@fonderie/permissions 1.0.1 → 1.0.3

package/brain/outcomes.md

@@ -0,0 +1,28 @@
+<!-- GENERATED — do not edit. Regenerate with: npm run docs:signatures -->
+
+# @fonderie/permissions — outcomes
+
+What this package does to a running app: tables its migrations create,
+rows it seeds, routes it registers. Generated from the migration SQL and
+route tables in source — trust this file instead of reading `dist/` or
+downloading tarballs.
+
+## Database tables (after all migrations)
+
+### `fonderie_role_permissions`
+
+```sql
+id                       UUID PRIMARY KEY DEFAULT gen_random_uuid()
+role_id                  UUID NOT NULL
+workspace_id             UUID
+permission_key           TEXT NOT NULL
+can_create               BOOLEAN NOT NULL DEFAULT false
+can_read                 BOOLEAN NOT NULL DEFAULT false
+can_update               BOOLEAN NOT NULL DEFAULT false
+can_delete               BOOLEAN NOT NULL DEFAULT false
+created_at               TIMESTAMPTZ NOT NULL DEFAULT now()
+-- UNIQUE (role_id, permission_key)
+-- INDEX idx_frp_permission_key (permission_key)
+```
+
+Raw SQL ships in `node_modules/@fonderie/permissions/dist/migrations/sql/` — read it there if you must; never download tarballs.

package/brain/signatures.md

@@ -0,0 +1,72 @@
+<!-- GENERATED — do not edit. Regenerate with: npm run docs:signatures -->
+
+# @fonderie/permissions — signatures
+
+## @fonderie/permissions
+
+Subpath exports: `@fonderie/permissions/config`, `@fonderie/permissions/types`, `@fonderie/permissions/middleware`, `@fonderie/permissions/migrations`
+
+```ts
+type Operation = 'create' | 'read' | 'update' | 'delete';
+
+type PermissionKey = string;
+
+interface IRole {
+    id: string;
+    name: string;
+    isSystem: boolean;
+    workspaceId: string | null;
+}
+
+interface IPermission {
+    permissionKey: PermissionKey;
+    canCreate: boolean;
+    canRead: boolean;
+    canUpdate: boolean;
+    canDelete: boolean;
+}
+
+interface IMembership {
+    userId: string;
+    workspaceId: string;
+    roleId: string;
+    roleName: string;
+}
+
+interface IRoleWithPermissions extends IRole {
+    permissions: IPermission[];
+}
+
+new PermissionsModule(store: IStoreAdapter, config?: IPermissionsConfig): PermissionsModule
+  .engine: PermissionsEngine
+  .name: "@fonderie/permissions"
+  .deps: string[]
+  .install(app: IFonderieApp): void
+
+new PermissionsEngine(store: IStoreAdapter, config?: IPermissionsConfig): PermissionsEngine
+  .getMembership(userId: string, workspaceId: string): Promise<IMembership | null>
+  .can(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<boolean>
+  .assert(userId: string, operation: Operation, permissionKey: string, workspaceId: string): Promise<void>
+  .canAll(userId: string, checks: { operation: Operation; permissionKey: string; }[], workspaceId: string): Promise<boolean>
+  .canAny(userId: string, checks: { operation: Operation; permissionKey: string; }[], workspaceId: string): Promise<boolean>
+
+new PermissionDeniedError(operation: string, permissionKey: string): PermissionDeniedError
+  .status: 403
+  .name: string
+  .message: string
+  .stack: string
+  .cause: unknown
+
+interface IPermissionsConfig {
+    wildcards?: boolean;
+    superRole?: string;
+}
+
+const OPERATIONS: { readonly CREATE: "create"; readonly READ: "read"; readonly UPDATE: "update"; readonly DELETE: "delete"; }
+
+const PERMISSION_COLUMN: { create: string; read: string; update: string; delete: string; }
+
+function requireRole(roleName: string | string[], store: IStoreAdapter): Middleware
+
+function requirePermission(operation: Operation, permissionKey: string): Middleware
+```

package/dist/migrations/sql/001_permissions.sql

@@ -0,0 +1,17 @@
+-- fonderie_role_permissions: CRUD bit flags per role per resource key
+CREATE TABLE IF NOT EXISTS fonderie_role_permissions (
+	id             UUID         PRIMARY KEY DEFAULT gen_random_uuid(),
+	role_id        UUID         NOT NULL,
+	workspace_id   UUID,
+	permission_key TEXT         NOT NULL,
+	can_create     BOOLEAN      NOT NULL DEFAULT false,
+	can_read       BOOLEAN      NOT NULL DEFAULT false,
+	can_update     BOOLEAN      NOT NULL DEFAULT false,
+	can_delete     BOOLEAN      NOT NULL DEFAULT false,
+	created_at     TIMESTAMPTZ  NOT NULL DEFAULT now(),
+	UNIQUE (role_id, permission_key)
+);
+
+CREATE INDEX IF NOT EXISTS idx_frp_role_id        ON fonderie_role_permissions (role_id);
+CREATE INDEX IF NOT EXISTS idx_frp_workspace_id   ON fonderie_role_permissions (workspace_id);
+CREATE INDEX IF NOT EXISTS idx_frp_permission_key ON fonderie_role_permissions (permission_key);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fonderie/permissions",
-	"version": "1.0.1",
+	"version": "1.0.3",
 	"description": "Role-based access control for SaaS — define roles, assign CRUD permissions per resource, and gate any route with requirePermission. Supports multiple roles per user via BOOL_OR aggregation.",
 	"keywords": [
 		"fonderie-js",
@@ -72,16 +72,17 @@
 	},
 	"files": [
 		"dist",
+		"brain",
 		"LICENSE",
 		"README.md"
 	],
 	"repository": {
 		"type": "git",
-		"url": "git+https://github.com/fonderie-js/sdk.git",
+		"url": "git+https://github.com/fonderiejs/sdk.git",
 		"directory": "packages/permissions"
 	},
-	"homepage": "https://github.com/fonderie-js/sdk/tree/main/packages/permissions#readme",
+	"homepage": "https://github.com/fonderiejs/sdk/tree/main/packages/permissions#readme",
 	"bugs": {
-		"url": "https://github.com/fonderie-js/sdk/issues"
+		"url": "https://github.com/fonderiejs/sdk/issues"
 	}
 }