@objectstack/platform-objects 0.1.0 → 4.0.5

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { PermissionSetSchema } from '@objectstack/spec/security';
 import { Dashboard } from '@objectstack/spec/ui';
 
 // src/identity/sys-user.object.ts
@@ -8,6 +9,7 @@ var SysUser = ObjectSchema.create({
   pluralLabel: "Users",
   icon: "user",
   isSystem: true,
+  managedBy: "better-auth",
   description: "User accounts for authentication",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -93,6 +95,7 @@ var SysSession = ObjectSchema.create({
   pluralLabel: "Sessions",
   icon: "key",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Active user sessions",
   displayNameField: "user_id",
   titleFormat: "Session \u2014 {user_id}",
@@ -184,6 +187,7 @@ var SysAccount = ObjectSchema.create({
   pluralLabel: "Accounts",
   icon: "link",
   isSystem: true,
+  managedBy: "better-auth",
   description: "OAuth and authentication provider accounts",
   titleFormat: "{provider_id} - {account_id}",
   compactLayout: ["provider_id", "user_id", "account_id"],
@@ -267,6 +271,7 @@ var SysVerification = ObjectSchema.create({
   pluralLabel: "Verifications",
   icon: "shield-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Email and phone verification tokens",
   titleFormat: "Verification for {identifier}",
   compactLayout: ["identifier", "expires_at", "created_at"],
@@ -321,6 +326,7 @@ var SysOrganization = ObjectSchema.create({
   pluralLabel: "Organizations",
   icon: "building-2",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -394,6 +400,7 @@ var SysMember = ObjectSchema.create({
   pluralLabel: "Members",
   icon: "user-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organization membership records",
   titleFormat: "{user_id} in {organization_id}",
   compactLayout: ["user_id", "organization_id", "role"],
@@ -442,6 +449,7 @@ var SysInvitation = ObjectSchema.create({
   pluralLabel: "Invitations",
   icon: "mail",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organization invitations for user onboarding",
   titleFormat: "Invitation to {organization_id}",
   compactLayout: ["email", "organization_id", "status"],
@@ -511,6 +519,7 @@ var SysTeam = ObjectSchema.create({
   pluralLabel: "Teams",
   icon: "users",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -569,6 +578,7 @@ var SysTeamMember = ObjectSchema.create({
   pluralLabel: "Team Members",
   icon: "user-plus",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Team membership records linking users to teams",
   titleFormat: "{user_id} in {team_id}",
   compactLayout: ["user_id", "team_id", "created_at"],
@@ -611,6 +621,7 @@ var SysApiKey = ObjectSchema.create({
   pluralLabel: "API Keys",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "API keys for programmatic access",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -713,6 +724,7 @@ var SysTwoFactor = ObjectSchema.create({
   pluralLabel: "Two Factor Credentials",
   icon: "smartphone",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Two-factor authentication credentials",
   titleFormat: "Two-factor for {user_id}",
   compactLayout: ["user_id", "created_at"],
@@ -765,6 +777,7 @@ var SysDeviceCode = ObjectSchema.create({
   pluralLabel: "Device Codes",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
@@ -908,6 +921,7 @@ var SysOauthApplication = ObjectSchema.create({
   pluralLabel: "OAuth Applications",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1123,6 +1137,7 @@ var SysOauthAccessToken = ObjectSchema.create({
   pluralLabel: "OAuth Access Tokens",
   icon: "ticket",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Opaque OAuth access tokens issued to client applications",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -1200,6 +1215,7 @@ var SysOauthRefreshToken = ObjectSchema.create({
   pluralLabel: "OAuth Refresh Tokens",
   icon: "refresh-cw",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Opaque OAuth refresh tokens (linked to a session)",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -1281,6 +1297,7 @@ var SysOauthConsent = ObjectSchema.create({
   pluralLabel: "OAuth Consents",
   icon: "shield-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "User consent records for OAuth client applications",
   compactLayout: ["client_id", "user_id", "scopes"],
   fields: {
@@ -1340,6 +1357,7 @@ var SysJwks = ObjectSchema.create({
   pluralLabel: "JWKS Keys",
   icon: "key",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Asymmetric key pairs used to sign and verify issued JWTs",
   compactLayout: ["id", "created_at", "expires_at"],
   fields: {
@@ -1548,6 +1566,248 @@ var SysPermissionSet = ObjectSchema.create({
     mru: true
   }
 });
+var SysUserPermissionSet = ObjectSchema.create({
+  name: "sys_user_permission_set",
+  label: "User Permission Set",
+  pluralLabel: "User Permission Sets",
+  icon: "user-check",
+  isSystem: true,
+  description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+  titleFormat: "{user_id} \u2192 {permission_set_id}",
+  compactLayout: ["user_id", "permission_set_id", "organization_id"],
+  fields: {
+    id: Field.text({
+      label: "Assignment ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the assignment."
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    permission_set_id: Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Optional organization scope. NULL = applies in every org context."
+    }),
+    granted_by: Field.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User who granted this permission set."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "permission_set_id", "organization_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["organization_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysRolePermissionSet = ObjectSchema.create({
+  name: "sys_role_permission_set",
+  label: "Role Permission Set",
+  pluralLabel: "Role Permission Sets",
+  icon: "shield-plus",
+  isSystem: true,
+  description: "Binds a permission set to a role.",
+  titleFormat: "{role_id} \u2192 {permission_set_id}",
+  compactLayout: ["role_id", "permission_set_id"],
+  fields: {
+    id: Field.text({
+      label: "Binding ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the role-permission-set binding."
+    }),
+    role_id: Field.lookup("sys_role", {
+      label: "Role",
+      required: true,
+      description: "Foreign key to sys_role."
+    }),
+    permission_set_id: Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["role_id", "permission_set_id"], unique: true },
+    { fields: ["role_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var BETTER_AUTH_MANAGED_OBJECTS = [
+  "sys_user",
+  "sys_account",
+  "sys_session",
+  "sys_organization",
+  "sys_member",
+  "sys_invitation",
+  "sys_team",
+  "sys_team_member",
+  "sys_api_key",
+  "sys_two_factor",
+  "sys_verification",
+  "sys_jwks",
+  "sys_device_code",
+  "sys_oauth_application",
+  "sys_oauth_access_token",
+  "sys_oauth_refresh_token",
+  "sys_oauth_consent"
+];
+var denyWritesOnManagedObjects = () => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+  ])
+);
+var defaultPermissionSets = [
+  PermissionSetSchema.parse({
+    name: "admin_full_access",
+    label: "Administrator \u2014 Full Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      }
+    },
+    systemPermissions: ["manage_users", "manage_metadata", "setup.access"]
+  }),
+  PermissionSetSchema.parse({
+    name: "member_default",
+    label: "Member \u2014 Standard Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true
+      },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "owner_only_writes",
+        object: "*",
+        operation: "update",
+        using: "owner_id = current_user.id"
+      },
+      {
+        name: "owner_only_deletes",
+        object: "*",
+        operation: "delete",
+        using: "owner_id = current_user.id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be left unprotected by the wildcard rule above. ────
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  }),
+  PermissionSetSchema.parse({
+    name: "viewer_readonly",
+    label: "Viewer \u2014 Read-Only",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: false,
+        allowEdit: false,
+        allowDelete: false
+      },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "select",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  })
+];
 var SysAuditLog = ObjectSchema.create({
   name: "sys_audit_log",
   label: "Audit Log",
@@ -3686,6 +3946,8 @@ var SETUP_APP = {
         { id: "nav_api_keys", type: "object", label: "API Keys", objectName: "sys_api_key", icon: "key" },
         { id: "nav_roles", type: "object", label: "Roles", objectName: "sys_role", icon: "shield-check" },
         { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "sys_permission_set", icon: "lock" },
+        { id: "nav_user_permission_sets", type: "object", label: "User Permission Sets", objectName: "sys_user_permission_set", icon: "user-check" },
+        { id: "nav_role_permission_sets", type: "object", label: "Role Permission Sets", objectName: "sys_role_permission_set", icon: "shield-plus" },
         { id: "nav_oauth_apps", type: "object", label: "OAuth Apps", objectName: "sys_oauth_application", icon: "app-window" },
         { id: "nav_jwks", type: "object", label: "Signing Keys", objectName: "sys_jwks", icon: "key-round" }
       ]
@@ -4155,6 +4417,6 @@ var SecurityOverviewDashboard = Dashboard.create({
   ]
 });
 
