@lssm/example.wealth-snapshot 0.0.0-canary-20251217063201 → 0.0.0-canary-20251217073102

package/dist/libs/identity-rbac/dist/contracts/rbac.js

@@ -1 +1,487 @@
-import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{e as n,t as r}from"./dist/spec.js";import"./dist/index.js";import{l as i}from"./user.js";const a=[`platform.identity-rbac`],o=new t({name:`Role`,description:`RBAC role definition`,fields:{id:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),s=new t({name:`PolicyBinding`,description:`Role assignment to a target`,fields:{id:{type:e.String_unsecure(),isOptional:!1},roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},role:{type:o,isOptional:!1}}}),c=new t({name:`PermissionCheckResult`,description:`Result of a permission check`,fields:{allowed:{type:e.Boolean(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!0},matchedRole:{type:e.String_unsecure(),isOptional:!0}}}),l=new t({name:`CreateRoleInput`,description:`Input for creating a role`,fields:{name:{type:e.NonEmptyString(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0}}}),u=new t({name:`UpdateRoleInput`,description:`Input for updating a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}}),d=new t({name:`DeleteRoleInput`,description:`Input for deleting a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1}}}),f=new t({name:`ListRolesOutput`,description:`Output for listing roles`,fields:{roles:{type:o,isOptional:!1,isArray:!0}}}),p=new t({name:`AssignRoleInput`,description:`Input for assigning a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0}}}),m=new t({name:`RevokeRoleInput`,description:`Input for revoking a role`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),h=new t({name:`BindingIdPayload`,description:`Payload with binding ID`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),g=new t({name:`CheckPermissionInput`,description:`Input for checking a permission`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0},permission:{type:e.String_unsecure(),isOptional:!1}}}),_=new t({name:`ListUserPermissionsInput`,description:`Input for listing user permissions`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0}}}),v=new t({name:`ListUserPermissionsOutput`,description:`Output for listing user permissions`,fields:{permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},roles:{type:o,isOptional:!1,isArray:!0}}});n({meta:{name:`identity.rbac.role.create`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`create`],description:`Create a new role with permissions.`,goal:`Allow admins to define custom roles.`,context:`Role management in admin settings.`},io:{input:l,output:o,errors:{ROLE_EXISTS:{description:`A role with this name already exists`,http:409,gqlCode:`ROLE_EXISTS`,when:`Role name is taken`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.created`]}}),n({meta:{name:`identity.rbac.role.update`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`update`],description:`Update an existing role.`,goal:`Allow admins to modify role permissions.`,context:`Role management in admin settings.`},io:{input:u,output:o},policy:{auth:`admin`},sideEffects:{audit:[`role.updated`]}}),n({meta:{name:`identity.rbac.role.delete`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`delete`],description:`Delete an existing role.`,goal:`Allow admins to remove unused roles.`,context:`Role management. Removes all policy bindings using this role.`},io:{input:d,output:i,errors:{ROLE_IN_USE:{description:`Role is still assigned to users or organizations`,http:409,gqlCode:`ROLE_IN_USE`,when:`Role has active bindings`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.deleted`]}}),r({meta:{name:`identity.rbac.role.list`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`list`],description:`List all available roles.`,goal:`Show available roles for assignment.`,context:`Role assignment UI.`},io:{input:null,output:f},policy:{auth:`user`}}),n({meta:{name:`identity.rbac.assign`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`assign`],description:`Assign a role to a user or organization.`,goal:`Grant permissions via role assignment.`,context:`User/org permission management.`},io:{input:p,output:s,errors:{ROLE_NOT_FOUND:{description:`The specified role does not exist`,http:404,gqlCode:`ROLE_NOT_FOUND`,when:`Role ID is invalid`},ALREADY_ASSIGNED:{description:`This role is already assigned to the target`,http:409,gqlCode:`ALREADY_ASSIGNED`,when:`Binding already exists`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.assigned`,version:1,when:`Role is assigned`,payload:s}],audit:[`role.assigned`]}}),n({meta:{name:`identity.rbac.revoke`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`revoke`],description:`Revoke a role from a user or organization.`,goal:`Remove permissions via role revocation.`,context:`User/org permission management.`},io:{input:m,output:i,errors:{BINDING_NOT_FOUND:{description:`The policy binding does not exist`,http:404,gqlCode:`BINDING_NOT_FOUND`,when:`Binding ID is invalid`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.revoked`,version:1,when:`Role is revoked`,payload:h}],audit:[`role.revoked`]}}),r({meta:{name:`identity.rbac.check`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`check`,`permission`],description:`Check if a user has a specific permission.`,goal:`Authorization check before sensitive operations.`,context:`Called by other services to verify permissions.`},io:{input:g,output:c},policy:{auth:`user`}}),r({meta:{name:`identity.rbac.permissions`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`permissions`,`user`],description:`List all permissions for a user in a context.`,goal:`Show what a user can do in an org.`,context:`UI permission display, debugging.`},io:{input:_,output:v},policy:{auth:`user`}});export{_,c,d,f,g,h,l,m,o,p,s,u,v};
