@objectstack/plugin-security 3.2.4 → 3.2.6

package/src/objects/sys-permission-set.object.ts

@@ -0,0 +1,94 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * sys_permission_set — System Permission Set Object
+ *
+ * Named groupings of fine-grained permissions.
+ * Permission sets can be assigned to roles or directly to users
+ * for granular access control.
+ *
+ * @namespace sys
+ */
+export const SysPermissionSet = ObjectSchema.create({
+  namespace: 'sys',
+  name: 'permission_set',
+  label: 'Permission Set',
+  pluralLabel: 'Permission Sets',
+  icon: 'lock',
+  isSystem: true,
+  description: 'Named permission groupings for fine-grained access control',
+  titleFormat: '{name}',
+  compactLayout: ['name', 'label', 'active'],
+  
+  fields: {
+    id: Field.text({
+      label: 'Permission Set ID',
+      required: true,
+      readonly: true,
+    }),
+    
+    created_at: Field.datetime({
+      label: 'Created At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    updated_at: Field.datetime({
+      label: 'Updated At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    name: Field.text({
+      label: 'API Name',
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: 'Unique machine name for the permission set',
+    }),
+    
+    label: Field.text({
+      label: 'Display Name',
+      required: true,
+      maxLength: 255,
+    }),
+    
+    description: Field.textarea({
+      label: 'Description',
+      required: false,
+    }),
+    
+    object_permissions: Field.textarea({
+      label: 'Object Permissions',
+      required: false,
+      description: 'JSON-serialized object-level CRUD permissions',
+    }),
+    
+    field_permissions: Field.textarea({
+      label: 'Field Permissions',
+      required: false,
+      description: 'JSON-serialized field-level read/write permissions',
+    }),
+    
+    active: Field.boolean({
+      label: 'Active',
+      defaultValue: true,
+    }),
+  },
+  
+  indexes: [
+    { fields: ['name'], unique: true },
+    { fields: ['active'] },
+  ],
+  
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    trash: true,
+    mru: true,
+  },
+});

package/src/objects/sys-role.object.ts

@@ -0,0 +1,93 @@
+// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.
+
+import { ObjectSchema, Field } from '@objectstack/spec/data';
+
+/**
+ * sys_role — System Role Object
+ *
+ * RBAC role definition for the ObjectStack platform.
+ * Roles group permissions and are assigned to users or members.
+ *
+ * @namespace sys
+ */
+export const SysRole = ObjectSchema.create({
+  namespace: 'sys',
+  name: 'role',
+  label: 'Role',
+  pluralLabel: 'Roles',
+  icon: 'shield',
+  isSystem: true,
+  description: 'Role definitions for RBAC access control',
+  titleFormat: '{name}',
+  compactLayout: ['name', 'label', 'active'],
+  
+  fields: {
+    id: Field.text({
+      label: 'Role ID',
+      required: true,
+      readonly: true,
+    }),
+    
+    created_at: Field.datetime({
+      label: 'Created At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    updated_at: Field.datetime({
+      label: 'Updated At',
+      defaultValue: 'NOW()',
+      readonly: true,
+    }),
+    
+    name: Field.text({
+      label: 'API Name',
+      required: true,
+      searchable: true,
+      maxLength: 100,
+      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',
+    }),
+    
+    label: Field.text({
+      label: 'Display Name',
+      required: true,
+      maxLength: 255,
+    }),
+    
+    description: Field.textarea({
+      label: 'Description',
+      required: false,
+    }),
+    
+    permissions: Field.textarea({
+      label: 'Permissions',
+      required: false,
+      description: 'JSON-serialized array of permission strings',
+    }),
+    
+    active: Field.boolean({
+      label: 'Active',
+      defaultValue: true,
+    }),
+    
+    is_default: Field.boolean({
+      label: 'Default Role',
+      defaultValue: false,
+      description: 'Automatically assigned to new users',
+    }),
+  },
+  
+  indexes: [
+    { fields: ['name'], unique: true },
+    { fields: ['active'] },
+  ],
+  
+  enable: {
+    trackHistory: true,
+    searchable: true,
+    apiEnabled: true,
+    apiMethods: ['get', 'list', 'create', 'update', 'delete'],
+    trash: true,
+    mru: true,
+  },
+});