@decaf-ts/integrations 0.3.5 → 0.3.7

package/lib/types/namespaces/org-based-authorization-system.d.mts

@@ -0,0 +1,299 @@
+import { Cascade, ModelService, Repository, transactional } from "@decaf-ts/core";
+import { Model } from "@decaf-ts/decorator-validation";
+export declare enum IsolationTier {
+    Pooled = "pooled",
+    Bridge = "bridge",
+    Silo = "silo"
+}
+export declare enum MembershipStatus {
+    Invited = "invited",
+    Active = "active",
+    Suspended = "suspended",
+    Removed = "removed"
+}
+export declare enum PrincipalKind {
+    User = "user",
+    Group = "group",
+    ServiceAccount = "service_account",
+    Agent = "agent",
+    ApiKey = "api_key"
+}
+export declare enum ScopeKind {
+    Tenant = "tenant",
+    OrgUnit = "org_unit",
+    Resource = "resource"
+}
+export declare enum PermissionCategory {
+    Admin = "admin",
+    ContentRead = "content_read",
+    ContentWrite = "content_write",
+    Memory = "memory",
+    Graph = "graph",
+    Vector = "vector",
+    Export = "export",
+    Billing = "billing",
+    Audit = "audit",
+    Security = "security",
+    Data = "data",
+    Automation = "automation"
+}
+export declare enum ResourceVisibility {
+    Private = "private",
+    ResourceAcl = "resource_acl",
+    OrgUnit = "org_unit",
+    OrgSubtree = "org_subtree",
+    Tenant = "tenant"
+}
+export declare enum StorageKind {
+    Postgres = "postgres",
+    Arango = "arango",
+    Qdrant = "qdrant",
+    ObjectStorage = "object_storage"
+}
+export declare enum StorageBindingKind {
+    Shared = "shared",
+    Dedicated = "dedicated"
+}
+export declare const IsolationTierOptions: IsolationTier[];
+export declare const MembershipStatusOptions: MembershipStatus[];
+export declare const PrincipalKindOptions: PrincipalKind[];
+export declare const ScopeKindOptions: ScopeKind[];
+export declare const PermissionCategoryOptions: PermissionCategory[];
+export declare const ResourceVisibilityOptions: ResourceVisibility[];
+export declare const StorageKindOptions: StorageKind[];
+export declare const StorageBindingKindOptions: StorageBindingKind[];
+export declare const REL_RESTRICT: {
+    readonly update: Cascade.NONE;
+    readonly delete: Cascade.NONE;
+    readonly nullable: false;
+};
+export declare const REL_NULLIFY: {
+    readonly update: Cascade.NONE;
+    readonly delete: Cascade.NONE;
+    readonly nullable: true;
+};
+export declare const REL_CASCADE_DEPENDENT: {
+    readonly update: Cascade.CASCADE;
+    readonly delete: Cascade.CASCADE;
+    readonly nullable: false;
+};
+export declare const REL_CASCADE_INSERT_UPDATE: {
+    readonly update: Cascade.CASCADE;
+    readonly delete: Cascade.NONE;
+    readonly nullable: false;
+};
+export type TxArgs = any[];
+export interface CreateTenantInput {
+    slug: string;
+    name: string;
+    isolationTier?: IsolationTier;
+    profileKey?: string;
+    profileMetadata?: Record<string, unknown>;
+}
+export interface CreateUserInput {
+    email?: string;
+    phone?: string;
+    displayName: string;
+}
+export interface CreateOrgUnitInput {
+    tenantId: string;
+    parentOrgUnitId?: string;
+    name: string;
+    metadata?: Record<string, unknown>;
+    profileKey?: string;
+    profileMetadata?: Record<string, unknown>;
+}
+export interface CreateRoleInput {
+    tenantId?: string;
+    key: string;
+    name: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface CreatePermissionInput {
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+}
+export interface AssignRoleInput {
+    tenantId: string;
+    principalId: string;
+    roleId: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    inheritDown?: boolean;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+}
+export interface RegisterResourceInput {
+    tenantId: string;
+    orgUnitId: string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    ownerPrincipalId?: string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface GrantResourceInput {
+    tenantId: string;
+    resourceId: string;
+    principalId: string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdByPrincipalId?: string;
+}
+export interface CanAccessInput {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    resourceProtectedId?: string;
+    scopeKind?: ScopeKind;
+    scopeId?: string;
+    at?: Date;
+}
+export interface AccessContext {
+    tenantId: string;
+    principalId: string;
+    permissionsByScope: Record<string, string[]>;
+    allowedOrgUnitIdsByPermission: Record<string, string[]>;
+    resourceGrants: Array<{
+        resourceId: string;
+        permissionKey: string;
+    }>;
+}
+export interface ArangoAuthContext {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    allowedOrgUnitIds: string[];
+    allowedResourceIds: string[];
+}
+export interface QdrantAuthFilter {
+    must: Array<Record<string, unknown>>;
