toride 0.3.0 → 0.4.0

package/dist/index.js

@@ -1,6 +1,8 @@
 import {
+  ConditionExpressionSchema,
   CycleError,
   DepthLimitError,
+  ForbiddenError,
   PolicySchema,
   Toride,
   ValidationError,
@@ -12,7 +14,7 @@ import {
   validatePolicy,
   validatePolicyResult,
   validatePolicyStrict
-} from "./chunk-2AWXNP37.js";
+} from "./chunk-GRFSE3QO.js";
 import {
   TorideClient
 } from "./chunk-S6DKDABO.js";
@@ -47,9 +49,114 @@ function detectOldRelationSyntax(raw) {
     }
   }
 }
-function parsePolicy(raw) {
+function normalizeAttributeValue(raw, depth = 0, format = "yaml") {
+  if (raw === null || raw === void 0) return raw;
+  if (typeof raw === "string") {
+    if (["string", "number", "boolean"].includes(raw)) {
+      return { kind: "primitive", type: raw };
+    }
+    if (format === "yaml" && raw.endsWith("[]")) {
+      const baseType = raw.slice(0, -2);
+      if (["string", "number", "boolean"].includes(baseType)) {
+        return {
+          kind: "array",
+          items: { kind: "primitive", type: baseType }
+        };
+      }
+    }
+  }
+  if (typeof raw === "object" && !Array.isArray(raw)) {
+    const obj = raw;
+    const isCanonical = obj.kind === "primitive" && "type" in obj || obj.kind === "object" && "fields" in obj || obj.kind === "array" && "items" in obj;
+    if (isCanonical) {
+      if (obj.kind === "object" && typeof obj.fields === "object" && obj.fields !== null) {
+        const normalizedFields = {};
+        for (const [key, value] of Object.entries(obj.fields)) {
+          normalizedFields[key] = normalizeAttributeValue(value, depth, format);
+        }
+        return { ...obj, fields: normalizedFields };
+      }
+      if (obj.kind === "array" && "items" in obj) {
+        return { ...obj, items: normalizeAttributeValue(obj.items, depth, format) };
+      }
+      return obj;
+    }
+    if (obj.type === "array" && "items" in obj) {
+      return {
+        kind: "array",
+        items: normalizeAttributeValue(obj.items, depth, format)
+      };
+    }
+    if (depth > 3) {
+      throw new ValidationError(
+        "Attribute nesting depth exceeds maximum of 3",
+        "attributes"
+      );
+    }
+    const normalized = {};
+    for (const [key, value] of Object.entries(obj)) {
+      normalized[key] = normalizeAttributeValue(value, depth + 1, format);
+    }
+    return { kind: "object", fields: normalized };
+  }
+  if (Array.isArray(raw)) {
+    return raw.map((item) => normalizeAttributeValue(item, depth, format));
+  }
+  return raw;
+}
+function normalizeAttributeRecord(attrs, format) {
+  const normalizedAttrs = {};
+  for (const [attrKey, attrValue] of Object.entries(attrs)) {
+    normalizedAttrs[attrKey] = normalizeAttributeValue(attrValue, 0, format);
+  }
+  return normalizedAttrs;
+}
+function normalizeAttributes(raw, format) {
+  if (raw === null || raw === void 0 || typeof raw !== "object" || Array.isArray(raw)) {
+    return raw;
+  }
+  const obj = raw;
+  const normalized = { ...obj };
+  if ("actors" in normalized && typeof normalized.actors === "object" && normalized.actors !== null) {
+    const actors = normalized.actors;
+    const normalizedActors = {};
+    for (const [actorName, actorDef] of Object.entries(actors)) {
+      if (typeof actorDef === "object" && actorDef !== null) {
+        const actor = actorDef;
+        const normalizedActor = { ...actor };
+        if ("attributes" in normalizedActor && typeof normalizedActor.attributes === "object" && normalizedActor.attributes !== null) {
+          normalizedActor.attributes = normalizeAttributeRecord(normalizedActor.attributes, format);
+        }
+        normalizedActors[actorName] = normalizedActor;
+      } else {
+        normalizedActors[actorName] = actorDef;
+      }
+    }
+    normalized.actors = normalizedActors;
+  }
+  if ("resources" in normalized && typeof normalized.resources === "object" && normalized.resources !== null) {
+    const resources = normalized.resources;
+    const normalizedResources = {};
+    for (const [resName, resDef] of Object.entries(resources)) {
+      if (typeof resDef === "object" && resDef !== null) {
+        const resource = resDef;
+        const normalizedResource = { ...resource };
+        if ("attributes" in normalizedResource && typeof normalizedResource.attributes === "object" && normalizedResource.attributes !== null) {
+          normalizedResource.attributes = normalizeAttributeRecord(normalizedResource.attributes, format);
+        }
+        normalizedResources[resName] = normalizedResource;
+      } else {
+        normalizedResources[resName] = resDef;
+      }
+    }
+    normalized.resources = normalizedResources;
+  }
+  return normalized;
+}
+function parsePolicy(raw, format) {
   detectOldRelationSyntax(raw);
-  const result = v.safeParse(PolicySchema, raw);
+  const normalizedRaw = normalizeAttributes(raw, format);
+  const result = v.safeParse(PolicySchema, normalizedRaw);
   if (!result.success) {
     const issue = result.issues[0];
     const path = issue?.path?.map((p) => String(p.key)).join(".") ?? "";
@@ -72,7 +179,7 @@ async function loadYaml(input) {
       ""
     );
   }
-  return parsePolicy(raw);
+  return parsePolicy(raw, "yaml");
 }
 async function loadJson(input) {
   let raw;
@@ -84,7 +191,7 @@ async function loadJson(input) {
       ""
     );
   }
-  return parsePolicy(raw);
+  return parsePolicy(raw, "json");
 }
 
