@checkstack/auth-common 0.0.3 → 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +147 -0
- package/package.json +1 -1
- package/src/access.ts +91 -0
- package/src/index.ts +1 -1
- package/src/rpc-contract.ts +260 -41
- package/src/permissions.ts +0 -50
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,152 @@
|
|
|
1
1
|
# @checkstack/auth-common
|
|
2
2
|
|
|
3
|
+
## 0.2.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- 9faec1f: # Unified AccessRule Terminology Refactoring
|
|
8
|
+
|
|
9
|
+
This release completes a comprehensive terminology refactoring from "permission" to "accessRule" across the entire codebase, establishing a consistent and modern access control vocabulary.
|
|
10
|
+
|
|
11
|
+
## Changes
|
|
12
|
+
|
|
13
|
+
### Core Infrastructure (`@checkstack/common`)
|
|
14
|
+
|
|
15
|
+
- Introduced `AccessRule` interface as the primary access control type
|
|
16
|
+
- Added `accessPair()` helper for creating read/manage access rule pairs
|
|
17
|
+
- Added `access()` builder for individual access rules
|
|
18
|
+
- Replaced `Permission` type with `AccessRule` throughout
|
|
19
|
+
|
|
20
|
+
### API Changes
|
|
21
|
+
|
|
22
|
+
- `env.registerPermissions()` → `env.registerAccessRules()`
|
|
23
|
+
- `meta.permissions` → `meta.access` in RPC contracts
|
|
24
|
+
- `usePermission()` → `useAccess()` in frontend hooks
|
|
25
|
+
- Route `permission:` field → `accessRule:` field
|
|
26
|
+
|
|
27
|
+
### UI Changes
|
|
28
|
+
|
|
29
|
+
- "Roles & Permissions" tab → "Roles & Access Rules"
|
|
30
|
+
- "You don't have permission..." → "You don't have access..."
|
|
31
|
+
- All permission-related UI text updated
|
|
32
|
+
|
|
33
|
+
### Documentation & Templates
|
|
34
|
+
|
|
35
|
+
- Updated 18 documentation files with AccessRule terminology
|
|
36
|
+
- Updated 7 scaffolding templates with `accessPair()` pattern
|
|
37
|
+
- All code examples use new AccessRule API
|
|
38
|
+
|
|
39
|
+
## Migration Guide
|
|
40
|
+
|
|
41
|
+
### Backend Plugins
|
|
42
|
+
|
|
43
|
+
```diff
|
|
44
|
+
- import { permissionList } from "./permissions";
|
|
45
|
+
- env.registerPermissions(permissionList);
|
|
46
|
+
+ import { accessRules } from "./access";
|
|
47
|
+
+ env.registerAccessRules(accessRules);
|
|
48
|
+
```
|
|
49
|
+
|
|
50
|
+
### RPC Contracts
|
|
51
|
+
|
|
52
|
+
```diff
|
|
53
|
+
- .meta({ userType: "user", permissions: [permissions.read.id] })
|
|
54
|
+
+ .meta({ userType: "user", access: [access.read] })
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
### Frontend Hooks
|
|
58
|
+
|
|
59
|
+
```diff
|
|
60
|
+
- const canRead = accessApi.usePermission(permissions.read.id);
|
|
61
|
+
+ const canRead = accessApi.useAccess(access.read);
|
|
62
|
+
```
|
|
63
|
+
|
|
64
|
+
### Routes
|
|
65
|
+
|
|
66
|
+
```diff
|
|
67
|
+
- permission: permissions.entityRead.id,
|
|
68
|
+
+ accessRule: access.read,
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
### Patch Changes
|
|
72
|
+
|
|
73
|
+
- Updated dependencies [9faec1f]
|
|
74
|
+
- Updated dependencies [f533141]
|
|
75
|
+
- @checkstack/common@0.2.0
|
|
76
|
+
|
|
77
|
+
## 0.1.0
|
|
78
|
+
|
|
79
|
+
### Minor Changes
|
|
80
|
+
|
|
81
|
+
- 8e43507: # Teams and Resource-Level Access Control
|
|
82
|
+
|
|
83
|
+
This release introduces a comprehensive Teams system for organizing users and controlling access to resources at a granular level.
