@b1-road/types 0.1.0-alpha.2 → 0.1.0-alpha.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/iam.cjs.map +1 -1
- package/dist/iam.d.cts +28 -4
- package/dist/iam.d.ts +28 -4
- package/package.json +1 -1
package/README.md
CHANGED
package/dist/iam.cjs.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"sources":["../src/iam.ts"],"sourcesContent":["/**\n * IAM control-plane wire types. These describe the shapes Road's IAM API\n * speaks: scopes, assignments, authorization checks, effective permissions,\n * token exchange, and sessions.\n *\n * They live behind a subpath (`@b1-road/types/iam`) so the React SDK — which\n * never needs the control-plane — doesn't pay for them in its tree-shaken\n * bundle. The Nest SDK imports from here directly.\n */\n\nimport type { RoadPermission } from \"./permissions\";\n\n/** Scope shape. Three flavors today; platforms may register more over time. */\nexport type ScopeType = \"system\" | \"business_unit\" | \"platform\";\n\n
|
|
1
|
+
{"version":3,"sources":["../src/iam.ts"],"sourcesContent":["/**\n * IAM control-plane wire types. These describe the shapes Road's IAM API\n * speaks: scopes, assignments, authorization checks, effective permissions,\n * token exchange, and sessions.\n *\n * They live behind a subpath (`@b1-road/types/iam`) so the React SDK — which\n * never needs the control-plane — doesn't pay for them in its tree-shaken\n * bundle. The Nest SDK imports from here directly.\n */\n\nimport type { RoadPermission } from \"./permissions\";\n\n/** Scope shape. Three flavors today; platforms may register more over time. */\nexport type ScopeType = \"system\" | \"business_unit\" | \"platform\";\n\n/**\n * Subjects the IAM engine can authorize. `service` covers M2M. (`api_key` was a\n * legacy subject the API never accepted — `SUBJECT_TYPES` is `['user','service']`\n * — so it is intentionally absent: the contract must not advertise a value the\n * API rejects.)\n */\nexport type SubjectType = \"user\" | \"service\";\n\nexport interface Scope {\n id: string;\n type: ScopeType;\n externalId: string | null;\n parentScopeId: string | null;\n parentScope?: {\n id: string;\n type: ScopeType;\n externalId: string | null;\n } | null;\n metadata: Record<string, unknown>;\n createdAt: string;\n updatedAt?: string;\n}\n\nexport interface CreateScopeInput {\n type: ScopeType;\n externalId?: string | null;\n parentScopeId?: string | null;\n metadata?: Record<string, unknown>;\n}\n\nexport interface Assignment {\n id: string;\n subjectType: SubjectType;\n subjectId: string;\n roleId: string;\n scopeId: string;\n grantedBy: string;\n grantedAt: string;\n expiresAt: string | null;\n /**\n * Hydrated convenience field the **list** endpoint\n * (`GET /subjects/:type/:id/assignments`) includes so a client can show the\n * role name without a follow-up lookup. Omitted by endpoints that return a\n * bare assignment (e.g. `assignments.create`), hence optional.\n */\n roleName?: string;\n}\n\nexport interface CreateAssignmentInput {\n subjectType: SubjectType;\n subjectId: string;\n roleId: string;\n scopeId: string;\n expiresAt?: string | null;\n}\n\nexport interface AuthorizeInput {\n subjectType: SubjectType;\n /**\n * The IAM subject to authorize — a **Road user id** (the profile UUID), a\n * service id, or an api-key id.