@intentius/chant-lexicon-cedar 0.44.8

package/src/generated/index.d.ts

@@ -0,0 +1,219 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { Declarable } from "@intentius/chant/declarable";
+
+/**
+ * Entity UID of `App::Application`.
+ */
+export type ApplicationUid = `App::Application::"${string}"`;
+
+export interface ApplicationAttributesProps {
+  name: string;
+  owner: TeamUid;
+}
+
+/**
+ * Entity UID of `App::Document`.
+ * Member of: App::Folder.
+ */
+export type DocumentUid = `App::Document::"${string}"`;
+
+export interface DocumentAttributesProps {
+  classification: string;
+  folder: FolderUid;
+  owner: UserUid;
+  public: boolean;
+  tags: string[];
+  title: string;
+}
+
+/**
+ * Entity UID of `App::Folder`.
+ */
+export type FolderUid = `App::Folder::"${string}"`;
+
+export interface FolderAttributesProps {
+  name: string;
+  owner: UserUid;
+  tags: string[];
+}
+
+/**
+ * Entity UID of `App::Group`.
+ */
+export type GroupUid = `App::Group::"${string}"`;
+
+export interface GroupAttributesProps {
+  description?: string;
+  name: string;
+}
+
+/**
+ * Entity UID of `App::ServiceAccount`.
+ * Member of: App::Group.
+ */
+export type ServiceAccountUid = `App::ServiceAccount::"${string}"`;
+
+export interface ServiceAccountAttributesProps {
+  name: string;
+  owner: UserUid;
+  rotatedAt?: string;
+}
+
+/**
+ * Entity UID of `App::Team`.
+ * Member of: App::Group.
+ */
+export type TeamUid = `App::Team::"${string}"`;
+
+export interface TeamAttributesProps {
+  costCenter?: string;
+  name: string;
+}
+
+/**
+ * Entity UID of `App::User`.
+ * Member of: App::Group, App::Team.
+ */
+export type UserUid = `App::User::"${string}"`;
+
+export interface UserAttributesProps {
+  department: string;
+  email: string;
+  level: number;
+  manager?: UserUid;
+  mfaEnabled: boolean;
+  roles: string[];
+}
+
+export interface AdminContextProps {
+  breakGlass?: boolean;
+  mfa: boolean;
+}
+
+export interface ApproveContextProps {
+  mfa: boolean;
+}
+
+export interface CommentContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+export interface CreateContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+export interface DeleteContextProps {
+  approvedBy?: UserUid;
+  mfa: boolean;
+}
+
+export interface ListContextProps {
+  mfa: boolean;
+  sourceIp?: string;
+}
+
+export interface ReadContextProps {
+  mfa: boolean;
+  sourceIp?: string;
+}
+
+export interface ShareContextProps {
+  approvedBy?: UserUid;
+  mfa: boolean;
+}
+
+export interface WriteContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+/** Every entity type name the schema declares, as Cedar writes it. */
+export type EntityTypeName = "App::Application" | "App::Document" | "App::Folder" | "App::Group" | "App::ServiceAccount" | "App::Team" | "App::User";
+
+/** Every entity UID the schema can produce. */
+export type EntityUid = ApplicationUid | DocumentUid | FolderUid | GroupUid | ServiceAccountUid | TeamUid | UserUid;
+
+/** Every action UID the schema declares. */
+export type ActionUid = "App::Action::\"admin\"" | "App::Action::\"approve\"" | "App::Action::\"comment\"" | "App::Action::\"create\"" | "App::Action::\"delete\"" | "App::Action::\"list\"" | "App::Action::\"read\"" | "App::Action::\"share\"" | "App::Action::\"write\"";
+
+/** Anything a policy scope may name. */
+export type PolicyRef = EntityUid | ActionUid;
+
+/** A Cedar policy either permits or forbids; there is no third effect. */
+export type PolicyEffect = "permit" | "forbid";
+
+/**
+ * One scope position (`principal`, `action`, `resource`).
+ * 
+ * `{}` is the unconstrained form Cedar writes as a bare variable. The
+ * constrained forms mirror the grammar: `== E`, `in E`, `in [E, …]`,
+ * `is T`, and `is T in E`.
+ */
+export type PolicyScope =
+  | Record<string, never>
+  | { eq: PolicyRef; in?: never; is?: never }
+  | { in: PolicyRef | PolicyRef[]; eq?: never; is?: never }
+  | { is: EntityTypeName; in?: PolicyRef | PolicyRef[]; eq?: never };
+
+/**
+ * The props of a `Cedar::Policy`.
+ * 
+ * `when`/`unless` carry Cedar expression text. They stay strings because
+ * Cedar's expression grammar is the policy language itself — typing it in
+ * TypeScript is import/reconcile's problem (epic #1645 sub-issue 6), not
+ * codegen's.
