@c1m-public/platform-auth 0.11.0 → 0.12.0

package/README.md

@@ -110,7 +110,7 @@ The resolved snapshot from `GET /api/v1/platform/access`.
 | `PLATFORM_PERMISSIONS`, `LEADBROKER_PERMISSIONS`, `WORKSPACE_PERMISSIONS`, `WORKSPACE_ROLES` + key types | Generated from the backend catalog — see the drift guard below. |
 | `parseAccessSnapshot`, `emptySnapshot`, `AccessSnapshot`, `AccessEntry` | Validate and shape the snapshot. |
 | `hasPermission`, `hasAnyPermission`, `hasAllPermissions`, `hasWorkspacePermission`, `isPlatformOwner`, `appScopes`, `permissionsFor` | Scope-aware predicates. |
-| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { saasApp })`. Platform managers are not listed; admit them on `platform.tenants.manage`. |
+| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { dashId })`. Platform managers are not listed; admit them on `platform.tenants.manage`. |
 | `fetchAccessSnapshot` | Framework-neutral fetch. Pass `request` and it forwards client identity for you. |
 | `AccessSnapshotError`, `isAccessSnapshotError` | `unauthenticated` / `forbidden` / `unavailable` / `invalid_snapshot`. |
 

package/dist/access/index.d.ts

@@ -1 +1 @@
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-HL6QFIZy.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, A as AccessSnapshot, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, P as PermissionCheckOptions, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-D-cH_sfe.js';

package/dist/access/index.js

@@ -111,7 +111,7 @@ function isAccessSnapshotError(error, code) {
 }
 
 // src/access/snapshot.ts
-var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
+var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "dash_id", "workspace"]);
 function emptySnapshot(subjectId = "") {
   return {
     subject_id: subjectId,
@@ -144,7 +144,7 @@ function parseAccessSnapshot(input) {
     if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
     const { key, scope_type, scope_id } = raw;
     if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
-    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
+    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|dash_id|workspace");
     if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
     return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
   });
@@ -190,7 +190,7 @@ function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
-    case "saas_app":
+    case "dash_id":
       if (dashId === void 0) return true;
       return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:
@@ -229,7 +229,7 @@ function appScopes(snapshot, key) {
   for (const entry of snapshot.permissions) {
     if (entry.key !== key) continue;
     if (entry.scope_type === "platform") return { all: true, apps: [] };
-    if (entry.scope_type === "saas_app") {
+    if (entry.scope_type === "dash_id") {
       if (entry.scope_id === "*") return { all: true, apps: [] };
       apps.add(entry.scope_id.toLowerCase());
     }

package/dist/access/next.d.ts

@@ -1,5 +1,5 @@
-import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-HL6QFIZy.js';
-export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-HL6QFIZy.js';
+import { A as AccessSnapshot, P as PermissionCheckOptions, R as Resolvable } from '../index-D-cH_sfe.js';
+export { a as AccessEntry, b as AccessErrorCode, c as AccessScopeType, d as AccessSnapshotError, D as DASH_PERMISSIONS, e as DASH_ROLES, f as DEFAULT_ACCESS_ENDPOINT_PATH, g as DashPermissionKey, h as DashRole, F as FetchAccessSnapshotOptions, L as LEADBROKER_PERMISSIONS, i as LeadBrokerPermissionKey, j as PIPELINE_STAGES, k as PLATFORM_PERMISSIONS, l as PermissionKey, m as PipelineStage, n as PlatformPermissionKey, W as WORKSPACE_PERMISSIONS, o as WORKSPACE_ROLES, p as WorkspacePermissionKey, q as WorkspaceRole, r as appScopes, s as dashRole, t as emptySnapshot, u as entryCoversApp, v as fetchAccessSnapshot, w as hasAllPermissions, x as hasAnyPermission, y as hasPermission, z as hasWorkspacePermission, B as isAccessSnapshotError, C as isPipelineStage, E as isPlatformOwner, G as managedDashes, H as parseAccessSnapshot, I as permissionsFor } from '../index-D-cH_sfe.js';
 
 /** Default cache tag for one subject's snapshot: `access:<subjectId>`. */
 declare function accessCacheTag(subjectId: string): string;

package/dist/access/next.js

@@ -93,7 +93,7 @@ function forwardedRequestHeaders2(request, init) {
 }
 
 // src/access/snapshot.ts
-var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "saas_app", "workspace"]);
+var SCOPE_TYPES = /* @__PURE__ */ new Set(["platform", "dash_id", "workspace"]);
 function emptySnapshot(subjectId = "") {
   return {
     subject_id: subjectId,
@@ -126,7 +126,7 @@ function parseAccessSnapshot(input) {
     if (!isRecord(raw)) fail(`permissions[${i}]`, "is not an object");
     const { key, scope_type, scope_id } = raw;
     if (typeof key !== "string" || key === "") fail(`permissions[${i}].key`, "must be a non-empty string");
-    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|saas_app|workspace");
+    if (typeof scope_type !== "string" || !SCOPE_TYPES.has(scope_type)) fail(`permissions[${i}].scope_type`, "must be platform|dash_id|workspace");
     if (scope_id !== void 0 && scope_id !== null && typeof scope_id !== "string") fail(`permissions[${i}].scope_id`, "must be a string");
     return { key, scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
   });
@@ -201,7 +201,7 @@ function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
-    case "saas_app":
+    case "dash_id":
       if (dashId === void 0) return true;
       return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:
@@ -240,7 +240,7 @@ function appScopes(snapshot, key) {
   for (const entry of snapshot.permissions) {
     if (entry.key !== key) continue;
     if (entry.scope_type === "platform") return { all: true, apps: [] };
-    if (entry.scope_type === "saas_app") {
+    if (entry.scope_type === "dash_id") {
       if (entry.scope_id === "*") return { all: true, apps: [] };
       apps.add(entry.scope_id.toLowerCase());
     }

package/dist/access/react.d.ts

@@ -2,12 +2,12 @@ import * as react from 'react';
 import { ReactNode } from 'react';
 