-export { AuditLogsView, OrganizationsView, PackageInstallationsView, RolesView, SETUP_APP, SecurityOverviewDashboard, SessionsView, SysAccount, SysActivity, SysAgent, SysApiKey, SysApp, SysAuditLog, SysComment, SysDeviceCode, SysFlow, SysInvitation, SysJwks, SysMember, SysMetadataObject as SysMetadata, SysMetadataHistoryObject, SysMetadataObject, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysObject, SysOrganization, SysPackage, SysPackageInstallation, SysPackageVersion, SysPermissionSet, SysPresence, SysProject, SysProjectCredential, SysProjectMember, SysRole, SysSession, SysTeam, SysTeamMember, SysTool, SysTwoFactor, SysUser, SysUserPreference, SysVerification, SysView, SystemOverviewDashboard, UsersView };
+export { AuditLogsView, OrganizationsView, PackageInstallationsView, RolesView, SETUP_APP, SecurityOverviewDashboard, SessionsView, SysAccount, SysActivity, SysAgent, SysApiKey, SysApp, SysAuditLog, SysComment, SysDeviceCode, SysFlow, SysInvitation, SysJwks, SysMember, SysMetadataObject as SysMetadata, SysMetadataHistoryObject, SysMetadataObject, SysOauthAccessToken, SysOauthApplication, SysOauthConsent, SysOauthRefreshToken, SysObject, SysOrganization, SysPackage, SysPackageInstallation, SysPackageVersion, SysPermissionSet, SysPresence, SysProject, SysProjectCredential, SysProjectMember, SysRole, SysRolePermissionSet, SysSession, SysTeam, SysTeamMember, SysTool, SysTwoFactor, SysUser, SysUserPermissionSet, SysUserPreference, SysVerification, SysView, SystemOverviewDashboard, UsersView, defaultPermissionSets };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map