@maravilla-labs/platform 0.3.3 → 0.3.7

package/src/types.ts

@@ -929,6 +929,245 @@ export interface UpdateUserOptions {
   profile?: Record<string, any>;
 }
 
+// ── Groups ──
+
+export interface AuthGroup {
+  id: string;
+  name: string;
+  description: string | null;
+  permissions: string[];
+  member_count: number;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface CreateGroupOptions {
+  name: string;
+  description?: string;
+  permissions?: string[];
+}
+
+export interface UpdateGroupOptions {
+  name?: string;
+  description?: string;
+  permissions?: string[];
+}
+
+export interface GroupPermission {
+  resource_name: string;
+  actions: string[];
+}
+
+// ── Circles ──
+
+export interface AuthCircle {
+  id: string;
+  name: string;
+  metadata: Record<string, any> | null;
+  member_count: number;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface CreateCircleOptions {
+  name: string;
+  metadata?: Record<string, any>;
+}
+
+export interface UpdateCircleOptions {
+  name?: string;
+  metadata?: Record<string, any>;
+}
+
+export interface AddCircleMemberOptions {
+  user_id: string;
+  relationship: string;
+  is_primary_contact?: boolean;
+}
+
+export interface CircleMembership {
+  user_id: string;
+  email: string;
+  relationship: string;
+  is_primary_contact: boolean;
+  joined_at: number;
+}
+
+// ── Resources ──
+
+export type ResourceServiceType =
+  | 'kv'
+  | 'database'
+  | 'realtime'
+  | 'media'
+  | 'vector'
+  | 'storage'
+  | 'queue'
+  | 'push'
+  | 'workflow'
+  | 'transforms';
+
+export interface Resource {
+  id: string;
+  resource_name: string;
+  title: string;
+  description: string | null;
+  actions: string[];
+  policy: string | null;
+  service_type: ResourceServiceType | null;
+  read_filter: string | null;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface CreateResourceOptions {
+  resource_name: string;
+  title: string;
+  description?: string;
+  actions?: string[];
+  policy?: string;
+  service_type?: ResourceServiceType;
+  read_filter?: string;
+}
+
+export interface UpdateResourceOptions {
+  title?: string;
+  description?: string;
+  actions?: string[];
+  policy?: string;
+  service_type?: ResourceServiceType;
+  read_filter?: string;
+}
+
+// ── Relation types ──
+
+export interface RelationType {
+  id: string;
+  relation_name: string;
+  title: string;
+  description: string | null;
+  category: string;
+  icon: string | null;
+  color: string | null;
+  inverse_relation_id: string | null;
+  implies_stewardship: boolean;
+  requires_minor: boolean;
+  bidirectional: boolean;
+  is_system: boolean;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface CreateRelationTypeOptions {
+  relation_name: string;
+  title: string;
+  description?: string;
+  category?: string;
+  icon?: string;
+  color?: string;
+  inverse_relation_id?: string;
+  implies_stewardship?: boolean;
+  requires_minor?: boolean;
+  bidirectional?: boolean;
+  is_system?: boolean;
+}
+
+export interface UpdateRelationTypeOptions {
+  title?: string;
+  description?: string;
+  category?: string;
+  icon?: string;
+  color?: string;
+  inverse_relation_id?: string;
+  implies_stewardship?: boolean;
+  requires_minor?: boolean;
+  bidirectional?: boolean;
+}
+
+// ── Auth config (extended) ──
+
+export interface AuthConfig {
+  fields: AuthField[];
+  oauth_providers: any[];
+  branding: Record<string, any>;
+  password_policy: Record<string, any>;
+  session_config: Record<string, any>;
+}
+
+// ── Stewardship ──
+
+export type DelegationMode = 'full' | 'scoped';
+export type StewardshipStatus = 'active' | 'suspended' | 'revoked' | 'expired';
+
+export interface ScopedPermission {
+  resource: string;
+  actions: string[];
+}
+
+export interface StewardshipOverride {
+  id: string;
+  steward_id: string;
+  ward_id: string;
+  delegation_mode: DelegationMode;
+  scoped_permissions: ScopedPermission[];
+  valid_from: number | null;
+  valid_until: number | null;
+  status: StewardshipStatus;
+  reason: string | null;
+  source: string;
+  source_circle_id: string | null;
+  source_relation_type_id: string | null;
+  created_at: number;
+  updated_at: number;
+}
+
+export interface CreateStewardshipOverrideOptions {
+  steward_id: string;
+  ward_id: string;
+  delegation_mode?: DelegationMode;
+  scoped_permissions?: ScopedPermission[];
+  valid_from?: number;
+  valid_until?: number;
+  reason?: string;
+}
+
+export interface StewardshipResolution {
+  stewards: StewardshipOverride[];
+  wards: StewardshipOverride[];
+}
+
+export interface ActAsContext {
+  steward_id: string;
+  ward_id: string;
+  delegation_mode: DelegationMode;
+  scoped_permissions: ScopedPermission[];
+  session_token: string;
+  expires_at: number;
+}
+
+export interface StewardshipAuditEntry {
+  id: string;
+  performed_by: string;
+  on_behalf_of: string;
+  action: string;
+  resource: string | null;
+  details: Record<string, any> | null;
+  created_at: number;
+}
+
+/**
+ * Sub-namespace exposed at `platform.auth.stewardship` mirroring the
+ * runtime's `globalThis.platform.auth.stewardship.*` surface.
+ */
+export interface AuthStewardshipApi {
+  resolve(userId: string): Promise<StewardshipResolution>;
+  createOverride(opts: CreateStewardshipOverrideOptions): Promise<StewardshipOverride>;
+  revoke(id: string): Promise<void>;
+  checkPermission(stewardId: string, wardId: string, resource: string, action: string): Promise<boolean>;
+  createActAs(stewardId: string, wardId: string): Promise<ActAsContext>;
+  listAudit(userId: string, options?: { limit?: number; offset?: number }): Promise<StewardshipAuditEntry[]>;
+}
+
 /**
  * Auth service for end-user authentication and user management.
  *
@@ -1091,6 +1330,60 @@ export interface AuthService {
     handler: T
   ): (request: Request) => Promise<Response>;
 
