@objectstack/platform-objects 0.1.0 → 4.0.5

package/dist/security/index.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var data = require('@objectstack/spec/data');
+var security = require('@objectstack/spec/security');
 
 // src/security/sys-role.object.ts
 var SysRole = data.ObjectSchema.create({
@@ -171,8 +172,253 @@ var SysPermissionSet = data.ObjectSchema.create({
     mru: true
   }
 });
+var SysUserPermissionSet = data.ObjectSchema.create({
+  name: "sys_user_permission_set",
+  label: "User Permission Set",
+  pluralLabel: "User Permission Sets",
+  icon: "user-check",
+  isSystem: true,
+  description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+  titleFormat: "{user_id} \u2192 {permission_set_id}",
+  compactLayout: ["user_id", "permission_set_id", "organization_id"],
+  fields: {
+    id: data.Field.text({
+      label: "Assignment ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the assignment."
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    permission_set_id: data.Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Optional organization scope. NULL = applies in every org context."
+    }),
+    granted_by: data.Field.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User who granted this permission set."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "permission_set_id", "organization_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["organization_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysRolePermissionSet = data.ObjectSchema.create({
+  name: "sys_role_permission_set",
+  label: "Role Permission Set",
+  pluralLabel: "Role Permission Sets",
+  icon: "shield-plus",
+  isSystem: true,
+  description: "Binds a permission set to a role.",
+  titleFormat: "{role_id} \u2192 {permission_set_id}",
+  compactLayout: ["role_id", "permission_set_id"],
+  fields: {
+    id: data.Field.text({
+      label: "Binding ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the role-permission-set binding."
+    }),
+    role_id: data.Field.lookup("sys_role", {
+      label: "Role",
+      required: true,
+      description: "Foreign key to sys_role."
+    }),
+    permission_set_id: data.Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["role_id", "permission_set_id"], unique: true },
+    { fields: ["role_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var BETTER_AUTH_MANAGED_OBJECTS = [
+  "sys_user",
+  "sys_account",
+  "sys_session",
+  "sys_organization",
+  "sys_member",
+  "sys_invitation",
+  "sys_team",
+  "sys_team_member",
+  "sys_api_key",
+  "sys_two_factor",
+  "sys_verification",
+  "sys_jwks",
+  "sys_device_code",
+  "sys_oauth_application",
+  "sys_oauth_access_token",
+  "sys_oauth_refresh_token",
+  "sys_oauth_consent"
+];
+var denyWritesOnManagedObjects = () => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+  ])
+);
+var defaultPermissionSets = [
+  security.PermissionSetSchema.parse({
+    name: "admin_full_access",
+    label: "Administrator \u2014 Full Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      }
+    },
+    systemPermissions: ["manage_users", "manage_metadata", "setup.access"]
+  }),
+  security.PermissionSetSchema.parse({
+    name: "member_default",
+    label: "Member \u2014 Standard Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true
+      },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "owner_only_writes",
+        object: "*",
+        operation: "update",
+        using: "owner_id = current_user.id"
+      },
+      {
+        name: "owner_only_deletes",
+        object: "*",
+        operation: "delete",
+        using: "owner_id = current_user.id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be left unprotected by the wildcard rule above. ────
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  }),
+  security.PermissionSetSchema.parse({
+    name: "viewer_readonly",
+    label: "Viewer \u2014 Read-Only",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: false,
+        allowEdit: false,
+        allowDelete: false
+      },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "select",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  })
+];
 
 exports.SysPermissionSet = SysPermissionSet;
 exports.SysRole = SysRole;
+exports.SysRolePermissionSet = SysRolePermissionSet;
+exports.SysUserPermissionSet = SysUserPermissionSet;
