@c1m-public/platform-auth 0.4.0 → 0.5.0

package/README.md

@@ -32,7 +32,7 @@ sessions never needs them.
 | `createSessionRefresher` | Coalesced refresh-token exchange: one backend call per token per window. |
 | `evaluateSessionGate`, `hasSessionShape` | Pure proxy decision — `pass` / `redirect_home` / `anonymous_public` / `unauthorized_api` / `redirect_login`. The proxy owns response construction. |
 | `createHandoffTarget`, `createHandoffSource`, `brokerPaths`, `sourceStartPath` | Browser halves of the first-party session handoff (`/api/v1/platform/auth/handoffs/{app}`): PKCE S256 + state, one-time code, host-local cookies, no tokens in URLs. |
-| `HANDOFF_ERROR_MESSAGES`, `handoffErrorMessage`, `isHandoffErrorCode` | One error vocabulary shared by backend and BFF codes. |
+| `HANDOFF_ERROR_MESSAGES`, `SSO_ERROR_MESSAGES`, `AUTH_ERROR_MESSAGES`, `authErrorMessage(code, overrides?)`, `isAuthErrorCode`, `handoffErrorMessage`, `isHandoffErrorCode` | One sign-in error vocabulary — handoff, admission and SSO codes. Surfaces pass their own copy as `overrides` instead of forking the map. |
 
 ```ts
 // proxy.ts
@@ -65,6 +65,7 @@ The resolved snapshot from `GET /api/v1/platform/access`.
 | `PLATFORM_PERMISSIONS`, `LEADBROKER_PERMISSIONS`, `WORKSPACE_PERMISSIONS`, `WORKSPACE_ROLES` + key types | Generated from the backend catalog — see the drift guard below. |
 | `parseAccessSnapshot`, `emptySnapshot`, `AccessSnapshot`, `AccessEntry` | Validate and shape the snapshot. |
 | `hasPermission`, `hasAnyPermission`, `hasAllPermissions`, `hasWorkspacePermission`, `isPlatformOwner`, `appScopes`, `permissionsFor` | Scope-aware predicates. |
+| `managedDashes`, `dashRole` | The dashes a subject runs, from the mirrored `dash.owner` / `dash.admin` bundle grants (`snapshot.dash_roles`). Admission only — gate an action with `hasPermission(snapshot, "dash.publish", { saasApp })`. Platform managers are not listed; admit them on `platform.tenants.manage`. |
 | `fetchAccessSnapshot` | Framework-neutral fetch. Pass `request` and it forwards client identity for you. |
 | `AccessSnapshotError`, `isAccessSnapshotError` | `unauthenticated` / `forbidden` / `unavailable` / `invalid_snapshot`. |
 

package/dist/access/generated/keys.d.ts

@@ -1,6 +1,12 @@
 /** Platform-operator permission keys. */
 export declare const PLATFORM_PERMISSIONS: readonly ["platform.admin.view", "platform.audit.view", "platform.auth.manage", "platform.billing.manage", "platform.channels.manage", "platform.channels.view", "platform.config.manage", "platform.docs.manage", "platform.docs.view", "platform.observability.manage", "platform.observability.view", "platform.ops.manage", "platform.support.impersonate", "platform.support.sessions", "platform.tenants.archive", "platform.tenants.manage", "platform.tenants.restore", "platform.users.deactivate", "platform.users.delete", "platform.users.invite", "platform.users.manage_access", "platform.users.reactivate", "platform.users.view"];
 export type PlatformPermissionKey = (typeof PLATFORM_PERMISSIONS)[number];
+/** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
+export declare const DASH_PERMISSIONS: readonly ["dash.apps.manage", "dash.billing.manage", "dash.channels.manage", "dash.customers.manage", "dash.domains.manage", "dash.members.manage", "dash.ownership.transfer", "dash.plans.manage", "dash.publish", "dash.settings.manage", "dash.workspaces.admin", "dash.workspaces.manage"];
+export type DashPermissionKey = (typeof DASH_PERMISSIONS)[number];
+/** Membership-mirrored dash role bundles (grant keys at dash scope). */
