@lucern/contracts 0.3.0-alpha.10 → 0.3.0-alpha.12

package/dist/schemas/tables/controlPlane/accessControl.js

@@ -0,0 +1,655 @@
+import { z } from 'zod';
+
+// src/schemas/tables/controlPlane/accessControl.ts
+
+// src/dsl/defineTable.ts
+function defineTable(spec) {
+  return spec;
+}
+
+// src/schemas/tables/controlPlane/accessControl.ts
+var permitActorType = z.enum([
+  "human",
+  "agent",
+  "service_principal",
+  "external_stakeholder",
+  "system"
+]);
+var permitMembershipStatus = z.enum([
+  "active",
+  "invited",
+  "revoked",
+  "suspended",
+  "disabled"
+]);
+var permitDecision = z.enum(["allow", "deny"]);
+var permitAccessReviewStatus = z.enum([
+  "open",
+  "in_progress",
+  "approved",
+  "denied",
+  "expired",
+  "cancelled"
+]);
+var permitReviewScope = z.enum([
+  "tenant",
+  "workspace",
+  "resource_instance",
+  "group",
+  "principal",
+  "api_key",
+  "admin_action"
+]);
+var permitRecordStatus = z.enum([
+  "queued",
+  "inflight",
+  "completed",
+  "failed",
+  "skipped",
+  "stale"
+]);
+var permitObjectType = z.enum([
+  "resource",
+  "role",
+  "resource_role",
+  "resource_relation",
+  "tenant",
+  "workspace",
+  "principal",
+  "membership",
+  "group",
+  "resource_instance",
+  "relationship_tuple",
+  "role_assignment",
+  "attribute_binding",
+  "policy_bundle"
+]);
+var permitOutboxOperation = z.enum([
+  "upsert",
+  "delete",
+  "sync",
+  "resync",
+  "delete_sync",
+  "noop"
+]);
+var permitPolicyBundleStatus = z.enum([
+  "draft",
+  "validated",
+  "enforced",
+  "archived"
+]);
+var permitSyncStatus = z.enum([
+  "pending",
+  "synced",
+  "error",
+  "skipped"
+]);
+var permitAccessReviewSubjectType = z.enum([
+  "principal",
+  "group",
+  "role_assignment",
+  "resource_instance"
+]);
+var permitAttributeType = z.enum([
+  "string",
+  "number",
+  "bool",
+  "json",
+  "time"
+]);
+var permitAttributeOperator = z.enum([
+  "eq",
+  "neq",
+  "in",
+  "not_in",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "contains",
+  "not_contains",
+  "matches"
+]);
+var permitRoleBindingTarget = z.enum([
+  "principal",
+  "group"
+]);
+var permitPrincipals = defineTable({
+  name: "permitPrincipals",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    principalType: permitActorType,
+    status: permitMembershipStatus,
+    displayName: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional(),
+    lastSeenAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_principalId", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_tenant_principalType_status",
+      columns: ["tenantId", "principalType", "status"]
+    }
+  ]
+});
+var permitPrincipalAliases = defineTable({
+  name: "permitPrincipalAliases",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    principalId: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    provider: z.string(),
+    providerSubjectId: z.string(),
+    providerProjectId: z.string().optional(),
+    alias: z.string(),
+    aliasKind: z.string(),
+    status: permitMembershipStatus,
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    revokedBy: z.string().optional(),
+    revokedAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principalId", columns: ["principalId"] },
+    { kind: "index", name: "by_tenant_provider_subject", columns: ["tenantId", "provider", "providerSubjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_alias",
+      columns: ["tenantId", "provider", "alias"]
+    },
+    { kind: "index", name: "by_tenant_alias", columns: ["tenantId", "alias"] },
+    {
+      kind: "index",
+      name: "by_tenant_provider_status",
+      columns: ["tenantId", "provider", "status"]
+    }
+  ]
+});
+var permitGroups = defineTable({
+  name: "permitGroups",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    groupKey: z.string(),
+    groupName: z.string(),
+    groupType: z.enum(["tenant", "workspace", "external", "system", "dynamic"]),
+    status: permitMembershipStatus,
+    description: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_tenant_groupId", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_tenant_groupKey", columns: ["tenantId", "groupKey"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitGroupMemberships = defineTable({
+  name: "permitGroupMemberships",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    groupId: z.string(),
+    memberType: z.enum(["principal", "group"]),
+    memberId: z.string(),
+    principalId: z.string().optional(),
+    childGroupId: z.string().optional(),
+    status: permitMembershipStatus,
+    addedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    expiresAt: z.number().optional(),
+    revocationReason: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_principal", columns: ["tenantId", "principalId"] },
+    { kind: "index", name: "by_tenant_member", columns: ["tenantId", "memberType", "memberId"] },
+    {
+      kind: "index",
+      name: "by_tenant_member_group",
+      columns: ["tenantId", "memberType", "memberId", "groupId"]
+    },
+    { kind: "index", name: "by_tenant_group", columns: ["tenantId", "groupId"] },
+    { kind: "index", name: "by_member_group", columns: ["memberType", "memberId", "groupId"] },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    {
