slotlock 0.8.0 → 0.10.0

package/workspace-domains.js

@@ -0,0 +1,249 @@
+// A team's verified domains and the requests to join that come through them (teams phase 5), as
+// the dashboard and the daily check reach them: through the SECURITY DEFINER functions of
+// ddl-identity.ts, which check the actor's role and lock the team themselves. The DNS side, and
+// the normaliser every domain and address goes through, is domains.ts.
+import { checkSlotlockDomain, normalizeSlotlockDomain, slotlockDomainToken, slotlockEmailDomain, } from './domains.js';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
+const PERSON = /^(github:[1-9]\d{0,19}|google:[A-Za-z0-9._-]{1,255})$/;
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+/**
+ * The addresses as matched: lowercase, the domain in its ASCII form, the domain claimable at all
+ * (a consumer address matches no team). At most ten.
+ */
+export function slotlockMatchableEmails(emails) {
+    const matchable = [];
+    for (const email of emails.slice(0, 10)) {
+        const at = email.lastIndexOf('@');
+        const domain = slotlockEmailDomain(email);
+        if (at < 1 || domain === null)
+            continue;
+        matchable.push(`${email.slice(0, at).toLowerCase()}@${domain}`);
+    }
+    return matchable;
+}
+/** Through the functions of ddl-identity.ts. */
+export function createSlotlockWorkspaceDomains(sql) {
+    async function list(tenantRef) {
+        if (!TEAM.test(tenantRef))
+            return [];
+        const rows = await sql `SELECT * FROM slotlock.workspace_domains_list(${tenantRef}::text)`;
+        return rows.map((row) => ({
+            id: row.domain_id,
+            ascii: row.domain_ascii,
+            unicode: row.domain_unicode,
+            status: row.status,
+            expired: row.expired,
+            token: row.token,
+            joinPolicy: row.join_policy,
+            createdAt: row.created_at,
+            verifiedAt: row.verified_at,
+            lastCheckedAt: row.last_checked_at,
+            missingSince: row.missing_since,
+            errorSince: row.error_since,
+            lapseAfter: row.lapse_after,
+        }));
+    }
+    async function apply(id, actor, token, check) {
+        const [row] = await sql `
+      SELECT outcome, team_ref, domain_name FROM slotlock.record_domain_check(
+        ${id}::uuid, ${actor}::text, ${token}::text, ${check.primary}::text, ${check.secondary}::text,
+        ${slotlockDomainToken()}::text)`;
+        return { domainId: id, tenantRef: row?.team_ref ?? null, domain: row?.domain_name ?? null, outcome: row?.outcome ?? 'not_found', check };
+    }
+    return {
+        async claim(tenantRef, actor, typed) {
+            if (!TEAM.test(tenantRef) || !PERSON.test(actor))
+                return { refusal: 'not_found' };
+            const domain = normalizeSlotlockDomain(typed);
+            if ('refusal' in domain)
+                return { refusal: domain.refusal };
+            const [row] = await sql `
+        SELECT claimed_id, refusal FROM slotlock.claim_domain(
+          ${tenantRef}::text, ${actor}::text, ${domain.ascii}::text, ${domain.unicode}::text, ${slotlockDomainToken()}::text)`;
+            if (row?.refusal)
+                return { refusal: refusalOf(row.refusal) ?? 'not_allowed' };
+            return row?.claimed_id ? { id: row.claimed_id } : { refusal: 'not_allowed' };
+        },
+        list,
+        async verifyNow(tenantRef, actor, id, resolvers) {
+            const none = { domainId: id, tenantRef: null, domain: null, check: null };
+            if (!TEAM.test(tenantRef) || !PERSON.test(actor) || !UUID.test(id))
+                return { ...none, outcome: 'not_found' };
+            const claim = (await list(tenantRef)).find((domain) => domain.id === id);
+            if (!claim)
+                return { ...none, outcome: 'not_found' };
+            if (claim.expired)
+                return { ...none, outcome: 'expired' };
+            if (claim.lastCheckedAt !== null && Date.now() - claim.lastCheckedAt.getTime() < 60_000)
+                return { ...none, outcome: 'too_soon' };
+            return apply(id, actor, claim.token, await checkSlotlockDomain(resolvers, claim.ascii, claim.token));
+        },
+        async checkDue(resolvers, limit = 50, seen) {
+            const due = await sql `
+        SELECT domain_id, domain_ascii, token, missing_since FROM slotlock.domains_due(${limit}::integer)`;
+            const outcomes = [];
+            for (const claim of due) {
+                seen?.(claim.domain_id, claim.missing_since);
+                outcomes.push(await apply(claim.domain_id, null, claim.token, await checkSlotlockDomain(resolvers, claim.domain_ascii, claim.token)));
+            }
+            return outcomes;
+        },
+        async release(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.release_domain(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async restrictInvites(tenantRef, actor, on) {