|
|
84
|
+
|
|
85
|
+
## Features
|
|
86
|
+
|
|
87
|
+
### Team Management
|
|
88
|
+
|
|
89
|
+
- Create, update, and delete teams with name and description
|
|
90
|
+
- Add/remove users from teams
|
|
91
|
+
- Designate team managers with elevated privileges
|
|
92
|
+
- View team membership and manager status
|
|
93
|
+
|
|
94
|
+
### Resource-Level Access Control
|
|
95
|
+
|
|
96
|
+
- Grant teams access to specific resources (systems, health checks, incidents, maintenances)
|
|
97
|
+
- Configure read-only or manage permissions per team
|
|
98
|
+
- Resource-level "Team Only" mode that restricts access exclusively to team members
|
|
99
|
+
- Separate `resourceAccessSettings` table for resource-level settings (not per-grant)
|
|
100
|
+
- Automatic cleanup of grants when teams are deleted (database cascade)
|
|
101
|
+
|
|
102
|
+
### Middleware Integration
|
|
103
|
+
|
|
104
|
+
- Extended `autoAuthMiddleware` to support resource access checks
|
|
105
|
+
- Single-resource pre-handler validation for detail endpoints
|
|
106
|
+
- Automatic list filtering for collection endpoints
|
|
107
|
+
- S2S endpoints for access verification
|
|
108
|
+
|
|
109
|
+
### Frontend Components
|
|
110
|
+
|
|
111
|
+
- `TeamsTab` component for managing teams in Auth Settings
|
|
112
|
+
- `TeamAccessEditor` component for assigning team access to resources
|
|
113
|
+
- Resource-level "Team Only" toggle in `TeamAccessEditor`
|
|
114
|
+
- Integration into System, Health Check, Incident, and Maintenance editors
|
|
115
|
+
|
|
116
|
+
## Breaking Changes
|
|
117
|
+
|
|
118
|
+
### API Response Format Changes
|
|
119
|
+
|
|
120
|
+
List endpoints now return objects with named keys instead of arrays directly:
|
|
121
|
+
|
|
122
|
+
```typescript
|
|
123
|
+
// Before
|
|
124
|
+
const systems = await catalogApi.getSystems();
|
|
125
|
+
|
|
126
|
+
// After
|
|
127
|
+
const { systems } = await catalogApi.getSystems();
|
|
128
|
+
```
|
|
129
|
+
|
|
130
|
+
Affected endpoints:
|
|
131
|
+
|
|
132
|
+
- `catalog.getSystems` → `{ systems: [...] }`
|
|
133
|
+
- `healthcheck.getConfigurations` → `{ configurations: [...] }`
|
|
134
|
+
- `incident.listIncidents` → `{ incidents: [...] }`
|
|
135
|
+
- `maintenance.listMaintenances` → `{ maintenances: [...] }`
|
|
136
|
+
|
|
137
|
+
### User Identity Enrichment
|
|
138
|
+
|
|
139
|
+
`RealUser` and `ApplicationUser` types now include `teamIds: string[]` field with team memberships.
|
|
140
|
+
|
|
141
|
+
## Documentation
|
|
142
|
+
|
|
143
|
+
See `docs/backend/teams.md` for complete API reference and integration guide.
|
|
144
|
+
|
|
145
|
+
### Patch Changes
|
|
146
|
+
|
|
147
|
+
- Updated dependencies [8e43507]
|
|
148
|
+
- @checkstack/common@0.1.0
|
|
149
|
+
|
|
3
150
|
## 0.0.3
|
|
4
151
|
|
|
5
152
|
### Patch Changes
|
package/package.json
CHANGED
package/src/access.ts
ADDED
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
import { access, accessPair, type AccessRule } from "@checkstack/common";
|
|
2
|
+
|
|
3
|
+
/**
|
|
4
|
+
* Access rules for the Auth plugin.
|
|
5
|
+
*
|
|
6
|
+
* Auth has fine-grained access rules for different operations
|
|
7
|
+
* on users, roles, teams, strategies, etc.
|
|
8
|
+
*/
|
|
9
|
+
export const authAccess = {
|
|
10
|
+
/**
|
|
11
|
+
* User management access rules.
|
|
12
|
+
*/
|
|
13
|
+
users: {
|
|
14
|
+
read: access("users", "read", "List all users"),
|
|
15
|
+
create: access(
|
|
16
|
+
"users.create",
|
|
17
|
+
"manage",
|
|
18
|
+
"Create new users (credential strategy)"
|
|
19
|
+
),
|
|
20
|
+
manage: access("users", "manage", "Delete users"),
|
|
21
|
+
},
|
|
22
|
+
|
|
23
|
+
/**
|
|
24
|
+
* Role management access rules.
|
|
25
|
+
*/
|
|
26
|
+
roles: {
|
|
27
|
+
read: access("roles", "read", "Read and list roles"),
|
|
28
|
+
create: access("roles.create", "manage", "Create new roles"),
|
|
29
|
+
update: access(
|
|
30
|
+
"roles.update",
|
|
31
|
+
"manage",
|
|
32
|
+
"Update role names and access rules"
|
|
33
|
+
),
|
|
34
|
+
delete: access("roles.delete", "manage", "Delete roles"),
|
|
35
|
+
manage: access("roles", "manage", "Assign roles to users"),
|
|
36
|
+
},
|
|
37
|
+
|
|
38
|
+
/**
|
|
39
|
+
* Authentication strategy management.
