@objectstack/platform-objects 0.1.0 → 4.0.5

package/dist/index.js

@@ -1,6 +1,7 @@
 'use strict';
 
 var data = require('@objectstack/spec/data');
+var security = require('@objectstack/spec/security');
 var ui = require('@objectstack/spec/ui');
 
 // src/identity/sys-user.object.ts
@@ -10,6 +11,7 @@ var SysUser = data.ObjectSchema.create({
   pluralLabel: "Users",
   icon: "user",
   isSystem: true,
+  managedBy: "better-auth",
   description: "User accounts for authentication",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -95,6 +97,7 @@ var SysSession = data.ObjectSchema.create({
   pluralLabel: "Sessions",
   icon: "key",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Active user sessions",
   displayNameField: "user_id",
   titleFormat: "Session \u2014 {user_id}",
@@ -186,6 +189,7 @@ var SysAccount = data.ObjectSchema.create({
   pluralLabel: "Accounts",
   icon: "link",
   isSystem: true,
+  managedBy: "better-auth",
   description: "OAuth and authentication provider accounts",
   titleFormat: "{provider_id} - {account_id}",
   compactLayout: ["provider_id", "user_id", "account_id"],
@@ -269,6 +273,7 @@ var SysVerification = data.ObjectSchema.create({
   pluralLabel: "Verifications",
   icon: "shield-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Email and phone verification tokens",
   titleFormat: "Verification for {identifier}",
   compactLayout: ["identifier", "expires_at", "created_at"],
@@ -323,6 +328,7 @@ var SysOrganization = data.ObjectSchema.create({
   pluralLabel: "Organizations",
   icon: "building-2",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organizations for multi-tenant grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -396,6 +402,7 @@ var SysMember = data.ObjectSchema.create({
   pluralLabel: "Members",
   icon: "user-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organization membership records",
   titleFormat: "{user_id} in {organization_id}",
   compactLayout: ["user_id", "organization_id", "role"],
@@ -444,6 +451,7 @@ var SysInvitation = data.ObjectSchema.create({
   pluralLabel: "Invitations",
   icon: "mail",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Organization invitations for user onboarding",
   titleFormat: "Invitation to {organization_id}",
   compactLayout: ["email", "organization_id", "status"],
@@ -513,6 +521,7 @@ var SysTeam = data.ObjectSchema.create({
   pluralLabel: "Teams",
   icon: "users",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Teams within organizations for fine-grained grouping",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -571,6 +580,7 @@ var SysTeamMember = data.ObjectSchema.create({
   pluralLabel: "Team Members",
   icon: "user-plus",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Team membership records linking users to teams",
   titleFormat: "{user_id} in {team_id}",
   compactLayout: ["user_id", "team_id", "created_at"],
@@ -613,6 +623,7 @@ var SysApiKey = data.ObjectSchema.create({
   pluralLabel: "API Keys",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "API keys for programmatic access",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -715,6 +726,7 @@ var SysTwoFactor = data.ObjectSchema.create({
   pluralLabel: "Two Factor Credentials",
   icon: "smartphone",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Two-factor authentication credentials",
   titleFormat: "Two-factor for {user_id}",
   compactLayout: ["user_id", "created_at"],
@@ -767,6 +779,7 @@ var SysDeviceCode = data.ObjectSchema.create({
   pluralLabel: "Device Codes",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "OAuth 2.0 Device Authorization Grant (RFC 8628) pending requests",
   titleFormat: "{user_code}",
   compactLayout: ["user_code", "status", "client_id", "expires_at"],
@@ -910,6 +923,7 @@ var SysOauthApplication = data.ObjectSchema.create({
