+        return yield* invalid("principal field must be string-compatible");
+    }
+    const entity = index.entities.get(field.id.owner.name);
+    if (entity === undefined)
+        return yield* invalid("missing principal entity");
+    return entity;
+});
+export const walkRef = (index, term, resource, me, limits, spent) => Result.gen(function* () {
+    const derived = emptyDerived();
+    derived.staticWork = 1 + term.steps.length;
+    yield* takeWork(spent, derived.staticWork, limits.maxStaticWork);
+    let current;
+    switch (term.root._tag) {
+        case "resource":
+            derived.usesResource = true;
+            current = resource;
+            break;
+        case "me":
+            derived.usesMe = true;
+            if (me === undefined) {
+                return yield* invalid("structurally invalid me traversal without a principal entity");
+            }
+            current = { _tag: "entity", entity: me };
+            break;
+    }
+    const depth = term.steps.length;
+    if (depth > limits.maxTraversalDepth) {
+        return yield* invalid(`traversal depth ${depth} exceeds ${limits.maxTraversalDepth}`);
+    }
+    derived.traversalDepth = depth;
+    if (term.steps.length === 0) {
+        return { shape: { _tag: "row", focus: current }, derived };
+    }
+    let last;
+    for (let i = 0; i < term.steps.length; i++) {
+        const step = term.steps[i];
+        const field = yield* requireField(index, step.field, "traversal field");
+        if (!fieldAccessibleFrom(index, current, field)) {
+            return yield* invalid(`wrong owner for field '${step.field.owner.kind}:${step.field.owner.name}.${step.field.localName}'`);
+        }
+        const isLast = i === term.steps.length - 1;
+        if (!isLast) {
+            if (field.cardinality === "many") {
+                return yield* invalid("intermediate many-valued traversal is not supported");
+            }
+            if (field.valueType !== "ref") {
+                return yield* invalid(`non-ref traversal through '${step.field.localName}'`);
+            }
+            const next = yield* rowFromRefTarget(index, field.refTarget, field.id.owner);
+            if (next === undefined) {
+                return yield* invalid(`cannot traverse from an untargeted ref through '${step.field.localName}'`);
+            }
+            current = next;
+        }
+        last = field;
+    }
+    if (last === undefined)
+        return yield* invalid("empty traversal has no field");
+    if (last.valueType === "ref") {
+        const target = yield* resolveRefTarget(index, last.refTarget, last.id.owner);
+        return {
+            shape: {
+                _tag: "ref",
+                target,
+                cardinality: last.cardinality,
+            },
+            derived,
+        };
+    }
+    if (last.cardinality === "many") {
+        return {
+            shape: {
+                _tag: "collection",
+                element: { _tag: "scalar", valueType: last.valueType },
+            },
+            derived,
+        };
+    }
+    return {
+        shape: { _tag: "scalar", valueType: last.valueType },
+        derived,
+    };
+});
+export const walkValue = (index, term, resource, me, claims, limits, spent) => {
+    const finish = (shape, derived) => Result.gen(function* () {
+        yield* takeWork(spent, derived.staticWork, limits.maxStaticWork);
+        return { shape, derived };
+    });
+    switch (term._tag) {
+        case "ref":
+            return walkRef(index, term, resource, me, limits, spent);
+        case "lit":
+            return finish(litScalar(term.value), { ...emptyDerived(), staticWork: 1 });
+        case "subject":
+            return finish({ _tag: "subject" }, { ...emptyDerived(), usesSubject: true, staticWork: 1 });
+        case "me":
+            return finish({ _tag: "me", entity: me }, { ...emptyDerived(), usesMe: true, staticWork: 1 });
+        case "claim":
+            return Result.gen(function* () {
+                const claim = yield* claimByKey(claims, term.key);
+                return yield* finish({ _tag: "claim", shape: claim.shape }, { ...emptyDerived(), staticWork: 1 });