|
|
40
|
+
*/
|
|
41
|
+
strategies: access(
|
|
42
|
+
"strategies",
|
|
43
|
+
"manage",
|
|
44
|
+
"Manage authentication strategies and settings"
|
|
45
|
+
),
|
|
46
|
+
|
|
47
|
+
/**
|
|
48
|
+
* Registration settings management.
|
|
49
|
+
*/
|
|
50
|
+
registration: access(
|
|
51
|
+
"registration",
|
|
52
|
+
"manage",
|
|
53
|
+
"Manage user registration settings"
|
|
54
|
+
),
|
|
55
|
+
|
|
56
|
+
/**
|
|
57
|
+
* External application management.
|
|
58
|
+
*/
|
|
59
|
+
applications: access(
|
|
60
|
+
"applications",
|
|
61
|
+
"manage",
|
|
62
|
+
"Create, update, delete, and view external applications"
|
|
63
|
+
),
|
|
64
|
+
|
|
65
|
+
/**
|
|
66
|
+
* Team management access rules.
|
|
67
|
+
*/
|
|
68
|
+
teams: accessPair("teams", {
|
|
69
|
+
read: "View teams and team memberships",
|
|
70
|
+
manage: "Create, delete, and manage all teams and resource access",
|
|
71
|
+
}),
|
|
72
|
+
};
|
|
73
|
+
|
|
74
|
+
/**
|
|
75
|
+
* All access rules for registration with the plugin system.
|
|
76
|
+
*/
|
|
77
|
+
export const authAccessRules: AccessRule[] = [
|
|
78
|
+
authAccess.users.read,
|
|
79
|
+
authAccess.users.create,
|
|
80
|
+
authAccess.users.manage,
|
|
81
|
+
authAccess.roles.read,
|
|
82
|
+
authAccess.roles.create,
|
|
83
|
+
authAccess.roles.update,
|
|
84
|
+
authAccess.roles.delete,
|
|
85
|
+
authAccess.roles.manage,
|
|
86
|
+
authAccess.strategies,
|
|
87
|
+
authAccess.registration,
|
|
88
|
+
authAccess.applications,
|
|
89
|
+
authAccess.teams.read,
|
|
90
|
+
authAccess.teams.manage,
|
|
91
|
+
];
|
package/src/index.ts
CHANGED
package/src/rpc-contract.ts
CHANGED
|
@@ -5,7 +5,7 @@ import {
|
|
|
5
5
|
lucideIconSchema,
|
|
6
6
|
} from "@checkstack/common";
|
|
7
7
|
import { z } from "zod";
|
|
8
|
-
import {
|
|
8
|
+
import { authAccess } from "./access";
|
|
9
9
|
import { pluginMetadata } from "./plugin-metadata";
|
|
10
10
|
|
|
11
11
|
// Base builder with full metadata support
|
|
@@ -23,12 +23,12 @@ const RoleDtoSchema = z.object({
|
|
|
23
23
|
id: z.string(),
|
|
24
24
|
name: z.string(),
|
|
25
25
|
description: z.string().optional().nullable(),
|
|
26
|
-
|
|
26
|
+
accessRules: z.array(z.string()),
|
|
27
27
|
isSystem: z.boolean().optional(),
|
|
28
28
|
isAssignable: z.boolean().optional(), // False for anonymous role
|
|
29
29
|
});
|
|
30
30
|
|
|
31
|
-
const
|
|
31
|
+
const AccessRuleDtoSchema = z.object({
|
|
32
32
|
id: z.string(),
|
|
33
33
|
description: z.string().optional(),
|
|
34
34
|
});
|
|
@@ -118,33 +118,33 @@ export const authContract = {
|
|
|
118
118
|
.output(RegistrationStatusSchema),
|
|
119
119
|
|
|
120
120
|
// ==========================================================================
|
|
121
|
-
// AUTHENTICATED ENDPOINTS (userType: "authenticated" - no specific
|
|
121
|
+
// AUTHENTICATED ENDPOINTS (userType: "authenticated" - no specific access rule)
|
|
122
122
|
// ==========================================================================
|
|
123
123
|
|
|
124
|
-
|
|
125
|
-
.meta({ userType: "authenticated" }) // Any authenticated user can check their own
|
|
126
|
-
.output(z.object({
|
|
124
|
+
accessRules: _base
|
|
125
|
+
.meta({ userType: "authenticated" }) // Any authenticated user can check their own access rules
|
|
126
|
+
.output(z.object({ accessRules: z.array(z.string()) })),
|
|
127
127
|
|
|
128
128
|
// ==========================================================================