+export declare const DASH_ROLES: readonly ["dash.admin", "dash.owner"];
+export type DashRole = (typeof DASH_ROLES)[number];
 /** Lead-broker workload permission keys. */
 export declare const LEADBROKER_PERMISSIONS: readonly ["leadbroker.finance.manage", "leadbroker.leads.dispatch", "leadbroker.leads.review", "leadbroker.leads.view", "leadbroker.policy.manage"];
 export type LeadBrokerPermissionKey = (typeof LEADBROKER_PERMISSIONS)[number];
@@ -11,4 +17,4 @@ export type WorkspacePermissionKey = (typeof WORKSPACE_PERMISSIONS)[number];
 export declare const WORKSPACE_ROLES: readonly ["workspace.editor", "workspace.frontdesk", "workspace.manager"];
 export type WorkspaceRole = (typeof WORKSPACE_ROLES)[number];
 /** Every permission key the backend can grant, across all scopes. */
-export type PermissionKey = PlatformPermissionKey | LeadBrokerPermissionKey | WorkspacePermissionKey;
+export type PermissionKey = PlatformPermissionKey | DashPermissionKey | LeadBrokerPermissionKey | WorkspacePermissionKey;

package/dist/access/generated/keys.js

@@ -26,6 +26,26 @@ export const PLATFORM_PERMISSIONS = [
     "platform.users.reactivate",
     "platform.users.view",
 ];
+/** Dash-owner permission keys (granted at dash scope, mirrored from the membership role). */
+export const DASH_PERMISSIONS = [
+    "dash.apps.manage",
+    "dash.billing.manage",
+    "dash.channels.manage",
+    "dash.customers.manage",
+    "dash.domains.manage",
+    "dash.members.manage",
+    "dash.ownership.transfer",
+    "dash.plans.manage",
+    "dash.publish",
+    "dash.settings.manage",
+    "dash.workspaces.admin",
+    "dash.workspaces.manage",
+];
+/** Membership-mirrored dash role bundles (grant keys at dash scope). */
+export const DASH_ROLES = [
+    "dash.admin",
+    "dash.owner",
+];
 /** Lead-broker workload permission keys. */
 export const LEADBROKER_PERMISSIONS = [
     "leadbroker.finance.manage",

package/dist/access/predicates.d.ts

@@ -22,6 +22,18 @@ export declare function hasAllPermissions(snapshot: AccessSnapshot, keys: readon
  * Platform/saas_app entries never confer workspace-staff permissions.
  */
 export declare function hasWorkspacePermission(snapshot: AccessSnapshot, workspaceId: string, key: string): boolean;
+/**
+ * The dashes this subject runs, from the mirrored dash bundle grants — the
+ * admission list for the Admin Center's dash area. Platform managers are not
+ * listed: their reach is platform-wide, so admit them with
+ * `hasPermission(snapshot, "platform.tenants.manage")` instead.
+ */
+export declare function managedDashes(snapshot: AccessSnapshot): Array<{
+    saasApp: string;
+    role: string;
+}>;
+/** The dash bundle held on one dash, or "" when the subject holds none there. */
+export declare function dashRole(snapshot: AccessSnapshot, saasApp: string): string;
 export declare function isPlatformOwner(snapshot: AccessSnapshot): boolean;
 /**
  * The saas_app scopes under which `key` is held. Returns `{ all: true }` when a

package/dist/access/predicates.js

@@ -39,6 +39,25 @@ export function hasWorkspacePermission(snapshot, workspaceId, key) {
         return true;
     return (snapshot.workspace_permissions[workspaceId] ?? []).includes(key);
 }
+/**
+ * The dashes this subject runs, from the mirrored dash bundle grants — the
+ * admission list for the Admin Center's dash area. Platform managers are not
+ * listed: their reach is platform-wide, so admit them with
+ * `hasPermission(snapshot, "platform.tenants.manage")` instead.
