@lssm/lib.identity-rbac 0.0.0-canary-20251217060433 → 0.0.0-canary-20251217062139

package/dist/contracts/rbac.js

@@ -1 +1 @@
-import{SuccessResultModel as e}from"./user.js";import{ScalarTypeEnum as t,SchemaModel as n}from"@lssm/lib.schema";import{defineCommand as r,defineQuery as i}from"@lssm/lib.contracts";const a=[`platform.identity-rbac`],o=new n({name:`Role`,description:`RBAC role definition`,fields:{id:{type:t.String_unsecure(),isOptional:!1},name:{type:t.String_unsecure(),isOptional:!1},description:{type:t.String_unsecure(),isOptional:!0},permissions:{type:t.String_unsecure(),isOptional:!1,isArray:!0},createdAt:{type:t.DateTime(),isOptional:!1}}}),s=new n({name:`PolicyBinding`,description:`Role assignment to a target`,fields:{id:{type:t.String_unsecure(),isOptional:!1},roleId:{type:t.String_unsecure(),isOptional:!1},targetType:{type:t.String_unsecure(),isOptional:!1},targetId:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!0},createdAt:{type:t.DateTime(),isOptional:!1},role:{type:o,isOptional:!1}}}),c=new n({name:`PermissionCheckResult`,description:`Result of a permission check`,fields:{allowed:{type:t.Boolean(),isOptional:!1},reason:{type:t.String_unsecure(),isOptional:!0},matchedRole:{type:t.String_unsecure(),isOptional:!0}}}),l=new n({name:`CreateRoleInput`,description:`Input for creating a role`,fields:{name:{type:t.NonEmptyString(),isOptional:!1},description:{type:t.String_unsecure(),isOptional:!0},permissions:{type:t.String_unsecure(),isOptional:!1,isArray:!0}}}),u=new n({name:`UpdateRoleInput`,description:`Input for updating a role`,fields:{roleId:{type:t.String_unsecure(),isOptional:!1},name:{type:t.String_unsecure(),isOptional:!0},description:{type:t.String_unsecure(),isOptional:!0},permissions:{type:t.String_unsecure(),isOptional:!0,isArray:!0}}}),d=new n({name:`DeleteRoleInput`,description:`Input for deleting a role`,fields:{roleId:{type:t.String_unsecure(),isOptional:!1}}}),f=new n({name:`ListRolesOutput`,description:`Output for listing roles`,fields:{roles:{type:o,isOptional:!1,isArray:!0}}}),p=new n({name:`AssignRoleInput`,description:`Input for assigning a role`,fields:{roleId:{type:t.String_unsecure(),isOptional:!1},targetType:{type:t.String_unsecure(),isOptional:!1},targetId:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!0}}}),m=new n({name:`RevokeRoleInput`,description:`Input for revoking a role`,fields:{bindingId:{type:t.String_unsecure(),isOptional:!1}}}),h=new n({name:`BindingIdPayload`,description:`Payload with binding ID`,fields:{bindingId:{type:t.String_unsecure(),isOptional:!1}}}),g=new n({name:`CheckPermissionInput`,description:`Input for checking a permission`,fields:{userId:{type:t.String_unsecure(),isOptional:!1},orgId:{type:t.String_unsecure(),isOptional:!0},permission:{type:t.String_unsecure(),isOptional:!1}}}),_=new n({name:`ListUserPermissionsInput`,description:`Input for listing user permissions`,fields:{userId:{type:t.String_unsecure(),isOptional:!1},orgId:{type:t.String_unsecure(),isOptional:!0}}}),v=new n({name:`ListUserPermissionsOutput`,description:`Output for listing user permissions`,fields:{permissions:{type:t.String_unsecure(),isOptional:!1,isArray:!0},roles:{type:o,isOptional:!1,isArray:!0}}}),y=r({meta:{name:`identity.rbac.role.create`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`create`],description:`Create a new role with permissions.`,goal:`Allow admins to define custom roles.`,context:`Role management in admin settings.`},io:{input:l,output:o,errors:{ROLE_EXISTS:{description:`A role with this name already exists`,http:409,gqlCode:`ROLE_EXISTS`,when:`Role name is taken`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.created`]}}),b=r({meta:{name:`identity.rbac.role.update`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`update`],description:`Update an existing role.`,goal:`Allow admins to modify role permissions.`,context:`Role management in admin settings.`},io:{input:u,output:o},policy:{auth:`admin`},sideEffects:{audit:[`role.updated`]}}),x=r({meta:{name:`identity.rbac.role.delete`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`delete`],description:`Delete an existing role.`,goal:`Allow admins to remove unused roles.`,context:`Role management. Removes all policy bindings using this role.`},io:{input:d,output:e,errors:{ROLE_IN_USE:{description:`Role is still assigned to users or organizations`,http:409,gqlCode:`ROLE_IN_USE`,when:`Role has active bindings`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.deleted`]}}),S=i({meta:{name:`identity.rbac.role.list`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`list`],description:`List all available roles.