@objectstack/spec 0.3.2 → 0.4.1

package/json-schema/hub/SpaceSubscription.json

@@ -0,0 +1,77 @@
+{
+  "$ref": "#/definitions/SpaceSubscription",
+  "definitions": {
+    "SpaceSubscription": {
+      "type": "object",
+      "properties": {
+        "planId": {
+          "type": "string",
+          "description": "Reference to Plan Code"
+        },
+        "status": {
+          "type": "string",
+          "enum": [
+            "active",
+            "past_due",
+            "canceled",
+            "trialing",
+            "incomplete"
+          ]
+        },
+        "currentPeriodEnd": {
+          "type": "string",
+          "format": "date-time"
+        },
+        "stripeCustomerId": {
+          "type": "string"
+        },
+        "stripeSubscriptionId": {
+          "type": "string"
+        },
+        "addons": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "pluginId": {
+                "type": "string",
+                "description": "Marketplace Plugin ID (NPM package name)"
+              },
+              "quantity": {
+                "type": "number",
+                "default": 1
+              },
+              "status": {
+                "type": "string",
+                "enum": [
+                  "active",
+                  "past_due",
+                  "canceled",
+                  "trialing",
+                  "incomplete"
+                ],
+                "default": "active"
+              }
+            },
+            "required": [
+              "pluginId"
+            ],
+            "additionalProperties": false
+          }
+        },
+        "usage": {
+          "type": "object",
+          "additionalProperties": {
+            "type": "number"
+          }
+        }
+      },
+      "required": [
+        "planId",
+        "status"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/hub/SubscriptionStatus.json

@@ -0,0 +1,16 @@
+{
+  "$ref": "#/definitions/SubscriptionStatus",
+  "definitions": {
+    "SubscriptionStatus": {
+      "type": "string",
+      "enum": [
+        "active",
+        "past_due",
+        "canceled",
+        "trialing",
+        "incomplete"
+      ]
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/{system → hub}/Tenant.json

@@ -18,13 +18,12 @@
             "shared_schema",
             "isolated_schema",
             "isolated_db"
-          ],
-          "description": "Data isolation strategy"
+          ]
         },
         "customizations": {
           "type": "object",
           "additionalProperties": {},
-          "description": "Tenant-specific customizations"
+          "description": "Custom configuration values"
         },
         "quotas": {
           "type": "object",
@@ -45,8 +44,7 @@
               "description": "API requests per minute"
             }
           },
-          "additionalProperties": false,
-          "description": "Resource quotas and limits"
+          "additionalProperties": false
         }
       },
       "required": [

package/json-schema/permission/CriteriaSharingRule.json

@@ -0,0 +1,82 @@
+{
+  "$ref": "#/definitions/CriteriaSharingRule",
+  "definitions": {
+    "CriteriaSharingRule": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z_][a-z0-9_]*$",
+          "description": "Unique rule name (snake_case)"
+        },
+        "label": {
+          "type": "string",
+          "description": "Human-readable label"
+        },
+        "description": {
+          "type": "string",
+          "description": "Administrative notes"
+        },
+        "object": {
+          "type": "string",
+          "description": "Target Object Name"
+        },
+        "active": {
+          "type": "boolean",
+          "default": true
+        },
+        "accessLevel": {
+          "type": "string",
+          "enum": [
+            "read",
+            "edit",
+            "full"
+          ],
+          "default": "read"
+        },
+        "sharedWith": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "user",
+                "group",
+                "role",
+                "role_and_subordinates",
+                "guest"
+              ]
+            },
+            "value": {
+              "type": "string",
+              "description": "ID or Code of the User/Group/Role"
+            }
+          },
+          "required": [
+            "type",
+            "value"
+          ],
+          "additionalProperties": false,
+          "description": "The recipient of the shared access"
+        },
+        "type": {
+          "type": "string",
+          "const": "criteria"
+        },
+        "condition": {
+          "type": "string",
+          "description": "Formula condition (e.g. \"department = 'Sales'\")"
+        }
+      },
+      "required": [
+        "name",
+        "object",
+        "sharedWith",
+        "type",
+        "condition"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/{data → permission}/OWDModel.json