+exports.defaultPermissionSets = defaultPermissionSets;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/security/sys-role.object.ts","../../src/security/sys-permission-set.object.ts"],"names":["ObjectSchema","Field"],"mappings":";;;;;AAYO,IAAM,OAAA,GAAUA,kBAAa,MAAA,CAAO;AAAA,EACzC,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,MAAA;AAAA,EACP,WAAA,EAAa,OAAA;AAAA,EACb,IAAA,EAAM,QAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,0CAAA;AAAA,EACb,gBAAA,EAAkB,OAAA;AAAA,EAClB,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,CAAC,OAAA,EAAS,MAAA,EAAQ,UAAU,YAAY,CAAA;AAAA,EAEvD,MAAA,EAAQ;AAAA;AAAA,IAEN,KAAA,EAAOC,WAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,cAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,IAAA,EAAMA,WAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,UAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,WAAA,EAAa,+DAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,6CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,MAAA,EAAQA,WAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,YAAA,EAAc,IAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,OAAA,CAAQ;AAAA,MACxB,KAAA,EAAO,cAAA;AAAA,MACP,YAAA,EAAc,KAAA;AAAA,MACd,WAAA,EAAa,qCAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,EAAA,EAAIA,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,SAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IACjC,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA;AAAE,GACvB;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC;AC7FM,IAAM,gBAAA,GAAmBD,kBAAa,MAAA,CAAO;AAAA,EAClD,IAAA,EAAM,oBAAA;AAAA,EACN,KAAA,EAAO,gBAAA;AAAA,EACP,WAAA,EAAa,iBAAA;AAAA,EACb,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,4DAAA;AAAA,EACb,gBAAA,EAAkB,OAAA;AAAA,EAClB,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,CAAC,OAAA,EAAS,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAEzC,MAAA,EAAQ;AAAA;AAAA,IAEN,KAAA,EAAOC,WAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,cAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,IAAA,EAAMA,WAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,UAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,WAAA,EAAa,4CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,kBAAA,EAAoBA,WAAM,QAAA,CAAS;AAAA,MACjC,KAAA,EAAO,oBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,+CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,iBAAA,EAAmBA,WAAM,QAAA,CAAS;AAAA,MAChC,KAAA,EAAO,mBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,oDAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,MAAA,EAAQA,WAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,YAAA,EAAc,IAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,EAAA,EAAIA,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,mBAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IACjC,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA;AAAE,GACvB;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC","file":"index.js","sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  name: 'sys_role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  displayNameField: 'label',\n  titleFormat: '{label}',\n  compactLayout: ['label', 'name', 'active', 'is_default'],\n\n  fields: {\n    // ── Identity ─────────────────────────────────────────────────\n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      searchable: true,\n      maxLength: 255,\n      group: 'Identity',\n    }),\n\n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n      group: 'Identity',\n    }),\n\n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n      group: 'Identity',\n    }),\n\n    // ── Configuration ────────────────────────────────────────────\n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n      group: 'Configuration',\n    }),\n\n    // ── Status ───────────────────────────────────────────────────\n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n      group: 'Status',\n    }),\n\n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n      group: 'Status',\n    }),\n\n    // ── System ───────────────────────────────────────────────────\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  name: 'sys_permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  displayNameField: 'label',\n  titleFormat: '{label}',\n  compactLayout: ['label', 'name', 'active'],\n\n  fields: {\n    // ── Identity ─────────────────────────────────────────────────\n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      searchable: true,\n      maxLength: 255,\n      group: 'Identity',\n    }),\n\n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n      group: 'Identity',\n    }),\n\n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n      group: 'Identity',\n    }),\n\n    // ── Permissions ──────────────────────────────────────────────\n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n      group: 'Permissions',\n    }),\n\n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n      group: 'Permissions',\n    }),\n\n    // ── Status ───────────────────────────────────────────────────\n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n      group: 'Status',\n    }),\n\n    // ── System ───────────────────────────────────────────────────\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n"]}
+{"version":3,"sources":["../../src/security/sys-role.object.ts","../../src/security/sys-permission-set.object.ts","../../src/security/sys-user-permission-set.object.ts","../../src/security/sys-role-permission-set.object.ts","../../src/security/default-permission-sets.ts"],"names":["ObjectSchema","Field","PermissionSetSchema"],"mappings":";;;;;;AAYO,IAAM,OAAA,GAAUA,kBAAa,MAAA,CAAO;AAAA,EACzC,IAAA,EAAM,UAAA;AAAA,EACN,KAAA,EAAO,MAAA;AAAA,EACP,WAAA,EAAa,OAAA;AAAA,EACb,IAAA,EAAM,QAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,0CAAA;AAAA,EACb,gBAAA,EAAkB,OAAA;AAAA,EAClB,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,CAAC,OAAA,EAAS,MAAA,EAAQ,UAAU,YAAY,CAAA;AAAA,EAEvD,MAAA,EAAQ;AAAA;AAAA,IAEN,KAAA,EAAOC,WAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,cAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,IAAA,EAAMA,WAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,UAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,WAAA,EAAa,+DAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,6CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,MAAA,EAAQA,WAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,YAAA,EAAc,IAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,OAAA,CAAQ;AAAA,MACxB,KAAA,EAAO,cAAA;AAAA,MACP,YAAA,EAAc,KAAA;AAAA,MACd,WAAA,EAAa,qCAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,EAAA,EAAIA,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,SAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IACjC,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA;AAAE,GACvB;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC;AC7FM,IAAM,gBAAA,GAAmBD,kBAAa,MAAA,CAAO;AAAA,EAClD,IAAA,EAAM,oBAAA;AAAA,EACN,KAAA,EAAO,gBAAA;AAAA,EACP,WAAA,EAAa,iBAAA;AAAA,EACb,IAAA,EAAM,MAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,4DAAA;AAAA,EACb,gBAAA,EAAkB,OAAA;AAAA,EAClB,WAAA,EAAa,SAAA;AAAA,EACb,aAAA,EAAe,CAAC,OAAA,EAAS,MAAA,EAAQ,QAAQ,CAAA;AAAA,EAEzC,MAAA,EAAQ;AAAA;AAAA,IAEN,KAAA,EAAOC,WAAM,IAAA,CAAK;AAAA,MAChB,KAAA,EAAO,cAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,IAAA,EAAMA,WAAM,IAAA,CAAK;AAAA,MACf,KAAA,EAAO,UAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY,IAAA;AAAA,MACZ,SAAA,EAAW,GAAA;AAAA,MACX,WAAA,EAAa,4CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,WAAA,EAAaA,WAAM,QAAA,CAAS;AAAA,MAC1B,KAAA,EAAO,aAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,kBAAA,EAAoBA,WAAM,QAAA,CAAS;AAAA,MACjC,KAAA,EAAO,oBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,+CAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,iBAAA,EAAmBA,WAAM,QAAA,CAAS;AAAA,MAChC,KAAA,EAAO,mBAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa,oDAAA;AAAA,MACb,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,MAAA,EAAQA,WAAM,OAAA,CAAQ;AAAA,MACpB,KAAA,EAAO,QAAA;AAAA,MACP,YAAA,EAAc,IAAA;AAAA,MACd,KAAA,EAAO;AAAA,KACR,CAAA;AAAA;AAAA,IAGD,EAAA,EAAIA,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,mBAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU,IAAA;AAAA,MACV,KAAA,EAAO;AAAA,KACR;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,MAAM,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IACjC,EAAE,MAAA,EAAQ,CAAC,QAAQ,CAAA;AAAE,GACvB;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC;ACxFM,IAAM,oBAAA,GAAuBD,kBAAa,MAAA,CAAO;AAAA,EACtD,IAAA,EAAM,yBAAA;AAAA,EACN,KAAA,EAAO,qBAAA;AAAA,EACP,WAAA,EAAa,sBAAA;AAAA,EACb,IAAA,EAAM,YAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,yFAAA;AAAA,EACb,WAAA,EAAa,sCAAA;AAAA,EACb,aAAA,EAAe,CAAC,SAAA,EAAW,mBAAA,EAAqB,iBAAiB,CAAA;AAAA,EAEjE,MAAA,EAAQ;AAAA,IACN,EAAA,EAAIC,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,OAAA,EAASA,UAAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AAAA,MAChC,KAAA,EAAO,MAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,iBAAA,EAAmBA,UAAAA,CAAM,MAAA,CAAO,oBAAA,EAAsB;AAAA,MACpD,KAAA,EAAO,gBAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,eAAA,EAAiBA,UAAAA,CAAM,MAAA,CAAO,kBAAA,EAAoB;AAAA,MAChD,KAAA,EAAO,cAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,UAAA,EAAYA,UAAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AAAA,MACnC,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,KAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU;AAAA,KACX;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,QAAQ,CAAC,SAAA,EAAW,qBAAqB,iBAAiB,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IAC5E,EAAE,MAAA,EAAQ,CAAC,SAAS,CAAA,EAAE;AAAA,IACtB,EAAE,MAAA,EAAQ,CAAC,iBAAiB,CAAA,EAAE;AAAA,IAC9B,EAAE,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAE,GAClC;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC;AC1EM,IAAM,oBAAA,GAAuBD,kBAAa,MAAA,CAAO;AAAA,EACtD,IAAA,EAAM,yBAAA;AAAA,EACN,KAAA,EAAO,qBAAA;AAAA,EACP,WAAA,EAAa,sBAAA;AAAA,EACb,IAAA,EAAM,aAAA;AAAA,EACN,QAAA,EAAU,IAAA;AAAA,EACV,WAAA,EAAa,mCAAA;AAAA,EACb,WAAA,EAAa,sCAAA;AAAA,EACb,aAAA,EAAe,CAAC,SAAA,EAAW,mBAAmB,CAAA;AAAA,EAE9C,MAAA,EAAQ;AAAA,IACN,EAAA,EAAIC,WAAM,IAAA,CAAK;AAAA,MACb,KAAA,EAAO,YAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,OAAA,EAASA,UAAAA,CAAM,MAAA,CAAO,UAAA,EAAY;AAAA,MAChC,KAAA,EAAO,MAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,iBAAA,EAAmBA,UAAAA,CAAM,MAAA,CAAO,oBAAA,EAAsB;AAAA,MACpD,KAAA,EAAO,gBAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,WAAA,EAAa;AAAA,KACd,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,IAED,UAAA,EAAYA,WAAM,QAAA,CAAS;AAAA,MACzB,KAAA,EAAO,YAAA;AAAA,MACP,YAAA,EAAc,OAAA;AAAA,MACd,QAAA,EAAU;AAAA,KACX;AAAA,GACH;AAAA,EAEA,OAAA,EAAS;AAAA,IACP,EAAE,MAAA,EAAQ,CAAC,WAAW,mBAAmB,CAAA,EAAG,QAAQ,IAAA,EAAK;AAAA,IACzD,EAAE,MAAA,EAAQ,CAAC,SAAS,CAAA,EAAE;AAAA,IACtB,EAAE,MAAA,EAAQ,CAAC,mBAAmB,CAAA;AAAE,GAClC;AAAA,EAEA,MAAA,EAAQ;AAAA,IACN,YAAA,EAAc,IAAA;AAAA,IACd,UAAA,EAAY,IAAA;AAAA,IACZ,UAAA,EAAY,IAAA;AAAA,IACZ,YAAY,CAAC,KAAA,EAAO,MAAA,EAAQ,QAAA,EAAU,UAAU,QAAQ,CAAA;AAAA,IACxD,KAAA,EAAO,IAAA;AAAA,IACP,GAAA,EAAK;AAAA;AAET,CAAC;AClDD,IAAM,2BAAA,GAA8B;AAAA,EAClC,UAAA;AAAA,EACA,aAAA;AAAA,EACA,aAAA;AAAA,EACA,kBAAA;AAAA,EACA,YAAA;AAAA,EACA,gBAAA;AAAA,EACA,UAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,UAAA;AAAA,EACA,iBAAA;AAAA,EACA,uBAAA;AAAA,EACA,wBAAA;AAAA,EACA,yBAAA;AAAA,EACA;AACF,CAAA;AAEA,IAAM,0BAAA,GAA6B,MAK7B,MAAA,CAAO,WAAA;AAAA,EACX,2BAAA,CAA4B,GAAA,CAAI,CAAC,IAAA,KAAS;AAAA,IACxC,IAAA;AAAA,IACA,EAAE,WAAW,IAAA,EAAM,WAAA,EAAa,OAAO,SAAA,EAAW,KAAA,EAAO,aAAa,KAAA;AAAM,GAC7E;AACH,CAAA;AA4BO,IAAM,qBAAA,GAAyC;AAAA,EACpDC,6BAAoB,KAAA,CAAM;AAAA,IACxB,IAAA,EAAM,mBAAA;AAAA,IACN,KAAA,EAAO,kCAAA;AAAA,IACP,SAAA,EAAW,IAAA;AAAA,IACX,OAAA,EAAS;AAAA,MACP,GAAA,EAAK;AAAA,QACH,SAAA,EAAW,IAAA;AAAA,QACX,WAAA,EAAa,IAAA;AAAA,QACb,SAAA,EAAW,IAAA;AAAA,QACX,WAAA,EAAa,IAAA;AAAA,QACb,cAAA,EAAgB,IAAA;AAAA,QAChB,gBAAA,EAAkB;AAAA;AACpB,KACF;AAAA,IACA,iBAAA,EAAmB,CAAC,cAAA,EAAgB,iBAAA,EAAmB,cAAc;AAAA,GACtE,CAAA;AAAA,EACDA,6BAAoB,KAAA,CAAM;AAAA,IACxB,IAAA,EAAM,gBAAA;AAAA,IACN,KAAA,EAAO,+BAAA;AAAA,IACP,SAAA,EAAW,IAAA;AAAA,IACX,OAAA,EAAS;AAAA,MACP,GAAA,EAAK;AAAA,QACH,SAAA,EAAW,IAAA;AAAA,QACX,WAAA,EAAa,IAAA;AAAA,QACb,SAAA,EAAW,IAAA;AAAA,QACX,WAAA,EAAa;AAAA,OACf;AAAA;AAAA,MAEA,GAAG,0BAAA;AAA2B,KAChC;AAAA,IACA,gBAAA,EAAkB;AAAA,MAChB;AAAA,QACE,IAAA,EAAM,kBAAA;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,SAAA,EAAW,KAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,QACE,IAAA,EAAM,mBAAA;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,QACE,IAAA,EAAM,oBAAA;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA;AAAA;AAAA,MAGA;AAAA,QACE,IAAA,EAAM,uBAAA;AAAA,QACN,MAAA,EAAQ,kBAAA;AAAA,QACR,SAAA,EAAW,KAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,QACE,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,UAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA;AACT;AACF,GACD,CAAA;AAAA,EACDA,6BAAoB,KAAA,CAAM;AAAA,IACxB,IAAA,EAAM,iBAAA;AAAA,IACN,KAAA,EAAO,yBAAA;AAAA,IACP,SAAA,EAAW,IAAA;AAAA,IACX,OAAA,EAAS;AAAA,MACP,GAAA,EAAK;AAAA,QACH,SAAA,EAAW,IAAA;AAAA,QACX,WAAA,EAAa,KAAA;AAAA,QACb,SAAA,EAAW,KAAA;AAAA,QACX,WAAA,EAAa;AAAA,OACf;AAAA;AAAA;AAAA;AAAA,MAIA,GAAG,0BAAA;AAA2B,KAChC;AAAA,IACA,gBAAA,EAAkB;AAAA,MAChB;AAAA,QACE,IAAA,EAAM,kBAAA;AAAA,QACN,MAAA,EAAQ,GAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,QACE,IAAA,EAAM,uBAAA;AAAA,QACN,MAAA,EAAQ,kBAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACT;AAAA,MACA;AAAA,QACE,IAAA,EAAM,eAAA;AAAA,QACN,MAAA,EAAQ,UAAA;AAAA,QACR,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA;AACT;AACF,GACD;AACH","file":"index.js","sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  