|
|
129
|
-
// USER MANAGEMENT (userType: "user" with
|
|
129
|
+
// USER MANAGEMENT (userType: "user" with access)
|
|
130
130
|
// ==========================================================================
|
|
131
131
|
|
|
132
132
|
getUsers: _base
|
|
133
|
-
.meta({ userType: "user",
|
|
133
|
+
.meta({ userType: "user", access: [authAccess.users.read] })
|
|
134
134
|
.output(z.array(UserDtoSchema)),
|
|
135
135
|
|
|
136
136
|
deleteUser: _base
|
|
137
|
-
.meta({ userType: "user",
|
|
137
|
+
.meta({ userType: "user", access: [authAccess.users.manage] })
|
|
138
138
|
.input(z.string())
|
|
139
139
|
.output(z.void()),
|
|
140
140
|
|
|
141
141
|
createCredentialUser: _base
|
|
142
|
-
.meta({ userType: "user",
|
|
142
|
+
.meta({ userType: "user", access: [authAccess.users.create] })
|
|
143
143
|
.input(CreateCredentialUserInputSchema)
|
|
144
144
|
.output(CreateCredentialUserOutputSchema),
|
|
145
145
|
|
|
146
146
|
updateUserRoles: _base
|
|
147
|
-
.meta({ userType: "user",
|
|
147
|
+
.meta({ userType: "user", access: [authAccess.users.manage] })
|
|
148
148
|
.input(
|
|
149
149
|
z.object({
|
|
150
150
|
userId: z.string(),
|
|
@@ -154,55 +154,55 @@ export const authContract = {
|
|
|
154
154
|
.output(z.void()),
|
|
155
155
|
|
|
156
156
|
// ==========================================================================
|
|
157
|
-
// ROLE MANAGEMENT (userType: "user" with
|
|
157
|
+
// ROLE MANAGEMENT (userType: "user" with access)
|
|
158
158
|
// ==========================================================================
|
|
159
159
|
|
|
160
160
|
getRoles: _base
|
|
161
|
-
.meta({ userType: "user",
|
|
161
|
+
.meta({ userType: "user", access: [authAccess.roles.read] })
|
|
162
162
|
.output(z.array(RoleDtoSchema)),
|
|
163
163
|
|
|
164
|
-
|
|
165
|
-
.meta({ userType: "user",
|
|
166
|
-
.output(z.array(
|
|
164
|
+
getAccessRules: _base
|
|
165
|
+
.meta({ userType: "user", access: [authAccess.roles.read] })
|
|
166
|
+
.output(z.array(AccessRuleDtoSchema)),
|
|
167
167
|
|
|
168
168
|
createRole: _base
|
|
169
|
-
.meta({ userType: "user",
|
|
169
|
+
.meta({ userType: "user", access: [authAccess.roles.create] })
|
|
170
170
|
.input(
|
|
171
171
|
z.object({
|
|
172
172
|
name: z.string(),
|
|
173
173
|
description: z.string().optional(),
|
|
174
|
-
|
|
174
|
+
accessRules: z.array(z.string()),
|
|
175
175
|
})
|
|
176
176
|
)
|
|
177
177
|
.output(z.void()),
|
|
178
178
|
|
|
179
179
|
updateRole: _base
|
|
180
|
-
.meta({ userType: "user",
|
|
180
|
+
.meta({ userType: "user", access: [authAccess.roles.update] })
|
|
181
181
|
.input(
|
|
182
182
|
z.object({
|
|
183
183
|
id: z.string(),
|
|
184
184
|
name: z.string().optional(),
|
|
185
185
|
description: z.string().optional(),
|
|
186
|
-
|
|
186
|
+
accessRules: z.array(z.string()),
|
|
187
187
|
})
|
|
188
188
|
)
|
|
189
189
|
.output(z.void()),
|
|
190
190
|
|
|
191
191
|
deleteRole: _base
|
|
192
|
-
.meta({ userType: "user",
|
|
192
|
+
.meta({ userType: "user", access: [authAccess.roles.delete] })
|
|
193
193
|
.input(z.string())
|
|
194
194
|
.output(z.void()),
|
|
195
195
|
|
|
196
196
|
// ==========================================================================
|
|
197
|
-
// STRATEGY MANAGEMENT (userType: "user" with
|
|
197
|
+
// STRATEGY MANAGEMENT (userType: "user" with access)
|
|
198
198
|
// ==========================================================================