+            const [row] = await sql `
+        SELECT slotlock.set_invite_domain_restriction(${tenantRef}::text, ${actor}::text, ${on}::boolean) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async invitesRestricted(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return false;
+            const [state] = await sql `
+        SELECT slotlock.workspace_invites_restricted(${tenantRef}::text) AS restricted`;
+            return state?.restricted === true;
+        },
+        async setJoinPolicy(tenantRef, actor, id, policy) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.set_domain_join_policy(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${policy}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async discoverable(person, emails) {
+            const matchable = slotlockMatchableEmails(emails);
+            if (!PERSON.test(person) || matchable.length === 0)
+                return [];
+            const rows = await sql `SELECT team_ref, handle, name, domain, domain_key, join_policy, requested
+          FROM slotlock.discoverable_workspaces(${person}::text, ${matchable}::text[])`;
+            return rows.map((row) => ({
+                tenantRef: row.team_ref,
+                handle: row.handle,
+                name: row.name,
+                domain: row.domain,
+                domainKey: row.domain_key,
+                joinPolicy: row.join_policy,
+                requested: row.requested,
+            }));
+        },
+        async requestToJoin(tenantRef, person, emails, evidence, memberCap) {
+            const matchable = slotlockMatchableEmails(emails);
+            if (!TEAM.test(tenantRef) || !PERSON.test(person) || matchable.length === 0)
+                return { refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT outcome, refusal FROM slotlock.request_to_join(
+          ${tenantRef}::text, ${person}::text, ${matchable}::text[], ${evidence}::text, ${memberCap}::integer)`;
+            return row?.outcome ? { outcome: row.outcome } : { refusal: refusalOf(row?.refusal) ?? 'not_found' };
+        },
+        async requests(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return [];
+            const rows = await sql `SELECT * FROM slotlock.workspace_join_requests_list(${tenantRef}::text)`;
+            return rows.map((row) => ({
+                id: row.request_id,
+                person: row.person_ref,
+                display: row.display,
+                email: row.email,
+                domain: row.domain,
+                createdAt: row.created_at,
+                expiresAt: row.expires_at,
+                evidence: row.evidence,
+            }));
+        },
+        async decide({ tenantRef, actor, id, decision, role, memberCap }) {
+            if (!UUID.test(id))
+                return { person: null, refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT refusal, joined_person FROM slotlock.decide_join_request(
+          ${tenantRef}::text, ${actor}::text, ${id}::uuid, ${decision}::text, ${role}::text, ${memberCap}::integer)`;
+            return { person: row?.joined_person ?? null, refusal: refusalOf(row?.refusal) };
+        },
+        async domainMembers(tenantRef) {
+            const found = new Map();
+            if (!TEAM.test(tenantRef))
+                return found;
+            const rows = await sql `
+        SELECT person_ref, domain, domain_status FROM slotlock.workspace_domain_members(${tenantRef}::text)`;
+            for (const row of rows)
+                found.set(row.person_ref, { domain: row.domain, status: row.domain_status });
+            return found;
+        },
+        async prune() {
+            const [row] = await sql `SELECT slotlock.prune_workspace_domains() AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+    };
+}
+/** The role a request may be approved as: Viewer, Member or Developer. */
+export function slotlockJoinRole(value) {
+    return isSlotlockWorkspaceRole(value) && (value === 'viewer' || value === 'member' || value === 'developer') ? value : null;
+}
+/** The audit log's actions for a team's domains (its Identity group). */
+export const SLOTLOCK_DOMAIN_AUDIT_ACTIONS = Object.freeze([
+    'domain.claimed',
+    'domain.verified',
+    'domain.record_missing',
+    'domain.lapsing',
+    'domain.restored',
+    'domain.lapsed',
+    'domain.released',
+    'domain.join_policy_changed',
+    'workspace.invites_restricted',
+    'workspace.invites_unrestricted',
+]);
+/** The action a check's outcome records, or null for one that changed nothing. */
+const CHECK_ACTIONS = Object.freeze({
+    verified: 'domain.verified',
+    restored: 'domain.restored',
+    lapsing: 'domain.lapsing',
+    lapsed: 'domain.lapsed',
+});
+/**
+ * The audit event a check that changed something records: which domain, and what each resolver said
+ * (public DNS data). A domain gone for the first time is recorded once (`missing` while it had been
+ * seen); repeats and checks that changed nothing are not.
