@grubbylee/aiba 0.1.1

package/capabilities/review-access/recipes/typescript-reference.yaml

@@ -0,0 +1,78 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Review Access
+  description: >-
+    Semantic implementation guidance for a server-authoritative review access
+    boundary in TypeScript projects.
+spec:
+  capability:
+    id: review-access
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - miniprogram/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-reviewer-boundary
+      intent: Implement a reviewer principal that cannot impersonate normal or administrative users.
+      requiredInterfaces: [identity.principal, authorization.decision]
+      invariants: [reviewer-is-distinct-principal, client-cannot-self-assert-reviewer]
+      guidance:
+        - Derive reviewer identity, permissions, and enablement only from trusted server configuration.
+        - Reject client-provided role, scope, data-mode, or reviewer identity assertions.
+    - id: constrain-review-session
+      intent: Bind review access to an enabled release, a short lifetime, and explicit revocation.
+      requiredInterfaces: [identity.principal, authorization.decision]
+      invariants: [server-authoritative-enable, access-expires, access-is-revocable]
+      guidance:
+        - Enforce enablement and expiry on every authentication and authorization boundary.
+        - Store revocation state in a server-authoritative component.
+    - id: isolate-review-data
+      intent: Restrict reviewers to explicit read-only scopes and isolated or sanitized data.
+      requiredInterfaces: [authorization.decision]
+      invariants: [scope-is-least-privilege, production-data-is-isolated]
+      guidance:
+        - Use an allowlist of review-only actions and datasets.
+        - Never make unrestricted production records reachable through a review session.
+    - id: defend-and-audit
+      intent: Rate-limit authentication attempts and emit attributable audit events.
+      requiredInterfaces: [audit.event]
+      invariants: [attempts-are-rate-limited, actions-are-audited]
+      guidance:
+        - Apply rate limits in trusted server state rather than client storage.
+        - Audit authentication, denial, session creation, authorization, expiry, and revocation.
+  evidence:
+    - invariant: reviewer-is-distinct-principal
+      suggestions: &sourceTestSuggestions
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Server-side review access implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Security-focused review access tests.
+    - invariant: server-authoritative-enable
+      suggestions: *sourceTestSuggestions
+    - invariant: scope-is-least-privilege
+      suggestions: *sourceTestSuggestions
+    - invariant: access-expires
+      suggestions: *sourceTestSuggestions
+    - invariant: access-is-revocable
+      suggestions: *sourceTestSuggestions
+    - invariant: production-data-is-isolated
+      suggestions: *sourceTestSuggestions
+    - invariant: attempts-are-rate-limited
+      suggestions: *sourceTestSuggestions
+    - invariant: actions-are-audited
+      suggestions: *sourceTestSuggestions
+    - invariant: client-cannot-self-assert-reviewer
+      suggestions: *sourceTestSuggestions