|
|
199
199
|
|
|
200
200
|
getStrategies: _base
|
|
201
|
-
.meta({ userType: "user",
|
|
201
|
+
.meta({ userType: "user", access: [authAccess.strategies] })
|
|
202
202
|
.output(z.array(StrategyDtoSchema)),
|
|
203
203
|
|
|
204
204
|
updateStrategy: _base
|
|
205
|
-
.meta({ userType: "user",
|
|
205
|
+
.meta({ userType: "user", access: [authAccess.strategies] })
|
|
206
206
|
.input(
|
|
207
207
|
z.object({
|
|
208
208
|
id: z.string(),
|
|
@@ -213,24 +213,24 @@ export const authContract = {
|
|
|
213
213
|
.output(z.object({ success: z.boolean() })),
|
|
214
214
|
|
|
215
215
|
reloadAuth: _base
|
|
216
|
-
.meta({ userType: "user",
|
|
216
|
+
.meta({ userType: "user", access: [authAccess.strategies] })
|
|
217
217
|
.output(z.object({ success: z.boolean() })),
|
|
218
218
|
|
|
219
219
|
// ==========================================================================
|
|
220
|
-
// REGISTRATION MANAGEMENT (userType: "user" with
|
|
220
|
+
// REGISTRATION MANAGEMENT (userType: "user" with access)
|
|
221
221
|
// ==========================================================================
|
|
222
222
|
|
|
223
223
|
getRegistrationSchema: _base
|
|
224
224
|
.meta({
|
|
225
225
|
userType: "user",
|
|
226
|
-
|
|
226
|
+
access: [authAccess.registration],
|
|
227
227
|
})
|
|
228
228
|
.output(z.record(z.string(), z.unknown())),
|
|
229
229
|
|
|
230
230
|
setRegistrationStatus: _base
|
|
231
231
|
.meta({
|
|
232
232
|
userType: "user",
|
|
233
|
-
|
|
233
|
+
access: [authAccess.registration],
|
|
234
234
|
})
|
|
235
235
|
.input(RegistrationStatusSchema)
|
|
236
236
|
.output(z.object({ success: z.boolean() })),
|
|
@@ -240,10 +240,10 @@ export const authContract = {
|
|
|
240
240
|
// ==========================================================================
|
|
241
241
|
|
|
242
242
|
/**
|
|
243
|
-
* Get
|
|
244
|
-
* Used by core AuthService for
|
|
243
|
+
* Get access rules assigned to the anonymous role.
|
|
244
|
+
* Used by core AuthService for access checks on public endpoints.
|
|
245
245
|
*/
|
|
246
|
-
|
|
246
|
+
getAnonymousAccessRules: _base
|
|
247
247
|
.meta({ userType: "service" })
|
|
248
248
|
.output(z.array(z.string())),
|
|
249
249
|
|
|
@@ -293,28 +293,28 @@ export const authContract = {
|
|
|
293
293
|
),
|
|
294
294
|
|
|
295
295
|
/**
|
|
296
|
-
* Filter a list of user IDs to only those who have a specific
|
|
296
|
+
* Filter a list of user IDs to only those who have a specific access rule.
|
|
297
297
|
* Used by SignalService to send signals only to authorized users.
|
|
298
298
|
*/
|
|
299
|
-
|
|
299
|
+
filterUsersByAccessRule: _base
|
|
300
300
|
.meta({ userType: "service" })
|
|
301
301
|
.input(
|
|
302
302
|
z.object({
|
|
303
303
|
userIds: z.array(z.string()),
|
|
304
|
-
|
|
304
|
+
accessRule: z.string(), // Fully-qualified access rule ID
|
|
305
305
|
})
|
|
306
306
|
)
|
|
307
307
|
.output(z.array(z.string())), // Returns filtered user IDs
|
|
308
308
|
|
|
309
309
|
// ==========================================================================
|
|
310
|
-
// APPLICATION MANAGEMENT (userType: "user" with
|
|
310
|
+
// APPLICATION MANAGEMENT (userType: "user" with access)
|
|
311
311
|
// External API applications (API keys) with RBAC integration
|
|
312
312
|
// ==========================================================================
|
|
313
313
|
|
|
314
314
|
getApplications: _base
|
|
315
315
|
.meta({
