@grantjs/schema 1.18.0 → 1.18.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@grantjs/schema",
3
- "version": "1.18.0",
3
+ "version": "1.18.2",
4
4
  "license": "MIT",
5
5
  "repository": {
6
6
  "type": "git",
@@ -24,7 +24,7 @@
24
24
  "devDependencies": {
25
25
  "@graphql-codegen/add": "^7.1.1",
26
26
  "@graphql-codegen/cli": "^7.4.6",
27
- "@graphql-codegen/typed-document-node": "^7.1.1",
27
+ "@graphql-codegen/typed-document-node": "^7.2.0",
28
28
  "@graphql-codegen/typescript": "^6.1.2",
29
29
  "@graphql-codegen/typescript-operations": "^6.1.10",
30
30
  "@graphql-codegen/typescript-resolvers": "^6.1.1",
@@ -34,7 +34,7 @@
34
34
  "graphql": "^16.14.2",
35
35
  "@typescript/native": "npm:typescript@^7.0.2",
36
36
  "typescript": "npm:@typescript/typescript6@^6.0.2",
37
- "vitest": "^5.0.3"
37
+ "vitest": "^5.0.5"
38
38
  },
39
39
  "scripts": {
40
40
  "dev": "graphql-codegen --config codegen.ts generate --watch",
@@ -3,17 +3,62 @@ import type { EventCategory, EventType } from './event-catalog';
3
3
 
4
4
  /**
5
5
  * Payload carried inside an event. The internal model can be rich; the external
6
- * webhook envelope projects `data` through a redaction allowlist.
6
+ * webhook envelope projects `data` (see `ExternalEventData`): `after` and `delta`
7
+ * are redacted, `before` is reduced to its identity fields.
7
8
  */
8
9
  export interface EventData {
9
10
  /** Snapshot of the entity after the change (redacted on external delivery). */
10
11
  after?: Record<string, unknown> | null;
11
- /** Snapshot before the change (optional). */
12
+ /** Snapshot before the change (optional). External delivery keeps only its identity fields. */
12
13
  before?: Record<string, unknown> | null;
13
14
  /** Changed-fields delta: field -> { from, to }. */
14
15
  delta?: Record<string, { from: unknown; to: unknown }> | null;
15
16
  }
16
17
 
18
+ /**
19
+ * Keys an external (webhook) `data.before` may carry. The projection copies these,
20
+ * and only these, from the internal `before` snapshot, and only when the value is a
21
+ * string, number, boolean or `null`: a subscriber learns which entity or pivot an
22
+ * event removed, never its profile fields, metadata or secrets.
23
+ */
24
+ export const EVENT_IDENTITY_KEYS = [
25
+ 'id',
26
+ 'name',
27
+ 'slug',
28
+ 'kind',
29
+ 'type',
30
+ 'userId',
31
+ 'roleId',
32
+ 'groupId',
33
+ 'permissionId',
34
+ 'tagId',
35
+ 'apiKeyId',
36
+ 'resourceId',
37
+ 'targetKind',
38
+ 'targetId',
39
+ 'projectId',
40
+ 'roleName',
41
+ 'groupName',
42
+ 'permissionName',
43
+ 'tagName',
44
+ ] as const;
45
+
46
+ export type EventIdentityKey = (typeof EVENT_IDENTITY_KEYS)[number];
47
+
48
+ /** Identity-only projection of an internal `before` snapshot (see `EVENT_IDENTITY_KEYS`). */
49
+ export type EventIdentity = Partial<Record<EventIdentityKey, string | number | boolean | null>>;
50
+
51
+ /**
52
+ * `data` as delivered to webhook consumers: `after` and `delta` redacted, `before`
53
+ * reduced to the identity of the entity or pivot the event is about. Absent when
54
+ * the internal snapshot has no identity field.
55
+ */
56
+ export interface ExternalEventData {
57
+ after?: Record<string, unknown> | null;
58
+ before?: EventIdentity | null;
59
+ delta?: Record<string, { from: unknown; to: unknown }> | null;
60
+ }
61
+
17
62
  /** Reference to the aggregate (entity) the event is about. */
18
63
  export interface EventAggregateRef {
19
64
  kind: string;
@@ -68,7 +113,7 @@ export interface DomainEvent {
68
113
  /**
69
114
  * External event envelope delivered to webhook consumers. CloudEvents 1.0 core
70
115
  * fields plus Grant extension attributes (prefixed `grant`). `data` is the
71
- * redacted projection of the internal payload.
116
+ * redacted projection of the internal payload (`ExternalEventData`).
72
117
  */
73
118
  export interface CloudEventEnvelope {
74
119
  specversion: '1.0';
@@ -83,11 +128,10 @@ export interface CloudEventEnvelope {
83
128
  /**
84
129
  * The user the event is about, when it has one (`user.role_revoked`,
85
130
  * `project.user_removed`, `organization.invitation_sent`, ...). `null` when
86
- * the event has no subject user. Needed because the internal `before`
87
- * snapshot is dropped from external `data`, so revoke/remove events would
88
- * otherwise not say whose access changed.
131
+ * the event has no subject user. It names the user even when `data.before`
132
+ * is absent or carries no `userId`.
89
133
  */
90
134
  grantsubjectuser?: { userId: string } | null;
91
135
  grantcategory: EventCategory;
92
- data: EventData;
136
+ data: ExternalEventData;
93
137
  }