\n *\n * Optional: **when omitted, the API authorizes the authenticated caller**\n * derived from the access token. Cookie-mode SDKs (`@b1-road/nestjs`) rely on\n * this — they carry the caller's token, not their Road user id, so they omit\n * `subjectId` rather than passing the Auth Server `sub` (which IAM does not\n * key subjects by). Server-to-server callers that authorize *another* subject\n * pass its Road user/service id explicitly.\n */\n subjectId?: string;\n scopeId: string;\n /** Either a single permission string (`\"read:Member\"`) or the wildcard. */\n permission: RoadPermission | (string & {});\n}\n\nexport interface AuthorizeResult {\n allowed: boolean;\n reason: string;\n}\n\nexport interface AuthorizeBatchInput {\n subjectType: SubjectType;\n /** Optional — same semantics as {@link AuthorizeInput.subjectId} (omitted = the authenticated caller). */\n subjectId?: string;\n scopeId: string;\n permissions: Array<RoadPermission | (string & {})>;\n}\n\nexport interface AuthorizeBatchResult {\n results: Array<{ permission: string; allowed: boolean }>;\n}\n\nexport interface EffectivePermissionsResult {\n /** Expanded permissions; `manage:X` has been expanded into the CRUD set. */\n permissions: string[];\n}\n\nexport interface Session {\n id: string;\n deviceName: string;\n ipAddress: string | null;\n userAgent?: string;\n provider: string;\n lastUsedAt: string;\n createdAt: string;\n current: boolean;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
|
package/dist/iam.d.cts
CHANGED
|
@@ -12,8 +12,13 @@ import { e as RoadPermission } from './permissions-BSbomCrB.cjs';
|
|
|
12
12
|
|
|
13
13
|
/** Scope shape. Three flavors today; platforms may register more over time. */
|
|
14
14
|
type ScopeType = "system" | "business_unit" | "platform";
|
|
15
|
-
/**
|
|
16
|
-
|
|
15
|
+
/**
|
|
16
|
+
* Subjects the IAM engine can authorize. `service` covers M2M. (`api_key` was a
|
|
17
|
+
* legacy subject the API never accepted — `SUBJECT_TYPES` is `['user','service']`
|
|
18
|
+
* — so it is intentionally absent: the contract must not advertise a value the
|
|
19
|
+
* API rejects.)
|
|
20
|
+
*/
|
|
21
|
+
type SubjectType = "user" | "service";
|
|
17
22
|
interface Scope {
|
|
18
23
|
id: string;
|
|
19
24
|
type: ScopeType;
|
|
@@ -43,6 +48,13 @@ interface Assignment {
|
|
|
43
48
|
grantedBy: string;
|
|
44
49
|
grantedAt: string;
|
|
45
50
|
expiresAt: string | null;
|
|
51
|
+
/**
|
|
52
|
+
* Hydrated convenience field the **list** endpoint
|
|
53
|
+
* (`GET /subjects/:type/:id/assignments`) includes so a client can show the
|
|
54
|
+
* role name without a follow-up lookup. Omitted by endpoints that return a
|
|
55
|
+
* bare assignment (e.g. `assignments.create`), hence optional.
|
|
56
|
+
*/
|
|
57
|
+
roleName?: string;
|
|
46
58
|
}
|
|
47
59
|
interface CreateAssignmentInput {
|
|
48
60
|
subjectType: SubjectType;
|
|
@@ -53,7 +65,18 @@ interface CreateAssignmentInput {
|
|
|
53
65
|
}
|
|
54
66
|
interface AuthorizeInput {
|
|
55
67
|
subjectType: SubjectType;
|
|
56
|
-
|
|
68
|
+
/**
|
|
69
|
+
* The IAM subject to authorize — a **Road user id** (the profile UUID), a
|
|
70
|
+
* service id, or an api-key id.
|
|
71
|
+
*
|
|
72
|
+
* Optional: **when omitted, the API authorizes the authenticated caller**
|
|
73
|
+
* derived from the access token. Cookie-mode SDKs (`@b1-road/nestjs`) rely on
|
|
74
|
+
* this — they carry the caller's token, not their Road user id, so they omit
|
|
75
|
+
* `subjectId` rather than passing the Auth Server `sub` (which IAM does not
|
|
76
|
+
* key subjects by). Server-to-server callers that authorize *another* subject
|
|
77
|
+
* pass its Road user/service id explicitly.