@@ -6,7 +6,8 @@
       "enum": [
         "private",
         "public_read",
-        "public_read_write"
+        "public_read_write",
+        "controlled_by_parent"
       ]
     }
   },

package/json-schema/{data → permission}/ObjectPermission.json

@@ -24,6 +24,21 @@
           "default": false,
           "description": "Delete permission"
         },
+        "allowTransfer": {
+          "type": "boolean",
+          "default": false,
+          "description": "Change record ownership"
+        },
+        "allowRestore": {
+          "type": "boolean",
+          "default": false,
+          "description": "Restore from trash (Undelete)"
+        },
+        "allowPurge": {
+          "type": "boolean",
+          "default": false,
+          "description": "Permanently delete (Hard Delete/GDPR)"
+        },
         "viewAllRecords": {
           "type": "boolean",
           "default": false,

package/json-schema/permission/OwnerSharingRule.json

@@ -0,0 +1,102 @@
+{
+  "$ref": "#/definitions/OwnerSharingRule",
+  "definitions": {
+    "OwnerSharingRule": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z_][a-z0-9_]*$",
+          "description": "Unique rule name (snake_case)"
+        },
+        "label": {
+          "type": "string",
+          "description": "Human-readable label"
+        },
+        "description": {
+          "type": "string",
+          "description": "Administrative notes"
+        },
+        "object": {
+          "type": "string",
+          "description": "Target Object Name"
+        },
+        "active": {
+          "type": "boolean",
+          "default": true
+        },
+        "accessLevel": {
+          "type": "string",
+          "enum": [
+            "read",
+            "edit",
+            "full"
+          ],
+          "default": "read"
+        },
+        "sharedWith": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "user",
+                "group",
+                "role",
+                "role_and_subordinates",
+                "guest"
+              ]
+            },
+            "value": {
+              "type": "string",
+              "description": "ID or Code of the User/Group/Role"
+            }
+          },
+          "required": [
+            "type",
+            "value"
+          ],
+          "additionalProperties": false,
+          "description": "The recipient of the shared access"
+        },
+        "type": {
+          "type": "string",
+          "const": "owner"
+        },
+        "ownedBy": {
+          "type": "object",
+          "properties": {
+            "type": {
+              "type": "string",
+              "enum": [
+                "user",
+                "group",
+                "role",
+                "role_and_subordinates",
+                "guest"
+              ]
+            },
+            "value": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "value"
+          ],
+          "additionalProperties": false,
+          "description": "Source group/role whose records are being shared"
+        }
+      },
+      "required": [
+        "name",
+        "object",
+        "sharedWith",
+        "type",
+        "ownedBy"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/{data → permission}/PermissionSet.json

@@ -6,7 +6,9 @@
       "properties": {
         "name": {
           "type": "string",
-          "description": "Permission set unique name"
+          "minLength": 2,
+          "pattern": "^[a-z][a-z0-9_]*$",
+          "description": "Permission set unique name (lowercase snake_case)"
         },
         "label": {
           "type": "string",
@@ -42,6 +44,21 @@
                 "default": false,
                 "description": "Delete permission"
               },
+              "allowTransfer": {
+                "type": "boolean",
+                "default": false,
+                "description": "Change record ownership"
+              },
+              "allowRestore": {
+                "type": "boolean",
+                "default": false,
+                "description": "Restore from trash (Undelete)"
+              },
+              "allowPurge": {
+                "type": "boolean",
+                "default": false,
+                "description": "Permanently delete (Hard Delete/GDPR)"
+              },
               "viewAllRecords": {
                 "type": "boolean",
                 "default": false,

package/json-schema/permission/RLSConfig.json

@@ -0,0 +1,59 @@
+{
+  "$ref": "#/definitions/RLSConfig",
+  "definitions": {
+    "RLSConfig": {
+      "type": "object",
+      "properties": {
+        "enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Enable RLS enforcement globally"
+        },
+        "defaultPolicy": {
+          "type": "string",
+          "enum": [
+            "deny",
+            "allow"
+          ],
+          "default": "deny",
+          "description": "Default action when no policies match"
+        },
+        "allowSuperuserBypass": {
+          "type": "boolean",
+          "default": true,
+          "description": "Allow superusers to bypass RLS"
+        },
+        "bypassRoles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Roles that bypass RLS (see all data)"
+        },
+        "logEvaluations": {
+          "type": "boolean",
+          "default": false,
+          "description": "Log RLS policy evaluations for debugging"
+        },
+        "cacheResults": {
+          "type": "boolean",
+          "default": true,
+          "description": "Cache RLS evaluation results"
+        },
+        "cacheTtlSeconds": {
+          "type": "integer",
+          "exclusiveMinimum": 0,
+          "default": 300,
+          "description": "Cache TTL in seconds"
+        },
+        "prefetchUserContext": {
+          "type": "boolean",
+          "default": true,
+          "description": "Pre-fetch user context for performance"
+        }
+      },
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/permission/RLSEvaluationResult.json

