@objectstack/core 12.6.0 → 14.3.0

package/dist/index.cjs

@@ -4235,7 +4235,7 @@ async function tryFind(ql, object, where, limit = 100) {
 async function resolveAuthzContext(input) {
   const { ql, headers } = input;
   const ctx = {
-    roles: [],
+    positions: [],
     permissions: [],
     systemPermissions: [],
     org_user_ids: []
@@ -4284,16 +4284,16 @@ async function resolveAuthzContext(input) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = (0, import_spec.mapMembershipRole)(raw);
-        if (!ctx.roles.includes(r)) ctx.roles.push(r);
+        if (!ctx.positions.includes(r)) ctx.positions.push(r);
       }
     }
   }
-  const userRoleRows = await tryFind(ql, "sys_user_role", { user_id: userId }, 200);
-  for (const ur of userRoleRows) {
+  const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
+  for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
-    const r = ur.role;
-    if (typeof r === "string" && r && !ctx.roles.includes(r)) ctx.roles.push(r);
+    const r = ur.position;
+    if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
   }
   if (tenantId) {
     const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
@@ -4316,11 +4316,12 @@ async function resolveAuthzContext(input) {
     upsRows.filter((r) => (r.organization_id ?? r.organizationId ?? null) === null).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   let hasPlatformAdminGrant = false;
-  if (ctx.roles.length > 0) {
-    const roleRows = await tryFind(ql, "sys_role", { name: { $in: ctx.roles } }, 100);
-    const roleIds = roleRows.map((r) => r.id).filter(Boolean);
-    if (roleIds.length > 0) {
-      const rpsRows = await tryFind(ql, "sys_role_permission_set", { role_id: { $in: roleIds } }, 500);
+  if (!ctx.positions.includes("everyone")) ctx.positions.push("everyone");
+  if (ctx.positions.length > 0) {
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: ctx.positions } }, 100);
+    const positionIds = positionRows.map((r) => r.id).filter(Boolean);
+    if (positionIds.length > 0) {
+      const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
       for (const r of rpsRows) {
         const id = r.permission_set_id ?? r.permissionSetId;
         if (id) psIds.add(id);
@@ -4353,8 +4354,8 @@ async function resolveAuthzContext(input) {
     }
     if (Object.keys(mergedTabs).length > 0) ctx.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !ctx.roles.includes(import_spec.BUILTIN_ROLE_PLATFORM_ADMIN)) {
-    ctx.roles.unshift(import_spec.BUILTIN_ROLE_PLATFORM_ADMIN);
+  if (hasPlatformAdminGrant && !ctx.positions.includes(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    ctx.positions.unshift(import_spec.BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
   if (!ctx.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;