package/capabilities/review-access/recipes/wechat-native.yaml

@@ -0,0 +1,73 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: wechat-native
+  version: 0.1.0
+  title: Native WeChat Mini Program Review Access
+  description: >-
+    Semantic guidance for a native WeChat Mini Program review entry backed by
+    a server-authoritative TypeScript security boundary.
+spec:
+  capability:
+    id: review-access
+    version: 0.1.0
+  compatibility:
+    languages: [JavaScript, TypeScript]
+    frameworks: [WeChat Mini Program]
+  writeScope:
+    allowedPatterns:
+      - miniprogram/**
+      - src/**
+  operations:
+    - id: add-review-entry
+      intent: Add a reviewer-facing Mini Program entry that submits only credential and release identity.
+      requiredInterfaces: [identity.principal]
+      invariants: [client-cannot-self-assert-reviewer, reviewer-is-distinct-principal]
+      guidance:
+        - Do not place enablement, reviewer roles, scopes, secrets, or production data rules in Mini Program code.
+        - Keep reviewer session tokens in memory and use a dedicated reviewer principal returned by the server.
+    - id: enforce-server-policy
+      intent: Enforce release binding, enablement, expiration, revocation, and rate limits in trusted server state.
+      requiredInterfaces: [identity.principal, authorization.decision]
+      invariants: [server-authoritative-enable, access-expires, access-is-revocable, attempts-are-rate-limited]
+      guidance:
+        - Derive the rate-limit key from trusted transport metadata rather than request body fields.
+        - Re-evaluate policy while authorizing an existing review session.
+    - id: isolate-review-capabilities
+      intent: Expose only fixed review operations backed by isolated or sanitized data.
+      requiredInterfaces: [authorization.decision]
+      invariants: [scope-is-least-privilege, production-data-is-isolated]
+      guidance:
+        - Map each endpoint to a server-owned scope instead of accepting arbitrary scope input.
+        - Inject an isolated review dataset without a production-data fallback.
+    - id: audit-review-boundary
+      intent: Emit attributable audit events for authentication, authorization, denial, and revocation.
+      requiredInterfaces: [audit.event]
+      invariants: [actions-are-audited]
+      guidance:
+        - Record outcomes and reason codes without logging raw credentials or session tokens.
+  evidence:
+    - invariant: reviewer-is-distinct-principal
+      suggestions: &wechatEvidence
+        - type: source
+          pathPattern: src/server/**/*.ts
+          description: Server-authoritative review access implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Black-box review access attack tests.
+    - invariant: server-authoritative-enable
+      suggestions: *wechatEvidence
+    - invariant: scope-is-least-privilege
+      suggestions: *wechatEvidence
+    - invariant: access-expires
+      suggestions: *wechatEvidence
+    - invariant: access-is-revocable
+      suggestions: *wechatEvidence
+    - invariant: production-data-is-isolated
+      suggestions: *wechatEvidence
+    - invariant: attempts-are-rate-limited
+      suggestions: *wechatEvidence
+    - invariant: actions-are-audited
+      suggestions: *wechatEvidence
+    - invariant: client-cannot-self-assert-reviewer
+      suggestions: *wechatEvidence

package/capabilities/users/README.md

@@ -0,0 +1,8 @@
+# Users Capability
+
+`users` defines tenant-scoped user lifecycle management over trusted identity,
+authorization, and audit boundaries. It separates profile data from roles and
+credentials, uses explicit states, and coordinates disable/delete with session
+revocation.
+
+It does not prescribe a user table, directory provider, permission model, or UI.

package/capabilities/users/capability.yaml

@@ -0,0 +1,76 @@
+apiVersion: aiba.dev/v0alpha1
+kind: Capability
+metadata:
+  id: users
+  version: 0.1.0
+  title: Users
+  description: >-
+    Authorized, tenant-scoped user lifecycle management with server-derived
+    identity, explicit states, session revocation, and attributable changes.
+spec:
+  interfaces:
+    - identity.principal
+    - identity.session
+    - authorization.decision
+    - audit.event
+    - users.lifecycle
+  dependencies:
+    - id: identity
+      version: ^0.1.0
+      optional: false
+    - id: authorization
+      version: ^0.1.0
+      optional: false
+    - id: audit
+      version: ^0.1.0
+      optional: false
+  invariants:
+    - id: tenant-and-id-are-server-derived
+      title: Tenant and ID are server derived
+      description: User identifiers and tenant ownership cannot be selected through lifecycle request fields.
+      severity: critical
+      evidence: &sourceAndTest
+        acceptedTypes: [source, test, config, document]
+        requiredTypes: [source, test]
+        minimum: 2
+        requireHash: true
+    - id: every-operation-is-authorized
+      title: Every operation is authorized
+      description: Read and mutation operations require an explicit authorization decision over the target user.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: tenant-boundaries-hide-records
+      title: Tenant boundaries hide records
+      description: Cross-tenant records are neither returned nor distinguishable from missing records.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: roles-and-credentials-are-separate
+      title: Roles and credentials are separate
+      description: Profile and lifecycle inputs cannot assign roles, permissions, passwords, or credential material.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: lifecycle-transitions-are-explicit
+      title: Lifecycle transitions are explicit
+      description: Pending, active, disabled, and deleted states follow a bounded transition graph and deleted users cannot be revived.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: identifiers-are-unique-per-tenant
+      title: Identifiers are unique per tenant
+      description: Normalized login identifiers cannot create duplicate active user identity inside one tenant.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: disable-and-delete-revoke-sessions
+      title: Disable and delete revoke sessions
+      description: Disabling or deleting a user triggers trusted revocation of all reusable sessions.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: mutations-and-audit-commit-together
+      title: Mutations and audit commit together
+      description: User state and its audit outbox record are committed atomically or the mutation fails visibly.
+      severity: critical
+      evidence: *sourceAndTest
+    - id: returned-profile-is-minimized
+      title: Returned profile is minimized
+      description: Lifecycle responses exclude credential material, roles, permissions, and unnecessary identifiers.
+      severity: error
+      evidence: *sourceAndTest

