@logto/schemas 1.12.0 → 1.13.1

package/lib/seeds/cloud-api.js

@@ -8,8 +8,6 @@ export var CloudScope;
 (function (CloudScope) {
     /** The user can create a user tenant. */
     CloudScope["CreateTenant"] = "create:tenant";
-    /** The user can perform arbitrary operations on any tenant. */
-    CloudScope["ManageTenant"] = "manage:tenant";
     /** The user can update or delete its own tenants. */
     CloudScope["ManageTenantSelf"] = "manage:tenant:self";
     CloudScope["SendSms"] = "send:sms";
@@ -18,6 +16,8 @@ export var CloudScope;
     CloudScope["ManageAffiliate"] = "manage:affiliate";
     /** The user can create new affiliates and logs. */
     CloudScope["CreateAffiliate"] = "create:affiliate";
+    /** The user can cleanup outdated logs. */
+    CloudScope["CleanupOutdatedLogs"] = "cleanup:outdated-logs";
 })(CloudScope || (CloudScope = {}));
 export const createCloudApi = () => {
     const resourceId = generateStandardId();
@@ -45,7 +45,6 @@ export const createCloudApi = () => {
                 name: AdminTenantRole.User,
             },
         },
-        buildScope(CloudScope.ManageTenant, 'Allow managing existing tenants, including create without limitation, update, and delete.'),
         buildScope(CloudScope.SendEmail, 'Allow sending emails. This scope is only available to M2M application.'),
         buildScope(CloudScope.SendSms, 'Allow sending SMS. This scope is only available to M2M application.'),
         buildScope(CloudScope.CreateAffiliate, 'Allow creating new affiliates and logs.'),

package/lib/seeds/management-api.d.ts

@@ -1,5 +1,9 @@
 import { RoleType, type CreateResource, type CreateRole, type CreateScope } from '../db-entries/index.js';
-import { PredefinedScope, InternalRole } from '../types/index.js';
+import { PredefinedScope, InternalRole, AdminTenantRole } from '../types/index.js';
+/**
+ * The Management API data for a tenant. Usually used for creating a new tenant in the admin
+ * tenant.
+ */
 export type AdminData = {
     resource: CreateResource;
     scopes: CreateScope[];
@@ -32,6 +36,10 @@ export declare const defaultManagementApi: Readonly<{
         /** @deprecated You should not rely on this constant. Change to something else. */
         resourceId: string;
     }[];
+    /**
+     * An internal user role for Management API of the `default` tenant.
+     * @deprecated This role will be removed soon.
+     */
     role: {
         tenantId: string;
         /** @deprecated You should not rely on this constant. Change to something else. */
@@ -43,9 +51,72 @@ export declare const defaultManagementApi: Readonly<{
 }>;
 export declare function getManagementApiResourceIndicator<TenantId extends string>(tenantId: TenantId): `https://${TenantId}.logto.app/api`;
 export declare function getManagementApiResourceIndicator<TenantId extends string, Path extends string>(tenantId: TenantId, path: Path): `https://${TenantId}.logto.app/${Path}`;
-export declare const getManagementApiAdminName: <TenantId extends string>(tenantId: TenantId) => `${TenantId}:admin`;
+/**
+ * The fixed Management API user role for `default` tenant in the admin tenant. It is used for
+ * OSS only.
+ */
+export declare const defaultManagementApiAdminName: "default:admin";
 /** Create a set of admin data for Management API of the given tenant ID. */
-export declare const createAdminData: (tenantId: string) => AdminData;
-/** Create a set of admin data for Management API of the given tenant ID for `admin` tenant. */
-export declare const createAdminDataInAdminTenant: (tenantId: string) => AdminData;
-export declare const createMeApiInAdminTenant: () => AdminData;
+export declare const createAdminData: (tenantId: string) => Readonly<{
+    resource: {
+        tenantId: string;
+        id: string;
+        indicator: `https://${string}.logto.app/api`;
+        name: string;
+    };
+    scopes: {
+        tenantId: string;
+        id: string;
+        name: PredefinedScope;
+        description: string;
+        resourceId: string;
+    }[];
+    /** @deprecated This role will be removed soon. */
+    role: {
+        tenantId: string;
+        id: string;
+        name: InternalRole;
+        description: string;
+        type: RoleType.MachineToMachine;
+    };
+}>;
+/** Create a set of admin data for Management API of the given tenant ID for the admin tenant. */
+export declare const createAdminDataInAdminTenant: (tenantId: string) => Readonly<{
+    resource: {
+        tenantId: string;
+        id: string;
+        indicator: `https://${string}.logto.app/api`;
+        name: string;
+    };
+    scopes: {
+        tenantId: string;
+        id: string;
+        name: PredefinedScope;
+        description: string;
+        resourceId: string;
+    }[];
+    /** The machine-to-machine role for the Management API proxy of the given tenant ID. */
+    role: Readonly<import("../db-entries/role.js").Role>;
+}>;
+export declare const createMeApiInAdminTenant: () => Readonly<{
+    resource: {
+        tenantId: string;
+        id: string;
+        indicator: "https://admin.logto.app/me";
+        name: string;
+    };
+    scopes: {
+        tenantId: string;
+        id: string;
+        name: PredefinedScope;
+        description: string;
+        resourceId: string;
+    }[];
+    role: {
+        tenantId: string;
+        id: string;
+        name: AdminTenantRole;
+        description: string;
+        type: RoleType.User;
+    };
+}>;