+ */
+export function slotlockDomainCheckEvent(found, firstMissing) {
+    const action = CHECK_ACTIONS[found.outcome] ?? (found.outcome === 'missing' && firstMissing ? 'domain.record_missing' : null);
+    if (action === null || found.domain === null)
+        return null;
+    return {
+        action,
+        targetType: 'domain',
+        targetRef: found.domainId,
+        metadata: {
+            domain: found.domain,
+            resolvers: (found.check?.detail ?? []).map((asked) => ({
+                resolver: asked.resolver,
+                verdict: asked.verdict,
+                ad: asked.ad,
+                ttl: asked.ttl,
+                values: asked.values,
+                ...(asked.reason !== null ? { reason: asked.reason } : {}),
+            })),
+        },
+    };
+}
+/**
+ * The daily check, from the server's maintenance: the claims due looked up and applied, each change
+ * recorded in its team's audit log as Slotlock's. How many were checked.
+ */
+export async function runSlotlockDomainChecks(params) {
+    const before = new Map();
+    const outcomes = await params.domains.checkDue(params.resolvers, params.limit ?? 50, (id, missingSince) => {
+        before.set(id, missingSince);
+    });
+    for (const found of outcomes) {
+        const event = slotlockDomainCheckEvent(found, before.get(found.domainId) === null);
+        if (event === null || found.tenantRef === null || !params.record)
+            continue;
+        await params.record(found.tenantRef, { ...event, actorType: 'system', actorRef: 'slotlock' }).catch(() => undefined);
+    }
+    return outcomes.length;
+}

package/workspace-roles.d.ts

@@ -0,0 +1,47 @@
+/** The roles, most powerful first. */
+export declare const SLOTLOCK_WORKSPACE_ROLES: readonly ["owner", "admin", "developer", "member", "viewer", "billing"];
+export type SlotlockWorkspaceRole = (typeof SLOTLOCK_WORKSPACE_ROLES)[number];
+/** Each role as the dashboard names it. */
+export declare const SLOTLOCK_WORKSPACE_ROLE_NAMES: Readonly<Record<SlotlockWorkspaceRole, string>>;
+export declare const SLOTLOCK_WORKSPACE_CAPABILITIES: readonly ["account.use", "workspace.read", "usage.read", "assistant.chat", "operations.run", "resources.manage", "sandbox.manage", "keys.manage_own", "keys.full", "keys.manage_any", "webhooks.manage", "contacts.forget", "assistant.settings", "members.manage", "audit.read", "privacy.manage", "billing.manage", "workspace.own", "identity.manage"];
+export type SlotlockWorkspaceCapability = (typeof SLOTLOCK_WORKSPACE_CAPABILITIES)[number];
+/** Capabilities that also need a sign-in in the last 15 minutes (as GitHub's sudo mode). */
+export declare const SLOTLOCK_FRESH_CAPABILITIES: ReadonlySet<SlotlockWorkspaceCapability>;
+/** What each role may do. */
+export declare const SLOTLOCK_ROLE_CAPABILITIES: Readonly<Record<SlotlockWorkspaceRole, ReadonlySet<SlotlockWorkspaceCapability>>>;
+export declare function isSlotlockWorkspaceRole(value: unknown): value is SlotlockWorkspaceRole;
+/** Whether a role may use a capability. */
+export declare function slotlockRoleCan(role: SlotlockWorkspaceRole | null | undefined, capability: SlotlockWorkspaceCapability): boolean;
+/**
+ * Whether `granter` may give `role` to someone: never a role with a capability the granter lacks,
+ * so an Admin invites up to Admin, never Owner or Billing, and only those who manage members grant
+ * at all.
