@logto/schemas 1.39.0 → 1.40.0

package/lib/db-entries/application-access-control-user-role-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The user role allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlUserRoleRelation} for the original type.
+ */
+export type CreateApplicationAccessControlUserRoleRelation = {
+    tenantId?: string;
+    applicationId: string;
+    roleId: string;
+};
+/** The user role allow relations for application-level access control. */
+export type ApplicationAccessControlUserRoleRelation = {
+    tenantId: string;
+    applicationId: string;
+    roleId: string;
+};
+export type ApplicationAccessControlUserRoleRelationKeys = 'tenantId' | 'applicationId' | 'roleId';
+export declare const ApplicationAccessControlUserRoleRelations: GeneratedSchema<ApplicationAccessControlUserRoleRelationKeys, CreateApplicationAccessControlUserRoleRelation, ApplicationAccessControlUserRoleRelation, 'application_access_control_user_role_relations', 'application_access_control_user_role_relation'>;

package/lib/db-entries/application-access-control-user-role-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    roleId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    roleId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlUserRoleRelations = Object.freeze({
+    table: 'application_access_control_user_role_relations',
+    tableSingular: 'application_access_control_user_role_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        roleId: 'role_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'roleId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application.d.ts

@@ -18,6 +18,7 @@ export type CreateApplication = {
     protectedAppMetadata?: ProtectedAppMetadata | null;
     customData?: JsonObject;
     isThirdParty?: boolean;
+    appLevelAccessControlEnabled?: boolean;
     createdAt?: number;
 };
 export type Application = {
@@ -33,7 +34,8 @@ export type Application = {
     protectedAppMetadata: ProtectedAppMetadata | null;
     customData: JsonObject;
     isThirdParty: boolean;
+    appLevelAccessControlEnabled: boolean;
     createdAt: number;
 };
-export type ApplicationKeys = 'tenantId' | 'id' | 'name' | 'secret' | 'description' | 'type' | 'oidcClientMetadata' | 'customClientMetadata' | 'protectedAppMetadata' | 'customData' | 'isThirdParty' | 'createdAt';
+export type ApplicationKeys = 'tenantId' | 'id' | 'name' | 'secret' | 'description' | 'type' | 'oidcClientMetadata' | 'customClientMetadata' | 'protectedAppMetadata' | 'customData' | 'isThirdParty' | 'appLevelAccessControlEnabled' | 'createdAt';
 export declare const Applications: GeneratedSchema<ApplicationKeys, CreateApplication, Application, 'applications', 'application'>;

package/lib/db-entries/application.js

@@ -14,6 +14,7 @@ const createGuard = z.object({
     protectedAppMetadata: protectedAppMetadataGuard.nullable().optional(),
     customData: jsonObjectGuard.optional(),
     isThirdParty: z.boolean().optional(),
+    appLevelAccessControlEnabled: z.boolean().optional(),
     createdAt: z.number().optional(),
 });
 const guard = z.object({
@@ -28,6 +29,7 @@ const guard = z.object({
     protectedAppMetadata: protectedAppMetadataGuard.nullable(),
     customData: jsonObjectGuard,
     isThirdParty: z.boolean(),
+    appLevelAccessControlEnabled: z.boolean(),
     createdAt: z.number(),
 });
 export const Applications = Object.freeze({
@@ -45,6 +47,7 @@ export const Applications = Object.freeze({
         protectedAppMetadata: 'protected_app_metadata',
         customData: 'custom_data',
         isThirdParty: 'is_third_party',
+        appLevelAccessControlEnabled: 'app_level_access_control_enabled',
         createdAt: 'created_at',
     },
     fieldKeys: [
@@ -59,6 +62,7 @@ export const Applications = Object.freeze({
         'protectedAppMetadata',
         'customData',
         'isThirdParty',
+        'appLevelAccessControlEnabled',
         'createdAt',
     ],
     createGuard,

package/lib/db-entries/index.d.ts

@@ -5,6 +5,10 @@ export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
 export * from './aggregated-daily-active-user.js';
+export * from './application-access-control-org-role-relation.js';
+export * from './application-access-control-organization-relation.js';
+export * from './application-access-control-user-relation.js';
+export * from './application-access-control-user-role-relation.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/index.js

