@checkstack/pluginmanager-common 0.2.18 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @checkstack/pluginmanager-common
 
+## 0.3.0
+
+### Minor Changes
+
+- b8a00da: Consolidate plugin install and uninstall into a single access rule. `pluginManagerAccess.install` and `pluginManagerAccess.uninstall` both produced the identical qualified id `pluginmanager.plugin.manage` (collapsing into one row with an ambiguous description in the role editor); they are replaced by a single `pluginManagerAccess.manage` ("Install and uninstall plugins").
+
+  BREAKING CHANGES: the `install` and `uninstall` keys were removed from `pluginManagerAccess` - use `pluginManagerAccess.manage`. The qualified rule id `pluginmanager.plugin.manage` is unchanged, so existing role grants keep working.
+
 ## 0.2.18
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/pluginmanager-common",
-  "version": "0.2.18",
+  "version": "0.3.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [

package/src/access.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from "bun:test";
+
+import { pluginManagerAccess, pluginManagerAccessRules } from "./access";
+import { pluginMetadata } from "./plugin-metadata";
+
+describe("pluginManagerAccess", () => {
+  it("exposes exactly one manage rule covering install and uninstall", () => {
+    expect(pluginManagerAccess.manage.id).toBe("plugin.manage");
+    expect(pluginManagerAccessRules).toHaveLength(2);
+  });
+
+  it("has unique qualified ids (no collapsed grants in the role editor)", () => {
+    const qualifiedIds = pluginManagerAccessRules.map(
+      (rule) => `${pluginMetadata.pluginId}.${rule.id}`,
+    );
+    expect(new Set(qualifiedIds).size).toBe(qualifiedIds.length);
+  });
+});

package/src/access.ts

@@ -6,22 +6,19 @@ import { pluginMetadata } from "./plugin-metadata";
  * Access rules for the Plugin Manager.
  *
  * The plugin system runs arbitrary code with full platform access — only
- * trusted operators should hold the `manage` rule.
+ * trusted operators should hold the `manage` rule, which covers both
+ * installing and uninstalling plugins.
  */
 export const pluginManagerAccess = {
   view: access("plugin", "read", "View installed plugins and install events", {
     pluginId: pluginMetadata.pluginId,
   }),
-  install: access("plugin", "manage", "Install plugins from any source", {
-    pluginId: pluginMetadata.pluginId,
-  }),
-  uninstall: access("plugin", "manage", "Uninstall plugins", {
+  manage: access("plugin", "manage", "Install and uninstall plugins", {
     pluginId: pluginMetadata.pluginId,
   }),
 };
 
 export const pluginManagerAccessRules = [
   pluginManagerAccess.view,
-  pluginManagerAccess.install,
-  pluginManagerAccess.uninstall,
+  pluginManagerAccess.manage,
 ];

package/src/rpc-contract.ts

@@ -43,7 +43,7 @@ export const pluginManagerContract = {
   previewInstall: proc({
     operationType: "mutation",
     userType: "user",
-    access: [pluginManagerAccess.install],
+    access: [pluginManagerAccess.manage],
   })
     .input(z.object({ source: pluginSourceSchema }))
     .output(installPreviewSchema),
@@ -56,7 +56,7 @@ export const pluginManagerContract = {
   install: proc({
     operationType: "mutation",
     userType: "user",
-    access: [pluginManagerAccess.install],
+    access: [pluginManagerAccess.manage],
   })
     .input(
       z.object({
@@ -79,7 +79,7 @@ export const pluginManagerContract = {
   previewUninstall: proc({
     operationType: "query",
     userType: "user",
-    access: [pluginManagerAccess.uninstall],
+    access: [pluginManagerAccess.manage],
   })
     .input(z.object({ pluginName: z.string().min(1) }))
     .output(uninstallPreviewSchema),
@@ -91,7 +91,7 @@ export const pluginManagerContract = {
   uninstall: proc({
     operationType: "mutation",
     userType: "user",
-    access: [pluginManagerAccess.uninstall],
+    access: [pluginManagerAccess.manage],
   })
     .input(
       z.object({