@jskit-ai/users-core 0.1.31 → 0.1.33

package/src/shared/resources/workspaceMembersResource.js

@@ -19,7 +19,7 @@ const workspaceSummaryOutputSchema = Type.Object(
 const memberSummaryOutputSchema = Type.Object(
   {
     userId: Type.Integer({ minimum: 1 }),
-    roleId: Type.String({ minLength: 1 }),
+    roleSid: Type.String({ minLength: 1 }),
     status: Type.String({ minLength: 1 }),
     displayName: Type.String(),
     email: Type.String({ minLength: 1 }),
@@ -32,7 +32,7 @@ const inviteSummaryOutputSchema = Type.Object(
   {
     id: Type.Integer({ minimum: 1 }),
     email: Type.String({ minLength: 3, format: "email" }),
-    roleId: Type.String({ minLength: 1 }),
+    roleSid: Type.String({ minLength: 1 }),
     status: Type.String({ minLength: 1 }),
     expiresAt: Type.String({ minLength: 1 }),
     invitedByUserId: Type.Union([Type.Integer({ minimum: 1 }), Type.Null()])
@@ -57,13 +57,13 @@ function normalizeMemberSummary(member, workspace) {
 
   return {
     userId: Number(source.userId),
-    roleId: normalizeLowerText(source.roleId || "member") || "member",
+    roleSid: normalizeLowerText(source.roleSid || "member") || "member",
     status: normalizeLowerText(source.status || "active") || "active",
     displayName: normalizeText(source.displayName),
     email: normalizeLowerText(source.email),
     isOwner:
       Number(source.userId) === Number(workspace.ownerUserId) ||
-      normalizeLowerText(source.roleId) === OWNER_ROLE_ID
+      normalizeLowerText(source.roleSid) === OWNER_ROLE_ID
   };
 }
 
@@ -73,7 +73,7 @@ function normalizeInviteSummary(invite) {
   return {
     id: Number(source.id),
     email: normalizeLowerText(source.email),
-    roleId: normalizeLowerText(source.roleId || "member") || "member",
+    roleSid: normalizeLowerText(source.roleSid || "member") || "member",
     status: normalizeLowerText(source.status || "pending") || "pending",
     expiresAt: source.expiresAt,
     invitedByUserId: source.invitedByUserId == null ? null : Number(source.invitedByUserId)
@@ -160,7 +160,7 @@ const workspaceInvitesOutputValidator = Object.freeze({
 const updateMemberRoleBodyValidator = Object.freeze({
   schema: Type.Object(
     {
-      roleId: Type.String({ minLength: 1 })
+      roleSid: Type.String({ minLength: 1 })
     },
     { additionalProperties: false }
   ),
@@ -168,7 +168,7 @@ const updateMemberRoleBodyValidator = Object.freeze({
     const source = normalizeObjectInput(payload);
 
     return {
-      roleId: normalizeLowerText(source.roleId)
+      roleSid: normalizeLowerText(source.roleSid)
     };
   }
 });
@@ -177,7 +177,7 @@ const updateMemberRoleInputValidator = Object.freeze({
   schema: Type.Object(
     {
       memberUserId: Type.Integer({ minimum: 1 }),
-      roleId: Type.String({ minLength: 1 })
+      roleSid: Type.String({ minLength: 1 })
     },
     { additionalProperties: false }
   ),
@@ -186,7 +186,7 @@ const updateMemberRoleInputValidator = Object.freeze({
 
     return {
       memberUserId: normalizePositiveInteger(source.memberUserId),
-      roleId: normalizeLowerText(source.roleId)
+      roleSid: normalizeLowerText(source.roleSid)
     };
   }
 });
@@ -211,7 +211,7 @@ const createInviteBodyValidator = Object.freeze({
   schema: Type.Object(
     {
       email: Type.String({ minLength: 3, format: "email" }),
-      roleId: Type.String({ minLength: 1 })
+      roleSid: Type.String({ minLength: 1 })
     },
     { additionalProperties: false }
   ),
@@ -220,7 +220,7 @@ const createInviteBodyValidator = Object.freeze({
 