@@ -6,6 +6,10 @@ export * from './-before-all.js';
 export * from './-function.js';
 export * from './account-center.js';
 export * from './aggregated-daily-active-user.js';
+export * from './application-access-control-org-role-relation.js';
+export * from './application-access-control-organization-relation.js';
+export * from './application-access-control-user-relation.js';
+export * from './application-access-control-user-role-relation.js';
 export * from './application-secret.js';
 export * from './application-sign-in-experience.js';
 export * from './application-user-consent-organization-resource-scope.js';

package/lib/db-entries/sign-in-experience.d.ts

@@ -1,4 +1,4 @@
-import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, GeneratedSchema } from './../foundations/index.js';
+import { Color, Branding, LanguageInfo, SignIn, SignUp, SocialSignIn, ConnectorTargets, CustomContent, CustomUiAssets, CustomUiCsp, PartialPasswordPolicy, Mfa, AdaptiveMfa, CaptchaPolicy, SentinelPolicy, EmailBlocklistPolicy, ForgotPasswordMethods, PasskeySignIn, SignUpProfileFields, GeneratedSchema } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 /**
  *
@@ -24,6 +24,7 @@ export type CreateSignInExperience = {
     customCss?: string | null;
     customContent?: CustomContent;
     customUiAssets?: CustomUiAssets | null;
+    customUiCsp?: CustomUiCsp;
     passwordPolicy?: PartialPasswordPolicy;
     mfa?: Mfa;
     adaptiveMfa?: AdaptiveMfa;
@@ -58,6 +59,7 @@ export type SignInExperience = {
     customCss: string | null;
     customContent: CustomContent;
     customUiAssets: CustomUiAssets | null;
+    customUiCsp: CustomUiCsp;
     passwordPolicy: PartialPasswordPolicy;
     mfa: Mfa;
     adaptiveMfa: AdaptiveMfa;
@@ -73,5 +75,5 @@ export type SignInExperience = {
     /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
     signUpProfileFields: SignUpProfileFields | null;
 };
-export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields';
+export type SignInExperienceKeys = 'tenantId' | 'id' | 'color' | 'branding' | 'hideLogtoBranding' | 'languageInfo' | 'termsOfUseUrl' | 'privacyPolicyUrl' | 'agreeToTermsPolicy' | 'signIn' | 'signUp' | 'socialSignIn' | 'socialSignInConnectorTargets' | 'signInMode' | 'customCss' | 'customContent' | 'customUiAssets' | 'customUiCsp' | 'passwordPolicy' | 'mfa' | 'adaptiveMfa' | 'singleSignOnEnabled' | 'supportEmail' | 'supportWebsiteUrl' | 'unknownSessionRedirectUrl' | 'captchaPolicy' | 'sentinelPolicy' | 'emailBlocklistPolicy' | 'forgotPasswordMethods' | 'passkeySignIn' | 'signUpProfileFields';
 export declare const SignInExperiences: GeneratedSchema<SignInExperienceKeys, CreateSignInExperience, SignInExperience, 'sign_in_experiences', 'sign_in_experience'>;