name: 'sys_role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  displayNameField: 'label',\n  titleFormat: '{label}',\n  compactLayout: ['label', 'name', 'active', 'is_default'],\n\n  fields: {\n    // ── Identity ─────────────────────────────────────────────────\n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      searchable: true,\n      maxLength: 255,\n      group: 'Identity',\n    }),\n\n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n      group: 'Identity',\n    }),\n\n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n      group: 'Identity',\n    }),\n\n    // ── Configuration ────────────────────────────────────────────\n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n      group: 'Configuration',\n    }),\n\n    // ── Status ───────────────────────────────────────────────────\n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n      group: 'Status',\n    }),\n\n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n      group: 'Status',\n    }),\n\n    // ── System ───────────────────────────────────────────────────\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  name: 'sys_permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  displayNameField: 'label',\n  titleFormat: '{label}',\n  compactLayout: ['label', 'name', 'active'],\n\n  fields: {\n    // ── Identity ─────────────────────────────────────────────────\n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      searchable: true,\n      maxLength: 255,\n      group: 'Identity',\n    }),\n\n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n      group: 'Identity',\n    }),\n\n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n      group: 'Identity',\n    }),\n\n    // ── Permissions ──────────────────────────────────────────────\n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n      group: 'Permissions',\n    }),\n\n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n      group: 'Permissions',\n    }),\n\n    // ── Status ───────────────────────────────────────────────────\n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n      group: 'Status',\n    }),\n\n    // ── System ───────────────────────────────────────────────────\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n      group: 'System',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n      group: 'System',\n    }),\n  },\n\n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_user_permission_set — User ↔ PermissionSet assignment.\n *\n * Salesforce-style additive permission grant: a user may be assigned any\n * number of `sys_permission_set` rows, optionally scoped to a specific\n * organization. The runtime resolver (`resolveExecutionContext` in\n * `@objectstack/runtime`) reads this table when building the per-request\n * `ExecutionContext.permissions[]`.\n *\n * Uniqueness is `(user_id, permission_set_id, organization_id)` so the\n * same permission set can be granted independently in each org context\n * the user belongs to.\n *\n * @namespace sys\n */\nexport const SysUserPermissionSet = ObjectSchema.create({\n  name: 'sys_user_permission_set',\n  label: 'User Permission Set',\n  pluralLabel: 'User Permission Sets',\n  icon: 'user-check',\n  isSystem: true,\n  description: 'Direct assignment of a permission set to a user (optionally scoped to an organization).',\n  titleFormat: '{user_id} → {permission_set_id}',\n  compactLayout: ['user_id', 'permission_set_id', 'organization_id'],\n\n  fields: {\n    id: Field.text({\n      label: 'Assignment ID',\n      required: true,\n      readonly: true,\n      description: 'UUID of the assignment.',\n    }),\n\n    user_id: Field.lookup('sys_user', {\n      label: 'User',\n      required: true,\n      description: 'Foreign key to sys_user.',\n    }),\n\n    permission_set_id: Field.lookup('sys_permission_set', {\n      label: 'Permission Set',\n      required: true,\n      description: 'Foreign key to sys_permission_set.',\n    }),\n\n    organization_id: Field.lookup('sys_organization', {\n      label: 'Organization',\n      required: false,\n      description: 'Optional organization scope. NULL = applies in every org context.',\n    }),\n\n    granted_by: Field.lookup('sys_user', {\n      label: 'Granted By',\n      required: false,\n      description: 'User who granted this permission set.',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n  },\n\n  indexes: [\n    { fields: ['user_id', 'permission_set_id', 'organization_id'], unique: true },\n    { fields: ['user_id'] },\n    { fields: ['organization_id'] },\n    { fields: ['permission_set_id'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: false,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role_permission_set — Role ↔ PermissionSet binding.\n *\n * Allows administrators to compose a `sys_role` from one or more\n * `sys_permission_set` rows. At request time, the runtime resolver\n * (`resolveExecutionContext`) collects every permission set bound to\n * the user's roles via this table and injects their names into\n * `ExecutionContext.permissions[]` for downstream RBAC evaluation.\n *\n * @namespace sys\n */\nexport const SysRolePermissionSet = ObjectSchema.create({\n  name: 'sys_role_permission_set',\n  label: 'Role Permission Set',\n  pluralLabel: 'Role Permission Sets',\n  icon: 'shield-plus',\n  isSystem: true,\n  description: 'Binds a permission set to a role.',\n  titleFormat: '{role_id} → {permission_set_id}',\n  compactLayout: ['role_id', 'permission_set_id'],\n\n  fields: {\n    id: Field.text({\n      label: 'Binding ID',\n      required: true,\n      readonly: true,\n      description: 'UUID of the role-permission-set binding.',\n    }),\n\n    role_id: Field.lookup('sys_role', {\n      label: 'Role',\n      required: true,\n      description: 'Foreign key to sys_role.',\n    }),\n\n    permission_set_id: Field.lookup('sys_permission_set', {\n      label: 'Permission Set',\n      required: true,\n      description: 'Foreign key to sys_permission_set.',\n    }),\n\n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n\n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n  },\n\n  indexes: [\n    { fields: ['role_id', 'permission_set_id'], unique: true },\n    { fields: ['role_id'] },\n    { fields: ['permission_set_id'] },\n  ],\n\n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: false,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { PermissionSetSchema, type PermissionSet } from '@objectstack/spec/security';\n\n/**\n * Identity tables managed by the better-auth plugin (see\n * `packages/platform-objects/src/identity/`). Mutations to these tables\n * MUST flow through the better-auth API endpoints (sign-up, password\n * reset, organization invite/remove-member, api-key/create, …) rather\n * than the generic CRUD pipeline so that password hashing, token\n * signing, email verification, invitation flows and scope hashing all\n * fire correctly.\n *\n * The default member/viewer permission sets therefore explicitly DENY\n * `allowCreate / allowEdit / allowDelete` on these objects while still\n * permitting reads (subject to the rest of the RLS chain). Admin\n * permission sets keep their `*` wildcard so they can rescue data\n * directly when needed.\n *\n * Each entry mirrors the `managedBy: 'better-auth'` flag declared on\n * the corresponding object schema in `packages/platform-objects/src/identity/`.\n */\nconst BETTER_AUTH_MANAGED_OBJECTS = [\n  'sys_user',\n  'sys_account',\n  'sys_session',\n  'sys_organization',\n  'sys_member',\n  'sys_invitation',\n  'sys_team',\n  'sys_team_member',\n  'sys_api_key',\n  'sys_two_factor',\n  'sys_verification',\n  'sys_jwks',\n  'sys_device_code',\n  'sys_oauth_application',\n  'sys_oauth_access_token',\n  'sys_oauth_refresh_token',\n  'sys_oauth_consent',\n] as const;\n\nconst denyWritesOnManagedObjects = (): Record<string, {\n  allowRead: boolean;\n  allowCreate: boolean;\n  allowEdit: boolean;\n  allowDelete: boolean;\n}> => Object.fromEntries(\n  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [\n    name,\n    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false },\n  ]),\n);\n\n/**\n * Default permission sets seeded by the platform.