+ */
+export interface PolicyProps {
+  /** Defaults to `permit` when omitted. */
+  effect?: PolicyEffect;
+  principal?: PolicyScope;
+  action?: PolicyScope;
+  resource?: PolicyScope;
+  /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+  when?: string[];
+  /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+  unless?: string[];
+  /** Emitted as `@key("value")`; an explicit `id` wins over the logical name. */
+  annotations?: Record<string, string>;
+}
+
+export declare const Policy: new (props: PolicyProps) => Declarable;
+
+export declare const Application: new (props: ApplicationAttributesProps) => Declarable;
+export declare const ApplicationAttributes: new (props: ApplicationAttributesProps) => Declarable;
+export declare const Document: new (props: DocumentAttributesProps) => Declarable;
+export declare const DocumentAttributes: new (props: DocumentAttributesProps) => Declarable;
+export declare const Folder: new (props: FolderAttributesProps) => Declarable;
+export declare const FolderAttributes: new (props: FolderAttributesProps) => Declarable;
+export declare const Group: new (props: GroupAttributesProps) => Declarable;
+export declare const GroupAttributes: new (props: GroupAttributesProps) => Declarable;
+export declare const ServiceAccount: new (props: ServiceAccountAttributesProps) => Declarable;
+export declare const ServiceAccountAttributes: new (props: ServiceAccountAttributesProps) => Declarable;
+export declare const Team: new (props: TeamAttributesProps) => Declarable;
+export declare const TeamAttributes: new (props: TeamAttributesProps) => Declarable;
+export declare const User: new (props: UserAttributesProps) => Declarable;
+export declare const UserAttributes: new (props: UserAttributesProps) => Declarable;
+
+export declare const AdminAction: "App::Action::\"admin\"";
+export declare const AdminContext: new (props: AdminContextProps) => Declarable;
+export declare const ApproveAction: "App::Action::\"approve\"";
+export declare const ApproveContext: new (props: ApproveContextProps) => Declarable;
+export declare const CommentAction: "App::Action::\"comment\"";
+export declare const CommentContext: new (props: CommentContextProps) => Declarable;
+export declare const CreateAction: "App::Action::\"create\"";
+export declare const CreateContext: new (props: CreateContextProps) => Declarable;
+export declare const DeleteAction: "App::Action::\"delete\"";
+export declare const DeleteContext: new (props: DeleteContextProps) => Declarable;
+export declare const ListAction: "App::Action::\"list\"";
+export declare const ListContext: new (props: ListContextProps) => Declarable;
+export declare const ReadAction: "App::Action::\"read\"";
+export declare const ReadContext: new (props: ReadContextProps) => Declarable;
+export declare const ShareAction: "App::Action::\"share\"";
+export declare const ShareContext: new (props: ShareContextProps) => Declarable;
+export declare const WriteAction: "App::Action::\"write\"";
+export declare const WriteContext: new (props: WriteContextProps) => Declarable;
+
+export declare const ALL_ACTIONS: readonly ActionUid[];
+export declare const ALL_ENTITY_TYPES: readonly EntityTypeName[];

package/src/generated/index.ts

@@ -0,0 +1,279 @@
+// Code generated by chant generate. DO NOT EDIT.
+import type { Declarable } from "@intentius/chant/declarable";
+import { createProperty, createResource } from "./runtime";
+
+/**
+ * Entity UID of `App::Application`.
+ */
+export type ApplicationUid = `App::Application::"${string}"`;
+
+export interface ApplicationAttributesProps {
+  name: string;
+  owner: TeamUid;
+}
+
+/**
+ * Entity UID of `App::Document`.
+ * Member of: App::Folder.
+ */
+export type DocumentUid = `App::Document::"${string}"`;
+
+export interface DocumentAttributesProps {
+  classification: string;
+  folder: FolderUid;
+  owner: UserUid;
+  public: boolean;
+  tags: string[];
+  title: string;
+}
+
+/**
+ * Entity UID of `App::Folder`.
+ */
+export type FolderUid = `App::Folder::"${string}"`;
+
+export interface FolderAttributesProps {
+  name: string;
+  owner: UserUid;
+  tags: string[];
+}
+
+/**
+ * Entity UID of `App::Group`.
+ */
+export type GroupUid = `App::Group::"${string}"`;
+
+export interface GroupAttributesProps {
+  description?: string;
+  name: string;
+}
+
+/**
+ * Entity UID of `App::ServiceAccount`.
+ * Member of: App::Group.
+ */
+export type ServiceAccountUid = `App::ServiceAccount::"${string}"`;
+
+export interface ServiceAccountAttributesProps {
+  name: string;
+  owner: UserUid;
+  rotatedAt?: string;
+}
+
+/**
+ * Entity UID of `App::Team`.