package/lib/db-entries/sign-in-experience.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard } from './../foundations/index.js';
+import { colorGuard, brandingGuard, languageInfoGuard, signInGuard, signUpGuard, socialSignInGuard, connectorTargetsGuard, customContentGuard, customUiAssetsGuard, customUiCspGuard, partialPasswordPolicyGuard, mfaGuard, adaptiveMfaGuard, captchaPolicyGuard, sentinelPolicyGuard, emailBlocklistPolicyGuard, forgotPasswordMethodsGuard, passkeySignInGuard, signUpProfileFieldsGuard } from './../foundations/index.js';
 import { AgreeToTermsPolicy, SignInMode } from './custom-types.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
@@ -20,6 +20,7 @@ const createGuard = z.object({
     customCss: z.string().nullable().optional(),
     customContent: customContentGuard.optional(),
     customUiAssets: customUiAssetsGuard.nullable().optional(),
+    customUiCsp: customUiCspGuard.optional(),
     passwordPolicy: partialPasswordPolicyGuard.optional(),
     mfa: mfaGuard.optional(),
     adaptiveMfa: adaptiveMfaGuard.optional(),
@@ -52,6 +53,7 @@ const guard = z.object({
     customCss: z.string().nullable(),
     customContent: customContentGuard,
     customUiAssets: customUiAssetsGuard.nullable(),
+    customUiCsp: customUiCspGuard,
     passwordPolicy: partialPasswordPolicyGuard,
     mfa: mfaGuard,
     adaptiveMfa: adaptiveMfaGuard,
@@ -87,6 +89,7 @@ export const SignInExperiences = Object.freeze({
         customCss: 'custom_css',
         customContent: 'custom_content',
         customUiAssets: 'custom_ui_assets',
+        customUiCsp: 'custom_ui_csp',
         passwordPolicy: 'password_policy',
         mfa: 'mfa',
         adaptiveMfa: 'adaptive_mfa',
@@ -119,6 +122,7 @@ export const SignInExperiences = Object.freeze({
         'customCss',
         'customContent',
         'customUiAssets',
+        'customUiCsp',
         'passwordPolicy',
         'mfa',
         'adaptiveMfa',

package/lib/foundations/jsonb-types/account-centers.d.ts

@@ -49,4 +49,30 @@ export declare const accountCenterFieldControlGuard: z.ZodObject<{
 export type AccountCenterFieldControl = z.infer<typeof accountCenterFieldControlGuard>;
 export declare const webauthnRelatedOriginsGuard: z.ZodArray<z.ZodString, "many">;
 export type WebauthnRelatedOrigins = z.infer<typeof webauthnRelatedOriginsGuard>;
+/**
+ * Configuration for which custom profile fields are exposed in the prebuilt account center and
+ * in which order. Each entry references an existing field by name in the `custom_profile_fields`
+ * catalog; fields in the catalog but not in this list are not shown in the account center.
+ *
+ * Kept separate from `signUpProfileFields` so the sign-up and account-center surfaces can be
+ * configured independently against the same catalog.
+ */
+export type AccountCenterProfileFieldItem = {
+    name: string;
+};
+export declare const accountCenterProfileFieldItemGuard: z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>;
+export declare const accountCenterProfileFieldsGuard: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    name: string;
+}, {
+    name: string;
+}>, "many">;
+export type AccountCenterProfileFields = z.infer<typeof accountCenterProfileFieldsGuard>;
 export declare const deleteAccountUrlGuard: z.ZodEffects<z.ZodString, string, string>;

package/lib/foundations/jsonb-types/account-centers.js

@@ -26,6 +26,10 @@ export const accountCenterFieldControlGuard = z
 })
     .partial();
 export const webauthnRelatedOriginsGuard = z.array(z.string());
+export const accountCenterProfileFieldItemGuard = z.object({
+    name: z.string(),
+});
+export const accountCenterProfileFieldsGuard = z.array(accountCenterProfileFieldItemGuard);
 export const deleteAccountUrlGuard = z
     .string()
     .max(2048)

package/lib/foundations/jsonb-types/applications.d.ts

@@ -217,6 +217,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     }, {
         path: string;
     }>, "many">;
+    additionalScopes: z.ZodOptional<z.ZodArray<z.ZodEnum<[import("@logto/core-kit").UserScope.CustomData, import("@logto/core-kit").UserScope.Identities, import("@logto/core-kit").UserScope.Roles, import("@logto/core-kit").UserScope.Organizations, import("@logto/core-kit").UserScope.OrganizationRoles]>, "many">>;
     customDomains: z.ZodOptional<z.ZodArray<z.ZodObject<{
         domain: z.ZodString;
         status: z.ZodNativeEnum<typeof import("./custom-domain.js").DomainStatus>;
@@ -327,6 +328,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     pageRules: {
         path: string;
     }[];
+    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
     customDomains?: {
         status: import("./custom-domain.js").DomainStatus;
         domain: string;
@@ -355,6 +357,7 @@ export declare const protectedAppMetadataGuard: z.ZodObject<{
     pageRules: {
         path: string;
     }[];
+    additionalScopes?: (import("@logto/core-kit").UserScope.CustomData | import("@logto/core-kit").UserScope.Identities | import("@logto/core-kit").UserScope.Roles | import("@logto/core-kit").UserScope.Organizations | import("@logto/core-kit").UserScope.OrganizationRoles)[] | undefined;
     customDomains?: {
         status: import("./custom-domain.js").DomainStatus;
         domain: string;