+ */
+export declare function slotlockRoleMayGrant(granter: SlotlockWorkspaceRole | null | undefined, role: SlotlockWorkspaceRole): boolean;
+/** The API key scopes a role may give a key it creates: admin only with `keys.full`. */
+export declare function slotlockRoleKeyScopes(role: SlotlockWorkspaceRole | null | undefined): readonly ('read' | 'write' | 'admin')[];
+/**
+ * Each dashboard POST route, by the capability it needs before its handler runs. A handler may ask
+ * for more where the form decides (a Full-access key asks `keys.full`; another person's key asks
+ * `keys.manage_any`). A route not listed is refused.
+ */
+export declare const SLOTLOCK_DASHBOARD_POST_CAPABILITIES: Readonly<Record<string, SlotlockWorkspaceCapability>>;
+/** Each dashboard page (GET), by the capability it needs. A page not listed is refused. */
+export declare const SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES: Readonly<Record<string, SlotlockWorkspaceCapability>>;
+/**
+ * A member limited to some locations and groups (RFC 0004 D1) keeps at most these of their role's
+ * capabilities: they read and run the desk for those resources, and chat with an assistant that
+ * reaches only them. Nothing that reaches the whole workspace (keys, webhooks, people, money, its
+ * hours and closures, its data whole or a person's) is theirs.
+ */
+export declare const SLOTLOCK_SCOPED_CAPABILITIES: ReadonlySet<SlotlockWorkspaceCapability>;
+/**
+ * The pages a limited member reaches: what the store reads for them is held to their resources by
+ * the database (resource_scope_v1), and pages whose content is the whole workspace's (keys,
+ * webhooks, contacts, hours, closures, locations, usage, the audit log) are not among them.
+ */
+export declare const SLOTLOCK_SCOPED_DASHBOARD_PAGES: ReadonlySet<string>;
+/** The forms a limited member may send: their own account's, and the desk's for their resources. */
+export declare const SLOTLOCK_SCOPED_DASHBOARD_POSTS: ReadonlySet<string>;
+/** Whether a role, limited (`scoped`) or not, may use a capability. */
+export declare function slotlockMemberCan(role: SlotlockWorkspaceRole | null | undefined, scoped: boolean, capability: SlotlockWorkspaceCapability): boolean;

package/workspace-roles.js

@@ -0,0 +1,304 @@
+// Who may do what in a workspace: six fixed roles, each a set of capabilities, and every dashboard
+// route named by the capability it needs. The dashboard reads a person's role from the database on
+// every request (workspaces.ts) and checks it here before any handler runs, so a role changed or a
+// membership ended applies at the next request, and a route missing from the table is refused.
+//
+// The roles follow what API products settled on (Stripe, Vercel): a Developer holds credentials but
+// not people or money; Billing and Viewer hold the least. Owner and Admin differ by money and by
+// the workspace itself. A capability marked fresh also needs a sign-in in the last 15 minutes.
+/** The roles, most powerful first. */
+export const SLOTLOCK_WORKSPACE_ROLES = Object.freeze([
+    'owner',
+    'admin',
+    'developer',
+    'member',
+    'viewer',
+    'billing',
+]);
+/** Each role as the dashboard names it. */
+export const SLOTLOCK_WORKSPACE_ROLE_NAMES = Object.freeze({
+    owner: 'Owner',
+    admin: 'Admin',
+    developer: 'Developer',
+    member: 'Member',
+    viewer: 'Viewer',
+    billing: 'Billing',
+});
+export const SLOTLOCK_WORKSPACE_CAPABILITIES = Object.freeze([
+    /** Switch workspace or environment, sign out, see one's own account. Every role. */
+    'account.use',
+    /** Read the workspace: overview, resources, bookings, contacts, history, key and webhook lists. */
+    'workspace.read',
+    /** The plan, its limits and this month's use. */
+    'usage.read',
+    /** Chat with the assistant; what it proposes still waits for a person to approve. */
+    'assistant.chat',
+    /** Run the booking desk: approvals, the waitlist, hours, closures and holiday calendars. */
+    'operations.run',
+    /** Resources, their booking rules, pools, locations and groups. */
+    'resources.manage',
+    /** The test environment's seed, reset and fast-forward. */
+    'sandbox.manage',
+    /** Read-only, read-write or resource-limited keys; rotate, revoke and limit one's own. */
+    'keys.manage_own',
+    /** Full-access keys (the admin scope: contacts, webhooks, history, erasure). Fresh. */
+    'keys.full',
+    /** Rotate, revoke or limit a key someone else created. */
+    'keys.manage_any',
+    /** Add, delete and enable webhooks, which stream every change to an outside address. Fresh. */
+    'webhooks.manage',
+    /** Forget a contact: an erasure request. */
+    'contacts.forget',
+    /** Connect, test or disconnect the assistant's model and its key. Fresh. */
+    'assistant.settings',
+    /** Invite, change roles and remove people, up to one's own powers. */
+    'members.manage',
+    /** Read the audit log. */
+    'audit.read',
+    /**
+     * Export the workspace's data, and find, export or erase what it keeps about one person (RFC 0004
+     * D3). Fresh.
