@logto/schemas 1.44.0 → 1.45.0

package/alterations/1.45.0-1791531333-add-tenant-viewer-role.ts

@@ -0,0 +1,38 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    // Cloud region databases other than the admin tenant's own have no `admin` tenant to hold the role.
+    const adminTenant = await pool.maybeOne(sql`
+      select id from tenants where id = 'admin'
+    `);
+
+    if (!adminTenant) {
+      return;
+    }
+
+    await pool.query(sql`
+      update organization_scopes
+        set description = 'Write the tenant data.'
+        where tenant_id = 'admin' and id = 'write-data';
+      insert into organization_roles (tenant_id, id, name, description, type)
+        values ('admin', 'viewer', 'viewer', 'Viewer of the tenant, who can read the tenant data and members but cannot change anything.', 'User');
+      insert into organization_role_scope_relations (tenant_id, organization_role_id, organization_scope_id)
+        values ('admin', 'viewer', 'read-data'),
+               ('admin', 'viewer', 'read-member');
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      delete from organization_roles
+        where tenant_id = 'admin' and id = 'viewer';
+      update organization_scopes
+        set description = 'Write the tenant data, including creating and updating the tenant.'
+        where tenant_id = 'admin' and id = 'write-data';
+    `);
+  },
+};
+
+export default alteration;

package/alterations-js/1.45.0-1791531333-add-tenant-viewer-role.js

@@ -0,0 +1,32 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        // Cloud region databases other than the admin tenant's own have no `admin` tenant to hold the role.
+        const adminTenant = await pool.maybeOne(sql `
+      select id from tenants where id = 'admin'
+    `);
+        if (!adminTenant) {
+            return;
+        }
+        await pool.query(sql `
+      update organization_scopes
+        set description = 'Write the tenant data.'
+        where tenant_id = 'admin' and id = 'write-data';
+      insert into organization_roles (tenant_id, id, name, description, type)
+        values ('admin', 'viewer', 'viewer', 'Viewer of the tenant, who can read the tenant data and members but cannot change anything.', 'User');
+      insert into organization_role_scope_relations (tenant_id, organization_role_id, organization_scope_id)
+        values ('admin', 'viewer', 'read-data'),
+               ('admin', 'viewer', 'read-member');
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      delete from organization_roles
+        where tenant_id = 'admin' and id = 'viewer';
+      update organization_scopes
+        set description = 'Write the tenant data, including creating and updating the tenant.'
+        where tenant_id = 'admin' and id = 'write-data';
+    `);
+    },
+};
+export default alteration;

package/lib/consts/license.d.ts

@@ -107,7 +107,7 @@ export declare const licenseQuotaOverridesGuard: z.ZodObject<{
 }>;
 export type LicenseQuotaOverrides = z.infer<typeof licenseQuotaOverridesGuard>;
 /**
- * The payload of a license key, i.e. the claims of the Ed25519-signed JWT an operator installs on a
+ * The payload of a license key, i.e. the claims of the ES256-signed JWT an operator installs on a
  * self-hosted instance.
  *
  * The signature is what makes the payload trustworthy, so none of it is editable after issuing.

package/lib/types/system.d.ts

@@ -298,7 +298,7 @@ export declare const cloudflareGuard: Readonly<{
  * one license no matter how many instances share the database.
  */
 export declare const installedLicenseGuard: z.ZodObject<{
-    /** The raw Ed25519-signed license key JWT, exactly as it was installed. */
+    /** The raw ES256-signed license key JWT, exactly as it was installed. */
     jwt: z.ZodString;
     /** When the key was installed, as an ISO 8601 timestamp. */
     installedAt: z.ZodString;

package/lib/types/system.js

@@ -162,7 +162,7 @@ export const cloudflareGuard = Object.freeze({
  * one license no matter how many instances share the database.
  */
 export const installedLicenseGuard = z.object({
-    /** The raw Ed25519-signed license key JWT, exactly as it was installed. */
+    /** The raw ES256-signed license key JWT, exactly as it was installed. */
     jwt: z.string(),
     /** When the key was installed, as an ISO 8601 timestamp. */
     installedAt: z.string(),

package/lib/types/tenant-organization.d.ts

@@ -39,7 +39,7 @@ export declare const getTenantOrganizationCreateData: (tenantId: string) => Read
 export declare enum TenantScope {
     /** Read the tenant data. */
     ReadData = "read:data",
-    /** Write the tenant data, including creating and updating the tenant. */
+    /** Write the tenant data. */
     WriteData = "write:data",
     /** Delete data of the tenant. */
     DeleteData = "delete:data",
@@ -83,7 +83,9 @@ export declare enum TenantRole {
     /** Admin of the tenant, who has all permissions. */
     Admin = "admin",
     /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
-    Collaborator = "collaborator"
+    Collaborator = "collaborator",
+    /** Viewer of the tenant, who can read the tenant data and members but cannot change anything. */
+    Viewer = "viewer"
 }
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.