package/lib/foundations/jsonb-types/applications.js

@@ -1,5 +1,7 @@
+import { protectedAppAdditionalScopes } from '@logto/core-kit';
 import { z } from 'zod';
 import { cloudflareDataGuard, domainDnsRecordsGuard, domainStatusGuard } from './custom-domain.js';
+const protectedAppAdditionalScopeGuard = z.enum(protectedAppAdditionalScopes);
 export const customDomainGuard = z.object({
     /* The domain name, e.g app.example.com */
     domain: z.string(),
@@ -24,6 +26,8 @@ export const protectedAppMetadataGuard = z.object({
         /* The path pattern (regex) to match */
         path: z.string(),
     })),
+    /* Additional scopes requested by protected app sign-in */
+    additionalScopes: z.array(protectedAppAdditionalScopeGuard).optional(),
     /* Custom domain */
     customDomains: customDomainsGuard.optional(),
 });

package/lib/foundations/jsonb-types/applications.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/applications.test.js

@@ -0,0 +1,23 @@
+import { UserScope } from '@logto/core-kit';
+import { describe, expect, it } from 'vitest';
+import { protectedAppMetadataGuard } from './applications.js';
+const protectedAppMetadata = {
+    host: 'example.com',
+    origin: 'https://example.com',
+    sessionDuration: 3600,
+    pageRules: [],
+};
+describe('protectedAppMetadataGuard', () => {
+    it('accepts additional scopes with extended ID token claims', () => {
+        expect(protectedAppMetadataGuard.safeParse({
+            ...protectedAppMetadata,
+            additionalScopes: [UserScope.CustomData],
+        }).success).toBe(true);
+    });
+    it('rejects additional scopes without extended ID token claims', () => {
+        expect(protectedAppMetadataGuard.safeParse({
+            ...protectedAppMetadata,
+            additionalScopes: [UserScope.Sessions],
+        }).success).toBe(false);
+    });
+});

package/lib/foundations/jsonb-types/sign-in-experience.d.ts

@@ -441,4 +441,4 @@ export declare const signUpProfileFieldsGuard: z.ZodArray<z.ZodObject<{
     name: string;
 }>, "many">;
 export type SignUpProfileFields = z.infer<typeof signUpProfileFieldsGuard>;
-export {};
+export { customUiCspGuard, type CustomUiCsp } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.js

@@ -142,3 +142,4 @@ export const signUpProfileFieldItemGuard = z.object({
     name: z.string(),
 });
 export const signUpProfileFieldsGuard = z.array(signUpProfileFieldItemGuard);
+export { customUiCspGuard } from '@logto/core-kit';

package/lib/foundations/jsonb-types/sign-in-experience.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/foundations/jsonb-types/sign-in-experience.test.js

@@ -0,0 +1,18 @@
+import { describe, expect, it } from 'vitest';
+import { customUiCspGuard } from './sign-in-experience.js';
+describe('customUiCspGuard', () => {
+    it.each([
+        {},
+        { scriptSrc: ['https://example.com'] },
+        { connectSrc: ['https://api.example.com'] },
+        {
+            scriptSrc: ['https://example.com'],
+            connectSrc: ['https://api.example.com'],
+        },
+    ])('accepts %p', (value) => {
+        expect(customUiCspGuard.safeParse(value).success).toBe(true);
+    });
+    it('rejects unsupported directives', () => {
+        expect(customUiCspGuard.safeParse({ imgSrc: ['https://example.com'] }).success).toBe(false);
+    });
+});