+ */
+export function managedDashes(snapshot) {
+    if (!snapshot.active)
+        return [];
+    return Object.entries(snapshot.dash_roles)
+        .map(([saasApp, role]) => ({ saasApp, role }))
+        .sort((a, b) => a.saasApp.localeCompare(b.saasApp));
+}
+/** The dash bundle held on one dash, or "" when the subject holds none there. */
+export function dashRole(snapshot, saasApp) {
+    if (!snapshot.active)
+        return "";
+    return snapshot.dash_roles[saasApp] ?? "";
+}
 export function isPlatformOwner(snapshot) {
     return snapshot.active && snapshot.is_owner;
 }

package/dist/access/snapshot.d.ts

@@ -21,6 +21,14 @@ export interface AccessSnapshot {
     /** Platform operator base role (derived; display only — never authorize on it). */
     platform_role: string;
     permissions: AccessEntry[];
+    /**
+     * Dash bundle (`dash.owner` / `dash.admin`) per saas_app id, mirrored from
+     * the subject's dash membership. This is the admission list for the dash
+     * area: the dashes this subject runs. What they may *do* on one is a normal
+     * `hasPermission(snapshot, key, { saasApp })` check — platform managers hold
+     * their authority platform-wide and so appear here not at all.
+     */
+    dash_roles: Record<string, string>;
     /** Effective workspace-staff permission keys per workspace id. */
     workspace_permissions: Record<string, string[]>;
     /** Workspace-staff role bundle per workspace id (display only). */

package/dist/access/snapshot.js

@@ -8,6 +8,7 @@ export function emptySnapshot(subjectId = "") {
         active: false,
         platform_role: "",
         permissions: [],
+        dash_roles: {},
         workspace_permissions: {},
         workspace_roles: {},
     };
@@ -22,7 +23,7 @@ function fail(field, why) {
 export function parseAccessSnapshot(input) {
     if (!isRecord(input))
         fail("payload", "is not an object");
-    const { subject_id, access_version, is_owner, active, platform_role, permissions, workspace_permissions, workspace_roles } = input;
+    const { subject_id, access_version, is_owner, active, platform_role, permissions, dash_roles, workspace_permissions, workspace_roles } = input;
     if (typeof subject_id !== "string" || subject_id === "")
         fail("subject_id", "must be a non-empty string");
     if (typeof access_version !== "number" || !Number.isInteger(access_version) || access_version < 0)
@@ -47,6 +48,16 @@ export function parseAccessSnapshot(input) {
             fail(`permissions[${i}].scope_id`, "must be a string");
         return { key, scope_type: scope_type, scope_id: typeof scope_id === "string" ? scope_id : "" };
     });
+    const dashRoles = {};
+    if (dash_roles !== undefined && dash_roles !== null) {
+        if (!isRecord(dash_roles))
+            fail("dash_roles", "must be an object");
+        for (const [dash, role] of Object.entries(dash_roles)) {
+            if (typeof role !== "string")
+                fail(`dash_roles[${dash}]`, "must be a string");
+            dashRoles[dash] = role;
+        }
+    }
     const wsPerms = {};
     if (workspace_permissions !== undefined && workspace_permissions !== null) {
         if (!isRecord(workspace_permissions))
@@ -74,6 +85,7 @@ export function parseAccessSnapshot(input) {
         active,
         platform_role: typeof platform_role === "string" ? platform_role : "",
         permissions: entries,
+        dash_roles: dashRoles,
         workspace_permissions: wsPerms,
         workspace_roles: wsRoles,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c1m-public/platform-auth",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "type": "module",
   "license": "MIT",
   "description": "Server-side session and authorization helpers for C1M platform surfaces: token/session reads, the first-party handoff (PKCE target + source), proxy session gate and coalesced refresh, plus the resolved access snapshot, typed permission keys, predicates, a Next loader and React bindings under ./access",
@@ -43,14 +43,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
-    "build": "pnpm clean && tsc -p tsconfig.build.json",
-    "lint": "tsc -p tsconfig.json --noEmit",
-    "test": "vitest",
-    "test:run": "vitest run",
-    "type-check": "tsc -p tsconfig.json --noEmit"
-  },
   "dependencies": {
     "server-only": "0.0.1"
   },
@@ -74,5 +66,13 @@
     "react": {
       "optional": true
     }
+  },
+  "scripts": {
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "pnpm clean && tsc -p tsconfig.build.json",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest",
+    "test:run": "vitest run",
+    "type-check": "tsc -p tsconfig.json --noEmit"
   }
-}
+}