 /** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */
-type AccessScopeType = "platform" | "saas_app" | "workspace";
+type AccessScopeType = "platform" | "dash_id" | "workspace";
 interface AccessEntry {
     /** Permission key, e.g. "platform.users.manage_access". */
     key: string;
     scope_type: AccessScopeType;
-    /** "" for platform scope; saas_app slug or "*" for saas_app scope; workspace id for workspace scope. */
+    /** "" for platform scope; dash id or "*" for dash scope; workspace id for workspace scope. */
     scope_id: string;
 }
 /**
@@ -25,7 +25,7 @@ interface AccessSnapshot {
     platform_role: string;
     permissions: AccessEntry[];
     /**
-     * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
+     * Dash bundle (`dash.owner` / `dash.admin`) per dash id, mirrored from
      * the subject's dash membership. This is the admission list for the dash
      * area: the dashes this subject runs. What they may *do* on one is a normal
      * `hasPermission(snapshot, key, { dashId })` check — platform managers hold
@@ -41,7 +41,7 @@ interface AccessSnapshot {
 interface PermissionCheckOptions {
     /**
      * Dash slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app-scoped entry satisfy the check.
+     * entries and any dash-scoped entry satisfy the check.
      */
     dashId?: string;
 }

package/dist/access/react.js

@@ -8,7 +8,7 @@ function entryCoversApp(entry, dashId) {
   switch (entry.scope_type) {
     case "platform":
       return true;
-    case "saas_app":
+    case "dash_id":
       if (dashId === void 0) return true;
       return entry.scope_id === "*" || entry.scope_id.toLowerCase() === dashId.toLowerCase();
     default:

package/dist/{index-HL6QFIZy.d.ts → index-D-cH_sfe.d.ts}

@@ -39,12 +39,12 @@ declare class AccessSnapshotError extends Error {
 declare function isAccessSnapshotError(error: unknown, code?: AccessErrorCode): error is AccessSnapshotError;
 
 /** Scope a permission entry applies to. Mirrors c1m-server authz.Scope*. */
-type AccessScopeType = "platform" | "saas_app" | "workspace";
+type AccessScopeType = "platform" | "dash_id" | "workspace";
 interface AccessEntry {
     /** Permission key, e.g. "platform.users.manage_access". */
     key: string;
     scope_type: AccessScopeType;
-    /** "" for platform scope; saas_app slug or "*" for saas_app scope; workspace id for workspace scope. */
+    /** "" for platform scope; dash id or "*" for dash scope; workspace id for workspace scope. */
     scope_id: string;
 }
 /**
@@ -62,7 +62,7 @@ interface AccessSnapshot {
     platform_role: string;
     permissions: AccessEntry[];
     /**
-     * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
+     * Dash bundle (`dash.owner` / `dash.admin`) per dash id, mirrored from
      * the subject's dash membership. This is the admission list for the dash
      * area: the dashes this subject runs. What they may *do* on one is a normal
      * `hasPermission(snapshot, key, { dashId })` check — platform managers hold
@@ -81,13 +81,13 @@ declare function parseAccessSnapshot(input: unknown): AccessSnapshot;
 interface PermissionCheckOptions {
     /**
      * Dash slug the check is about. Omit for "anywhere": platform
-     * entries and any saas_app-scoped entry satisfy the check.
+     * entries and any dash-scoped entry satisfy the check.
      */
     dashId?: string;
 }
 /**
  * Mirrors c1m-server authz.entryCoversApp: platform scope covers every app;
- * saas_app scope covers "*" or a case-insensitive slug match; workspace-scoped
+ * Dash scope covers "*" or a case-insensitive dash-id match; workspace-scoped
  * entries never satisfy an app-level check.
  */
 declare function entryCoversApp(entry: AccessEntry, dashId: string | undefined): boolean;
@@ -98,7 +98,7 @@ declare function hasAllPermissions(snapshot: AccessSnapshot, keys: readonly stri
 /**
  * Workspace-staff check. Platform owners always pass (they own every
  * workspace); otherwise the workspace's effective permission list decides.
- * Platform/saas_app entries never confer workspace-staff permissions.
+ * Platform/dash entries never confer workspace-staff permissions.
  */
 declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: string, key: string): boolean;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.11.0",
+  "version": "0.12.0",
   "type": "module",
   "license": "MIT",
   "description": "Session and authorization helpers for C1M platform surfaces. The root is runtime-neutral (Web Request/Response): token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh; ./next adds the server-only guard; ./access carries the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings",