| … | … | @@ -0,0 +1,71 @@ |
| 1 | # trust-map |
| 2 | |
| 3 | A pubkey → permissions store, with optional [hyperident](../hyperident) chain verification. |
| 4 | |
| 5 | Answers one question — *may this key do this thing to this resource?* — and answers it either |
| 6 | directly or by walking a device-attestation chain back to an identity root. |
| 7 | |
| 8 | ## Install |
| 9 | |
| 10 | ```sh |
| 11 | npm install trust-map |
| 12 | ``` |
| 13 | |
| 14 | ## Usage |
| 15 | |
| 16 | ```js |
| 17 | import { TrustMap } from 'trust-map' |
| 18 | |
| 19 | const trust = new TrustMap('./storage') |
| 20 | await trust.ready() |
| 21 | |
| 22 | await trust.grant(pubkey, 'repo:myrepo', ['read', 'write']) |
| 23 | await trust.check(pubkey, 'repo:myrepo', 'write') // true |
| 24 | await trust.revoke(pubkey, 'repo:myrepo', ['write']) |
| 25 | await trust.check(pubkey, 'repo:myrepo', 'write') // false |
| 26 | |
| 27 | await trust.close() |
| 28 | ``` |
| 29 | |
| 30 | ## API |
| 31 | |
| 32 | #### `new TrustMap(storage, [options])` |
| 33 | |
| 34 | Backed by a Corestore. **RocksDB holds a single-writer lock**, so two processes cannot open the |
| 35 | same storage path at once — embed this in one daemon and have clients talk to that, rather than |
| 36 | opening it from several places. |
| 37 | |
| 38 | #### `await trust.grant(pubkey, resource, perms)` |
| 39 | #### `await trust.revoke(pubkey, resource, [perms])` |
| 40 | |
| 41 | Revoking with no `perms` removes every permission on that resource. |
| 42 | |
| 43 | #### `await trust.check(pubkey, resource, perm) -> bool` |
| 44 | |
| 45 | Direct check: is this exact pubkey granted this permission? |
| 46 | |
| 47 | #### `await trust.checkChain(pubkey, resource, perm) -> bool` |
| 48 | |
| 49 | The same question, but walks a hyperident device-attestation chain — so a grant to an identity |
| 50 | root answers for every device that root has attested, without granting each device separately. |
| 51 | |
| 52 | #### `await trust.list()` |
| 53 | #### `await trust.listForPubkey(pubkey)` |
| 54 | |
| 55 | ## Examples |
| 56 | |
| 57 | - `examples/cli.js` — grant / revoke / check from a terminal |
| 58 | - `examples/web.js` — the same over HTTP |
| 59 | |
| 60 | ⚠ They use **different** storage paths by default (`.trust-map-cli/` and `.trust-map-web/`) and |
| 61 | do not share state, for the single-writer reason above. |
| 62 | |
| 63 | ## Test |
| 64 | |
| 65 | ```sh |
| 66 | npm test # 11/11 |
| 67 | ``` |
| 68 | |
| 69 | ## License |
| 70 | |
| 71 | Not yet declared. |