+      kind: "index",
+      name: "by_workspace_principal",
+      columns: ["workspaceId", "principalId"]
+    }
+  ]
+});
+var permitResourceInstances = defineTable({
+  name: "permitResourceInstances",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceId: z.string(),
+    status: z.enum(["active", "deleted", "archived"]),
+    attributes: z.record(z.any()).optional(),
+    ownerPrincipalId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_resource_type",
+      columns: ["tenantId", "resourceType"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource_key",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_ownerPrincipalId",
+      columns: ["ownerPrincipalId"]
+    }
+  ]
+});
+var permitRoleAssignments = defineTable({
+  name: "permitRoleAssignments",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    role: z.string(),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    resourceType: z.string(),
+    resourceKey: z.string(),
+    resourceInstanceId: z.string().optional(),
+    status: permitMembershipStatus,
+    expiresAt: z.number().optional(),
+    attributes: z.record(z.any()).optional(),
+    grantedBy: z.string().optional(),
+    updatedBy: z.string().optional(),
+    revokedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_resource",
+      columns: ["tenantId", "resourceType", "resourceKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_role",
+      columns: ["tenantId", "role", "status"]
+    },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_workspace_resource",
+      columns: ["workspaceId", "resourceType", "resourceKey"]
+    }
+  ]
+});
+var permitRelationshipTuples = defineTable({
+  name: "permitRelationshipTuples",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    relation: z.string(),
+    subject: z.string(),
+    object: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    status: permitRecordStatus,
+    attributes: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastSeenAt: z.number().optional(),
+    updatedBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_subject", columns: ["tenantId", "subject"] },
+    { kind: "index", name: "by_tenant_object", columns: ["tenantId", "object"] },
+    { kind: "index", name: "by_tenant_relation", columns: ["tenantId", "relation"] },
+    {
+      kind: "index",
+      name: "by_tenant_relation_subject",
+      columns: ["tenantId", "relation", "subject"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitAttributeBindings = defineTable({
+  name: "permitAttributeBindings",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    targetType: permitRoleBindingTarget,
+    targetId: z.string(),
+    attributeName: z.string(),
+    attributeType: permitAttributeType,
+    attributeOperator: permitAttributeOperator,
+    attributeValue: z.any(),
+    status: permitRecordStatus,
+    source: z.string().optional(),
+    sourceRef: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    expiresAt: z.number().optional()
+  }),
+  indices: [
+    {
+      kind: "index",
+      name: "by_tenant_target",
+      columns: ["tenantId", "targetType", "targetId"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_target_attribute",
+      columns: ["tenantId", "targetType", "targetId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_name",
+      columns: ["tenantId", "attributeName"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    }
+  ]
+});
+var permitPolicyBundles = defineTable({
+  name: "permitPolicyBundles",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    bundleKey: z.string(),
+    version: z.number(),
+    status: permitPolicyBundleStatus,
+    policyHash: z.string().optional(),
+    policyPayload: z.record(z.any()),
+    metadata: z.record(z.any()).optional(),
+    createdBy: z.string(),
+    reviewedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    retiredAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    { kind: "index", name: "by_workspaceId", columns: ["workspaceId"] },
+    {
+      kind: "index",
+      name: "by_tenant_bundleKey",
+      columns: ["tenantId", "bundleKey"]
+    },
+    {
+      kind: "index",
+      name: "by_tenant_bundle_version",
+      columns: ["tenantId", "bundleKey", "version"]
+    },
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] }
+  ]
+});
+var permitProjectionOutbox = defineTable({
+  name: "permitProjectionOutbox",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    operation: permitOutboxOperation,
+    payload: z.record(z.any()),
+    status: permitRecordStatus,
+    attemptCount: z.number(),
+    nextAttemptAt: z.number().optional(),
+    lastError: z.string().optional(),
+    tenantId: z.string().optional(),
+    workspaceId: z.optional(z.string()),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+    lastHandledAt: z.number().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    { kind: "index", name: "by_tenantId", columns: ["tenantId"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_objectType",
+      columns: ["objectType", "status"]
+    }
+  ]
+});
+var tenantPermitSyncStates = defineTable({
+  name: "tenantPermitSyncStates",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    syncKey: z.string(),
+    objectType: permitObjectType,