     return {
       email: normalizeLowerText(source.email),
-      roleId: normalizeLowerText(source.roleId || "member") || "member"
+      roleSid: normalizeLowerText(source.roleSid || "member") || "member"
     };
   }
 });

package/src/shared/resources/workspacePendingInvitationsResource.js

@@ -25,7 +25,7 @@ function normalizePendingInvite(invite) {
     workspaceSlug: normalizeText(invite?.workspaceSlug),
     workspaceName: normalizeText(invite?.workspaceName || invite?.workspaceSlug),
     workspaceAvatarUrl: normalizeText(invite?.workspaceAvatarUrl),
-    roleId: normalizeLowerText(invite?.roleId || "member") || "member",
+    roleSid: normalizeLowerText(invite?.roleSid || "member") || "member",
     status: normalizeLowerText(invite?.status || "pending") || "pending",
     expiresAt: invite?.expiresAt || null,
     token: encodeInviteTokenHash(tokenHash)
@@ -44,7 +44,7 @@ const pendingInviteRecordValidator = Object.freeze({
       workspaceSlug: Type.String({ minLength: 1 }),
       workspaceName: Type.String({ minLength: 1 }),
       workspaceAvatarUrl: Type.String(),
-      roleId: Type.String({ minLength: 1 }),
+      roleSid: Type.String({ minLength: 1 }),
       status: Type.String({ minLength: 1 }),
       expiresAt: Type.Union([Type.String({ minLength: 1 }), Type.Null()]),
       token: Type.String({ minLength: 1 })

package/src/shared/resources/workspaceResource.js

@@ -63,7 +63,7 @@ function normalizeWorkspaceListItemOutput(payload = {}) {
     slug: normalizeLowerText(source.slug),
     name: normalizeText(source.name),
     avatarUrl: normalizeText(source.avatarUrl),
-    roleId: normalizeLowerText(source.roleId || "member") || "member",
+    roleSid: normalizeLowerText(source.roleSid || "member") || "member",
     isAccessible: source.isAccessible !== false
   };
 }
@@ -85,7 +85,7 @@ const listItemSchema = Type.Object(
     slug: Type.String({ minLength: 1 }),
     name: Type.String({ minLength: 1, maxLength: 160 }),
     avatarUrl: Type.String(),
-    roleId: Type.String({ minLength: 1 }),
+    roleSid: Type.String({ minLength: 1 }),
     isAccessible: Type.Boolean()
   },
   { additionalProperties: false }

package/src/shared/roles.js

@@ -20,13 +20,38 @@ function normalizeRoleId(value) {
     .toLowerCase();
 }
 
-function createRoleDescriptor(roleId, configuredDefinition) {
+function resolveInheritedRolePermissions(roleSid, configuredRoles = {}, seenRoleIds = new Set()) {
+  if (seenRoleIds.has(roleSid)) {
+    throw new TypeError(`roleCatalog role "${roleSid}" has circular inheritance.`);
+  }
+
+  const source = asRecord(configuredRoles[roleSid]);
+  const inheritedRoleId = normalizeRoleId(source.inherits);
+  const directPermissions = normalizePermissionList(source.permissions);
+  if (!inheritedRoleId) {
+    return directPermissions;
+  }
+
+  if (!Object.hasOwn(configuredRoles, inheritedRoleId)) {
+    throw new TypeError(`roleCatalog role "${roleSid}" inherits unknown role "${inheritedRoleId}".`);
+  }
+
+  const nextSeenRoleIds = new Set(seenRoleIds);
+  nextSeenRoleIds.add(roleSid);
+
+  return normalizePermissionList([
+    ...resolveInheritedRolePermissions(inheritedRoleId, configuredRoles, nextSeenRoleIds),
+    ...directPermissions
+  ]);
+}
+
+function createRoleDescriptor(roleSid, configuredDefinition, configuredRoles = {}) {
   const source = asRecord(configuredDefinition);
-  const assignable = roleId === OWNER_ROLE_ID ? false : source.assignable === true;
-  const permissions = normalizePermissionList(source.permissions);
+  const assignable = roleSid === OWNER_ROLE_ID ? false : source.assignable === true;
+  const permissions = resolveInheritedRolePermissions(roleSid, configuredRoles);
 