+     */
+    'privacy.manage',
+    /** Change the plan and open billing. Fresh. */
+    'billing.manage',
+    /** Grant Owner or Billing, transfer, delete the workspace, link a GitHub organization. Fresh. */
+    'workspace.own',
+    /** The team's identity: its verified domains and who may join through them. Owner only. Fresh. */
+    'identity.manage',
+]);
+/** Capabilities that also need a sign-in in the last 15 minutes (as GitHub's sudo mode). */
+export const SLOTLOCK_FRESH_CAPABILITIES = new Set([
+    'keys.full',
+    'webhooks.manage',
+    'assistant.settings',
+    'billing.manage',
+    'workspace.own',
+    'privacy.manage',
+    'identity.manage',
+]);
+const everyCapability = SLOTLOCK_WORKSPACE_CAPABILITIES;
+const without = (...left) => everyCapability.filter((capability) => !left.includes(capability));
+/** What each role may do. */
+export const SLOTLOCK_ROLE_CAPABILITIES = Object.freeze({
+    owner: new Set(everyCapability),
+    admin: new Set(without('billing.manage', 'workspace.own', 'identity.manage')),
+    developer: new Set([
+        'account.use',
+        'workspace.read',
+        'usage.read',
+        'assistant.chat',
+        'operations.run',
+        'resources.manage',
+        'sandbox.manage',
+        'keys.manage_own',
+    ]),
+    member: new Set(['account.use', 'workspace.read', 'usage.read', 'assistant.chat', 'operations.run']),
+    viewer: new Set(['account.use', 'workspace.read', 'usage.read', 'assistant.chat']),
+    billing: new Set(['account.use', 'usage.read', 'billing.manage']),
+});
+export function isSlotlockWorkspaceRole(value) {
+    return typeof value === 'string' && SLOTLOCK_WORKSPACE_ROLES.includes(value);
+}
+/** Whether a role may use a capability. */
+export function slotlockRoleCan(role, capability) {
+    return role !== null && role !== undefined && SLOTLOCK_ROLE_CAPABILITIES[role].has(capability);
+}
+/**
+ * Whether `granter` may give `role` to someone: never a role with a capability the granter lacks,
+ * so an Admin invites up to Admin, never Owner or Billing, and only those who manage members grant
+ * at all.
+ */
+export function slotlockRoleMayGrant(granter, role) {
+    if (!slotlockRoleCan(granter, 'members.manage'))
+        return false;
+    for (const capability of SLOTLOCK_ROLE_CAPABILITIES[role]) {
+        if (!slotlockRoleCan(granter, capability))
+            return false;
+    }
+    return true;
+}
+/** The API key scopes a role may give a key it creates: admin only with `keys.full`. */
+export function slotlockRoleKeyScopes(role) {
+    if (slotlockRoleCan(role, 'keys.full'))
+        return ['read', 'write', 'admin'];
+    if (slotlockRoleCan(role, 'keys.manage_own'))
+        return ['read', 'write'];
+    return [];
+}
+/**
+ * Each dashboard POST route, by the capability it needs before its handler runs. A handler may ask
+ * for more where the form decides (a Full-access key asks `keys.full`; another person's key asks
+ * `keys.manage_any`). A route not listed is refused.
