@contractspec/lib.identity-rbac 0.0.0-canary-20260113162409

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Chaman Ventures, SASU
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,102 @@
+# @contractspec/lib.identity-rbac
+
+Website: https://contractspec.io/
+
+
+Identity, Organizations, and Role-Based Access Control (RBAC) module for ContractSpec applications.
+
+## Purpose
+
+Provides a reusable identity and authorization foundation for multi-tenant, multi-role applications. This module follows the spec-first approach where entity definitions generate database schemas.
+
+## Features
+
+- **User Management**: User profiles, authentication accounts, sessions
+- **Organizations**: Multi-tenant organization support with slugs, metadata
+- **Memberships**: Role-based organization membership (owner, admin, member)
+- **RBAC**: Roles, permissions, and policy bindings
+- **Teams**: Optional team grouping within organizations
+- **Events**: Domain events for user/org lifecycle changes
+
+## Installation
+
+```bash
+bun add @contractspec/lib.identity-rbac
+```
+
+## Usage
+
+### Entity Specs (for schema generation)
+
+```typescript
+import { UserEntity, OrganizationEntity, MemberEntity } from '@contractspec/lib.identity-rbac/entities';
+
+// Use in schema composition
+const contribution = {
+  moduleId: '@contractspec/lib.identity-rbac',
+  entities: [UserEntity, OrganizationEntity, MemberEntity, ...],
+};
+```
+
+### Contracts (for API generation)
+
+```typescript
+import { 
+  CreateUserContract,
+  InviteToOrgContract,
+  AssignRoleContract 
+} from '@contractspec/lib.identity-rbac/contracts';
+```
+
+### Policies (for authorization)
+
+```typescript
+import { RBACPolicyEngine, Permission } from '@contractspec/lib.identity-rbac/policies';
+
+const engine = new RBACPolicyEngine();
+const canManage = await engine.checkPermission({
+  userId: 'user-123',
+  orgId: 'org-456',
+  permission: Permission.MANAGE_MEMBERS,
+});
+```
+
+### Events
+
+```typescript
+import { UserCreatedEvent, OrgMemberAddedEvent } from '@contractspec/lib.identity-rbac/events';
+
+bus.subscribe(UserCreatedEvent, async (event) => {
+  // Handle user creation
+});
+```
+
+## Entity Overview
+
+| Entity | Description |
+|--------|-------------|
+| User | Platform user with profile and auth |
+| Organization | Tenant/company grouping |
+| Member | User's membership in an organization |
+| Role | Named set of permissions |
+| Permission | Atomic access right |
+| PolicyBinding | Binds roles to principals |
+| Team | Optional team within organization |
+
+## Schemas
+
+All entities are defined in the `lssm_sigil` PostgreSQL schema for isolation.
+
+## Events
+
+| Event | Trigger |
+|-------|---------|
+| user.created | New user registered |
+| user.updated | User profile changed |
+| user.deleted | User account removed |
+| org.created | New organization created |
+| org.member.added | User joined organization |
+| org.member.removed | User left organization |
+| role.assigned | Role assigned to user/org |
+| role.revoked | Role removed from user/org |
+

package/dist/contracts/index.d.ts

@@ -0,0 +1,4 @@
+import { CreateUserContract, CreateUserInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel } from "./user.js";
+import { AcceptInviteContract, AcceptInviteInputModel, CreateOrgContract, CreateOrgInputModel, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, RemoveMemberContract, RemoveMemberInputModel, UpdateOrgContract, UpdateOrgInputModel } from "./organization.js";
+import { AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateRoleContract, CreateRoleInputModel, DeleteRoleContract, DeleteRoleInputModel, ListRolesContract, ListRolesOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, UpdateRoleContract, UpdateRoleInputModel } from "./rbac.js";
+export { AcceptInviteContract, AcceptInviteInputModel, AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateOrgContract, CreateOrgInputModel, CreateRoleContract, CreateRoleInputModel, CreateUserContract, CreateUserInputModel, DeleteRoleContract, DeleteRoleInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListRolesContract, ListRolesOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, PermissionCheckResultModel, PolicyBindingModel, RemoveMemberContract, RemoveMemberInputModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, SuccessResultModel, UpdateOrgContract, UpdateOrgInputModel, UpdateRoleContract, UpdateRoleInputModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel };

package/dist/contracts/index.js

@@ -0,0 +1,5 @@
+import { CreateUserContract, CreateUserInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, SuccessResultModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel } from "./user.js";
+import { AcceptInviteContract, AcceptInviteInputModel, CreateOrgContract, CreateOrgInputModel, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, RemoveMemberContract, RemoveMemberInputModel, UpdateOrgContract, UpdateOrgInputModel } from "./organization.js";
+import { AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateRoleContract, CreateRoleInputModel, DeleteRoleContract, DeleteRoleInputModel, ListRolesContract, ListRolesOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, UpdateRoleContract, UpdateRoleInputModel } from "./rbac.js";
+
+export { AcceptInviteContract, AcceptInviteInputModel, AssignRoleContract, AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionContract, CheckPermissionInputModel, CreateOrgContract, CreateOrgInputModel, CreateRoleContract, CreateRoleInputModel, CreateUserContract, CreateUserInputModel, DeleteRoleContract, DeleteRoleInputModel, DeleteUserContract, DeleteUserInputModel, GetCurrentUserContract, GetOrgContract, GetOrgInputModel, InvitationModel, InviteMemberContract, InviteMemberInputModel, ListMembersContract, ListMembersInputModel, ListMembersOutputModel, ListRolesContract, ListRolesOutputModel, ListUserOrgsContract, ListUserOrgsOutputModel, ListUserPermissionsContract, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, ListUsersContract, ListUsersInputModel, ListUsersOutputModel, MemberModel, MemberRemovedPayloadModel, MemberUserModel, OrganizationModel, OrganizationWithRoleModel, PermissionCheckResultModel, PolicyBindingModel, RemoveMemberContract, RemoveMemberInputModel, RevokeRoleContract, RevokeRoleInputModel, RoleModel, SuccessResultModel, UpdateOrgContract, UpdateOrgInputModel, UpdateRoleContract, UpdateRoleInputModel, UpdateUserContract, UpdateUserInputModel, UserDeletedPayloadModel, UserProfileModel };