+            });
+    }
+};
+//# sourceMappingURL=traversal.js.map

package/dist/internal/authorization/validation/traversal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traversal.js","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/traversal.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAMxC,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,GAGb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAA+C,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,gBAAgB,EAChB,gBAAgB,EAChB,QAAQ,GAIT,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,KAAmC,EACnC,KAAyB,EACiB,EAAE,CAC5C,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;YAC9E,OAAO,EAAE,IAAI,EAAE,QAAiB,EAAE,MAAM,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC1E,OAAO,EAAE,IAAI,EAAE,OAAgB,EAAE,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,KAAK,OAAO,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,kBAAkB,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,WAAW,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,gBAAgB,CACvC,KAAK,EACL,KAAK,CAAC,SAAS,EACf,sBAAsB,CACvB,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;AACH,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,KAAmC,EACnC,SAAuC,EACe,EAAE,CACxD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,OAAO,GAAG,CACrB,KAAmC,EACnC,IAAsB,EACtB,QAAkB,EAClB,EAAwB,EACxB,MAAwB,EACxB,KAAiB,EACyE,EAAE,CAC5F,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC;IAC/B,OAAO,CAAC,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3C,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IAEjE,IAAI,OAAiB,CAAC;IACtB,QAAQ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;YAC5B,OAAO,GAAG,QAAQ,CAAC;YACnB,MAAM;QACR,KAAK,IAAI;YACP,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;YACtB,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,8DAA8D,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;YACzC,MAAM;IACV,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;IAChC,IAAI,KAAK,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACrC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,mBAAmB,KAAK,YAAY,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,OAAO,CAAC,cAAc,GAAG,KAAK,CAAC;IAE/B,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACxE,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,0BAA0B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CACpG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,IAAI,KAAK,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;gBACjC,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,qDAAqD,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC9B,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,8BAA8B,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,OAAO,KAAK,CAAC,CAAC,OAAO,CACnB,mDAAmD,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,GAAG,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,KAAc;gBACpB,MAAM;gBACN,WAAW,EAAE,IAAI,CAAC,WAAW;aAC9B;YACD,OAAO;SACR,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QAChC,OAAO;YACL,KAAK,EAAE;gBACL,IAAI,EAAE,YAAqB;gBAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aAChE;YACD,OAAO;SACR,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;QAC7D,OAAO;KACR,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAmC,EACnC,IAAwB,EACxB,QAAkB,EAClB,EAAwB,EACxB,MAAsC,EACtC,MAAwB,EACxB,KAAiB,EACyE,EAAE;IAC5F,MAAM,MAAM,GAAG,CAAC,KAAgB,EAAE,OAAgB,EAAE,EAAE,CACpD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,KAAK,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QACjE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IAC5B,CAAC,CAAC,CAAC;IACL,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,KAAK;YACR,OAAO,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3D,KAAK,KAAK;YACR,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,KAAK,SAAS;YACZ,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9F,KAAK,IAAI;YACP,OAAO,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,YAAY,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAChG,KAAK,OAAO;YACV,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClD,OAAO,KAAK,CAAC,CAAC,MAAM,CAClB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EACrC,EAAE,GAAG,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CACrC,CAAC;YACJ,CAAC,CAAC,CAAC;IACP,CAAC;AACH,CAAC,CAAC"}