+ */
+export const SLOTLOCK_DASHBOARD_POST_CAPABILITIES = Object.freeze({
+    '/sign-out': 'account.use',
+    '/sign-out-everywhere': 'account.use',
+    '/sessions/end': 'account.use',
+    '/organization': 'account.use',
+    '/environment': 'account.use',
+    '/teams/enable': 'account.use',
+    '/teams/disable': 'account.use',
+    // Anyone signed in may create a team workspace, join one they were invited to, or leave one.
+    '/teams/create': 'account.use',
+    // Deleting a team, or keeping one being deleted: its Owners only.
+    '/teams/delete': 'workspace.own',
+    '/teams/restore': 'workspace.own',
+    '/invite/accept': 'account.use',
+    '/members/leave': 'account.use',
+    // Inviting or changing someone also needs the power the role given carries (dashboard.ts
+    // capabilitiesOf): an Owner `workspace.own`, a Billing manager `billing.manage`.
+    '/members/invite': 'members.manage',
+    '/members/resend': 'members.manage',
+    '/members/revoke': 'members.manage',
+    '/members/role': 'members.manage',
+    // Limiting a member to locations and groups (RFC 0004 D1), or giving them all of it again.
+    '/members/scope': 'members.manage',
+    '/members/remove': 'members.manage',
+    // Approving or declining a request to join through a verified domain.
+    '/members/requests': 'members.manage',
+    // Asking to join a team through a verified address: anyone signed in, for a team they are not in.
+    '/join/request': 'account.use',
+    // A team's domains, and holding invitations to them: its Owners only.
+    '/identity/domains': 'identity.manage',
+    '/identity/domains/verify': 'identity.manage',
+    '/identity/domains/remove': 'identity.manage',
+    '/identity/domains/policy': 'identity.manage',
+    '/identity/invites': 'identity.manage',
+    // A team's single sign-on: its Owners only.
+    '/identity/sso': 'identity.manage',
+    '/identity/sso/test': 'identity.manage',
+    '/identity/sso/status': 'identity.manage',
+    '/identity/sso/delete': 'identity.manage',
+    '/identity/sso/provisioning': 'identity.manage',
+    '/identity/sso/mapping': 'identity.manage',
+    '/identity/sso/require': 'identity.manage',
+    '/identity/scim/enable': 'identity.manage',
+    '/identity/scim/disable': 'identity.manage',
+    '/identity/scim/token': 'identity.manage',
+    '/identity/scim/token/revoke': 'identity.manage',
+    '/identity/scim/group': 'identity.manage',
+    // Signing in through one's team's provider (to link it or prove oneself), or an Owner's bypass:
+    // from wherever one is, for a team the handler and the database check one belongs to.
+    '/sso/proof': 'account.use',
+    '/sso/bypass': 'account.use',
+    '/keys': 'keys.manage_own',
+    '/keys/rotate': 'keys.manage_own',
+    '/keys/revoke': 'keys.manage_own',
+    '/keys/limits': 'keys.manage_own',
+    '/resources': 'resources.manage',
+    '/resources/rules': 'resources.manage',
+    '/resources/pool': 'resources.manage',
+    '/resources/profile': 'resources.manage',
+    '/resources/place': 'resources.manage',
+    '/resources/parent': 'resources.manage',
+    '/locations': 'resources.manage',
+    '/locations/delete': 'resources.manage',
+    '/groups': 'resources.manage',
+    '/groups/delete': 'resources.manage',
+    '/webhooks': 'webhooks.manage',
+    '/webhooks/delete': 'webhooks.manage',
+    '/webhooks/enable': 'webhooks.manage',
+    '/waitlist/leave': 'operations.run',
+    '/approvals/decide': 'operations.run',
+    '/hours': 'operations.run',
+    '/closures': 'operations.run',
+    '/closures/delete': 'operations.run',
+    '/closures/import': 'operations.run',
+    '/closures/calendars/delete': 'operations.run',
+    '/sandbox/seed': 'sandbox.manage',
+    '/sandbox/reset': 'sandbox.manage',
+    '/sandbox/fast-forward': 'sandbox.manage',
+    '/contacts/forget': 'contacts.forget',
+    '/assistant': 'assistant.chat',
+    '/assistant/stream': 'assistant.chat',
+    '/assistant/reset': 'assistant.chat',
+    '/assistant/rename': 'assistant.chat',
+    '/assistant/delete': 'assistant.chat',
+    // Approving runs the change the assistant proposed: as the desk would.