package/lib/seeds/management-api.js

@@ -1,6 +1,6 @@
 import { generateStandardId } from '@logto/shared/universal';
 import { RoleType, } from '../db-entries/index.js';
-import { PredefinedScope, InternalRole, AdminTenantRole } from '../types/index.js';
+import { PredefinedScope, InternalRole, AdminTenantRole, getMapiProxyRole, } from '../types/index.js';
 import { adminTenantId, defaultTenantId } from './tenant.js';
 // Consider remove the dependency of IDs
 const defaultResourceId = 'management-api';
@@ -31,6 +31,10 @@ export const defaultManagementApi = Object.freeze({
             resourceId: defaultResourceId,
         },
     ],
+    /**
+     * An internal user role for Management API of the `default` tenant.
+     * @deprecated This role will be removed soon.
+     */
     role: {
         tenantId: defaultTenantId,
         /** @deprecated You should not rely on this constant. Change to something else. */
@@ -43,7 +47,11 @@ export const defaultManagementApi = Object.freeze({
 export function getManagementApiResourceIndicator(tenantId, path = 'api') {
     return `https://${tenantId}.logto.app/${path}`;
 }
-export const getManagementApiAdminName = (tenantId) => `${tenantId}:${AdminTenantRole.Admin}`;
+/**
+ * The fixed Management API user role for `default` tenant in the admin tenant. It is used for
+ * OSS only.
+ */
+export const defaultManagementApiAdminName = `${defaultTenantId}:admin`;
 /** Create a set of admin data for Management API of the given tenant ID. */
 export const createAdminData = (tenantId) => {
     const resourceId = generateStandardId();
@@ -63,6 +71,7 @@ export const createAdminData = (tenantId) => {
                 resourceId,
             },
         ],
+        /** @deprecated This role will be removed soon. */
         role: {
             tenantId,
             id: generateStandardId(),
@@ -72,7 +81,7 @@ export const createAdminData = (tenantId) => {
         },
     });
 };
-/** Create a set of admin data for Management API of the given tenant ID for `admin` tenant. */
+/** Create a set of admin data for Management API of the given tenant ID for the admin tenant. */
 export const createAdminDataInAdminTenant = (tenantId) => {
     const resourceId = generateStandardId();
     return Object.freeze({
@@ -91,13 +100,8 @@ export const createAdminDataInAdminTenant = (tenantId) => {
                 resourceId,
             },
         ],
-        role: {
-            tenantId: adminTenantId,
-            id: generateStandardId(),
-            name: getManagementApiAdminName(tenantId),
-            description: `Admin tenant admin role for Logto tenant ${tenantId}.`,
-            type: RoleType.User,
-        },
+        /** The machine-to-machine role for the Management API proxy of the given tenant ID. */
+        role: getMapiProxyRole(tenantId),
     });
 };
 export const createMeApiInAdminTenant = () => {