`,goal:`Show available roles for assignment.`,context:`Role assignment UI.`},io:{input:null,output:f},policy:{auth:`user`}}),C=r({meta:{name:`identity.rbac.assign`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`assign`],description:`Assign a role to a user or organization.`,goal:`Grant permissions via role assignment.`,context:`User/org permission management.`},io:{input:p,output:s,errors:{ROLE_NOT_FOUND:{description:`The specified role does not exist`,http:404,gqlCode:`ROLE_NOT_FOUND`,when:`Role ID is invalid`},ALREADY_ASSIGNED:{description:`This role is already assigned to the target`,http:409,gqlCode:`ALREADY_ASSIGNED`,when:`Binding already exists`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.assigned`,version:1,when:`Role is assigned`,payload:s}],audit:[`role.assigned`]}}),w=r({meta:{name:`identity.rbac.revoke`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`revoke`],description:`Revoke a role from a user or organization.`,goal:`Remove permissions via role revocation.`,context:`User/org permission management.`},io:{input:m,output:e,errors:{BINDING_NOT_FOUND:{description:`The policy binding does not exist`,http:404,gqlCode:`BINDING_NOT_FOUND`,when:`Binding ID is invalid`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.revoked`,version:1,when:`Role is revoked`,payload:h}],audit:[`role.revoked`]}}),T=i({meta:{name:`identity.rbac.check`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`check`,`permission`],description:`Check if a user has a specific permission.`,goal:`Authorization check before sensitive operations.`,context:`Called by other services to verify permissions.`},io:{input:g,output:c},policy:{auth:`user`}}),E=i({meta:{name:`identity.rbac.permissions`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`permissions`,`user`],description:`List all permissions for a user in a context.`,goal:`Show what a user can do in an org.`,context:`UI permission display, debugging.`},io:{input:_,output:v},policy:{auth:`user`}});export{C as AssignRoleContract,p as AssignRoleInputModel,h as BindingIdPayloadModel,T as CheckPermissionContract,g as CheckPermissionInputModel,y as CreateRoleContract,l as CreateRoleInputModel,x as DeleteRoleContract,d as DeleteRoleInputModel,S as ListRolesContract,f as ListRolesOutputModel,E as ListUserPermissionsContract,_ as ListUserPermissionsInputModel,v as ListUserPermissionsOutputModel,c as PermissionCheckResultModel,s as PolicyBindingModel,w as RevokeRoleContract,m as RevokeRoleInputModel,o as RoleModel,b as UpdateRoleContract,u as UpdateRoleInputModel};
+import{l as e}from"../schema/dist/ScalarTypeEnum.js";import{t}from"../schema/dist/SchemaModel.js";import"../schema/dist/index.js";import{n,t as r}from"./dist/spec.js";import"./dist/index.js";import{SuccessResultModel as i}from"./user.js";const a=[`platform.identity-rbac`],o=new t({name:`Role`,description:`RBAC role definition`,fields:{id:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),s=new t({name:`PolicyBinding`,description:`Role assignment to a target`,fields:{id:{type:e.String_unsecure(),isOptional:!1},roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},role:{type:o,isOptional:!1}}}),c=new t({name:`PermissionCheckResult`,description:`Result of a permission check`,fields:{allowed:{type:e.Boolean(),isOptional:!1},reason:{type:e.String_unsecure(),isOptional:!0},matchedRole:{type:e.String_unsecure(),isOptional:!0}}}),l=new t({name:`CreateRoleInput`,description:`Input for creating a role`,fields:{name:{type:e.NonEmptyString(),isOptional:!1},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0}}}),u=new t({name:`UpdateRoleInput`,description:`Input for updating a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},description:{type:e.String_unsecure(),isOptional:!0},permissions:{type:e.String_unsecure(),isOptional:!0,isArray:!0}}}),d=new t({name:`DeleteRoleInput`,description:`Input for deleting a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1}}}),f=new t({name:`ListRolesOutput`,description:`Output for listing roles`,fields:{roles:{type:o,isOptional:!1,isArray:!0}}}),p=new t({name:`AssignRoleInput`,description:`Input for assigning a role`,fields:{roleId:{type:e.String_unsecure(),isOptional:!1},targetType:{type:e.String_unsecure(),isOptional:!1},targetId:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0}}}),m=new t({name:`RevokeRoleInput`,description:`Input for revoking a role`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),h=new t({name:`BindingIdPayload`,description:`Payload with binding ID`,fields:{bindingId:{type:e.String_unsecure(),isOptional:!1}}}),g=new