+ * Member of: App::Group.
+ */
+export type TeamUid = `App::Team::"${string}"`;
+
+export interface TeamAttributesProps {
+  costCenter?: string;
+  name: string;
+}
+
+/**
+ * Entity UID of `App::User`.
+ * Member of: App::Group, App::Team.
+ */
+export type UserUid = `App::User::"${string}"`;
+
+export interface UserAttributesProps {
+  department: string;
+  email: string;
+  level: number;
+  manager?: UserUid;
+  mfaEnabled: boolean;
+  roles: string[];
+}
+
+export interface AdminContextProps {
+  breakGlass?: boolean;
+  mfa: boolean;
+}
+
+export interface ApproveContextProps {
+  mfa: boolean;
+}
+
+export interface CommentContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+export interface CreateContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+export interface DeleteContextProps {
+  approvedBy?: UserUid;
+  mfa: boolean;
+}
+
+export interface ListContextProps {
+  mfa: boolean;
+  sourceIp?: string;
+}
+
+export interface ReadContextProps {
+  mfa: boolean;
+  sourceIp?: string;
+}
+
+export interface ShareContextProps {
+  approvedBy?: UserUid;
+  mfa: boolean;
+}
+
+export interface WriteContextProps {
+  mfa: boolean;
+  reason?: string;
+}
+
+/** Every entity type name the schema declares, as Cedar writes it. */
+export type EntityTypeName = "App::Application" | "App::Document" | "App::Folder" | "App::Group" | "App::ServiceAccount" | "App::Team" | "App::User";
+
+/** Every entity UID the schema can produce. */
+export type EntityUid = ApplicationUid | DocumentUid | FolderUid | GroupUid | ServiceAccountUid | TeamUid | UserUid;
+
+/** Every action UID the schema declares. */
+export type ActionUid = "App::Action::\"admin\"" | "App::Action::\"approve\"" | "App::Action::\"comment\"" | "App::Action::\"create\"" | "App::Action::\"delete\"" | "App::Action::\"list\"" | "App::Action::\"read\"" | "App::Action::\"share\"" | "App::Action::\"write\"";
+
+/** Anything a policy scope may name. */
+export type PolicyRef = EntityUid | ActionUid;
+
+/** A Cedar policy either permits or forbids; there is no third effect. */
+export type PolicyEffect = "permit" | "forbid";
+
+/**
+ * One scope position (`principal`, `action`, `resource`).
+ * 
+ * `{}` is the unconstrained form Cedar writes as a bare variable. The
+ * constrained forms mirror the grammar: `== E`, `in E`, `in [E, …]`,
+ * `is T`, and `is T in E`.
+ */
+export type PolicyScope =
+  | Record<string, never>
+  | { eq: PolicyRef; in?: never; is?: never }
+  | { in: PolicyRef | PolicyRef[]; eq?: never; is?: never }
+  | { is: EntityTypeName; in?: PolicyRef | PolicyRef[]; eq?: never };
+
+/**
+ * The props of a `Cedar::Policy`.
+ * 
+ * `when`/`unless` carry Cedar expression text. They stay strings because
+ * Cedar's expression grammar is the policy language itself — typing it in
+ * TypeScript is import/reconcile's problem (epic #1645 sub-issue 6), not
+ * codegen's.