package/capabilities/users/recipes/typescript-reference.yaml

@@ -0,0 +1,75 @@
+apiVersion: aiba.dev/v0alpha1
+kind: CapabilityRecipe
+metadata:
+  id: typescript-reference
+  version: 0.1.0
+  title: TypeScript Users Lifecycle
+  description: Semantic guidance for a tenant-safe, authorized TypeScript user directory.
+spec:
+  capability:
+    id: users
+    version: 0.1.0
+  compatibility:
+    languages: [TypeScript]
+    frameworks: []
+  writeScope:
+    allowedPatterns:
+      - src/**
+      - server/**
+      - test/**
+      - tests/**
+      - cloudfunctions/**
+  operations:
+    - id: establish-user-record-boundary
+      intent: Derive user identity and tenant ownership on the server while keeping roles and credentials separate.
+      requiredInterfaces: [identity.principal, users.lifecycle]
+      invariants: [tenant-and-id-are-server-derived, roles-and-credentials-are-separate, identifiers-are-unique-per-tenant, returned-profile-is-minimized]
+      guidance:
+        - Take tenant ownership from trusted principal context and generate opaque user IDs inside the service.
+        - Reject role, permission, status, tenant, ID, password, and credential fields in create/profile inputs.
+    - id: authorize-user-operations
+      intent: Evaluate an explicit user resource decision for every read and mutation.
+      requiredInterfaces: [authorization.decision]
+      invariants: [every-operation-is-authorized, tenant-boundaries-hide-records]
+      guidance:
+        - Bind object-level checks to the actual record tenant and user ID before returning data.
+        - Return the same public not-found result for missing and cross-tenant records.
+    - id: enforce-user-lifecycle
+      intent: Apply a bounded state graph and revoke sessions for disabled or deleted users.
+      requiredInterfaces: [identity.session, users.lifecycle]
+      invariants: [lifecycle-transitions-are-explicit, disable-and-delete-revoke-sessions]
+      guidance:
+        - Keep deleted users terminal and represent deletion without silently reusing identity.
+        - Coordinate disable/delete with a session-revocation command through trusted infrastructure.
+    - id: commit-user-audit
+      intent: Commit each user mutation with an audit outbox event and optimistic version check.
+      requiredInterfaces: [audit.event]
+      invariants: [mutations-and-audit-commit-together]
+      guidance:
+        - Use a database transaction or equivalent outbox boundary for the user state and audit event.
+        - Reject concurrent stale writes instead of overwriting a newer lifecycle state.
+  evidence:
+    - invariant: tenant-and-id-are-server-derived
+      suggestions: &usersEvidence
+        - type: source
+          pathPattern: src/**/*.ts
+          description: Authorized user lifecycle implementation.
+        - type: test
+          pathPattern: src/**/*.test.ts
+          description: Tenant, lifecycle, and mutation tests.
+    - invariant: every-operation-is-authorized
+      suggestions: *usersEvidence
+    - invariant: tenant-boundaries-hide-records
+      suggestions: *usersEvidence
+    - invariant: roles-and-credentials-are-separate
+      suggestions: *usersEvidence
+    - invariant: lifecycle-transitions-are-explicit
+      suggestions: *usersEvidence
+    - invariant: identifiers-are-unique-per-tenant
+      suggestions: *usersEvidence
+    - invariant: disable-and-delete-revoke-sessions
+      suggestions: *usersEvidence
+    - invariant: mutations-and-audit-commit-together
+      suggestions: *usersEvidence
+    - invariant: returned-profile-is-minimized
+      suggestions: *usersEvidence

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};