Reconnexion/ng-eventually
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactor read filter from per-item grant to per-document ReadCap

Browse Source 
Model the read filter on NextGraph's real ReadCap mechanism instead of an
invented per-item grant. Verified in nextgraph-rs: there is no Document type
(document = repo); a store is a container repo referencing other repos by RDF
overlay; holding a store's cap does NOT grant the repos it contains (each repo
needs its own cap; no read-cap inheritance). So the access unit is the
DOCUMENT = an item's `@graph`, never the item.

- caps.ts: CapRegistry (read/write caps per document NURI + public docs;
  open/grantRead/grantWrite/makePublic/canRead/canWrite/governsRead/
  hasReadPolicy). Replaces access.ts (Grant).
- read-filter.ts: filter keeps an item iff its `@graph` document is readable
  (held cap or public); items with no `@graph` or in an ungoverned document are
  kept. No injected grantOf — the filter reads `@graph` and consults the
  registry (automatic, domain-agnostic).
- polyfill.ts: getCaps()/resetCaps() replace setGrantOf/getGrantOf; useShape
  filters only when caps.hasReadPolicy() (else passthrough, no regression).
- tests: caps.test.ts (6) + read-filter.test.ts (4), incl. no-inheritance
  between documents. 10 pass; tsc rc=0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Sylvain Duchesne
2026-06-29 11:19:57 +02:00
parent 672067d513
commit 88d96857fb
9 changed files with 231 additions and 149 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/client/test/access.test.ts
-30
View File
@@ -1,30 +0,0 @@
import { test, expect } from "bun:test";
import { canRead, canWrite, defaultGrant, grantRead } from "../src/access";
test("public docs are readable by anyone, even anonymous", () => {
const g = defaultGrant("public", "alice");
expect(canRead(g, null)).toBe(true);
expect(canRead(g, "bob")).toBe(true);
});
test("protected docs: owner + explicitly granted principals only", () => {
let g = defaultGrant("protected", "alice");
expect(canRead(g, "alice")).toBe(true);
expect(canRead(g, "bob")).toBe(false);
g = grantRead(g, "bob"); // e.g. bob becomes a connection of alice
expect(canRead(g, "bob")).toBe(true);
});
test("private docs: owner only", () => {
const g = defaultGrant("private", "alice");
expect(canRead(g, "alice")).toBe(true);
expect(canRead(g, "bob")).toBe(false);
expect(canRead(g, null)).toBe(false);
});
test("write is restricted to the write grant", () => {
const g = defaultGrant("public", "alice");
expect(canWrite(g, "alice")).toBe(true);
expect(canWrite(g, "bob")).toBe(false);
expect(canWrite(g, null)).toBe(false);
});
packages/client/test/caps.test.ts
+50
View File
@@ -0,0 +1,50 @@
import { test, expect } from "bun:test";
import { CapRegistry } from "../src/caps";
test("public documents are readable by anyone, even anonymous", () => {
const caps = new CapRegistry();
caps.open("did:ng:o:pub", "public", "alice");
expect(caps.canRead("did:ng:o:pub", null)).toBe(true);
expect(caps.canRead("did:ng:o:pub", "bob")).toBe(true);
});
test("protected documents: owner + explicitly granted principals only", () => {
const caps = new CapRegistry();
caps.open("did:ng:o:prot", "protected", "alice");
expect(caps.canRead("did:ng:o:prot", "alice")).toBe(true);
expect(caps.canRead("did:ng:o:prot", "bob")).toBe(false);
caps.grantRead("did:ng:o:prot", "bob"); // bob becomes a connection of alice
expect(caps.canRead("did:ng:o:prot", "bob")).toBe(true);
});
test("private documents: owner only", () => {
const caps = new CapRegistry();
caps.open("did:ng:o:priv", "private", "alice");
expect(caps.canRead("did:ng:o:priv", "alice")).toBe(true);
expect(caps.canRead("did:ng:o:priv", "bob")).toBe(false);
expect(caps.canRead("did:ng:o:priv", null)).toBe(false);
});
test("write is restricted to write-cap holders; the creator always holds it", () => {
const caps = new CapRegistry();
caps.open("did:ng:o:pub", "public", "alice");
expect(caps.canWrite("did:ng:o:pub", "alice")).toBe(true);
expect(caps.canWrite("did:ng:o:pub", "bob")).toBe(false);
expect(caps.canWrite("did:ng:o:pub", null)).toBe(false);
});
test("holding a document's cap does NOT grant another document (no inheritance)", () => {
const caps = new CapRegistry();
caps.grantRead("did:ng:o:doc1", "alice");
expect(caps.canRead("did:ng:o:doc1", "alice")).toBe(true);
expect(caps.canRead("did:ng:o:doc2", "alice")).toBe(false); // separate repo, separate cap
});
test("governsRead / hasReadPolicy distinguish governed from ungoverned documents", () => {
const caps = new CapRegistry();
expect(caps.hasReadPolicy()).toBe(false);
caps.grantRead("did:ng:o:doc1", "alice");
expect(caps.hasReadPolicy()).toBe(true);
expect(caps.governsRead("did:ng:o:doc1")).toBe(true);
expect(caps.governsRead("did:ng:o:unknown")).toBe(false); // not declared → not enforced
});
packages/client/test/read-filter.test.ts
+30 -21
View File
@@ -1,38 +1,47 @@
import { test, expect } from "bun:test";
import { filterReadable, makeReadFilteredView } from "../src/read-filter";
import type { Grant } from "../src/types";
import { CapRegistry } from "../src/caps";
interface Item { id: string; grant?: Grant }
const grantOf = (i: unknown): Grant | undefined => (i as Item).grant;
// The access unit is the DOCUMENT (an item's `@graph` = the repo it lives in),
// not the item. Items here carry `@graph`; caps are granted per document.