 // src/policy/merger.ts
@@ -155,6 +262,7 @@ function mergeResourceBlock(resourceName, base, overlay) {
   const derived_roles = appendArrays(base.derived_roles, overlay.derived_roles);
   const rules = appendArrays(base.rules, overlay.rules);
   const field_access = mergeFieldAccess(base.field_access, overlay.field_access);
+  const attributes = mergeAttributes(base.attributes, overlay.attributes);
   const result = {
     roles,
     permissions,
@@ -162,10 +270,17 @@ function mergeResourceBlock(resourceName, base, overlay) {
     ...relations && Object.keys(relations).length > 0 ? { relations } : {},
     ...derived_roles && derived_roles.length > 0 ? { derived_roles } : {},
     ...rules && rules.length > 0 ? { rules } : {},
-    ...field_access && Object.keys(field_access).length > 0 ? { field_access } : {}
+    ...field_access && Object.keys(field_access).length > 0 ? { field_access } : {},
+    ...attributes && Object.keys(attributes).length > 0 ? { attributes } : {}
   };
   return result;
 }
+function mergeAttributes(base, overlay) {
+  if (!base && !overlay) return void 0;
+  if (base) assertNoDangerousKeys(base, "base attributes");
+  if (overlay) assertNoDangerousKeys(overlay, "overlay attributes");
+  return { ...base ?? {}, ...overlay ?? {} };
+}
 function unionArrays(a, b) {
   return [.../* @__PURE__ */ new Set([...a, ...b])];
 }
@@ -226,8 +341,11 @@ function mergeFieldAccess(base, overlay) {
 // src/index.ts
 var VERSION = "0.0.1";
 export {
+  ConditionExpressionSchema,
   CycleError,
   DepthLimitError,
+  ForbiddenError,
+  PolicySchema,
   Toride,
   TorideClient,
   VERSION,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toride",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Relation-aware authorization engine for TypeScript",
   "type": "module",
   "exports": {
@@ -19,7 +19,8 @@
     "toride": "./dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "schema"
   ],
   "nx": {
     "tags": [