   return Object.freeze({
-    id: roleId,
+    id: roleSid,
     assignable,
     permissions: Object.freeze([...permissions])
   });
@@ -38,16 +63,16 @@ function listConfiguredRoleIds(appConfig = {}) {
 }
 
 function resolveConfiguredDefaultInviteRole(appConfig = {}) {
-  return normalizeRoleId(appConfig?.workspaceRoles?.defaultInviteRole);
+  return normalizeRoleId(appConfig?.roleCatalog?.workspace?.defaultInviteRole);
 }
 
 function normalizeConfiguredRoles(appConfig = {}) {
-  const workspaceRoles = asRecord(appConfig?.workspaceRoles);
-  const configuredRoles = asRecord(workspaceRoles.roles);
+  const roleCatalog = asRecord(appConfig?.roleCatalog);
+  const configuredRoles = asRecord(roleCatalog.roles);
   const normalizedRoles = {};
 
-  for (const [roleId, roleDefinition] of Object.entries(configuredRoles)) {
-    const normalizedRoleId = normalizeRoleId(roleId);
+  for (const [roleSid, roleDefinition] of Object.entries(configuredRoles)) {
+    const normalizedRoleId = normalizeRoleId(roleSid);
     if (!normalizedRoleId) {
       continue;
     }
@@ -60,7 +85,7 @@ function normalizeConfiguredRoles(appConfig = {}) {
 function createWorkspaceRoleCatalog(appConfig = {}) {
   const configuredRoles = normalizeConfiguredRoles(appConfig);
   const roleIds = listConfiguredRoleIds(appConfig);
-  const roles = roleIds.map((roleId) => createRoleDescriptor(roleId, configuredRoles[roleId]));
+  const roles = roleIds.map((roleSid) => createRoleDescriptor(roleSid, configuredRoles[roleSid], configuredRoles));
   const assignableRoleIds = roles.filter((role) => role.assignable).map((role) => role.id);
   const configuredDefaultInviteRole = resolveConfiguredDefaultInviteRole(appConfig);
   const defaultInviteRole = assignableRoleIds.includes(configuredDefaultInviteRole)
@@ -109,8 +134,8 @@ function listRoleDescriptors(appConfig = {}) {
   }));
 }
 
-function resolveRolePermissions(roleId, appConfig = {}) {
-  const normalizedRoleId = normalizeRoleId(roleId);
+function resolveRolePermissions(roleSid, appConfig = {}) {
+  const normalizedRoleId = normalizeRoleId(roleSid);
   if (!normalizedRoleId) {
     return [];
   }

package/templates/config/roles.js

@@ -0,0 +1,27 @@
+export const roleCatalog = {
+  workspace: {
+    defaultInviteRole: "member"
+  },
+  roles: {
+    owner: {
+      assignable: false,
+      permissions: ["*"]
+    },
+    admin: {
+      assignable: true,
+      inherits: "member",
+      permissions: [
+        "workspace.roles.view",
+        "workspace.settings.update",
+        "workspace.members.view",
+        "workspace.members.invite",
+        "workspace.members.manage",
+        "workspace.invites.revoke"
+      ]
+    },
+    member: {
+      assignable: true,
+      permissions: ["workspace.settings.view"]
+    }
+  }
+};