+    must_not?: Array<Record<string, unknown>>;
+}
+export interface CreateStorageBindingInput {
+    tenantId: string;
+    storageKind: StorageKind;
+    bindingKind: StorageBindingKind;
+    bindingKey: string;
+    region: string;
+    config?: Record<string, unknown>;
+}
+export interface BootstrapPermission {
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+}
+export interface BootstrapRole {
+    key: string;
+    name: string;
+    description?: string;
+    permissionKeys: string[];
+}
+export interface BootstrapOrgUnit {
+    name: string;
+    profileKey?: string;
+    metadata?: Record<string, unknown>;
+    children?: BootstrapOrgUnit[];
+}
+export interface BootstrapTemplate {
+    tenant: CreateTenantInput;
+    rootOrgUnit: BootstrapOrgUnit;
+    permissions: BootstrapPermission[];
+    roles: BootstrapRole[];
+    ownerUser: CreateUserInput;
+    ownerRoleKey: string;
+}
+export interface ResourceSnapshot {
+    id: string;
+    tenantId: string;
+    orgUnitId: string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    ownerPrincipalId?: string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface GrantSnapshot {
+    id: string;
+    tenantId: string;
+    resourceId: string;
+    principalId: string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdByPrincipalId?: string;
+}
+export interface EffectivePermissionSnapshot {
+    id: string;
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    sourceKind: string;
+    sourceId: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+}
+export interface AuthzDataSources {
+    loadResource?: (tenantId: string, protectedResourceId: string) => Promise<ResourceSnapshot | undefined>;
+    listResourceGrants?: (tenantId: string, protectedResourceId: string) => Promise<GrantSnapshot[]>;
+    listPrincipalGrants?: (tenantId: string, principalId: string) => Promise<GrantSnapshot[]>;
+    listEffectivePermissions?: (tenantId: string, principalId: string) => Promise<EffectivePermissionSnapshot[]>;
+    listEffectivePermissionsForScope?: (tenantId: string, scopeKind: ScopeKind, scopeId: string) => Promise<EffectivePermissionSnapshot[]>;
+}
+export declare function buildArangoContext(options: {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    allowedOrgUnitIds: string[];
+    allowedResourceIds: string[];
+}): ArangoAuthContext;
+export declare function buildQdrantFilter(options: {
+    tenantId: string;
+    principalId: string;
+    permissionKey: string;
+    allowedOrgUnitIds: string[];
+    allowedResourceIds: string[];
+}): QdrantAuthFilter;
+export declare function buildAccessContext(options: {
+    tenantId: string;
+    principalId: string;
+    permissions: EffectivePermissionSnapshot[];
+    grants: GrantSnapshot[];
+}): AccessContext;
+export declare abstract class BaseModelService<M extends Model<boolean> & {
+    id: string;
+}> extends ModelService<M, Repository<M, any>> {
+    protected constructor(clazz: new () => M);
+    protected newModel<T>(clazz: new () => T, data: Partial<T>): T;
+    createOne(data: Partial<M>, ...args: any[]): Promise<M>;
+    getById(id: string, ...args: any[]): Promise<M>;
+    updateOne(id: string, patch: Partial<M>, ...args: any[]): Promise<M>;
+    deleteById(id: string, ...args: any[]): Promise<void>;
+    findOneBy<K extends keyof M & string>(key: K, value: M[K], ...args: any[]): Promise<M>;
+    findManyBy<K extends keyof M & string>(key: K, value: M[K], ...args: any[]): Promise<M[]>;
+    listAll(...args: any[]): Promise<M[]>;
+}
+export declare function id(): string;
+export declare function relationId(value: string | {
+    id: string;
+}): string;
+export declare class AuthzService {
+    private readonly dataSources;
+    constructor(dataSources?: AuthzDataSources);
+    canAccess(input: CanAccessInput, ...args: any[]): Promise<boolean>;
+    requireAccess(input: CanAccessInput, ...args: any[]): Promise<void>;
+    buildAccessContext(tenantId: string, principalId: string, ...args: any[]): Promise<AccessContext>;
+    buildArangoContext(tenantId: string, principalId: string, permissionKey: string, ...args: any[]): Promise<ArangoAuthContext>;
+    buildQdrantFilter(tenantId: string, principalId: string, permissionKey: string, ...args: any[]): Promise<QdrantAuthFilter>;
+}
+export { transactional };

package/lib/types/namespaces/org-based-authorization-system.models.d.cts

@@ -0,0 +1,212 @@
+import { Model } from "@decaf-ts/decorator-validation";
+import { IsolationTier, MembershipStatus, PermissionCategory, PrincipalKind, ResourceVisibility, ScopeKind, StorageBindingKind, StorageKind } from "./org-based-authorization-system.d.cts";
+export declare class AuthorizationModel extends Model {
+    constructor(data?: unknown);
+}
+export declare class Tenant extends AuthorizationModel {
+    id: string;
+    slug: string;
+    name: string;
+    isolationTier: IsolationTier;
+    orgUnits?: OrgUnit[] | string[];
+    memberships?: TenantMembership[] | string[];
+    principals?: Principal[] | string[];
+    storageBindings?: StorageBinding[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantProfile extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnit extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    parent?: OrgUnit | string;
+    children?: OrgUnit[] | string[];
+    name: string;
+    path: string;
+    metadata?: Record<string, unknown>;
+    memberships?: OrgUnitMembership[] | string[];
+    resources?: ProtectedResource[] | string[];
+    inheritanceBlocks?: InheritanceBlock[] | string[];
+    ancestorLinks?: OrgUnitClosure[] | string[];
+    descendantLinks?: OrgUnitClosure[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitProfile extends AuthorizationModel {
+    id: string;
+    orgUnit: OrgUnit | string;
+    profileKey: string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitClosure extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    ancestor: OrgUnit | string;
+    descendant: OrgUnit | string;
+    depth: number;
+    createdAt: Date;
+}
+export declare class User extends AuthorizationModel {
+    id: string;
+    email?: string;
+    phone?: string;
+    displayName: string;
+    tenantMemberships?: TenantMembership[] | string[];
+    orgUnitMemberships?: OrgUnitMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Group extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit?: OrgUnit | string;
+    name: string;
+    metadata?: Record<string, unknown>;
+    members?: GroupMembership[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class Principal extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    kind: PrincipalKind;
+    subjectId: string;
+    roleAssignments?: RoleAssignment[] | string[];
+    resourceGrants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class TenantMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class OrgUnitMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    user: User | string;
+    status: MembershipStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class GroupMembership extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    group: Group | string;
+    principal: Principal | string;
+    metadata?: Record<string, unknown>;
+    createdAt: Date;
+}
+export declare class Permission extends AuthorizationModel {
+    id: string;
+    key: string;
+    category: PermissionCategory;
+    description?: string;
+    rolePermissions?: RolePermission[] | string[];
+}
+export declare class Role extends AuthorizationModel {
+    id: string;
+    tenant?: Tenant | string;
+    key: string;
+    name: string;
+    description?: string;
+    metadata?: Record<string, unknown>;
+    rolePermissions?: RolePermission[] | string[];
+    assignments?: RoleAssignment[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class RolePermission extends AuthorizationModel {
+    id: string;
+    role: Role | string;
+    permission: Permission | string;
+    createdAt: Date;
+}
+export declare class RoleAssignment extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    role: Role | string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    inheritDown: boolean;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class InheritanceBlock extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    blockedFromAncestor?: OrgUnit | string;
+    permissionCategory: PermissionCategory;
+    reason?: string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ProtectedResource extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    orgUnit: OrgUnit | string;
+    resourceType: string;
+    resourceId: string;
+    visibility: ResourceVisibility;
+    owner?: Principal | string;
+    sensitivity?: string;
+    metadata?: Record<string, unknown>;
+    grants?: ResourceGrant[] | string[];
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class ResourceGrant extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    resource: ProtectedResource | string;
+    principal: Principal | string;
+    permissionKey: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    conditions?: Record<string, unknown>;
+    createdBy?: Principal | string;
+    createdAt: Date;
+    updatedAt: Date;
+}
+export declare class EffectivePermission extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    principal: Principal | string;
+    permissionKey: string;
+    scopeKind: ScopeKind;
+    scopeId: string;
+    sourceKind: string;
+    sourceId: string;
+    startsAt?: Date;
+    expiresAt?: Date;
+    createdAt: Date;
+}
+export declare class StorageBinding extends AuthorizationModel {
+    id: string;
+    tenant: Tenant | string;
+    storageKind: StorageKind;
+    bindingKind: StorageBindingKind;
+    bindingKey: string;
+    region: string;
+    config?: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+}