@objectstack/core 12.6.0 → 13.0.0

package/dist/index.d.cts

@@ -1733,7 +1733,7 @@ interface ResolvedAuthzContext {
     tenantId?: string;
     email?: string;
     accessToken?: string;
-    roles: string[];
+    positions: string[];
     permissions: string[];
     systemPermissions: string[];
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
@@ -1756,7 +1756,7 @@ interface ResolveAuthzInput {
 }
 /**
  * Resolve the authorization context for an inbound request. Always resolves —
- * never throws. Anonymous requests yield `{ roles: [], permissions: [], ... }`.
+ * never throws. Anonymous requests yield `{ positions: [], permissions: [], ... }`.
  */
 declare function resolveAuthzContext(input: ResolveAuthzInput): Promise<ResolvedAuthzContext>;
 interface ResolveLocalizationInput {

package/dist/index.d.ts

@@ -1733,7 +1733,7 @@ interface ResolvedAuthzContext {
     tenantId?: string;
     email?: string;
     accessToken?: string;
-    roles: string[];
+    positions: string[];
     permissions: string[];
     systemPermissions: string[];
     tabPermissions?: Record<string, 'visible' | 'hidden' | 'default_on' | 'default_off'>;
@@ -1756,7 +1756,7 @@ interface ResolveAuthzInput {
 }
 /**
  * Resolve the authorization context for an inbound request. Always resolves —
- * never throws. Anonymous requests yield `{ roles: [], permissions: [], ... }`.
+ * never throws. Anonymous requests yield `{ positions: [], permissions: [], ... }`.
  */
 declare function resolveAuthzContext(input: ResolveAuthzInput): Promise<ResolvedAuthzContext>;
 interface ResolveLocalizationInput {

package/dist/index.js

@@ -4135,7 +4135,7 @@ function safeJsonParse(s, fallback) {
 // src/security/resolve-authz-context.ts
 import {
   mapMembershipRole,
-  BUILTIN_ROLE_PLATFORM_ADMIN,
+  BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS
 } from "@objectstack/spec";
 function safeJsonParse2(s, fallback) {
@@ -4158,7 +4158,7 @@ async function tryFind(ql, object, where, limit = 100) {
 async function resolveAuthzContext(input) {
   const { ql, headers } = input;
   const ctx = {
-    roles: [],
+    positions: [],
     permissions: [],
     systemPermissions: [],
     org_user_ids: []
@@ -4207,16 +4207,16 @@ async function resolveAuthzContext(input) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = mapMembershipRole(raw);
-        if (!ctx.roles.includes(r)) ctx.roles.push(r);
+        if (!ctx.positions.includes(r)) ctx.positions.push(r);
       }
     }
   }
-  const userRoleRows = await tryFind(ql, "sys_user_role", { user_id: userId }, 200);
-  for (const ur of userRoleRows) {
+  const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
+  for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
-    const r = ur.role;
-    if (typeof r === "string" && r && !ctx.roles.includes(r)) ctx.roles.push(r);
+    const r = ur.position;
+    if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
   }
   if (tenantId) {
     const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
@@ -4239,11 +4239,12 @@ async function resolveAuthzContext(input) {
     upsRows.filter((r) => (r.organization_id ?? r.organizationId ?? null) === null).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   let hasPlatformAdminGrant = false;
-  if (ctx.roles.length > 0) {
-    const roleRows = await tryFind(ql, "sys_role", { name: { $in: ctx.roles } }, 100);
-    const roleIds = roleRows.map((r) => r.id).filter(Boolean);
-    if (roleIds.length > 0) {
-      const rpsRows = await tryFind(ql, "sys_role_permission_set", { role_id: { $in: roleIds } }, 500);
+  if (!ctx.positions.includes("everyone")) ctx.positions.push("everyone");
+  if (ctx.positions.length > 0) {
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: ctx.positions } }, 100);
+    const positionIds = positionRows.map((r) => r.id).filter(Boolean);
+    if (positionIds.length > 0) {
+      const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
       for (const r of rpsRows) {
         const id = r.permission_set_id ?? r.permissionSetId;
         if (id) psIds.add(id);
@@ -4276,8 +4277,8 @@ async function resolveAuthzContext(input) {
     }
     if (Object.keys(mergedTabs).length > 0) ctx.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !ctx.roles.includes(BUILTIN_ROLE_PLATFORM_ADMIN)) {
-    ctx.roles.unshift(BUILTIN_ROLE_PLATFORM_ADMIN);
+  if (hasPlatformAdminGrant && !ctx.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    ctx.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
   if (!ctx.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;