package/templates/migrations/users_core_initial.cjs

@@ -5,7 +5,7 @@ exports.up = async function up(knex) {
   await knex.schema.createTable("users", (table) => {
     table.increments("id").primary();
     table.string("auth_provider", 64).notNullable();
-    table.string("auth_provider_user_id", 191).notNullable();
+    table.string("auth_provider_user_sid", 191).notNullable();
     table.string("email", 255).notNullable();
     table.string("username", 120).notNullable();
     table.string("display_name", 160).notNullable();
@@ -13,7 +13,7 @@ exports.up = async function up(knex) {
     table.string("avatar_version", 64).nullable();
     table.timestamp("avatar_updated_at", { useTz: false }).nullable();
     table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
-    table.unique(["auth_provider", "auth_provider_user_id"], "uq_users_identity");
+    table.unique(["auth_provider", "auth_provider_user_sid"], "uq_users_identity");
     table.unique(["email"], "uq_users_email");
     table.unique(["username"], "uq_users_username");
   });
@@ -35,7 +35,7 @@ exports.up = async function up(knex) {
     table.increments("id").primary();
     table.integer("workspace_id").unsigned().notNullable().references("id").inTable("workspaces").onDelete("CASCADE");
     table.integer("user_id").unsigned().notNullable().references("id").inTable("users").onDelete("CASCADE");
-    table.string("role_id", 64).notNullable().defaultTo("member");
+    table.string("role_sid", 64).notNullable().defaultTo("member");
     table.string("status", 32).notNullable().defaultTo("active");
     table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
     table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
@@ -63,7 +63,7 @@ exports.up = async function up(knex) {
     table.increments("id").primary();
     table.integer("workspace_id").unsigned().notNullable().references("id").inTable("workspaces").onDelete("CASCADE");
     table.string("email", 255).notNullable();
-    table.string("role_id", 64).notNullable().defaultTo("member");
+    table.string("role_sid", 64).notNullable().defaultTo("member");
     table.string("status", 32).notNullable().defaultTo("pending");
     table.string("token_hash", 191).notNullable();
     table.integer("invited_by_user_id").unsigned().nullable().references("id").inTable("users").onDelete("SET NULL");
@@ -97,7 +97,7 @@ exports.up = async function up(knex) {
 
   await knex.schema.createTable("console_settings", (table) => {
     table.integer("id").primary();
-    table.integer("owner_user_id").unsigned().nullable();
+    table.integer("owner_user_id").unsigned().nullable().references("id").inTable("users").onDelete("SET NULL");
     table.timestamp("created_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
     table.timestamp("updated_at", { useTz: false }).notNullable().defaultTo(knex.fn.now());
   });

package/test/authProfileSyncService.test.js

@@ -7,7 +7,7 @@ test("authProfileSyncService.syncIdentityProfile uses shared transaction for pro
   const transaction = { trxId: "tx-1" };
 
   const service = createService({
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity(_identity, options = {}) {
         calls.push({ step: "find", trx: options.trx || null });
         return null;
@@ -17,7 +17,7 @@ test("authProfileSyncService.syncIdentityProfile uses shared transaction for pro
         return {
           id: 13,
           authProvider: payload.authProvider,
-          authProviderUserId: payload.authProviderUserId,
+          authProviderUserSid: payload.authProviderUserSid,
           email: payload.email,
           displayName: payload.displayName
         };
@@ -42,7 +42,7 @@ test("authProfileSyncService.syncIdentityProfile uses shared transaction for pro
 
   const profile = await service.syncIdentityProfile({
     authProvider: "supabase",
-    authProviderUserId: "abc-1",
+    authProviderUserSid: "abc-1",
     email: "tony@example.com",
     displayName: "Tony"
   });
@@ -64,12 +64,12 @@ test("authProfileSyncService.syncIdentityProfile skips write path when profile i
   let provisionCalls = 0;
 
   const service = createService({
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity() {
         return {
           id: 7,
           authProvider: "supabase",
-          authProviderUserId: "abc-7",
+          authProviderUserSid: "abc-7",
           email: "tony@example.com",
           displayName: "Tony"
         };
@@ -96,7 +96,7 @@ test("authProfileSyncService.syncIdentityProfile skips write path when profile i
 