|
|
316
316
|
userType: "user",
|
|
317
|
-
|
|
317
|
+
access: [authAccess.applications],
|
|
318
318
|
})
|
|
319
319
|
.output(
|
|
320
320
|
z.array(
|
|
@@ -333,7 +333,7 @@ export const authContract = {
|
|
|
333
333
|
createApplication: _base
|
|
334
334
|
.meta({
|
|
335
335
|
userType: "user",
|
|
336
|
-
|
|
336
|
+
access: [authAccess.applications],
|
|
337
337
|
})
|
|
338
338
|
.input(
|
|
339
339
|
z.object({
|
|
@@ -358,7 +358,7 @@ export const authContract = {
|
|
|
358
358
|
updateApplication: _base
|
|
359
359
|
.meta({
|
|
360
360
|
userType: "user",
|
|
361
|
-
|
|
361
|
+
access: [authAccess.applications],
|
|
362
362
|
})
|
|
363
363
|
.input(
|
|
364
364
|
z.object({
|
|
@@ -373,7 +373,7 @@ export const authContract = {
|
|
|
373
373
|
deleteApplication: _base
|
|
374
374
|
.meta({
|
|
375
375
|
userType: "user",
|
|
376
|
-
|
|
376
|
+
access: [authAccess.applications],
|
|
377
377
|
})
|
|
378
378
|
.input(z.string())
|
|
379
379
|
.output(z.void()),
|
|
@@ -381,10 +381,229 @@ export const authContract = {
|
|
|
381
381
|
regenerateApplicationSecret: _base
|
|
382
382
|
.meta({
|
|
383
383
|
userType: "user",
|
|
384
|
-
|
|
384
|
+
access: [authAccess.applications],
|
|
385
385
|
})
|
|
386
386
|
.input(z.string())
|
|
387
387
|
.output(z.object({ secret: z.string() })), // New secret - shown once
|
|
388
|
+
|
|
389
|
+
// ==========================================================================
|
|
390
|
+
// TEAM MANAGEMENT (userType: "authenticated" with access)
|
|
391
|
+
// Resource-level access control via teams
|
|
392
|
+
// Both users and applications can manage teams with proper access
|
|
393
|
+
// ==========================================================================
|
|
394
|
+
|
|
395
|
+
getTeams: _base
|
|
396
|
+
.meta({
|
|
397
|
+
userType: "authenticated",
|
|
398
|
+
access: [authAccess.teams.read],
|
|
399
|
+
})
|
|
400
|
+
.output(
|
|
401
|
+
z.array(
|
|
402
|
+
z.object({
|
|
403
|
+
id: z.string(),
|
|
404
|
+
name: z.string(),
|
|
405
|
+
description: z.string().optional().nullable(),
|
|
406
|
+
memberCount: z.number(),
|
|
407
|
+
isManager: z.boolean(),
|
|
408
|
+
})
|
|
409
|
+
)
|
|
410
|
+
),
|
|
411
|
+
|
|
412
|
+
getTeam: _base
|
|
413
|
+
.meta({
|
|
414
|
+
userType: "authenticated",
|
|
415
|
+
access: [authAccess.teams.read],
|
|
416
|
+
})
|
|
417
|
+
.input(z.object({ teamId: z.string() }))
|
|
418
|
+
.output(
|
|
419
|
+
z
|
|
420
|
+
.object({
|
|
421
|
+
id: z.string(),
|
|
422
|
+
name: z.string(),
|
|
423
|
+
description: z.string().optional().nullable(),
|
|
424
|
+
members: z.array(
|
|
425
|
+
z.object({ id: z.string(), name: z.string(), email: z.string() })
|
|
426
|
+
),
|
|
427
|
+
managers: z.array(
|
|
428
|
+
z.object({ id: z.string(), name: z.string(), email: z.string() })
|
|
429
|
+
),
|
|
430
|
+
})
|
|
431
|
+
.optional()
|
|
432
|
+
),
|
|
433
|
+
|
|
434
|
+
createTeam: _base
|
|
435
|
+
.meta({
|
|
436
|
+
userType: "authenticated",
|
|
437
|
+
access: [authAccess.teams.manage],
|
|
438
|
+
})
|
|
439
|
+
.input(
|
|
440
|
+
z.object({
|
|
441
|
+
name: z.string().min(1).max(100),
|
|
442
|
+
description: z.string().max(500).optional(),
|
|
443
|
+
})
|
|
444
|
+
)
|
|
445
|
+
.output(z.object({ id: z.string() })),
|
|
446
|
+
|
|
447
|
+
updateTeam: _base
|
|
448
|
+
.meta({
|
|
449
|
+
userType: "authenticated",
|
|
450
|
+
access: [authAccess.teams.read],
|
|
451
|
+
})
|