+import { ScalarTypeEnum } from "../schema/dist/ScalarTypeEnum.js";
+import { SchemaModel } from "../schema/dist/SchemaModel.js";
+import "../schema/dist/index.js";
+import { defineCommand, defineQuery } from "./dist/spec.js";
+import "./dist/index.js";
+import { SuccessResultModel } from "./user.js";
+
+//#region ../../libs/identity-rbac/dist/contracts/rbac.js
+const OWNERS = ["platform.identity-rbac"];
+const RoleModel = new SchemaModel({
+	name: "Role",
+	description: "RBAC role definition",
+	fields: {
+		id: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		description: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		permissions: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		},
+		createdAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		}
+	}
+});
+const PolicyBindingModel = new SchemaModel({
+	name: "PolicyBinding",
+	description: "Role assignment to a target",
+	fields: {
+		id: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		roleId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetType: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		expiresAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: true
+		},
+		createdAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: false
+		},
+		role: {
+			type: RoleModel,
+			isOptional: false
+		}
+	}
+});
+const PermissionCheckResultModel = new SchemaModel({
+	name: "PermissionCheckResult",
+	description: "Result of a permission check",
+	fields: {
+		allowed: {
+			type: ScalarTypeEnum.Boolean(),
+			isOptional: false
+		},
+		reason: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		matchedRole: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const CreateRoleInputModel = new SchemaModel({
+	name: "CreateRoleInput",
+	description: "Input for creating a role",
+	fields: {
+		name: {
+			type: ScalarTypeEnum.NonEmptyString(),
+			isOptional: false
+		},
+		description: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		permissions: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		}
+	}
+});
+const UpdateRoleInputModel = new SchemaModel({
+	name: "UpdateRoleInput",
+	description: "Input for updating a role",
+	fields: {
+		roleId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		name: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		description: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		permissions: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true,
+			isArray: true
+		}
+	}
+});
+const DeleteRoleInputModel = new SchemaModel({
+	name: "DeleteRoleInput",
+	description: "Input for deleting a role",
+	fields: { roleId: {
+		type: ScalarTypeEnum.String_unsecure(),
+		isOptional: false
+	} }
+});
+const ListRolesOutputModel = new SchemaModel({
+	name: "ListRolesOutput",
+	description: "Output for listing roles",
+	fields: { roles: {
+		type: RoleModel,
+		isOptional: false,
+		isArray: true
+	} }
+});
+const AssignRoleInputModel = new SchemaModel({
+	name: "AssignRoleInput",
+	description: "Input for assigning a role",
+	fields: {
+		roleId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetType: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		targetId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		expiresAt: {
+			type: ScalarTypeEnum.DateTime(),
+			isOptional: true
+		}
+	}
+});
+const RevokeRoleInputModel = new SchemaModel({
+	name: "RevokeRoleInput",
+	description: "Input for revoking a role",
+	fields: { bindingId: {
+		type: ScalarTypeEnum.String_unsecure(),
+		isOptional: false
+	} }
+});
+const BindingIdPayloadModel = new SchemaModel({
+	name: "BindingIdPayload",
+	description: "Payload with binding ID",
+	fields: { bindingId: {
+		type: ScalarTypeEnum.String_unsecure(),
+		isOptional: false
+	} }
+});
+const CheckPermissionInputModel = new SchemaModel({
+	name: "CheckPermissionInput",
+	description: "Input for checking a permission",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		},
+		permission: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		}
+	}
+});
+const ListUserPermissionsInputModel = new SchemaModel({
+	name: "ListUserPermissionsInput",
+	description: "Input for listing user permissions",
+	fields: {
+		userId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false
+		},
+		orgId: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: true
+		}
+	}
+});
+const ListUserPermissionsOutputModel = new SchemaModel({
+	name: "ListUserPermissionsOutput",
+	description: "Output for listing user permissions",
+	fields: {
+		permissions: {
+			type: ScalarTypeEnum.String_unsecure(),
+			isOptional: false,
+			isArray: true
+		},
+		roles: {
+			type: RoleModel,
+			isOptional: false,
+			isArray: true
+		}
+	}
+});
+/**
+* Create a new role.
+*/
+const CreateRoleContract = defineCommand({
+	meta: {
+		name: "identity.rbac.role.create",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"role",
+			"create"
+		],
+		description: "Create a new role with permissions.",
+		goal: "Allow admins to define custom roles.",
+		context: "Role management in admin settings."
+	},
+	io: {
+		input: CreateRoleInputModel,
+		output: RoleModel,
+		errors: { ROLE_EXISTS: {
+			description: "A role with this name already exists",
+			http: 409,
+			gqlCode: "ROLE_EXISTS",
+			when: "Role name is taken"
+		} }
+	},
+	policy: { auth: "admin" },
+	sideEffects: { audit: ["role.created"] }
+});
+/**
+* Update a role.
+*/
+const UpdateRoleContract = defineCommand({
+	meta: {
+		name: "identity.rbac.role.update",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"role",
+			"update"
+		],
+		description: "Update an existing role.",
+		goal: "Allow admins to modify role permissions.",
+		context: "Role management in admin settings."