package/lib/types/tenant-organization.js

@@ -50,7 +50,7 @@ export var TenantScope;
 (function (TenantScope) {
     /** Read the tenant data. */
     TenantScope["ReadData"] = "read:data";
-    /** Write the tenant data, including creating and updating the tenant. */
+    /** Write the tenant data. */
     TenantScope["WriteData"] = "write:data";
     /** Delete data of the tenant. */
     TenantScope["DeleteData"] = "delete:data";
@@ -92,7 +92,7 @@ export const getTenantScope = (scope) => Object.freeze({
 });
 const tenantScopeDescriptions = Object.freeze({
     [TenantScope.ReadData]: 'Read the tenant data.',
-    [TenantScope.WriteData]: 'Write the tenant data, including creating and updating the tenant.',
+    [TenantScope.WriteData]: 'Write the tenant data.',
     [TenantScope.DeleteData]: 'Delete data of the tenant.',
     [TenantScope.ReadMember]: 'Read members of the tenant.',
     [TenantScope.InviteMember]: 'Invite members to the tenant.',
@@ -112,10 +112,13 @@ export var TenantRole;
     TenantRole["Admin"] = "admin";
     /** Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings. */
     TenantRole["Collaborator"] = "collaborator";
+    /** Viewer of the tenant, who can read the tenant data and members but cannot change anything. */
+    TenantRole["Viewer"] = "viewer";
 })(TenantRole || (TenantRole = {}));
 const tenantRoleDescriptions = Object.freeze({
     [TenantRole.Admin]: 'Admin of the tenant, who has all permissions.',
     [TenantRole.Collaborator]: 'Collaborator of the tenant, who has permissions to operate the tenant data, but not the tenant settings.',
+    [TenantRole.Viewer]: 'Viewer of the tenant, who can read the tenant data and members but cannot change anything.',
 });
 /**
  * Given a tenant role, return the corresponding organization role data in the admin tenant.
@@ -155,4 +158,5 @@ export const tenantRoleScopes = Object.freeze({
         TenantScope.DeleteData,
         TenantScope.ReadMember,
     ],
+    [TenantRole.Viewer]: [TenantScope.ReadData, TenantScope.ReadMember],
 });

package/lib/types/tenant-organization.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/types/tenant-organization.test.js

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { TenantRole, TenantScope, tenantRoleScopes } from './tenant-organization.js';
+describe('tenantRoleScopes', () => {
+    it('grants each tenant role its scopes', () => {
+        expect(tenantRoleScopes).toEqual({
+            [TenantRole.Admin]: Object.values(TenantScope),
+            [TenantRole.Collaborator]: [
+                TenantScope.ReadData,
+                TenantScope.WriteData,
+                TenantScope.DeleteData,
+                TenantScope.ReadMember,
+            ],
+            [TenantRole.Viewer]: [TenantScope.ReadData, TenantScope.ReadMember],
+        });
+    });
+});

package/lib/utils/management-api.d.ts

@@ -1 +1,6 @@
+/**
+ * The pattern of Management API resource indicators, e.g. `https://default.logto.app/api`. It is
+ * valid in both JavaScript and PostgreSQL regular expressions.
+ */
+export declare const managementApiIndicatorPattern: string;
 export declare const isManagementApi: (indicator: string) => boolean;

package/lib/utils/management-api.js

@@ -1 +1,7 @@
-export const isManagementApi = (indicator) => /^https:\/\/[^.]+\.logto\.app\/api$/.test(indicator);
+/**
+ * The pattern of Management API resource indicators, e.g. `https://default.logto.app/api`. It is
+ * valid in both JavaScript and PostgreSQL regular expressions.
+ */
+export const managementApiIndicatorPattern = String.raw `^https://[^.]+\.logto\.app/api$`;
+const managementApiIndicatorRegExp = new RegExp(managementApiIndicatorPattern);
+export const isManagementApi = (indicator) => managementApiIndicatorRegExp.test(indicator);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.44.0",
+  "version": "1.45.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -66,11 +66,11 @@
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
     "@logto/connector-kit": "^5.1.2",
-    "@logto/phrases": "^1.32.0",
     "@logto/language-kit": "^1.4.0",
+    "@logto/core-kit": "^2.13.0",
     "@logto/phrases-experience": "^1.15.0",
     "@logto/shared": "^3.4.3",
-    "@logto/core-kit": "^2.13.0"
+    "@logto/phrases": "^1.32.1"
   },
   "peerDependencies": {
     "zod": "3.24.3"