+    '/assistant/approve': 'operations.run',
+    '/assistant/dismiss': 'assistant.chat',
+    '/settings/assistant': 'assistant.settings',
+    '/settings/assistant/test': 'assistant.settings',
+    '/settings/assistant/models': 'assistant.settings',
+    '/settings/assistant/remove': 'assistant.settings',
+    '/plan/upgrade': 'billing.manage',
+    '/plan/manage': 'billing.manage',
+    '/settings/privacy/export': 'privacy.manage',
+    '/settings/privacy/export/delete': 'privacy.manage',
+    '/settings/privacy/person': 'privacy.manage',
+    '/settings/privacy/person/export': 'privacy.manage',
+    '/settings/privacy/person/erase': 'privacy.manage',
+});
+/** Each dashboard page (GET), by the capability it needs. A page not listed is refused. */
+export const SLOTLOCK_DASHBOARD_PAGE_CAPABILITIES = Object.freeze({
+    '/': 'workspace.read',
+    '/keys': 'workspace.read',
+    '/resources': 'workspace.read',
+    '/resources/:id': 'workspace.read',
+    '/webhooks': 'workspace.read',
+    '/waitlist': 'workspace.read',
+    '/approvals': 'workspace.read',
+    '/hours': 'workspace.read',
+    '/closures': 'workspace.read',
+    '/contacts': 'workspace.read',
+    '/locations': 'workspace.read',
+    '/assistant': 'assistant.chat',
+    '/assistant/chats': 'assistant.chat',
+    '/plan': 'usage.read',
+    '/teams': 'account.use',
+    '/settings': 'workspace.read',
+    '/settings/endpoints': 'workspace.read',
+    '/settings/hours': 'workspace.read',
+    '/settings/account': 'account.use',
+    '/settings/members': 'workspace.read',
+    '/settings/audit': 'audit.read',
+    '/settings/audit/export': 'audit.read',
+    '/settings/team': 'workspace.own',
+    '/settings/privacy': 'privacy.manage',
+    '/settings/privacy/download': 'privacy.manage',
+    '/settings/identity': 'identity.manage',
+});
+/**
+ * A member limited to some locations and groups (RFC 0004 D1) keeps at most these of their role's
+ * capabilities: they read and run the desk for those resources, and chat with an assistant that
+ * reaches only them. Nothing that reaches the whole workspace (keys, webhooks, people, money, its
+ * hours and closures, its data whole or a person's) is theirs.
+ */
+export const SLOTLOCK_SCOPED_CAPABILITIES = new Set([
+    'account.use',
+    'workspace.read',
+    'assistant.chat',
+    'operations.run',
+]);
+/**
+ * The pages a limited member reaches: what the store reads for them is held to their resources by
+ * the database (resource_scope_v1), and pages whose content is the whole workspace's (keys,
+ * webhooks, contacts, hours, closures, locations, usage, the audit log) are not among them.
+ */
+export const SLOTLOCK_SCOPED_DASHBOARD_PAGES = new Set([
+    '/',
+    '/resources',
+    '/resources/:id',
+    '/waitlist',
+    '/approvals',
+    '/assistant',
+    '/assistant/chats',
+    '/teams',
+    '/settings',
+    '/settings/account',
+    '/settings/members',
+]);
+/** The forms a limited member may send: their own account's, and the desk's for their resources. */
+export const SLOTLOCK_SCOPED_DASHBOARD_POSTS = new Set([
+    ...Object.entries(SLOTLOCK_DASHBOARD_POST_CAPABILITIES)
+        .filter(([, capability]) => capability === 'account.use' || capability === 'assistant.chat')
+        .map(([route]) => route),
+    '/waitlist/leave',
+    '/approvals/decide',
+    '/assistant/approve',
+]);
+/** Whether a role, limited (`scoped`) or not, may use a capability. */
+export function slotlockMemberCan(role, scoped, capability) {
+    return slotlockRoleCan(role, capability) && (!scoped || SLOTLOCK_SCOPED_CAPABILITIES.has(capability));
+}