package/dist/internal/authorization/validation/types.d.ts

@@ -0,0 +1,55 @@
+import * as Result from "effect/Result";
+import type { FieldCardinality, FieldRefTarget, ScalarValueType } from "../catalog.ts";
+import type { EntityId, OwnerRef } from "../identities.ts";
+import type { ClaimShape } from "../principal.ts";
+import { type ValidateFailure } from "./common.ts";
+import { type PreparedAuthorizationCatalog, type RowFocus } from "./catalog.ts";
+export type { RowFocus };
+export type TermShape = {
+    readonly _tag: "subject";
+} | {
+    readonly _tag: "scalar";
+    readonly valueType: ScalarValueType | "null" | "number";
+} | {
+    readonly _tag: "row";
+    readonly focus: RowFocus;
+} | {
+    readonly _tag: "me";
+    readonly entity: EntityId | undefined;
+} | {
+    readonly _tag: "ref";
+    readonly target: FieldRefTarget;
+    readonly cardinality: FieldCardinality;
+} | {
+    readonly _tag: "claim";
+    readonly shape: ClaimShape;
+} | {
+    readonly _tag: "collection";
+    readonly element: TermShape;
+};
+export type Derived = {
+    usesResource: boolean;
+    usesMe: boolean;
+    usesSubject: boolean;
+    traversalDepth: number;
+    staticWork: number;
+};
+export declare const emptyDerived: () => Derived;
+export declare const mergeDerived: (into: Derived, part: Derived) => void;
+export type StaticWork = {
+    count: number;
+};
+export declare const takeWork: (spent: StaticWork, nodes: number, maxStaticWork: number) => Result.Result<void, ValidateFailure>;
+export declare const charge: (derived: Derived, spent: StaticWork, nodes: number, maxStaticWork: number) => Result.Result<void, ValidateFailure>;
+export declare const rowFromRefTarget: (index: PreparedAuthorizationCatalog, target: FieldRefTarget, owner: OwnerRef) => Result.Result<RowFocus | undefined, ValidateFailure>;
+export declare const refTargetAsFocus: (target: FieldRefTarget) => RowFocus | undefined;
+export declare const resolveRefTarget: (index: PreparedAuthorizationCatalog, target: FieldRefTarget, owner: OwnerRef) => Result.Result<FieldRefTarget, ValidateFailure>;
+export declare const refCompatibleWithRow: (index: PreparedAuthorizationCatalog, target: FieldRefTarget, row: RowFocus) => boolean;
+export declare const sameRefTarget: (index: PreparedAuthorizationCatalog, left: FieldRefTarget, right: FieldRefTarget) => boolean;
+export declare const claimScalar: (shape: ClaimShape) => ScalarValueType | undefined;
+export declare const litScalar: (value: string | number | boolean | null) => TermShape;
+export declare const scalarAssignable: (expected: ScalarValueType | "null" | "number", actual: TermShape) => boolean;
+export declare const meCompatibleWith: (index: PreparedAuthorizationCatalog, me: EntityId | undefined, other: TermShape) => boolean;
+export declare const eqCompatible: (index: PreparedAuthorizationCatalog, left: TermShape, right: TermShape) => boolean;
+export declare const collectionElement: (shape: TermShape) => Result.Result<TermShape | undefined, ValidateFailure>;
+//# sourceMappingURL=types.d.ts.map

package/dist/internal/authorization/validation/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/internal/authorization/validation/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAW,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAKL,KAAK,4BAA4B,EACjC,KAAK,QAAQ,EACd,MAAM,cAAc,CAAC;AAEtB,YAAY,EAAE,QAAQ,EAAE,CAAC;AAEzB,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,eAAe,GAAG,MAAM,GAAG,QAAQ,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;CAAE,GAC9D;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;CACxC,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GACtD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjE,MAAM,MAAM,OAAO,GAAG;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;IAChB,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,eAAO,MAAM,YAAY,QAAO,OAM9B,CAAC;AAEH,eAAO,MAAM,YAAY,SAAU,OAAO,QAAQ,OAAO,KAAG,IAM3D,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,eAAO,MAAM,QAAQ,UACZ,UAAU,SACV,MAAM,iBACE,MAAM,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAMrC,CAAC;AAEF,eAAO,MAAM,MAAM,YACR,OAAO,SACT,UAAU,SACV,MAAM,iBACE,MAAM,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAGrC,CAAC;AAEF,eAAO,MAAM,gBAAgB,UACpB,4BAA4B,UAC3B,cAAc,SACf,QAAQ,KACd,MAAM,CAAC,MAAM,CAAC,QAAQ,GAAG,SAAS,EAAE,eAAe,CAgBlD,CAAC;AAEL,eAAO,MAAM,gBAAgB,WAAY,cAAc,KAAG,QAAQ,GAAG,SAIpE,CAAC;AAEF,eAAO,MAAM,gBAAgB,UACpB,4BAA4B,UAC3B,cAAc,SACf,QAAQ,KACd,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,eAAe,CAiB5C,CAAC;AAEL,eAAO,MAAM,oBAAoB,UACxB,4BAA4B,UAC3B,cAAc,OACjB,QAAQ,KACZ,OAGF,CAAC;AAEF,eAAO,MAAM,aAAa,UACjB,4BAA4B,QAC7B,cAAc,SACb,cAAc,KACpB,OAOF,CAAC;AAEF,eAAO,MAAM,WAAW,UAAW,UAAU,KAAG,eAAe,GAAG,SACX,CAAC;AAExD,eAAO,MAAM,SAAS,UAAW,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,KAAG,SAKnE,CAAC;AAEF,eAAO,MAAM,gBAAgB,aACjB,eAAe,GAAG,MAAM,GAAG,QAAQ,UACrC,SAAS,KAChB,OASF,CAAC;AAEF,eAAO,MAAM,gBAAgB,UACpB,4BAA4B,MAC/B,QAAQ,GAAG,SAAS,SACjB,SAAS,KACf,OAYF,CAAC;AAEF,eAAO,MAAM,YAAY,UAChB,4BAA4B,QAC7B,SAAS,SACR,SAAS,KACf,OA4CF,CAAC;AAEF,eAAO,MAAM,iBAAiB,UACrB,SAAS,KACf,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,SAAS,EAAE,eAAe,CAStD,CAAC"}

package/dist/internal/authorization/validation/types.js

@@ -0,0 +1,184 @@
+import * as Result from "effect/Result";
+import { invalid } from "./common.js";
+import { ownerFocus, requireEntity, requireTrait, sameRow, } from "./catalog.js";
+export const emptyDerived = () => ({
+    usesResource: false,
+    usesMe: false,
+    usesSubject: false,
+    traversalDepth: 0,
+    staticWork: 0,
+});
+export const mergeDerived = (into, part) => {
+    into.usesResource ||= part.usesResource;
+    into.usesMe ||= part.usesMe;
+    into.usesSubject ||= part.usesSubject;
+    if (part.traversalDepth > into.traversalDepth)
+        into.traversalDepth = part.traversalDepth;
+    into.staticWork += part.staticWork;
+};
+export const takeWork = (spent, nodes, maxStaticWork) => {
+    spent.count += nodes;
+    if (spent.count > maxStaticWork) {
+        return invalid(`static work ${spent.count} exceeds ${maxStaticWork}`);
+    }
+    return Result.succeed(undefined);
+};
+export const charge = (derived, spent, nodes, maxStaticWork) => {
+    derived.staticWork += nodes;
+    return takeWork(spent, nodes, maxStaticWork);
+};
+export const rowFromRefTarget = (index, target, owner) => Result.gen(function* () {
+    switch (target._tag) {
+        case "entity": {
+            const entity = yield* requireEntity(index, target.entity, "ref target");
+            return { _tag: "entity", entity };
+        }
+        case "trait": {
+            const trait = yield* requireTrait(index, target.trait, "ref target");
+            return { _tag: "trait", trait };
+        }
+        case "self":
+            return yield* ownerFocus(index, owner);
+        case "untargeted":
+            return undefined;
+    }
+});
+export const refTargetAsFocus = (target) => {
+    if (target._tag === "entity")
+        return { _tag: "entity", entity: target.entity };
+    if (target._tag === "trait")
+        return { _tag: "trait", trait: target.trait };
+    return undefined;
+};
+export const resolveRefTarget = (index, target, owner) => Result.gen(function* () {
+    if (target._tag === "self") {
+        const focus = yield* ownerFocus(index, owner);
+        return focus._tag === "entity"
+            ? { _tag: "entity", entity: focus.entity }
+            : { _tag: "trait", trait: focus.trait };
+    }
+    if (target._tag === "entity") {
+        const entity = yield* requireEntity(index, target.entity, "ref target");
+        return { _tag: "entity", entity };
+    }
+    if (target._tag === "trait") {
+        const trait = yield* requireTrait(index, target.trait, "ref target");
+        return { _tag: "trait", trait };
+    }
+    return target;
+});
+export const refCompatibleWithRow = (index, target, row) => {
+    const focus = refTargetAsFocus(target);
+    return focus !== undefined && sameRow(index, focus, row);
+};
+export const sameRefTarget = (index, left, right) => {
+    const leftFocus = refTargetAsFocus(left);
+    const rightFocus = refTargetAsFocus(right);
+    if (leftFocus !== undefined && rightFocus !== undefined) {
+        return sameRow(index, leftFocus, rightFocus);
+    }
+    return left._tag === "untargeted" && right._tag === "untargeted";
