From 828898a5d18da6b8bb91ea1f2c9aa4c89b0273ac Mon Sep 17 00:00:00 2001 From: Hassan Abdel-Rahman Date: Thu, 8 Oct 2026 09:35:04 -0400 Subject: [PATCH 01/20] Open anonymous access through grant where clauses and per-grant BXL expressions Co-Authored-By: Claude Opus 5.5 --- packages/base/realm-config.gts | 65 -- .../src/bxl/bridge/request-context-native.ts | 21 +- .../bxl/src/bxl/compiler/readable-syntax.ts | 7 +- .../bxl/src/bxl/profiles/function-safety.ts | 6 +- .../bxl/src/jqtools/evaluate/runtimeState.ts | 1 + packages/bxl/src/transform.ts | 1 + .../function-coverage/request-context.ts | 42 +- ...50_schema.sql => 1791466220205_schema.sql} | 11 + ...91466220205_anonymous-grant-rate-limits.js | 45 ++ packages/realm-server/main.ts | 7 +- packages/runtime-common/anonymous-access.ts | 74 +-- .../runtime-common/anonymous-admission.ts | 256 +++++--- .../runtime-common/anonymous-rate-limiter.ts | 32 +- .../card-operations/acting-users.ts | 78 --- .../card-operations/anonymous-request.ts | 147 +++++ .../card-operations/dispatch.ts | 28 +- .../runtime-common/card-operations/explain.ts | 211 ++++--- .../runtime-common/card-operations/gate.ts | 167 ++++-- .../card-operations/grant-expressions.ts | 453 ++++++++++++++ .../runtime-common/card-operations/index.ts | 16 +- .../card-operations/policy-query.ts | 72 ++- .../runtime-common/card-operations/policy.ts | 561 +++++++++++++++--- .../card-operations/telemetry.ts | 32 +- .../card-operations/transforms.ts | 1 + .../runtime-common/card-operations/types.ts | 122 ++-- packages/runtime-common/realm.ts | 162 ++--- 26 files changed, 1927 insertions(+), 691 deletions(-) rename packages/host/config/schema/{1791216526150_schema.sql => 1791466220205_schema.sql} (95%) create mode 100644 packages/postgres/migrations/1791466220205_anonymous-grant-rate-limits.js delete mode 100644 packages/runtime-common/card-operations/acting-users.ts create mode 100644 packages/runtime-common/card-operations/anonymous-request.ts create mode 100644 packages/runtime-common/card-operations/grant-expressions.ts diff --git a/packages/base/realm-config.gts b/packages/base/realm-config.gts index 7ebe3fd91f5..ad7ca97304f 100644 --- a/packages/base/realm-config.gts +++ b/packages/base/realm-config.gts @@ -411,34 +411,6 @@ export class RoutingRuleField extends FieldDef { static edit = RoutingRuleEdit; } -class AnonymousRateLimitAtom extends Component { - -} - -// How many invocations a caller who is not signed in may make against the -// realm per window, counted per caller address. -export class AnonymousRateLimitField extends FieldDef { - static displayName = 'Anonymous Rate Limit'; - - @field requests = contains(NumberField, { - description: - 'Invocations a caller who is not signed in may make against this realm in one window, counted per caller address', - }); - - @field windowSeconds = contains(NumberField, { - description: 'The length of the window, in seconds', - }); - - static atom = AnonymousRateLimitAtom; - static embedded = AnonymousRateLimitAtom; -} - // The JSON spelling of one setting's value, which is what the table shows and // what the editor reads back. A string is shown bare so an id or a path reads // as itself, and quoted wherever reading the bare form back would produce @@ -2001,25 +1973,6 @@ class RealmConfigIsolated extends Component { -
-

Callers who aren't signed in

-

- {{#if @model.anonymousRateLimit.requests}} - Limited to - <@fields.anonymousRateLimit @format='atom' /> - per address. - {{else}} - Limited by the platform's default rate. - {{/if}} -

- {{#if @model.anonymousBlocklist.length}} -
    - {{#each @model.anonymousBlocklist as |entry|}} -
  • {{entry}}
  • - {{/each}} -
- {{/if}} -