interface Item { id: string; "@graph"?: string }
const A: Item = { id: "a", grant: { read: ["alice"], write: ["alice"] } };
const PUB: Item = { id: "p", grant: { read: ["public"], write: ["bob"] } };
const NOGRANT: Item = { id: "n" }; // no grant → always kept
const PRIV: Item = { id: "a", "@graph": "did:ng:o:alice" }; // alice's doc
const PUB: Item = { id: "p", "@graph": "did:ng:o:public" }; // public doc
const UNGOV: Item = { id: "n", "@graph": "did:ng:o:other" }; // doc under no policy
const NOGRAPH: Item = { id: "x" }; // no document → kept
test("filterReadable keeps public, owner-readable, and ungranted items", () => {
const items = [A, PUB, NOGRANT];
expect(filterReadable(items, grantOf, "alice").map(i => (i as Item).id)).toEqual(["a", "p", "n"]);
expect(filterReadable(items, grantOf, "bob").map(i => (i as Item).id)).toEqual(["p", "n"]);
expect(filterReadable(items, grantOf, null).map(i => (i as Item).id)).toEqual(["p", "n"]);
function caps(): CapRegistry {
const c = new CapRegistry();
c.grantRead("did:ng:o:alice", "alice");
c.makePublic("did:ng:o:public");
return c;
}
test("filterReadable keeps public, cap-held, ungoverned and graphless items", () => {
const items = [PRIV, PUB, UNGOV, NOGRAPH];
expect(filterReadable(items, caps(), "alice").map(i => (i as Item).id)).toEqual(["a", "p", "n", "x"]);
expect(filterReadable(items, caps(), "bob").map(i => (i as Item).id)).toEqual(["p", "n", "x"]);
expect(filterReadable(items, caps(), null).map(i => (i as Item).id)).toEqual(["p", "n", "x"]);
});
test("makeReadFilteredView filters iteration/size, reflects the current user", () => {
const set = new Set<Item>([A, PUB, NOGRANT]);
const set = new Set<Item>([PRIV, PUB, UNGOV, NOGRAPH]);
let user: string | null = "bob";
const view = makeReadFilteredView(set, grantOf, () => user);
const view = makeReadFilteredView(set, caps(), () => user);
expect([...view].map(i => i.id)).toEqual(["p", "n"]);
expect(view.size).toBe(2);
expect([...view].map(i => i.id)).toEqual(["p", "n", "x"]);
expect(view.size).toBe(3);
user = "alice"; // read lazily → view updates without rewrapping
expect([...view].map(i => i.id)).toEqual(["a", "p", "n"]);
expect(view.size).toBe(3);
expect([...view].map(i => i.id)).toEqual(["a", "p", "n", "x"]);
expect(view.size).toBe(4);
});
test("makeReadFilteredView forwards mutations and membership to the target", () => {
const set = new Set<Item>([PUB]);
const view = makeReadFilteredView(set, grantOf, () => "bob");
const C: Item = { id: "c", grant: { read: ["bob"], write: ["bob"] } };
const view = makeReadFilteredView(set, caps(), () => "bob");
const C: Item = { id: "c", "@graph": "did:ng:o:public" };
view.add(C);
expect(set.has(C)).toBe(true); // mutation reached the real set
@@ -43,8 +52,8 @@ test("makeReadFilteredView forwards mutations and membership to the target", ()
});
test("forEach is filtered too", () => {
const set = new Set<Item>([A, PUB]);
const set = new Set<Item>([PRIV, PUB]);
const seen: string[] = [];
makeReadFilteredView(set, grantOf, () => "bob").forEach((i) => seen.push((i as Item).id));
makeReadFilteredView(set, caps(), () => "bob").forEach((i) => seen.push((i as Item).id));
expect(seen).toEqual(["p"]);
});