|
452
|
+
.input(
|
|
453
|
+
z.object({
|
|
454
|
+
id: z.string(),
|
|
455
|
+
name: z.string().optional(),
|
|
456
|
+
description: z.string().optional().nullable(),
|
|
457
|
+
})
|
|
458
|
+
)
|
|
459
|
+
.output(z.void()),
|
|
460
|
+
|
|
461
|
+
deleteTeam: _base
|
|
462
|
+
.meta({
|
|
463
|
+
userType: "authenticated",
|
|
464
|
+
access: [authAccess.teams.manage],
|
|
465
|
+
})
|
|
466
|
+
.input(z.string())
|
|
467
|
+
.output(z.void()),
|
|
468
|
+
|
|
469
|
+
addUserToTeam: _base
|
|
470
|
+
.meta({
|
|
471
|
+
userType: "authenticated",
|
|
472
|
+
access: [authAccess.teams.read],
|
|
473
|
+
})
|
|
474
|
+
.input(z.object({ teamId: z.string(), userId: z.string() }))
|
|
475
|
+
.output(z.void()),
|
|
476
|
+
|
|
477
|
+
removeUserFromTeam: _base
|
|
478
|
+
.meta({
|
|
479
|
+
userType: "authenticated",
|
|
480
|
+
access: [authAccess.teams.read],
|
|
481
|
+
})
|
|
482
|
+
.input(z.object({ teamId: z.string(), userId: z.string() }))
|
|
483
|
+
.output(z.void()),
|
|
484
|
+
|
|
485
|
+
addTeamManager: _base
|
|
486
|
+
.meta({
|
|
487
|
+
userType: "authenticated",
|
|
488
|
+
access: [authAccess.teams.manage],
|
|
489
|
+
})
|
|
490
|
+
.input(z.object({ teamId: z.string(), userId: z.string() }))
|
|
491
|
+
.output(z.void()),
|
|
492
|
+
|
|
493
|
+
removeTeamManager: _base
|
|
494
|
+
.meta({
|
|
495
|
+
userType: "authenticated",
|
|
496
|
+
access: [authAccess.teams.manage],
|
|
497
|
+
})
|
|
498
|
+
.input(z.object({ teamId: z.string(), userId: z.string() }))
|
|
499
|
+
.output(z.void()),
|
|
500
|
+
|
|
501
|
+
getResourceTeamAccess: _base
|
|
502
|
+
.meta({
|
|
503
|
+
userType: "authenticated",
|
|
504
|
+
access: [authAccess.teams.read],
|
|
505
|
+
})
|
|
506
|
+
.input(z.object({ resourceType: z.string(), resourceId: z.string() }))
|
|
507
|
+
.output(
|
|
508
|
+
z.array(
|
|
509
|
+
z.object({
|
|
510
|
+
teamId: z.string(),
|
|
511
|
+
teamName: z.string(),
|
|
512
|
+
canRead: z.boolean(),
|
|
513
|
+
canManage: z.boolean(),
|
|
514
|
+
})
|
|
515
|
+
)
|
|
516
|
+
),
|
|
517
|
+
|
|
518
|
+
setResourceTeamAccess: _base
|
|
519
|
+
.meta({
|
|
520
|
+
userType: "authenticated",
|
|
521
|
+
access: [authAccess.teams.manage],
|
|
522
|
+
})
|
|
523
|
+
.input(
|
|
524
|
+
z.object({
|
|
525
|
+
resourceType: z.string(),
|
|
526
|
+
resourceId: z.string(),
|
|
527
|
+
teamId: z.string(),
|
|
528
|
+
canRead: z.boolean().optional(),
|
|
529
|
+
canManage: z.boolean().optional(),
|
|
530
|
+
})
|
|
531
|
+
)
|
|
532
|
+
.output(z.void()),
|
|
533
|
+
|
|
534
|
+
removeResourceTeamAccess: _base
|
|
535
|
+
.meta({
|
|
536
|
+
userType: "authenticated",
|
|
537
|
+
access: [authAccess.teams.manage],
|
|
538
|
+
})
|
|
539
|
+
.input(
|
|
540
|
+
z.object({
|
|
541
|
+
resourceType: z.string(),
|
|
542
|
+
resourceId: z.string(),
|
|
543
|
+
teamId: z.string(),
|
|
544
|
+
})
|
|
545
|
+
)
|
|
546
|
+
.output(z.void()),
|
|
547
|
+
|
|
548
|
+
// Resource-level access settings (teamOnly flag)
|
|
549
|
+
getResourceAccessSettings: _base
|
|
550
|
+
.meta({
|
|
551
|
+
userType: "authenticated",
|
|
552
|
+
access: [authAccess.teams.read],
|
|
553
|
+
})
|
|
554
|
+
.input(z.object({ resourceType: z.string(), resourceId: z.string() }))
|
|
555
|
+
.output(z.object({ teamOnly: z.boolean() })),
|
|
556
|
+
|
|
557
|
+
setResourceAccessSettings: _base
|
|
558
|
+
.meta({
|
|
559
|
+
userType: "authenticated",
|
|
560
|
+
access: [authAccess.teams.manage],