package/lib/seeds/application.js

@@ -21,6 +21,7 @@ const buildSpaApplicationData = (tenantId, { id, name, description, }) => ({
     customClientMetadata: {},
     protectedAppMetadata: null,
     isThirdParty: false,
+    appLevelAccessControlEnabled: false,
     createdAt: 0,
     customData: {},
 });
@@ -45,6 +46,7 @@ const buildNativeApplicationData = (tenantId, { id, name, description, }) => ({
     customClientMetadata: { isDeviceFlow: true },
     protectedAppMetadata: null,
     isThirdParty: false,
+    appLevelAccessControlEnabled: false,
     createdAt: 0,
     customData: {},
 });

package/lib/seeds/sign-in-experience.d.ts

@@ -3,4 +3,16 @@ export declare const defaultPrimaryColor = "#6139F6";
 export declare const createDefaultSignInExperience: (forTenantId: string, isCloud: boolean) => Readonly<CreateSignInExperience>;
 /** @deprecated Use `createDefaultSignInExperience()` instead. */
 export declare const defaultSignInExperience: Readonly<CreateSignInExperience>;
-export declare const createAdminTenantSignInExperience: () => Readonly<CreateSignInExperience>;
+export type AdminSignInExperienceSeedOptions = {
+    /**
+     * When true, the seeded admin-tenant `passwordPolicy` explicitly disables the
+     * HaveIBeenPwned (HIBP) breach check by setting `rejects.pwned = false`. Intended
+     * for air-gapped or offline OSS deployments where `api.pwnedpasswords.com` is
+     * unreachable; otherwise the first admin sign-up will hang on the breach check.
+     *
+     * Defaults to `false`, which preserves the historical seeded value (`{}`) and lets
+     * the runtime fall back to the default policy (HIBP check enabled).
+     */
+    disablePwnedPasswordCheck?: boolean;
+};
+export declare const createAdminTenantSignInExperience: (options?: AdminSignInExperienceSeedOptions) => Readonly<CreateSignInExperience>;

package/lib/seeds/sign-in-experience.js

@@ -50,7 +50,7 @@ export const createDefaultSignInExperience = (forTenantId, isCloud) => Object.fr
 });
 /** @deprecated Use `createDefaultSignInExperience()` instead. */
 export const defaultSignInExperience = createDefaultSignInExperience(defaultTenantId, false);
-export const createAdminTenantSignInExperience = () => Object.freeze({
+export const createAdminTenantSignInExperience = (options = {}) => Object.freeze({
     ...defaultSignInExperience,
     tenantId: adminTenantId,
     color: {
@@ -62,6 +62,15 @@ export const createAdminTenantSignInExperience = () => Object.freeze({
         logoUrl: 'https://logto.io/logo.svg',
         darkLogoUrl: 'https://logto.io/logo-dark.svg',
     },
+    passwordPolicy: options.disablePwnedPasswordCheck
+        ? {
+            ...defaultSignInExperience.passwordPolicy,
+            rejects: {
+                ...defaultSignInExperience.passwordPolicy?.rejects,
+                pwned: false,
+            },
+        }
+        : defaultSignInExperience.passwordPolicy,
     mfa: {
         factors: [MfaFactor.TOTP, MfaFactor.WebAuthn, MfaFactor.BackupCode],
         policy: MfaPolicy.NoPrompt,

package/lib/seeds/sign-in-experience.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/seeds/sign-in-experience.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, it } from 'vitest';
+import { createAdminTenantSignInExperience, createDefaultSignInExperience, } from './sign-in-experience.js';
+import { adminTenantId } from './tenant.js';
+describe('createAdminTenantSignInExperience', () => {
+    it('seeds an empty passwordPolicy by default', () => {
+        const row = createAdminTenantSignInExperience();
+        expect(row.passwordPolicy).toEqual({});
+    });
+    it('seeds an empty passwordPolicy when option is explicitly false', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: false });
+        expect(row.passwordPolicy).toEqual({});
+    });
+    it('seeds rejects.pwned=false when disablePwnedPasswordCheck is true', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: true });
+        expect(row.passwordPolicy).toEqual({ rejects: { pwned: false } });
+    });
+    it('still targets the admin tenant id when the option is set', () => {
+        const row = createAdminTenantSignInExperience({ disablePwnedPasswordCheck: true });
+        expect(row.tenantId).toBe(adminTenantId);
+    });
+});
+describe('createDefaultSignInExperience (unchanged contract)', () => {
+    it('still has a two-parameter signature and seeds an empty passwordPolicy', () => {
+        const row = createDefaultSignInExperience('some-tenant-id', false);
+        expect(row.passwordPolicy).toEqual({});
+    });
+});

