@awsmbiz/inbis-access-control 0.0.0-stage → 0.1.0

package/migrations/0001_access_control_initial.sql

@@ -0,0 +1,52 @@
+-- @inbis/access-control 0001_access_control_initial
+-- Roles and permissions (plan Q40-Q42). Timestamps are
+-- epoch milliseconds. Applied after @inbis/auth: user_role references `user`,
+-- so deleting a user (any path) removes its role assignments.
+
+-- The permission catalogue, seeded from the app's code (defineAccessControl).
+CREATE TABLE `permission` (
+	`name` text PRIMARY KEY NOT NULL,
+	`description` text NOT NULL
+);
+
+-- System roles (seeded from code, immutable through the API) and custom roles (created by admins).
+CREATE TABLE `role` (
+	`id` text PRIMARY KEY NOT NULL,
+	`name` text NOT NULL,
+	`description` text,
+	`system` integer DEFAULT 0 NOT NULL,
+	`created_at` integer NOT NULL,
+	`updated_at` integer NOT NULL
+);
+CREATE UNIQUE INDEX `role_name_idx` ON `role` (`name`);
+
+CREATE TABLE `role_permission` (
+	`role_id` text NOT NULL REFERENCES `role`(`id`) ON DELETE CASCADE,
+	`permission` text NOT NULL REFERENCES `permission`(`name`) ON DELETE CASCADE,
+	PRIMARY KEY (`role_id`, `permission`)
+);
+CREATE INDEX `role_permission_permission_idx` ON `role_permission` (`permission`);
+
+-- Explicit inheritance only: `role_id` includes every permission of `inherits_role_id`.
+CREATE TABLE `role_inheritance` (
+	`role_id` text NOT NULL REFERENCES `role`(`id`) ON DELETE CASCADE,
+	`inherits_role_id` text NOT NULL REFERENCES `role`(`id`) ON DELETE CASCADE,
+	PRIMARY KEY (`role_id`, `inherits_role_id`)
+);
+
+-- Many roles per user.
+CREATE TABLE `user_role` (
+	`user_id` text NOT NULL REFERENCES `user`(`id`) ON DELETE CASCADE,
+	`role_id` text NOT NULL REFERENCES `role`(`id`) ON DELETE CASCADE,
+	`assigned_at` integer NOT NULL,
+	`assigned_by` text,
+	PRIMARY KEY (`user_id`, `role_id`)
+);
+CREATE INDEX `user_role_role_id_idx` ON `user_role` (`role_id`);
+
+-- Fingerprint of the last seeded catalogue: seeding skips its writes when unchanged.
+CREATE TABLE `access_control_seed` (
+	`id` integer PRIMARY KEY NOT NULL CHECK (`id` = 1),
+	`fingerprint` text NOT NULL,
+	`seeded_at` integer NOT NULL
+);

package/migrations/migrations.lock.json

@@ -0,0 +1,3 @@
+{
+  "0001_access_control_initial.sql": "sha256:f24813c304b02d09d726dbed3145e8d13bd426d47a1d46280aaf2ccd34b9119a"
+}

package/package.json

@@ -1,6 +1,69 @@
 {
   "name": "@awsmbiz/inbis-access-control",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Access control for Inbis applications: a typed permission catalogue declared in code, roles in D1, authorize() and requirePermission(), and package-owned D1 migrations.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/awsmbiz/inbis-platform.git",
+    "directory": "packages/access-control"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "dist",
+    "migrations"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./hono": {
+      "types": "./dist/hono.d.ts",
+      "default": "./dist/hono.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@awsmbiz/inbis-core": "0.1.0",
+    "@awsmbiz/inbis-db": "0.1.0"
+  },
+  "peerDependencies": {
+    "drizzle-orm": "^0.45.4",
+    "hono": "^4.13.14"
+  },
+  "peerDependenciesMeta": {
+    "hono": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "0.18.5",
+    "@cloudflare/vitest-plugin": "1.4.11",
+    "@cloudflare/workers-types": "5.20261030.1",
+    "@awsmbiz/inbis-auth": "0.1.0",
+    "@awsmbiz/inbis-eslint-config": "0.1.0",
+    "@awsmbiz/inbis-tsconfig": "0.1.0",
+    "drizzle-orm": "0.45.4",
+    "eslint": "10.14.0",
+    "hono": "4.13.14",
+    "publint": "0.3.25",
+    "tsdown": "0.23.4",
+    "typescript": "6.0.3",
+    "vitest": "5.0.5",
+    "wrangler": "4.156.0"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "typecheck": "tsc",
+    "lint": "eslint . --max-warnings 0",
+    "test": "vitest run",
+    "check:exports": "publint --strict && attw --pack . --profile esm-only",
+    "check:migrations": "inbis-db check-lock migrations --base \"${MIGRATIONS_BASE_REF:-origin/main}\""
+  }
 }