+  // ── Groups (RBAC) ──
+
+  createGroup(options: CreateGroupOptions): Promise<AuthGroup>;
+  listGroups(): Promise<AuthGroup[]>;
+  getGroup(groupId: string): Promise<AuthGroup | null>;
+  updateGroup(groupId: string, options: UpdateGroupOptions): Promise<AuthGroup>;
+  deleteGroup(groupId: string): Promise<void>;
+  addUserToGroup(userId: string, groupId: string): Promise<void>;
+  removeUserFromGroup(userId: string, groupId: string): Promise<void>;
+  getUserGroups(userId: string): Promise<AuthGroup[]>;
+  getGroupMembers(groupId: string): Promise<AuthUser[]>;
+  getGroupPermissions(groupId: string): Promise<GroupPermission[]>;
+  setGroupPermissions(groupId: string, permissions: GroupPermission[]): Promise<void>;
+
+  // ── Circles ──
+
+  createCircle(options: CreateCircleOptions): Promise<AuthCircle>;
+  listCircles(): Promise<AuthCircle[]>;
+  getCircle(circleId: string): Promise<AuthCircle | null>;
+  updateCircle(circleId: string, options: UpdateCircleOptions): Promise<AuthCircle>;
+  deleteCircle(circleId: string): Promise<void>;
+  addCircleMember(circleId: string, options: AddCircleMemberOptions): Promise<void>;
+  removeCircleMember(circleId: string, userId: string): Promise<void>;
+  getCircleMembers(circleId: string): Promise<CircleMembership[]>;
+  getUserCircles(userId: string): Promise<AuthCircle[]>;
+
+  // ── Resources ──
+
+  createResource(options: CreateResourceOptions): Promise<Resource>;
+  listResources(): Promise<Resource[]>;
+  updateResource(resourceId: string, options: UpdateResourceOptions): Promise<Resource>;
+  deleteResource(resourceId: string): Promise<void>;
+
+  // ── Relation types ──
+
+  createRelationType(options: CreateRelationTypeOptions): Promise<RelationType>;
+  listRelationTypes(): Promise<RelationType[]>;
+  updateRelationType(id: string, options: UpdateRelationTypeOptions): Promise<RelationType>;
+  deleteRelationType(id: string): Promise<void>;
+
+  // ── Profile ──
+
+  getProfile(userId: string): Promise<Record<string, any>>;
+  setProfile(userId: string, data: Record<string, any>): Promise<void>;
+
+  // ── Auth config ──
+
+  getAuthConfig(): Promise<AuthConfig>;
+  setAuthConfig(config: AuthConfig): Promise<void>;
+
+  // ── Stewardship (sub-namespace mirroring the runtime bridge) ──
+
+  readonly stewardship: AuthStewardshipApi;
+
   // ── Request-scoped identity + authorization ──
   //
   // These methods operate on the **current request's** caller context.