   pluralLabel: "OAuth Applications",
   icon: "key-round",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Registered OAuth/OIDC client applications",
   displayNameField: "name",
   titleFormat: "{name}",
@@ -1125,6 +1139,7 @@ var SysOauthAccessToken = data.ObjectSchema.create({
   pluralLabel: "OAuth Access Tokens",
   icon: "ticket",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Opaque OAuth access tokens issued to client applications",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -1202,6 +1217,7 @@ var SysOauthRefreshToken = data.ObjectSchema.create({
   pluralLabel: "OAuth Refresh Tokens",
   icon: "refresh-cw",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Opaque OAuth refresh tokens (linked to a session)",
   compactLayout: ["client_id", "user_id", "expires_at"],
   fields: {
@@ -1283,6 +1299,7 @@ var SysOauthConsent = data.ObjectSchema.create({
   pluralLabel: "OAuth Consents",
   icon: "shield-check",
   isSystem: true,
+  managedBy: "better-auth",
   description: "User consent records for OAuth client applications",
   compactLayout: ["client_id", "user_id", "scopes"],
   fields: {
@@ -1342,6 +1359,7 @@ var SysJwks = data.ObjectSchema.create({
   pluralLabel: "JWKS Keys",
   icon: "key",
   isSystem: true,
+  managedBy: "better-auth",
   description: "Asymmetric key pairs used to sign and verify issued JWTs",
   compactLayout: ["id", "created_at", "expires_at"],
   fields: {
@@ -1550,6 +1568,248 @@ var SysPermissionSet = data.ObjectSchema.create({
     mru: true
   }
 });
+var SysUserPermissionSet = data.ObjectSchema.create({
+  name: "sys_user_permission_set",
+  label: "User Permission Set",
+  pluralLabel: "User Permission Sets",
+  icon: "user-check",
+  isSystem: true,
+  description: "Direct assignment of a permission set to a user (optionally scoped to an organization).",
+  titleFormat: "{user_id} \u2192 {permission_set_id}",
+  compactLayout: ["user_id", "permission_set_id", "organization_id"],
+  fields: {
+    id: data.Field.text({
+      label: "Assignment ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the assignment."
+    }),
+    user_id: data.Field.lookup("sys_user", {
+      label: "User",
+      required: true,
+      description: "Foreign key to sys_user."
+    }),
+    permission_set_id: data.Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    organization_id: data.Field.lookup("sys_organization", {
+      label: "Organization",
+      required: false,
+      description: "Optional organization scope. NULL = applies in every org context."
+    }),
+    granted_by: data.Field.lookup("sys_user", {
+      label: "Granted By",
+      required: false,
+      description: "User who granted this permission set."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["user_id", "permission_set_id", "organization_id"], unique: true },
+    { fields: ["user_id"] },
+    { fields: ["organization_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var SysRolePermissionSet = data.ObjectSchema.create({
+  name: "sys_role_permission_set",
+  label: "Role Permission Set",
+  pluralLabel: "Role Permission Sets",
+  icon: "shield-plus",
+  isSystem: true,
+  description: "Binds a permission set to a role.",
+  titleFormat: "{role_id} \u2192 {permission_set_id}",
+  compactLayout: ["role_id", "permission_set_id"],
+  fields: {
+    id: data.Field.text({
+      label: "Binding ID",
+      required: true,
+      readonly: true,
+      description: "UUID of the role-permission-set binding."
+    }),
+    role_id: data.Field.lookup("sys_role", {
+      label: "Role",
+      required: true,
+      description: "Foreign key to sys_role."
+    }),
+    permission_set_id: data.Field.lookup("sys_permission_set", {
+      label: "Permission Set",
+      required: true,
+      description: "Foreign key to sys_permission_set."