|
|
561
|
+
})
|
|
562
|
+
.input(
|
|
563
|
+
z.object({
|
|
564
|
+
resourceType: z.string(),
|
|
565
|
+
resourceId: z.string(),
|
|
566
|
+
teamOnly: z.boolean(),
|
|
567
|
+
})
|
|
568
|
+
)
|
|
569
|
+
.output(z.void()),
|
|
570
|
+
|
|
571
|
+
// ==========================================================================
|
|
572
|
+
// S2S ENDPOINTS FOR TEAM ACCESS (userType: "service")
|
|
573
|
+
// ==========================================================================
|
|
574
|
+
|
|
575
|
+
checkResourceTeamAccess: _base
|
|
576
|
+
.meta({ userType: "service" })
|
|
577
|
+
.input(
|
|
578
|
+
z.object({
|
|
579
|
+
userId: z.string(),
|
|
580
|
+
userType: z.enum(["user", "application"]),
|
|
581
|
+
resourceType: z.string(),
|
|
582
|
+
resourceId: z.string(),
|
|
583
|
+
action: z.enum(["read", "manage"]),
|
|
584
|
+
hasGlobalAccess: z.boolean(),
|
|
585
|
+
})
|
|
586
|
+
)
|
|
587
|
+
.output(z.object({ hasAccess: z.boolean() })),
|
|
588
|
+
|
|
589
|
+
getAccessibleResourceIds: _base
|
|
590
|
+
.meta({ userType: "service" })
|
|
591
|
+
.input(
|
|
592
|
+
z.object({
|
|
593
|
+
userId: z.string(),
|
|
594
|
+
userType: z.enum(["user", "application"]),
|
|
595
|
+
resourceType: z.string(),
|
|
596
|
+
resourceIds: z.array(z.string()),
|
|
597
|
+
action: z.enum(["read", "manage"]),
|
|
598
|
+
hasGlobalAccess: z.boolean(),
|
|
599
|
+
})
|
|
600
|
+
)
|
|
601
|
+
.output(z.array(z.string())),
|
|
602
|
+
|
|
603
|
+
deleteResourceGrants: _base
|
|
604
|
+
.meta({ userType: "service" })
|
|
605
|
+
.input(z.object({ resourceType: z.string(), resourceId: z.string() }))
|
|
606
|
+
.output(z.void()),
|
|
388
607
|
};
|
|
389
608
|
|
|
390
609
|
// Export contract type
|
package/src/permissions.ts
DELETED
|
@@ -1,50 +0,0 @@
|
|
|
1
|
-
import type { Permission } from "@checkstack/common";
|
|
2
|
-
|
|
3
|
-
export const permissions = {
|
|
4
|
-
usersRead: {
|
|
5
|
-
id: "users.read",
|
|
6
|
-
description: "List all users",
|
|
7
|
-
},
|
|
8
|
-
usersCreate: {
|
|
9
|
-
id: "users.create",
|
|
10
|
-
description: "Create new users (credential strategy)",
|
|
11
|
-
},
|
|
12
|
-
usersManage: {
|
|
13
|
-
id: "users.manage",
|
|
14
|
-
description: "Delete users",
|
|
15
|
-
},
|
|
16
|
-
rolesRead: {
|
|
17
|
-
id: "roles.read",
|
|
18
|
-
description: "Read and list roles",
|
|
19
|
-
},
|
|
20
|
-
rolesCreate: {
|
|
21
|
-
id: "roles.create",
|
|
22
|
-
description: "Create new roles",
|
|
23
|
-
},
|
|
24
|
-
rolesUpdate: {
|
|
25
|
-
id: "roles.update",
|
|
26
|
-
description: "Update role names and permissions",
|
|
27
|
-
},
|
|
28
|
-
rolesDelete: {
|
|
29
|
-
id: "roles.delete",
|
|
30
|
-
description: "Delete roles",
|
|
31
|
-
},
|
|
32
|
-
rolesManage: {
|
|
33
|
-
id: "roles.manage",
|
|
34
|
-
description: "Assign roles to users",
|
|
35
|
-
},
|
|
36
|
-
strategiesManage: {
|
|
37
|
-
id: "strategies.manage",
|
|
38
|
-
description: "Manage authentication strategies and settings",
|
|
39
|
-
},
|
|
40
|
-
registrationManage: {
|
|
41
|
-
id: "registration.manage",
|
|
42
|
-
description: "Manage user registration settings",
|
|
43
|
-
},
|
|
44
|
-
applicationsManage: {
|
|
45
|
-
id: "applications.manage",
|
|
46
|
-
description: "Create, update, delete, and view external applications",
|
|
47
|
-
},
|
|
48
|
-
} satisfies Record<string, Permission>;
|
|
49
|
-
|
|
50
|
-
export const permissionList = Object.values(permissions);
|