@@ -0,0 +1,40 @@
+{
+  "$ref": "#/definitions/RLSEvaluationResult",
+  "definitions": {
+    "RLSEvaluationResult": {
+      "type": "object",
+      "properties": {
+        "policyName": {
+          "type": "string",
+          "description": "Policy name"
+        },
+        "granted": {
+          "type": "boolean",
+          "description": "Whether access was granted"
+        },
+        "durationMs": {
+          "type": "number",
+          "description": "Evaluation duration in milliseconds"
+        },
+        "error": {
+          "type": "string",
+          "description": "Error message if evaluation failed"
+        },
+        "usingResult": {
+          "type": "boolean",
+          "description": "USING clause evaluation result"
+        },
+        "checkResult": {
+          "type": "boolean",
+          "description": "CHECK clause evaluation result"
+        }
+      },
+      "required": [
+        "policyName",
+        "granted"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/{data/TriggerAction.json → permission/RLSOperation.json}

@@ -1,12 +1,14 @@
 {
-  "$ref": "#/definitions/TriggerAction",
+  "$ref": "#/definitions/RLSOperation",
   "definitions": {
-    "TriggerAction": {
+    "RLSOperation": {
       "type": "string",
       "enum": [
+        "select",
         "insert",
         "update",
-        "delete"
+        "delete",
+        "all"
       ]
     }
   },

package/json-schema/permission/RLSUserContext.json

@@ -0,0 +1,51 @@
+{
+  "$ref": "#/definitions/RLSUserContext",
+  "definitions": {
+    "RLSUserContext": {
+      "type": "object",
+      "properties": {
+        "id": {
+          "type": "string",
+          "description": "User ID"
+        },
+        "email": {
+          "type": "string",
+          "format": "email",
+          "description": "User email"
+        },
+        "tenantId": {
+          "type": "string",
+          "description": "Tenant/Organization ID"
+        },
+        "role": {
+          "anyOf": [
+            {
+              "type": "string"
+            },
+            {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          ],
+          "description": "User role(s)"
+        },
+        "department": {
+          "type": "string",
+          "description": "User department"
+        },
+        "attributes": {
+          "type": "object",
+          "additionalProperties": {},
+          "description": "Additional custom user attributes"
+        }
+      },
+      "required": [
+        "id"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/permission/RowLevelSecurityPolicy.json

@@ -0,0 +1,77 @@
+{
+  "$ref": "#/definitions/RowLevelSecurityPolicy",
+  "definitions": {
+    "RowLevelSecurityPolicy": {
+      "type": "object",
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[a-z_][a-z0-9_]*$",
+          "description": "Policy unique identifier (snake_case)"
+        },
+        "label": {
+          "type": "string",
+          "description": "Human-readable policy label"
+        },
+        "description": {
+          "type": "string",
+          "description": "Policy description and business justification"
+        },
+        "object": {
+          "type": "string",
+          "description": "Target object name"
+        },
+        "operation": {
+          "type": "string",
+          "enum": [
+            "select",
+            "insert",
+            "update",
+            "delete",
+            "all"
+          ],
+          "description": "Database operation this policy applies to"
+        },
+        "using": {
+          "type": "string",
+          "description": "Filter condition for SELECT/UPDATE/DELETE (PostgreSQL SQL WHERE clause syntax with parameterized context variables). Optional for INSERT-only policies."
+        },
+        "check": {
+          "type": "string",
+          "description": "Validation condition for INSERT/UPDATE (defaults to USING clause if not specified - enforced at application level)"
+        },
+        "roles": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Roles this policy applies to (omit for all roles)"
+        },
+        "enabled": {
+          "type": "boolean",
+          "default": true,
+          "description": "Whether this policy is active"
+        },
+        "priority": {
+          "type": "integer",
+          "default": 0,
+          "description": "Policy evaluation priority (higher = evaluated first)"
+        },
+        "tags": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          },
+          "description": "Policy categorization tags"
+        }
+      },
+      "required": [
+        "name",
+        "object",
+        "operation"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/permission/ShareRecipientType.json

@@ -0,0 +1,16 @@
+{
+  "$ref": "#/definitions/ShareRecipientType",
+  "definitions": {
+    "ShareRecipientType": {
+      "type": "string",
+      "enum": [
+        "user",
+        "group",
+        "role",
+        "role_and_subordinates",
+        "guest"
+      ]
+    }
+  },
+  "$schema": "http://json-schema.org/draft-07/schema#"
+}

package/json-schema/{data → permission}/SharingLevel.json

@@ -5,7 +5,8 @@
       "type": "string",
       "enum": [
         "read",
-        "edit"
+        "edit",
+        "full"
       ]
     }
   },