@astram/identity 0.20.0 → 0.22.0

package/migrations/1710000000109-CreatePermissionAnnouncementDismissal.cjs

@@ -0,0 +1,46 @@
+/**
+ * Framework identity migration — "Reviewed, not needed" dismissals of permission-announcement admin
+ * tasks (G-027 step 4, NAES G-034 R3; spec `docs/features/permission-announcements/SPEC.md` §4A).
+ *
+ * `<identity>.permission_announcement_dismissal` — one row per company and permission key that an
+ * administrator closed on purpose. Open tasks are never stored: identity computes them on read from
+ * the catalog (`<authz>.permission`) and the company's roles, so a grant closes a task with no job.
+ * Written and read only by identity's `PermissionAnnouncementService`.
+ *   - pad_company_uuid: the company the task belongs to (server-authorized, never trusted input).
+ *   - pad_perm_key: the permission key (same width as `role_permission.rp_perm_key`).
+ *   - pad_activated_at: the key's `perm_last_activated_at` when dismissed; a later re-activation
+ *     (key removed, then re-added by a release) no longer matches, so the task opens again.
+ *   - pad_dismissed_by / pad_dismissed_at: the actor and time (the audit row is the record).
+ * No foreign keys (companies live in the app database, keys in authz): a row left by a deleted
+ * company or an orphaned key is ignored by the read.
+ *
+ * Idempotent (CREATE TABLE IF NOT EXISTS); `down` drops the table with IF EXISTS. No rows are
+ * written, no ids are hard-coded. Database names come from `ctx.schemas` (namespace or single
+ * layout, ADR-0037/ADR-0041); the table is listed in core `FRAMEWORK_TABLES`.
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+async function up(ctx) {
+  const { query } = ctx;
+  const { identity: IDENTITY } = frameworkSchemasForMigration(ctx, process.env);
+
+  await query(
+    `CREATE TABLE IF NOT EXISTS \`${IDENTITY}\`.\`permission_announcement_dismissal\` (
+      pad_company_uuid CHAR(36)     NOT NULL,
+      pad_perm_key     VARCHAR(191) NOT NULL,
+      pad_activated_at TIMESTAMP(3) NOT NULL,
+      pad_dismissed_by CHAR(36)     NOT NULL,
+      pad_dismissed_at TIMESTAMP(3) NOT NULL,
+      PRIMARY KEY (pad_company_uuid, pad_perm_key)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  );
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const { identity: IDENTITY } = frameworkSchemasForMigration(ctx, process.env);
+  await query(`DROP TABLE IF EXISTS \`${IDENTITY}\`.\`permission_announcement_dismissal\``);
+}
+
+module.exports = { up, down };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/identity",
-  "version": "0.20.0",
+  "version": "0.22.0",
   "license": "MIT",
   "description": "Astram framework — the framework-owned identity + tenancy model. Hosts the identity @ObjectType classes (user, company, membership, posting), framework-authored identity migrations, and the identity resolver. Top of the dependency graph: depends on @astram/engine (for @ObjectType/@Field decorators) + @astram/guard / @astram/core (for the auth ports).",
   "type": "commonjs",
@@ -36,9 +36,9 @@
   },
   "dependencies": {
     "mariadb": "^3.5.4",
-    "@astram/core": "1.13.0",
-    "@astram/guard": "0.24.0",
-    "@astram/engine": "0.16.1"
+    "@astram/core": "1.14.0",
+    "@astram/engine": "0.16.2",
+    "@astram/guard": "0.25.1"
   },
   "peerDependencies": {
     "@nestjs/common": "^11",