+};
+export const claimScalar = (shape) => shape._tag === "scalar" ? shape.valueType : undefined;
+export const litScalar = (value) => {
+    if (value === null)
+        return { _tag: "scalar", valueType: "null" };
+    if (typeof value === "boolean")
+        return { _tag: "scalar", valueType: "boolean" };
+    if (typeof value === "number")
+        return { _tag: "scalar", valueType: "number" };
+    return { _tag: "scalar", valueType: "string" };
+};
+export const scalarAssignable = (expected, actual) => {
+    if (actual._tag === "subject")
+        return expected === "string";
+    if (actual._tag !== "scalar")
+        return false;
+    if (expected === actual.valueType)
+        return true;
+    if (expected === "number")
+        return actual.valueType === "long" || actual.valueType === "double";
+    if (actual.valueType === "number")
+        return expected === "long" || expected === "double";
+    if (expected === "string" && actual.valueType === "uuid")
+        return true;
+    if (expected === "uuid" && actual.valueType === "string")
+        return true;
+    return false;
+};
+export const meCompatibleWith = (index, me, other) => {
+    if (other._tag === "me")
+        return true;
+    if (other._tag === "row") {
+        return me === undefined || sameRow(index, { _tag: "entity", entity: me }, other.focus);
+    }
+    if (other._tag === "ref") {
+        const focus = refTargetAsFocus(other.target);
+        return (focus !== undefined && (me === undefined || sameRow(index, { _tag: "entity", entity: me }, focus)));
+    }
+    return false;
+};
+export const eqCompatible = (index, left, right) => {
+    const pair = (a, b) => {
+        if (a._tag === "collection" || b._tag === "collection")
+            return false;
+        if (a._tag === "ref" && a.cardinality === "many")
+            return false;
+        if (b._tag === "ref" && b.cardinality === "many")
+            return false;
+        if (a._tag === "me")
+            return meCompatibleWith(index, a.entity, b);
+        if (a._tag === "subject") {
+            if (b._tag === "subject")
+                return true;
+            if (scalarAssignable("string", b))
+                return true;
+            if (b._tag === "claim") {
+                const scalar = claimScalar(b.shape);
+                return (scalar !== undefined && scalarAssignable("string", { _tag: "scalar", valueType: scalar }));
+            }
+            return false;
+        }
+        if (a._tag === "row") {
+            if (b._tag === "row")
+                return sameRow(index, a.focus, b.focus);
+            if (b._tag === "ref")
+                return refCompatibleWithRow(index, b.target, a.focus);
+            return false;
+        }
+        if (a._tag === "ref") {
+            if (b._tag === "ref")
+                return sameRefTarget(index, a.target, b.target);
+            return false;
+        }
+        if (a._tag === "scalar") {
+            if (b._tag === "scalar")
+                return scalarAssignable(a.valueType, b);
+            if (b._tag === "claim") {
+                const scalar = claimScalar(b.shape);
+                return (scalar !== undefined && scalarAssignable(a.valueType, { _tag: "scalar", valueType: scalar }));
+            }
+            return false;
+        }
+        if (a._tag === "claim") {
+            const scalar = claimScalar(a.shape);
+            if (scalar === undefined)
+                return false;
+            return eqCompatible(index, { _tag: "scalar", valueType: scalar }, b);
+        }
+        return false;
+    };
+    return pair(left, right) || pair(right, left);
+};
+export const collectionElement = (shape) => {
+    if (shape._tag === "ref" && shape.cardinality === "many") {
+        return Result.succeed({ _tag: "ref", target: shape.target, cardinality: "one" });
+    }
+    if (shape._tag === "collection")
+        return Result.succeed(shape.element);
+    if (shape._tag === "claim" && shape.shape._tag === "array") {
+        return Result.succeed({ _tag: "claim", shape: shape.shape.items });
+    }
+    return Result.succeed(undefined);
+};
+//# sourceMappingURL=types.js.map