@checkstack/catalog-backend 0.0.3 → 0.2.0

package/CHANGELOG.md

@@ -1,5 +1,123 @@
 # @checkstack/catalog-backend
 
+## 0.2.0
+
+### Minor Changes
+
+- 9faec1f: # Unified AccessRule Terminology Refactoring
+
+  This release completes a comprehensive terminology refactoring from "permission" to "accessRule" across the entire codebase, establishing a consistent and modern access control vocabulary.
+
+  ## Changes
+
+  ### Core Infrastructure (`@checkstack/common`)
+
+  - Introduced `AccessRule` interface as the primary access control type
+  - Added `accessPair()` helper for creating read/manage access rule pairs
+  - Added `access()` builder for individual access rules
+  - Replaced `Permission` type with `AccessRule` throughout
+
+  ### API Changes
+
+  - `env.registerPermissions()` → `env.registerAccessRules()`
+  - `meta.permissions` → `meta.access` in RPC contracts
+  - `usePermission()` → `useAccess()` in frontend hooks
+  - Route `permission:` field → `accessRule:` field
+
+  ### UI Changes
+
+  - "Roles & Permissions" tab → "Roles & Access Rules"
+  - "You don't have permission..." → "You don't have access..."
+  - All permission-related UI text updated
+
+  ### Documentation & Templates
+
+  - Updated 18 documentation files with AccessRule terminology
+  - Updated 7 scaffolding templates with `accessPair()` pattern
+  - All code examples use new AccessRule API
+
+  ## Migration Guide
+
+  ### Backend Plugins
+
+  ```diff
+  - import { permissionList } from "./permissions";
+  - env.registerPermissions(permissionList);
+  + import { accessRules } from "./access";
+  + env.registerAccessRules(accessRules);
+  ```
+
+  ### RPC Contracts
+
+  ```diff
+  - .meta({ userType: "user", permissions: [permissions.read.id] })
+  + .meta({ userType: "user", access: [access.read] })
+  ```
+
+  ### Frontend Hooks
+
+  ```diff
+  - const canRead = accessApi.usePermission(permissions.read.id);
+  + const canRead = accessApi.useAccess(access.read);
+  ```
+
+  ### Routes
+
+  ```diff
+  - permission: permissions.entityRead.id,
+  + accessRule: access.read,
+  ```
+
+### Patch Changes
+
+- Updated dependencies [9faec1f]
+- Updated dependencies [827b286]
+- Updated dependencies [f533141]
+- Updated dependencies [aa4a8ab]
+  - @checkstack/backend-api@0.3.0
+  - @checkstack/catalog-common@1.1.0
+  - @checkstack/command-backend@0.1.0
+  - @checkstack/common@0.2.0
+  - @checkstack/notification-common@0.1.0
+
+## 0.1.0
+
+### Minor Changes
+
+- 8e43507: BREAKING: `getSystems` now returns `{ systems: [...] }` instead of plain array
+
+  This change enables resource-level access control filtering for the catalog plugin. The middleware needs a consistent object format with named keys to perform post-execution filtering on list endpoints.
+
+  ## Breaking Changes
+
+  - `getSystems()` now returns `{ systems: System[] }` instead of `System[]`
+  - All call sites must update to destructure: `const { systems } = await api.getSystems()`
+
+  ## New Features
+
+  - Added `resourceAccess` metadata to catalog endpoints:
+    - `getSystems`: List filtering by team access
+    - `getSystem`: Single resource pre-check by team access
+    - `getEntities`: List filtering for systems by team access
+
+  ## Migration
+
+  ```diff
+  - const systems = await catalogApi.getSystems();
+  + const { systems } = await catalogApi.getSystems();
+  ```
+
+### Patch Changes
+
+- Updated dependencies [97c5a6b]
+- Updated dependencies [8e43507]
+- Updated dependencies [8e43507]
+  - @checkstack/backend-api@0.2.0
+  - @checkstack/catalog-common@1.0.0
+  - @checkstack/common@0.1.0
+  - @checkstack/command-backend@0.0.4
+  - @checkstack/notification-common@0.0.4
+
 ## 0.0.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/catalog-backend",
-  "version": "0.0.3",
+  "version": "0.2.0",
   "type": "module",
   "main": "src/index.ts",
   "scripts": {

package/src/index.ts

@@ -2,11 +2,11 @@ import { createBackendPlugin } from "@checkstack/backend-api";
 import { type NodePgDatabase } from "drizzle-orm/node-postgres";
 import { coreServices } from "@checkstack/backend-api";
 import {
-  permissionList,
+  catalogAccessRules,
+  catalogAccess,
   pluginMetadata,
   catalogContract,
   catalogRoutes,
-  permissions,
 } from "@checkstack/catalog-common";
 import { createCatalogRouter } from "./router";
 import { NotificationApi } from "@checkstack/notification-common";
@@ -24,7 +24,7 @@ export { catalogHooks } from "./hooks";
 export default createBackendPlugin({
   metadata: pluginMetadata,
   register(env) {
-    env.registerPermissions(permissionList);
+    env.registerAccessRules(catalogAccessRules);
 
     env.registerInit({
       schema,
@@ -89,7 +89,7 @@ export default createBackendPlugin({
               iconName: "Activity",
               route:
                 resolveRoute(catalogRoutes.routes.config) + "?action=create",
-              requiredPermissions: [permissions.catalogManage],
+              requiredAccessRules: [catalogAccess.system.manage],
             },
             {
               id: "manage",
@@ -98,7 +98,7 @@ export default createBackendPlugin({
               iconName: "Activity",
               shortcuts: ["meta+shift+s", "ctrl+shift+s"],
               route: resolveRoute(catalogRoutes.routes.config),
-              requiredPermissions: [permissions.catalogManage],
+              requiredAccessRules: [catalogAccess.system.manage],
             },
           ],
         });

package/src/router.ts

@@ -1,8 +1,5 @@
 import { implement, ORPCError } from "@orpc/server";
-import {
-  autoAuthMiddleware,
-  type RpcContext,
-} from "@checkstack/backend-api";
+import { autoAuthMiddleware, type RpcContext } from "@checkstack/backend-api";
 import { catalogContract } from "@checkstack/catalog-common";
 import { EntityService } from "./services/entity-service";
 import type { NodePgDatabase } from "drizzle-orm/node-postgres";
@@ -15,8 +12,8 @@ import { eq } from "drizzle-orm";
 /**
  * Creates the catalog router using contract-based implementation.
  *
- * Auth and permissions are automatically enforced via autoAuthMiddleware
- * based on the contract's meta.userType and meta.permissions.
+ * Auth and access rules are automatically enforced via autoAuthMiddleware
+ * based on the contract's meta.userType and meta.access.
  */
 const os = implement(catalogContract)
   .$context<RpcContext>()
@@ -95,9 +92,11 @@ export const createCatalogRouter = ({
 
   const getSystems = os.getSystems.handler(async () => {
     const systems = await entityService.getSystems();
-    return systems as unknown as Array<
-      (typeof systems)[number] & { metadata: Record<string, unknown> | null }
-    >;
+    return {
+      systems: systems as unknown as Array<
+        (typeof systems)[number] & { metadata: Record<string, unknown> | null }
+      >,
+    };
   });
 
   const getSystem = os.getSystem.handler(async ({ input }) => {