   const profile = await service.syncIdentityProfile({
     authProvider: "supabase",
-    authProviderUserId: "abc-7",
+    authProviderUserSid: "abc-7",
     email: "tony@example.com",
     displayName: "Tony"
   });
@@ -109,7 +109,7 @@ test("authProfileSyncService.syncIdentityProfile skips write path when profile i
 test("authProfileSyncService.findByIdentity normalizes provider identity input", async () => {
   let capturedIdentity = null;
   const service = createService({
-    userProfilesRepository: {
+    usersRepository: {
       async findByIdentity(identity) {
         capturedIdentity = identity;
         return null;
@@ -127,7 +127,7 @@ test("authProfileSyncService.findByIdentity normalizes provider identity input",
 
   await service.findByIdentity({
     authProvider: "  SUPABASE  ",
-    authProviderUserId: " user-1 "
+    authProviderUserSid: " user-1 "
   });
 
   assert.deepEqual(capturedIdentity, {

package/test/avatarService.test.js

@@ -41,7 +41,7 @@ test("avatarService uploadForUser stores bytes and updates profile avatar fields
   const repository = createRepositoryDouble({
     id: 7,
     authProvider: "local",
-    authProviderUserId: "u-7",
+    authProviderUserSid: "u-7",
     email: "test@example.com",
     displayName: "Tester",
     avatarStorageKey: null,
@@ -59,13 +59,13 @@ test("avatarService uploadForUser stores bytes and updates profile avatar fields
   };
 
   const avatarService = createService({
-    userProfilesRepository: repository,
+    usersRepository: repository,
     avatarStorageService
   });
 
   const user = {
     authProvider: "local",
-    authProviderUserId: "u-7"
+    authProviderUserSid: "u-7"
   };
 
   const result = await avatarService.uploadForUser(user, {
@@ -84,7 +84,7 @@ test("avatarService clearForUser removes stored avatar and clears profile fields
   const repository = createRepositoryDouble({
     id: 7,
     authProvider: "local",
-    authProviderUserId: "u-7",
+    authProviderUserSid: "u-7",
     email: "test@example.com",
     displayName: "Tester",
     avatarStorageKey: "users/avatars/7/avatar",
@@ -99,13 +99,13 @@ test("avatarService clearForUser removes stored avatar and clears profile fields
   };
 
   const avatarService = createService({
-    userProfilesRepository: repository,
+    usersRepository: repository,
     avatarStorageService
   });
 
   const profile = await avatarService.clearForUser({
     authProvider: "local",
-    authProviderUserId: "u-7"
+    authProviderUserSid: "u-7"
   });
 
   assert.deepEqual(deletedKeys, ["users/avatars/7/avatar"]);

package/test/roles.test.js

@@ -7,7 +7,7 @@ import {
   hasPermission
 } from "../src/shared/roles.js";
 
-test("createWorkspaceRoleCatalog resolves role descriptors only from appConfig.workspaceRoles", () => {
+test("createWorkspaceRoleCatalog resolves role descriptors only from appConfig.roleCatalog", () => {
   const emptyCatalog = createWorkspaceRoleCatalog();
   assert.deepEqual(emptyCatalog.roles, []);
   assert.deepEqual(emptyCatalog.assignableRoleIds, []);
@@ -15,8 +15,10 @@ test("createWorkspaceRoleCatalog resolves role descriptors only from appConfig.w
   assert.equal(emptyCatalog.collaborationEnabled, false);
 