t({name:`CheckPermissionInput`,description:`Input for checking a permission`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0},permission:{type:e.String_unsecure(),isOptional:!1}}}),_=new t({name:`ListUserPermissionsInput`,description:`Input for listing user permissions`,fields:{userId:{type:e.String_unsecure(),isOptional:!1},orgId:{type:e.String_unsecure(),isOptional:!0}}}),v=new t({name:`ListUserPermissionsOutput`,description:`Output for listing user permissions`,fields:{permissions:{type:e.String_unsecure(),isOptional:!1,isArray:!0},roles:{type:o,isOptional:!1,isArray:!0}}}),y=r({meta:{name:`identity.rbac.role.create`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`create`],description:`Create a new role with permissions.`,goal:`Allow admins to define custom roles.`,context:`Role management in admin settings.`},io:{input:l,output:o,errors:{ROLE_EXISTS:{description:`A role with this name already exists`,http:409,gqlCode:`ROLE_EXISTS`,when:`Role name is taken`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.created`]}}),b=r({meta:{name:`identity.rbac.role.update`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`update`],description:`Update an existing role.`,goal:`Allow admins to modify role permissions.`,context:`Role management in admin settings.`},io:{input:u,output:o},policy:{auth:`admin`},sideEffects:{audit:[`role.updated`]}}),x=r({meta:{name:`identity.rbac.role.delete`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`delete`],description:`Delete an existing role.`,goal:`Allow admins to remove unused roles.`,context:`Role management. Removes all policy bindings using this role.`},io:{input:d,output:i,errors:{ROLE_IN_USE:{description:`Role is still assigned to users or organizations`,http:409,gqlCode:`ROLE_IN_USE`,when:`Role has active bindings`}}},policy:{auth:`admin`},sideEffects:{audit:[`role.deleted`]}}),S=n({meta:{name:`identity.rbac.role.list`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`role`,`list`],description:`List all available roles.`,goal:`Show available roles for assignment.`,context:`Role assignment UI.`},io:{input:null,output:f},policy:{auth:`user`}}),C=r({meta:{name:`identity.rbac.assign`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`assign`],description:`Assign a role to a user or organization.`,goal:`Grant permissions via role assignment.`,context:`User/org permission management.`},io:{input:p,output:s,errors:{ROLE_NOT_FOUND:{description:`The specified role does not exist`,http:404,gqlCode:`ROLE_NOT_FOUND`,when:`Role ID is invalid`},ALREADY_ASSIGNED:{description:`This role is already assigned to the target`,http:409,gqlCode:`ALREADY_ASSIGNED`,when:`Binding already exists`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.assigned`,version:1,when:`Role is assigned`,payload:s}],audit:[`role.assigned`]}}),w=r({meta:{name:`identity.rbac.revoke`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`revoke`],description:`Revoke a role from a user or organization.`,goal:`Remove permissions via role revocation.`,context:`User/org permission management.`},io:{input:m,output:i,errors:{BINDING_NOT_FOUND:{description:`The policy binding does not exist`,http:404,gqlCode:`BINDING_NOT_FOUND`,when:`Binding ID is invalid`}}},policy:{auth:`admin`},sideEffects:{emits:[{name:`role.revoked`,version:1,when:`Role is revoked`,payload:h}],audit:[`role.revoked`]}}),T=n({meta:{name:`identity.rbac.check`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`check`,`permission`],description:`Check if a user has a specific permission.`,goal:`Authorization check before sensitive operations.`,context:`Called by other services to verify permissions.`},io:{input:g,output:c},policy:{auth:`user`}}),E=n({meta:{name:`identity.rbac.permissions`,version:1,stability:`stable`,owners:[...a],tags:[`identity`,`rbac`,`permissions`,`user`],description:`List all permissions for a user in a context.`,goal:`Show what a user can do in an org.`,context:`UI permission display, debugging.`},io:{input:_,output:v},policy:{auth:`user`}});export{C as AssignRoleContract,p as AssignRoleInputModel,h as BindingIdPayloadModel,T as CheckPermissionContract,g as CheckPermissionInputModel,y as CreateRoleContract,l as CreateRoleInputModel,x as DeleteRoleContract,d as DeleteRoleInputModel,S as ListRolesContract,f as ListRolesOutputModel,E as ListUserPermissionsContract,_ as ListUserPermissionsInputModel,v as ListUserPermissionsOutputModel,c as PermissionCheckResultModel,s as PolicyBindingModel,w as RevokeRoleContract,m as RevokeRoleInputModel,o as RoleModel,b as UpdateRoleContract,u as UpdateRoleInputModel};