+    }),
+    created_at: data.Field.datetime({
+      label: "Created At",
+      defaultValue: "NOW()",
+      readonly: true
+    }),
+    updated_at: data.Field.datetime({
+      label: "Updated At",
+      defaultValue: "NOW()",
+      readonly: true
+    })
+  },
+  indexes: [
+    { fields: ["role_id", "permission_set_id"], unique: true },
+    { fields: ["role_id"] },
+    { fields: ["permission_set_id"] }
+  ],
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ["get", "list", "create", "update", "delete"],
+    trash: true,
+    mru: false
+  }
+});
+var BETTER_AUTH_MANAGED_OBJECTS = [
+  "sys_user",
+  "sys_account",
+  "sys_session",
+  "sys_organization",
+  "sys_member",
+  "sys_invitation",
+  "sys_team",
+  "sys_team_member",
+  "sys_api_key",
+  "sys_two_factor",
+  "sys_verification",
+  "sys_jwks",
+  "sys_device_code",
+  "sys_oauth_application",
+  "sys_oauth_access_token",
+  "sys_oauth_refresh_token",
+  "sys_oauth_consent"
+];
+var denyWritesOnManagedObjects = () => Object.fromEntries(
+  BETTER_AUTH_MANAGED_OBJECTS.map((name) => [
+    name,
+    { allowRead: true, allowCreate: false, allowEdit: false, allowDelete: false }
+  ])
+);
+var defaultPermissionSets = [
+  security.PermissionSetSchema.parse({
+    name: "admin_full_access",
+    label: "Administrator \u2014 Full Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true,
+        viewAllRecords: true,
+        modifyAllRecords: true
+      }
+    },
+    systemPermissions: ["manage_users", "manage_metadata", "setup.access"]
+  }),
+  security.PermissionSetSchema.parse({
+    name: "member_default",
+    label: "Member \u2014 Standard Access",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: true,
+        allowEdit: true,
+        allowDelete: true
+      },
+      // Identity tables are managed by better-auth — no direct writes.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "all",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "owner_only_writes",
+        object: "*",
+        operation: "update",
+        using: "owner_id = current_user.id"
+      },
+      {
+        name: "owner_only_deletes",
+        object: "*",
+        operation: "delete",
+        using: "owner_id = current_user.id"
+      },
+      // ── better-auth system tables that lack `organization_id` and would
+      //    otherwise be left unprotected by the wildcard rule above. ────
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "all",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  }),
+  security.PermissionSetSchema.parse({
+    name: "viewer_readonly",
+    label: "Viewer \u2014 Read-Only",
+    isProfile: true,
+    objects: {
+      "*": {
+        allowRead: true,
+        allowCreate: false,
+        allowEdit: false,
+        allowDelete: false
+      },
+      // Belt-and-suspenders: explicit deny on managed objects even though
+      // the wildcard already denies — keeps the policy readable when
+      // future relaxations might widen the wildcard.
+      ...denyWritesOnManagedObjects()
+    },
+    rowLevelSecurity: [
+      {
+        name: "tenant_isolation",
+        object: "*",
+        operation: "select",
+        using: "organization_id = current_user.organization_id"
+      },
+      {
+        name: "sys_organization_self",
+        object: "sys_organization",
+        operation: "select",
+        using: "id = current_user.organization_id"
+      },
+      {
+        name: "sys_user_self",
+        object: "sys_user",
+        operation: "select",
+        using: "id = current_user.id"
+      }
+    ]
+  })
+];
 var SysAuditLog = data.ObjectSchema.create({
   name: "sys_audit_log",
   label: "Audit Log",
@@ -3688,6 +3948,8 @@ var SETUP_APP = {
         { id: "nav_api_keys", type: "object", label: "API Keys", objectName: "sys_api_key", icon: "key" },
         { id: "nav_roles", type: "object", label: "Roles", objectName: "sys_role", icon: "shield-check" },
         { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "sys_permission_set", icon: "lock" },
+        { id: "nav_user_permission_sets", type: "object", label: "User Permission Sets", objectName: "sys_user_permission_set", icon: "user-check" },
+        { id: "nav_role_permission_sets", type: "object", label: "Role Permission Sets", objectName: "sys_role_permission_set", icon: "shield-plus" },
         { id: "nav_oauth_apps", type: "object", label: "OAuth Apps", objectName: "sys_oauth_application", icon: "app-window" },
         { id: "nav_jwks", type: "object", label: "Signing Keys", objectName: "sys_jwks", icon: "key-round" }
       ]
@@ -4194,16 +4456,19 @@ exports.SysProject = SysProject;
 exports.SysProjectCredential = SysProjectCredential;
 exports.SysProjectMember = SysProjectMember;
 exports.SysRole = SysRole;
+exports.SysRolePermissionSet = SysRolePermissionSet;
 exports.SysSession = SysSession;
 exports.SysTeam = SysTeam;
 exports.SysTeamMember = SysTeamMember;
 exports.SysTool = SysTool;
 exports.SysTwoFactor = SysTwoFactor;
 exports.SysUser = SysUser;
+exports.SysUserPermissionSet = SysUserPermissionSet;
 exports.SysUserPreference = SysUserPreference;
 exports.SysVerification = SysVerification;
 exports.SysView = SysView;
 exports.SystemOverviewDashboard = SystemOverviewDashboard;
 exports.UsersView = UsersView;
+exports.defaultPermissionSets = defaultPermissionSets;
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map