+	},
+	io: {
+		input: UpdateRoleInputModel,
+		output: RoleModel
+	},
+	policy: { auth: "admin" },
+	sideEffects: { audit: ["role.updated"] }
+});
+/**
+* Delete a role.
+*/
+const DeleteRoleContract = defineCommand({
+	meta: {
+		name: "identity.rbac.role.delete",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"role",
+			"delete"
+		],
+		description: "Delete an existing role.",
+		goal: "Allow admins to remove unused roles.",
+		context: "Role management. Removes all policy bindings using this role."
+	},
+	io: {
+		input: DeleteRoleInputModel,
+		output: SuccessResultModel,
+		errors: { ROLE_IN_USE: {
+			description: "Role is still assigned to users or organizations",
+			http: 409,
+			gqlCode: "ROLE_IN_USE",
+			when: "Role has active bindings"
+		} }
+	},
+	policy: { auth: "admin" },
+	sideEffects: { audit: ["role.deleted"] }
+});
+/**
+* List all roles.
+*/
+const ListRolesContract = defineQuery({
+	meta: {
+		name: "identity.rbac.role.list",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"role",
+			"list"
+		],
+		description: "List all available roles.",
+		goal: "Show available roles for assignment.",
+		context: "Role assignment UI."
+	},
+	io: {
+		input: null,
+		output: ListRolesOutputModel
+	},
+	policy: { auth: "user" }
+});
+/**
+* Assign a role to a user or organization.
+*/
+const AssignRoleContract = defineCommand({
+	meta: {
+		name: "identity.rbac.assign",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"assign"
+		],
+		description: "Assign a role to a user or organization.",
+		goal: "Grant permissions via role assignment.",
+		context: "User/org permission management."
+	},
+	io: {
+		input: AssignRoleInputModel,
+		output: PolicyBindingModel,
+		errors: {
+			ROLE_NOT_FOUND: {
+				description: "The specified role does not exist",
+				http: 404,
+				gqlCode: "ROLE_NOT_FOUND",
+				when: "Role ID is invalid"
+			},
+			ALREADY_ASSIGNED: {
+				description: "This role is already assigned to the target",
+				http: 409,
+				gqlCode: "ALREADY_ASSIGNED",
+				when: "Binding already exists"
+			}
+		}
+	},
+	policy: { auth: "admin" },
+	sideEffects: {
+		emits: [{
+			name: "role.assigned",
+			version: 1,
+			when: "Role is assigned",
+			payload: PolicyBindingModel
+		}],
+		audit: ["role.assigned"]
+	}
+});
+/**
+* Revoke a role from a user or organization.
+*/
+const RevokeRoleContract = defineCommand({
+	meta: {
+		name: "identity.rbac.revoke",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"revoke"
+		],
+		description: "Revoke a role from a user or organization.",
+		goal: "Remove permissions via role revocation.",
+		context: "User/org permission management."
+	},
+	io: {
+		input: RevokeRoleInputModel,
+		output: SuccessResultModel,
+		errors: { BINDING_NOT_FOUND: {
+			description: "The policy binding does not exist",
+			http: 404,
+			gqlCode: "BINDING_NOT_FOUND",
+			when: "Binding ID is invalid"
+		} }
+	},
+	policy: { auth: "admin" },
+	sideEffects: {
+		emits: [{
+			name: "role.revoked",
+			version: 1,
+			when: "Role is revoked",
+			payload: BindingIdPayloadModel
+		}],
+		audit: ["role.revoked"]
+	}
+});
+/**
+* Check if a user has a specific permission.
+*/
+const CheckPermissionContract = defineQuery({
+	meta: {
+		name: "identity.rbac.check",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"check",
+			"permission"
+		],
+		description: "Check if a user has a specific permission.",
+		goal: "Authorization check before sensitive operations.",
+		context: "Called by other services to verify permissions."
+	},
+	io: {
+		input: CheckPermissionInputModel,
+		output: PermissionCheckResultModel
+	},
+	policy: { auth: "user" }
+});
+/**
+* List permissions for a user.
+*/
+const ListUserPermissionsContract = defineQuery({
+	meta: {
+		name: "identity.rbac.permissions",
+		version: 1,
+		stability: "stable",
+		owners: [...OWNERS],
+		tags: [
+			"identity",
+			"rbac",
+			"permissions",
+			"user"
+		],
+		description: "List all permissions for a user in a context.",
+		goal: "Show what a user can do in an org.",
+		context: "UI permission display, debugging."
+	},
+	io: {
+		input: ListUserPermissionsInputModel,
+		output: ListUserPermissionsOutputModel
+	},
+	policy: { auth: "user" }
+});
+
+//#endregion
+export { AssignRoleInputModel, BindingIdPayloadModel, CheckPermissionInputModel, CreateRoleInputModel, DeleteRoleInputModel, ListRolesOutputModel, ListUserPermissionsInputModel, ListUserPermissionsOutputModel, PermissionCheckResultModel, PolicyBindingModel, RevokeRoleInputModel, RoleModel, UpdateRoleInputModel };