+    objectId: z.string(),
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string().optional(),
+    permitTenantKey: z.string().optional(),
+    permitResourceType: z.string().optional(),
+    permitResourceKey: z.string().optional(),
+    desiredPayload: z.record(z.any()),
+    lastAppliedPayloadHash: z.string().optional(),
+    status: permitSyncStatus,
+    attemptCount: z.number(),
+    lastError: z.string().optional(),
+    nextAttemptAt: z.number().optional(),
+    lastSyncedAt: z.number().optional(),
+    createdBy: z.string(),
+    updatedBy: z.string().optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_syncKey", columns: ["syncKey"] },
+    { kind: "index", name: "by_status", columns: ["status"] },
+    {
+      kind: "index",
+      name: "by_tenant_status",
+      columns: ["tenantId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    },
+    {
+      kind: "index",
+      name: "by_principal_status",
+      columns: ["principalId", "status"]
+    }
+  ]
+});
+var permitPolicyDecisionReceipts = defineTable({
+  name: "permitPolicyDecisionReceipts",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string().optional(),
+    workspaceId: z.string().optional(),
+    principalId: z.string(),
+    subjectType: permitAccessReviewSubjectType.optional(),
+    subjectId: z.string().optional(),
+    resourceType: z.string(),
+    resourceId: z.string(),
+    action: z.string(),
+    decision: permitDecision,
+    reasonCode: z.string(),
+    policyBundleId: z.string().optional(),
+    policyVersion: z.string(),
+    traceId: z.string().optional(),
+    requestId: z.string().optional(),
+    audienceMode: z.string().optional(),
+    audienceKey: z.string().optional(),
+    audienceClass: z.enum(["internal", "restricted_external", "public"]).optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    expiresAt: z.number().optional(),
+    createdBy: z.string().optional()
+  }),
+  indices: [
+    { kind: "index", name: "by_principal_createdAt", columns: ["principalId", "createdAt"] },
+    { kind: "index", name: "by_tenant_createdAt", columns: ["tenantId", "createdAt"] },
+    { kind: "index", name: "by_resource", columns: ["resourceType", "resourceId"] },
+    { kind: "index", name: "by_decision_createdAt", columns: ["decision", "createdAt"] },
+    { kind: "index", name: "by_traceId", columns: ["traceId"] },
+    { kind: "index", name: "by_action", columns: ["action"] }
+  ]
+});
+var permitAccessReviews = defineTable({
+  name: "permitAccessReviews",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    tenantId: z.string(),
+    workspaceId: z.optional(z.string()),
+    reviewKey: z.string(),
+    scope: permitReviewScope,
+    status: permitAccessReviewStatus,
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    outcome: z.enum(["allow", "deny"]).optional(),
+    requestedBy: z.string(),
+    reviewedBy: z.string().optional(),
+    requestedAt: z.number(),
+    reviewedAt: z.number().optional(),
+    dueAt: z.number().optional(),
+    justification: z.string().optional(),
+    rationale: z.string().optional(),
+    policyBundleId: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_tenant_status", columns: ["tenantId", "status"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    {
+      kind: "index",
+      name: "by_tenant_subject",
+      columns: ["tenantId", "subjectType", "subjectId"]
+    },
+    { kind: "index", name: "by_outcome", columns: ["outcome"] },
+    {
+      kind: "index",
+      name: "by_workspace_status",
+      columns: ["workspaceId", "status"]
+    }
+  ]
+});
+var permitAccessReviewItems = defineTable({
+  name: "permitAccessReviewItems",
+  component: "control-plane",
+  category: "access-control",
+  shape: z.object({
+    reviewKey: z.string(),
+    itemKey: z.string(),
+    tenantId: z.string(),
+    workspaceId: z.string().optional(),
+    subjectType: permitAccessReviewSubjectType,
+    subjectId: z.string(),
+    resourceType: z.string().optional(),
+    resourceKey: z.string().optional(),
+    role: z.string().optional(),
+    relation: z.string().optional(),
+    status: z.enum(["open", "approved", "revoked", "changed", "deferred"]),
+    reviewerId: z.string().optional(),
+    decisionAt: z.number().optional(),
+    rationale: z.string().optional(),
+    metadata: z.record(z.any()).optional(),
+    createdAt: z.number(),
+    updatedAt: z.number()
+  }),
+  indices: [
+    { kind: "index", name: "by_reviewKey", columns: ["reviewKey"] },
+    { kind: "index", name: "by_tenant_reviewKey", columns: ["tenantId", "reviewKey"] },
+    { kind: "index", name: "by_tenant_itemKey", columns: ["tenantId", "itemKey"] },
+    { kind: "index", name: "by_subject", columns: ["subjectType", "subjectId"] },
+    { kind: "index", name: "by_status", columns: ["status"] }
+  ]
+});
+
+export { permitAccessReviewItems, permitAccessReviews, permitAttributeBindings, permitGroupMemberships, permitGroups, permitPolicyBundles, permitPolicyDecisionReceipts, permitPrincipalAliases, permitPrincipals, permitProjectionOutbox, permitRelationshipTuples, permitResourceInstances, permitRoleAssignments, tenantPermitSyncStates };
+//# sourceMappingURL=accessControl.js.map
+//# sourceMappingURL=accessControl.js.map