package/lib/types/application.d.ts

@@ -48,6 +48,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -76,6 +77,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -100,6 +102,7 @@ export declare const featuredApplicationGuard: z.ZodObject<Pick<{
     } | null>;
     customData: z.ZodType<import("@withtyped/server").JsonObject, z.ZodTypeDef, import("@withtyped/server").JsonObject>;
     isThirdParty: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    appLevelAccessControlEnabled: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "type" | "name" | "id">, "strip", z.ZodTypeAny, {
     type: import("../db-entries/custom-types.js").ApplicationType;
@@ -144,6 +147,7 @@ export declare const applicationCreateGuard: z.ZodObject<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -172,6 +176,7 @@ export declare const applicationCreateGuard: z.ZodObject<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -251,6 +256,7 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -279,6 +285,7 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
         pageRules: {
             path: string;
         }[];
+        additionalScopes?: (UserScope.CustomData | UserScope.Identities | UserScope.Roles | UserScope.Organizations | UserScope.OrganizationRoles)[] | undefined;
         customDomains?: {
             status: import("../index.js").DomainStatus;
             domain: string;
@@ -319,6 +326,98 @@ export declare const applicationPatchGuard: z.ZodObject<Omit<{
     customClientMetadata?: import("../index.js").CustomClientMetadata;
     protectedAppMetadata?: import("../index.js").ProtectedAppMetadata | null;
 }>;
+/** The guard for one organization role access-control rule group. */
+export declare const applicationAccessControlOrganizationRoleRuleGuard: z.ZodObject<{
+    organizationId: z.ZodString;
+    organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+}, "strip", z.ZodTypeAny, {
+    organizationId: string;
+    organizationRoleIds: string[];
+}, {
+    organizationId: string;
+    organizationRoleIds: string[];
+}>;
+/** The guard for application-level access control rule payloads. */
+export declare const applicationAccessControlGuard: z.ZodPipeline<z.ZodEffects<z.ZodObject<{
+    userIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    userRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    organizationIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    organizationRoleRules: z.ZodArray<z.ZodObject<{
+        organizationId: z.ZodString;
+        organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>, {
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>, z.ZodObject<{
+    userIds: z.ZodArray<z.ZodString, "many">;
+    userRoleIds: z.ZodArray<z.ZodString, "many">;
+    organizationIds: z.ZodArray<z.ZodString, "many">;
+    organizationRoleRules: z.ZodArray<z.ZodObject<{
+        organizationId: z.ZodString;
+        organizationRoleIds: z.ZodPipeline<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>, z.ZodArray<z.ZodString, "many">>;
+    }, "strip", z.ZodTypeAny, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }, {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }>, "many">;
+}, "strip", z.ZodTypeAny, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}, {
+    userIds: string[];
+    userRoleIds: string[];
+    organizationIds: string[];
+    organizationRoleRules: {
+        organizationId: string;
+        organizationRoleIds: string[];
+    }[];
+}>>;
+export type ApplicationAccessControl = z.infer<typeof applicationAccessControlGuard>;
+/** Create an empty application-level access control rule set. */
+export declare const createDefaultApplicationAccessControl: () => ApplicationAccessControl;
 export declare const applicationUserConsentScopesResponseGuard: z.ZodObject<{
     organizationScopes: z.ZodArray<z.ZodObject<Pick<{
         tenantId: z.ZodType<string, z.ZodTypeDef, string>;