   const appConfig = {
-    workspaceRoles: {
-      defaultInviteRole: "editor",
+    roleCatalog: {
+      workspace: {
+        defaultInviteRole: "editor"
+      },
       roles: {
         owner: {
           assignable: false,
@@ -24,7 +26,7 @@ test("createWorkspaceRoleCatalog resolves role descriptors only from appConfig.w
         },
         editor: {
           assignable: true,
-          permissions: ["crud_contacts.*"]
+          permissions: ["crud.contacts.*"]
         }
       }
     }
@@ -35,7 +37,90 @@ test("createWorkspaceRoleCatalog resolves role descriptors only from appConfig.w
   assert.equal(roleCatalog.defaultInviteRole, "editor");
   assert.equal(roleCatalog.assignableRoleIds.includes("editor"), true);
   assert.deepEqual(resolveRolePermissions("owner", appConfig), ["workspace.settings.update"]);
-  assert.equal(hasPermission(editorRole?.permissions, "crud_contacts.update"), true);
+  assert.equal(hasPermission(editorRole?.permissions, "crud.contacts.update"), true);
+});
+
+test("createWorkspaceRoleCatalog resolves inherited role permissions with parent permissions first", () => {
+  const appConfig = {
+    roleCatalog: {
+      workspace: {
+        defaultInviteRole: "member"
+      },
+      roles: {
+        member: {
+          assignable: true,
+          permissions: [
+            "workspace.settings.view",
+            "crud.contacts.list"
+          ]
+        },
+        admin: {
+          assignable: true,
+          inherits: "member",
+          permissions: [
+            "workspace.settings.update",
+            "workspace.members.manage",
+            "workspace.settings.view"
+          ]
+        }
+      }
+    }
+  };
+
+  const roleCatalog = createWorkspaceRoleCatalog(appConfig);
+  const adminRole = roleCatalog.roles.find((role) => role.id === "admin");
+
+  assert.deepEqual(adminRole, {
+    id: "admin",
+    assignable: true,
+    permissions: [
+      "workspace.settings.view",
+      "crud.contacts.list",
+      "workspace.settings.update",
+      "workspace.members.manage"
+    ]
+  });
+});
+
+test("createWorkspaceRoleCatalog rejects unknown inherited roles", () => {
+  assert.throws(
+    () =>
+      createWorkspaceRoleCatalog({
+        roleCatalog: {
+          roles: {
+            admin: {
+              assignable: true,
+              inherits: "member",
+              permissions: []
+            }
+          }
+        }
+      }),
+    /inherits unknown role "member"/
+  );
+});
+
+test("createWorkspaceRoleCatalog rejects circular inherited roles", () => {
+  assert.throws(
+    () =>
+      createWorkspaceRoleCatalog({
+        roleCatalog: {
+          roles: {
+            member: {
+              assignable: true,
+              inherits: "admin",
+              permissions: []
+            },
+            admin: {
+              assignable: true,
+              inherits: "member",
+              permissions: []
+            }
+          }
+        }
+      }),
+    /circular inheritance/
+  );
 });
 
 test("cloneWorkspaceRoleCatalog normalizes role ids and returns detached arrays", () => {

package/test/usersRouteRequestInputValidator.test.js

@@ -379,7 +379,7 @@ test("workspace invite and member handlers build action input from request.input
     createActionRequest({
       input: {
         params: { workspaceSlug: "acme", memberUserId: "12" },
-        body: { roleId: "admin" }
+        body: { roleSid: "admin" }
       },
       executeAction
     }),
@@ -389,7 +389,7 @@ test("workspace invite and member handlers build action input from request.input
     createActionRequest({
       input: {
         params: { workspaceSlug: "acme" },
-        body: { email: "user@example.com", roleId: "member" }
+        body: { email: "user@example.com", roleSid: "member" }
       },
       executeAction
     }),
@@ -419,8 +419,8 @@ test("workspace invite and member handlers build action input from request.input
     input: { name: "Operations", slug: "operations" }
   });
   assert.deepEqual(calls[1].input, { payload: { token: "token-1", decision: "accept" } });
-  assert.deepEqual(calls[2].input, { workspaceSlug: "acme", memberUserId: "12", roleId: "admin" });
-  assert.deepEqual(calls[3].input, { workspaceSlug: "acme", email: "user@example.com", roleId: "member" });
+  assert.deepEqual(calls[2].input, { workspaceSlug: "acme", memberUserId: "12", roleSid: "admin" });
+  assert.deepEqual(calls[3].input, { workspaceSlug: "acme", email: "user@example.com", roleSid: "member" });
   assert.deepEqual(calls[4].input, { workspaceSlug: "acme", memberUserId: "44" });
   assert.deepEqual(calls[5].input, { workspaceSlug: "acme", inviteId: "55" });
 });