\n *\n * These are referenced by name (`admin_full_access`, `member_default`,\n * `viewer_readonly`) from `sys_role_permission_set` rows or assigned\n * directly to users via `sys_user_permission_set`.\n *\n * The runtime SecurityPlugin reads these via the metadata service when a\n * permission set name appears in the request `ExecutionContext.permissions[]`.\n *\n * Each entry is run through `PermissionSetSchema.parse(...)` so Zod fills\n * in the boolean/`priority`/`enabled` defaults — keeping the literal\n * source readable while still satisfying the strict output type.\n *\n * `objects: { '*': … }` uses the wildcard sentinel honoured by\n * `PermissionEvaluator` — admins do not need an explicit row per object.\n * Per-object entries fully override the wildcard for that object (see\n * `PermissionEvaluator.checkObjectPermission` — lookup, not merge).\n *\n * RLS policies use the canonical `current_user.*` placeholders compiled\n * by `RLSCompiler`. The active organization is exposed under\n * `current_user.organization_id` (sourced from\n * `ExecutionContext.tenantId` at request time) — there is no rewrite\n * step or `tenantField` indirection in SecurityPlugin. Schemas with a\n * different physical tenant column should fork these defaults.\n */\nexport const defaultPermissionSets: PermissionSet[] = [\n  PermissionSetSchema.parse({\n    name: 'admin_full_access',\n    label: 'Administrator — Full Access',\n    isProfile: true,\n    objects: {\n      '*': {\n        allowRead: true,\n        allowCreate: true,\n        allowEdit: true,\n        allowDelete: true,\n        viewAllRecords: true,\n        modifyAllRecords: true,\n      },\n    },\n    systemPermissions: ['manage_users', 'manage_metadata', 'setup.access'],\n  }),\n  PermissionSetSchema.parse({\n    name: 'member_default',\n    label: 'Member — Standard Access',\n    isProfile: true,\n    objects: {\n      '*': {\n        allowRead: true,\n        allowCreate: true,\n        allowEdit: true,\n        allowDelete: true,\n      },\n      // Identity tables are managed by better-auth — no direct writes.\n      ...denyWritesOnManagedObjects(),\n    },\n    rowLevelSecurity: [\n      {\n        name: 'tenant_isolation',\n        object: '*',\n        operation: 'all',\n        using: 'organization_id = current_user.organization_id',\n      },\n      {\n        name: 'owner_only_writes',\n        object: '*',\n        operation: 'update',\n        using: 'owner_id = current_user.id',\n      },\n      {\n        name: 'owner_only_deletes',\n        object: '*',\n        operation: 'delete',\n        using: 'owner_id = current_user.id',\n      },\n      // ── better-auth system tables that lack `organization_id` and would\n      //    otherwise be left unprotected by the wildcard rule above. ────\n      {\n        name: 'sys_organization_self',\n        object: 'sys_organization',\n        operation: 'all',\n        using: 'id = current_user.organization_id',\n      },\n      {\n        name: 'sys_user_self',\n        object: 'sys_user',\n        operation: 'select',\n        using: 'id = current_user.id',\n      },\n    ],\n  }),\n  PermissionSetSchema.parse({\n    name: 'viewer_readonly',\n    label: 'Viewer — Read-Only',\n    isProfile: true,\n    objects: {\n      '*': {\n        allowRead: true,\n        allowCreate: false,\n        allowEdit: false,\n        allowDelete: false,\n      },\n      // Belt-and-suspenders: explicit deny on managed objects even though\n      // the wildcard already denies — keeps the policy readable when\n      // future relaxations might widen the wildcard.\n      ...denyWritesOnManagedObjects(),\n    },\n    rowLevelSecurity: [\n      {\n        name: 'tenant_isolation',\n        object: '*',\n        operation: 'select',\n        using: 'organization_id = current_user.organization_id',\n      },\n      {\n        name: 'sys_organization_self',\n        object: 'sys_organization',\n        operation: 'select',\n        using: 'id = current_user.organization_id',\n      },\n      {\n        name: 'sys_user_self',\n        object: 'sys_user',\n        operation: 'select',\n        using: 'id = current_user.id',\n      },\n    ],\n  }),\n];\n"]}

package/dist/security/index.mjs

@@ -1,4 +1,5 @@
