131 lines · 4 KBtext/plain; charset=utf-8
The Coline App SDK: apps, tools, file types and surfaces that run inside Coline workspaces, and public websites with Coline Sites. TypeScript, with an in-memory test workspace. MIT.
| 4 | APP_CAPABILITY_OPERATIONS, |
| 5 | isAppCapabilityOperation, |
| 6 | type AppCapabilityOperation, |
| 7 | } from "./operations"; |
| 8 |
| 9 | /** |
| 10 | * The capability gate (plan §10.3, §12.2). |
| 11 | * |
| 12 | * Pure, transport-agnostic evaluation of a single capability call against |
| 13 | * the app's declared permissions, the install's granted permissions, and |
| 14 | * the effect ceiling of the executing unit. Every transport (tier-2 |
| 15 | * bridge, hosted-logic stubs, server guard) runs the SAME gate — the |
| 16 | * bridge is UX, the server is truth, but the logic is one function. |
| 17 | * |
| 18 | * The gate deliberately does not know about workspace membership or |
| 19 | * resource ACLs: those require IO and live in the host-side guard, which |
| 20 | * composes this gate with its own checks. |
| 21 | */ |
| 22 |
| 23 | export type CapabilityDenialCode = |
| 24 | | "unknown_operation" |
| 25 | | "permission_not_declared" |
| 26 | | "permission_not_granted" |
| 27 | | "effect_ceiling_exceeded"; |
| 28 |
| 29 | export type CapabilityGateDecision = |
| 30 | | { allowed: true; operation: AppCapabilityOperation } |
| 31 | | { |
| 32 | allowed: false; |
| 33 | operation: string; |
| 34 | code: CapabilityDenialCode; |
| 35 | message: string; |
| 36 | }; |
| 37 |
| 38 | export interface CapabilityGateConfig { |
| 39 | /** Permissions the manifest declares. */ |
| 40 | manifestPermissions: readonly AppPermissionV2[]; |
| 41 | /** Permissions the install has actually been granted. */ |
| 42 | grantedPermissions: readonly AppPermissionV2[]; |
| 43 | /** |
| 44 | * The effect ceiling of the executing unit (a tool's declared effect). |
| 45 | * Omitted for non-tool contexts (e.g. render handlers), which are |
| 46 | * implicitly ceilinged at `read` — rendering must not mutate. |
| 47 | */ |
| 48 | effectCeiling?: ToolEffect | undefined; |
| 49 | } |
| 50 |
| 51 | const RENDER_CONTEXT_CEILING: ToolEffect = "read"; |
| 52 |
| 53 | export function evaluateCapabilityGate( |
| 54 | operation: string, |
| 55 | config: CapabilityGateConfig, |
| 56 | ): CapabilityGateDecision { |
| 57 | if (!isAppCapabilityOperation(operation)) { |
| 58 | return { |
| 59 | allowed: false, |
| 60 | operation, |
| 61 | code: "unknown_operation", |
| 62 | message: `"${operation}" is not a Coline capability operation.`, |
| 63 | }; |
| 64 | } |
| 65 |
| 66 | const descriptor = APP_CAPABILITY_OPERATIONS[operation]; |
| 67 |
| 68 | if (descriptor.permission !== null) { |
| 69 | if (!config.manifestPermissions.includes(descriptor.permission)) { |
| 70 | return { |
| 71 | allowed: false, |
| 72 | operation, |
| 73 | code: "permission_not_declared", |
| 74 | message: `"${operation}" requires the "${descriptor.permission}" permission, which the app manifest does not declare.`, |
| 75 | }; |
| 76 | } |
| 77 | if (!config.grantedPermissions.includes(descriptor.permission)) { |
| 78 | return { |
| 79 | allowed: false, |
| 80 | operation, |
| 81 | code: "permission_not_granted", |
| 82 | message: `"${operation}" requires the "${descriptor.permission}" permission, which this install has not been granted.`, |
| 83 | }; |
| 84 | } |
| 85 | } |
| 86 |
| 87 | const ceiling = config.effectCeiling ?? RENDER_CONTEXT_CEILING; |
| 88 | if (!mutationClassAllowedByEffect(descriptor.mutation, ceiling)) { |
| 89 | return { |
| 90 | allowed: false, |
| 91 | operation, |
| 92 | code: "effect_ceiling_exceeded", |
| 93 | message: `"${operation}" is a ${descriptor.mutation}-class operation, above the "${ceiling}" effect ceiling of the executing unit.`, |
| 94 | }; |
| 95 | } |
| 96 |
| 97 | return { allowed: true, operation }; |
| 98 | } |
| 99 |
| 100 | export class CapabilityDeniedError extends Error { |
| 101 | readonly code: CapabilityDenialCode; |
| 102 | readonly operation: string; |
| 103 |
| 104 | constructor(decision: Extract<CapabilityGateDecision, { allowed: false }>) { |
| 105 | super(decision.message); |
| 106 | this.name = "CapabilityDeniedError"; |
| 107 | this.code = decision.code; |
| 108 | this.operation = decision.operation; |
| 109 | } |
| 110 | } |
| 111 |
| 112 | export interface CapabilityGate { |
| 113 | check(operation: string): CapabilityGateDecision; |
| 114 | assert(operation: string): AppCapabilityOperation; |
| 115 | } |
| 116 |
| 117 | export function createCapabilityGate(config: CapabilityGateConfig): CapabilityGate { |
| 118 | return { |
| 119 | check(operation) { |
| 120 | return evaluateCapabilityGate(operation, config); |
| 121 | }, |
| 122 | assert(operation) { |
| 123 | const decision = evaluateCapabilityGate(operation, config); |
| 124 | if (!decision.allowed) { |
| 125 | throw new CapabilityDeniedError(decision); |
| 126 | } |
| 127 | return decision.operation; |
| 128 | }, |
| 129 | }; |
| 130 | } |
| 131 |