|
|
78
|
+
*/
|
|
79
|
+
subjectId?: string;
|
|
57
80
|
scopeId: string;
|
|
58
81
|
/** Either a single permission string (`"read:Member"`) or the wildcard. */
|
|
59
82
|
permission: RoadPermission | (string & {});
|
|
@@ -64,7 +87,8 @@ interface AuthorizeResult {
|
|
|
64
87
|
}
|
|
65
88
|
interface AuthorizeBatchInput {
|
|
66
89
|
subjectType: SubjectType;
|
|
67
|
-
subjectId
|
|
90
|
+
/** Optional — same semantics as {@link AuthorizeInput.subjectId} (omitted = the authenticated caller). */
|
|
91
|
+
subjectId?: string;
|
|
68
92
|
scopeId: string;
|
|
69
93
|
permissions: Array<RoadPermission | (string & {})>;
|
|
70
94
|
}
|
package/dist/iam.d.ts
CHANGED
|
@@ -12,8 +12,13 @@ import { e as RoadPermission } from './permissions-BSbomCrB.js';
|
|
|
12
12
|
|
|
13
13
|
/** Scope shape. Three flavors today; platforms may register more over time. */
|
|
14
14
|
type ScopeType = "system" | "business_unit" | "platform";
|
|
15
|
-
/**
|
|
16
|
-
|
|
15
|
+
/**
|
|
16
|
+
* Subjects the IAM engine can authorize. `service` covers M2M. (`api_key` was a
|
|
17
|
+
* legacy subject the API never accepted — `SUBJECT_TYPES` is `['user','service']`
|
|
18
|
+
* — so it is intentionally absent: the contract must not advertise a value the
|
|
19
|
+
* API rejects.)
|
|
20
|
+
*/
|
|
21
|
+
type SubjectType = "user" | "service";
|
|
17
22
|
interface Scope {
|
|
18
23
|
id: string;
|
|
19
24
|
type: ScopeType;
|
|
@@ -43,6 +48,13 @@ interface Assignment {
|
|
|
43
48
|
grantedBy: string;
|
|
44
49
|
grantedAt: string;
|
|
45
50
|
expiresAt: string | null;
|
|
51
|
+
/**
|
|
52
|
+
* Hydrated convenience field the **list** endpoint
|
|
53
|
+
* (`GET /subjects/:type/:id/assignments`) includes so a client can show the
|
|
54
|
+
* role name without a follow-up lookup. Omitted by endpoints that return a
|
|
55
|
+
* bare assignment (e.g. `assignments.create`), hence optional.
|
|
56
|
+
*/
|
|
57
|
+
roleName?: string;
|
|
46
58
|
}
|
|
47
59
|
interface CreateAssignmentInput {
|
|
48
60
|
subjectType: SubjectType;
|
|
@@ -53,7 +65,18 @@ interface CreateAssignmentInput {
|
|
|
53
65
|
}
|
|
54
66
|
interface AuthorizeInput {
|
|
55
67
|
subjectType: SubjectType;
|
|
56
|
-
|
|
68
|
+
/**
|
|
69
|
+
* The IAM subject to authorize — a **Road user id** (the profile UUID), a
|
|
70
|
+
* service id, or an api-key id.
|
|
71
|
+
*
|
|
72
|
+
* Optional: **when omitted, the API authorizes the authenticated caller**
|
|
73
|
+
* derived from the access token. Cookie-mode SDKs (`@b1-road/nestjs`) rely on
|
|
74
|
+
* this — they carry the caller's token, not their Road user id, so they omit
|
|
75
|
+
* `subjectId` rather than passing the Auth Server `sub` (which IAM does not
|
|
76
|
+
* key subjects by). Server-to-server callers that authorize *another* subject
|
|
77
|
+
* pass its Road user/service id explicitly.
|
|
78
|
+
*/
|
|
79
|
+
subjectId?: string;
|
|
57
80
|
scopeId: string;
|
|
58
81
|
/** Either a single permission string (`"read:Member"`) or the wildcard. */
|
|
59
82
|
permission: RoadPermission | (string & {});
|
|
@@ -64,7 +87,8 @@ interface AuthorizeResult {
|
|
|
64
87
|
}
|
|
65
88
|
interface AuthorizeBatchInput {
|
|
66
89
|
subjectType: SubjectType;
|
|
67
|
-
subjectId
|
|
90
|
+
/** Optional — same semantics as {@link AuthorizeInput.subjectId} (omitted = the authenticated caller). */
|
|
91
|
+
subjectId?: string;
|
|
68
92
|
scopeId: string;
|
|
69
93
|
permissions: Array<RoadPermission | (string & {})>;
|
|
70
94
|
}
|
package/package.json
CHANGED