@adonis-agora/agent
Version:
Governed, durable-backed AI agent (chat + tool-calling + governance) for AdonisJS — part of the Agora ecosystem.
41 lines • 1.44 kB
JavaScript
/**
* Two-layer, data-driven table allowlist:
*
* 1. Every table is classified into a group (`tablesByGroup`).
* 2. Every role lists the groups it can read (`roleGroups`).
*
* `canAccess(roles, table)` is then "is the table's group in ANY of the roles'
* group lists?". **Fail-closed:** an unclassified table, unknown roles, or an
* empty role set is denied — a forgotten table never accidentally leaks.
*/
export class GroupTableAccessPolicy {
roleGroups;
tablesByGroup;
constructor(config) {
this.roleGroups = config.roleGroups;
this.tablesByGroup = config.tablesByGroup;
}
canAccess(roles, table) {
const group = this.resolveGroup(table);
if (group === undefined)
return false;
return roles.some((role) => this.roleGroups[role]?.includes(group) ?? false);
}
/** Resolve a table to its group, or `undefined` if unclassified (fail-closed). */
resolveGroup(table) {
for (const [group, patterns] of Object.entries(this.tablesByGroup)) {
for (const pattern of patterns) {
if (matchesPattern(table, pattern))
return group;
}
}
return undefined;
}
}
function matchesPattern(table, pattern) {
if (pattern.endsWith('*')) {
return table.startsWith(pattern.slice(0, -1));
}
return table === pattern;
}
//# sourceMappingURL=table-access.js.map