 import { ObjectSchema, Field } from '@objectstack/spec/data';
+import { PermissionSetSchema } from '@objectstack/spec/security';
 
 // src/security/sys-role.object.ts
 var SysRole = ObjectSchema.create({
@@ -169,7 +170,249 @@ var SysPermissionSet = ObjectSchema.create({
     mru: true
   }
 });
+var SysUserPermissionSet = ObjectSchema.create({
+  name: "sys_user_permission_set",
+  label: "User Permission Set",
+  pluralLabel: "User Permission Sets",
+  icon: "user-check",
+  isSystem: true,
+  description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+  titleFormat: "{user_id} \u2192 {permission_set_id}",
+  compactLayout: ["user_id", "permission_set_id", "organization_id"],
+  fields: {
+    id: Field.text({
+      label: "Assignment ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the assignment."
+    }),
+    user_id: Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    permission_set_id: Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    organization_id: Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Optional organization scope. NULL = applies in every org context."
+    }),
+    granted_by: Field.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User who granted this permission set."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "permission_set_id", "organization_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["organization_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysRolePermissionSet = ObjectSchema.create({
+  name: "sys_role_permission_set",
+  label: "Role Permission Set",
+  pluralLabel: "Role Permission Sets",
+  icon: "shield-plus",
+  isSystem: true,
+  description: "Binds a permission set to a role.",
+  titleFormat: "{role_id} \u2192 {permission_set_id}",
+  compactLayout: ["role_id", "permission_set_id"],
+  fields: {
+    id: Field.text({
+      label: "Binding ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the role-permission-set binding."
+    }),
+    role_id: Field.lookup("sys_role", {
+      label: "Role",
+      required: true,
+      description: "Foreign key to sys_role."
+    }),
+    permission_set_id: Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    created_at: Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["role_id", "permission_set_id"], unique: true },
+    { fields: ["role_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var BETTER_AUTH_MANAGED_OBJECTS = [
+  "sys_user",
+  "sys_account",
+  "sys_session",
+  "sys_organization",
+  "sys_member",
+  "sys_invitation",
+  "sys_team",
+  "sys_team_member",
+  "sys_api_key",
+  "sys_two_factor",
+  "sys_verification",
+  "sys_jwks",
+  "sys_device_code",
+  "sys_oauth_application",
+  "sys_oauth_access_token",
+  "sys_oauth_refresh_token",
+  "sys_oauth_consent"
+];
+var denyWritesOnManagedObjects = () => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+  ])
+);
+var defaultPermissionSets = [
+  PermissionSetSchema.parse({
+    name: "admin_full_access",
+    label: "Administrator \u2014 Full Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      }
+    },
+    systemPermissions: ["manage_users", "manage_metadata", "setup.access"]
+  }),
+  PermissionSetSchema.parse({
+    name: "member_default",
+    label: "Member \u2014 Standard Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true
+      },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "owner_only_writes",
+        object: "*",
+        operation: "update",
+        using: "owner_id = current_user.id"
+      },
+      {
+        name: "owner_only_deletes",
+        object: "*",
+        operation: "delete",
+        using: "owner_id = current_user.id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be left unprotected by the wildcard rule above. ────
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  }),
+  PermissionSetSchema.parse({
+    name: "viewer_readonly",
+    label: "Viewer \u2014 Read-Only",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: false,
+        allowEdit: false,
+        allowDelete: false
+      },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "select",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  })
+];
 
-export { SysPermissionSet, SysRole };
+export { SysPermissionSet, SysRole, SysRolePermissionSet, SysUserPermissionSet, defaultPermissionSets };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map