+ */
+export interface PolicyProps {
+  /** Defaults to `permit` when omitted. */
+  effect?: PolicyEffect;
+  principal?: PolicyScope;
+  action?: PolicyScope;
+  resource?: PolicyScope;
+  /** Cedar expression strings, each emitted as its own `when { … }` clause. */
+  when?: string[];
+  /** Cedar expression strings, each emitted as its own `unless { … }` clause. */
+  unless?: string[];
+  /** Emitted as `@key("value")`; an explicit `id` wins over the logical name. */
+  annotations?: Record<string, string>;
+}
+
+/**
+ * The policy resource. Declare one per policy:
+ * 
+ * ```ts
+ * export const allowOwnerRead = new Policy({
+ *   principal: { is: "App::User" },
+ *   action: { eq: ReadAction },
+ *   when: ['resource.owner == principal'],
+ * });
+ * ```
+ */
+export const Policy = createResource("Cedar::Policy", "cedar", {}) as unknown as new (props: PolicyProps) => Declarable;
+
+export const Application = createResource("App::Application", "cedar", {}) as unknown as new (props: ApplicationAttributesProps) => Declarable;
+export const ApplicationAttributes = createProperty("App::Application.Attributes", "cedar") as unknown as new (props: ApplicationAttributesProps) => Declarable;
+export const Document = createResource("App::Document", "cedar", {}) as unknown as new (props: DocumentAttributesProps) => Declarable;
+export const DocumentAttributes = createProperty("App::Document.Attributes", "cedar") as unknown as new (props: DocumentAttributesProps) => Declarable;
+export const Folder = createResource("App::Folder", "cedar", {}) as unknown as new (props: FolderAttributesProps) => Declarable;
+export const FolderAttributes = createProperty("App::Folder.Attributes", "cedar") as unknown as new (props: FolderAttributesProps) => Declarable;
+export const Group = createResource("App::Group", "cedar", {}) as unknown as new (props: GroupAttributesProps) => Declarable;
+export const GroupAttributes = createProperty("App::Group.Attributes", "cedar") as unknown as new (props: GroupAttributesProps) => Declarable;
+export const ServiceAccount = createResource("App::ServiceAccount", "cedar", {}) as unknown as new (props: ServiceAccountAttributesProps) => Declarable;
+export const ServiceAccountAttributes = createProperty("App::ServiceAccount.Attributes", "cedar") as unknown as new (props: ServiceAccountAttributesProps) => Declarable;
+export const Team = createResource("App::Team", "cedar", {}) as unknown as new (props: TeamAttributesProps) => Declarable;
+export const TeamAttributes = createProperty("App::Team.Attributes", "cedar") as unknown as new (props: TeamAttributesProps) => Declarable;
+export const User = createResource("App::User", "cedar", {}) as unknown as new (props: UserAttributesProps) => Declarable;
+export const UserAttributes = createProperty("App::User.Attributes", "cedar") as unknown as new (props: UserAttributesProps) => Declarable;
+
+/**
+ * `App::Action::"admin"`.
+ * Principals: App::User.
+ * Resources: App::Application.
+ */
+export const AdminAction = "App::Action::\"admin\"" as const;
+export const AdminContext = createProperty("App::Action::\"admin\".Context", "cedar") as unknown as new (props: AdminContextProps) => Declarable;
+/**
+ * `App::Action::"approve"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export const ApproveAction = "App::Action::\"approve\"" as const;
+export const ApproveContext = createProperty("App::Action::\"approve\".Context", "cedar") as unknown as new (props: ApproveContextProps) => Declarable;
+/**
+ * `App::Action::"comment"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export const CommentAction = "App::Action::\"comment\"" as const;
+export const CommentContext = createProperty("App::Action::\"comment\".Context", "cedar") as unknown as new (props: CommentContextProps) => Declarable;
+/**
+ * `App::Action::"create"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export const CreateAction = "App::Action::\"create\"" as const;
+export const CreateContext = createProperty("App::Action::\"create\".Context", "cedar") as unknown as new (props: CreateContextProps) => Declarable;
+/**
+ * `App::Action::"delete"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export const DeleteAction = "App::Action::\"delete\"" as const;
+export const DeleteContext = createProperty("App::Action::\"delete\".Context", "cedar") as unknown as new (props: DeleteContextProps) => Declarable;
+/**
+ * `App::Action::"list"`.
+ * Principals: App::ServiceAccount, App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export const ListAction = "App::Action::\"list\"" as const;
+export const ListContext = createProperty("App::Action::\"list\".Context", "cedar") as unknown as new (props: ListContextProps) => Declarable;
+/**
+ * `App::Action::"read"`.
+ * Principals: App::ServiceAccount, App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export const ReadAction = "App::Action::\"read\"" as const;
+export const ReadContext = createProperty("App::Action::\"read\".Context", "cedar") as unknown as new (props: ReadContextProps) => Declarable;
+/**
+ * `App::Action::"share"`.
+ * Principals: App::User.
+ * Resources: App::Document.
+ */
+export const ShareAction = "App::Action::\"share\"" as const;
+export const ShareContext = createProperty("App::Action::\"share\".Context", "cedar") as unknown as new (props: ShareContextProps) => Declarable;
+/**
+ * `App::Action::"write"`.
+ * Principals: App::User.
+ * Resources: App::Document, App::Folder.
+ */
+export const WriteAction = "App::Action::\"write\"" as const;
+export const WriteContext = createProperty("App::Action::\"write\".Context", "cedar") as unknown as new (props: WriteContextProps) => Declarable;
+
+/** Every generated action constant, for exhaustive iteration. */
+export const ALL_ACTIONS: readonly ActionUid[] = [AdminAction, ApproveAction, CommentAction, CreateAction, DeleteAction, ListAction, ReadAction, ShareAction, WriteAction];
+
+/** Every entity type name the schema declares. */
+export const ALL_ENTITY_TYPES: readonly EntityTypeName[] = ["App::Application", "App::Document", "App::Folder", "App::Group", "App::ServiceAccount", "App::Team", "App::User"];