@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/src/organization-access.ts

@@ -0,0 +1,216 @@
+import * as primitives from "./primitives";
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+import { Permission } from "./permissions";
+
+export const OrganizationAccessPreset = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["read_only", "full", "custom"]),
+);
+export type OrganizationAccessPreset = z.infer<typeof OrganizationAccessPreset>;
+
+export const OrganizationWorkspaceScope = /* @__PURE__ */ defineSchema(() =>
+  z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("all") }).strict(),
+    z
+      .object({
+        kind: z.literal("selected"),
+        workspaceIds: z
+          .array(primitives.uuid.transform((id) => id.toLowerCase()))
+          .max(500)
+          .refine((ids) => new Set(ids).size === ids.length, "Workspace IDs must be unique"),
+      })
+      .strict(),
+  ]),
+);
+export type OrganizationWorkspaceScope = z.infer<typeof OrganizationWorkspaceScope>;
+
+export const OrganizationActor = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["user", "organization"]),
+);
+export type OrganizationActor = z.infer<typeof OrganizationActor>;
+
+const aliases: Partial<Record<Permission, Permission>> = {
+  "environments:manage": "variable-sets:manage",
+  "environments:use": "variable-sets:use",
+};
+// Computed on first use, never at module load: the web build can place
+// `Permission` in a chunk that finishes initializing after this one, and a
+// top-level read of `Permission.options` then crashes the whole app.
+let permissionSets:
+  | { canonical: Permission[]; observational: Permission[]; readOnly: Permission[] }
+  | undefined;
+function sets() {
+  if (permissionSets) return permissionSets;
+  const canonical = Permission.options.filter((permission) => !aliases[permission]);
+  /** Everything that only observes. Reading secret values observes too. */
+  const observational = canonical.filter((permission) =>
+    /:(read|list|view|search)$/.test(permission),
+  );
+  /** Secret values are opt-in: Read only leaves them out, Custom can add them. */
+  const secretValue = new Set<Permission>(["secrets:read", "variable-sets:read"]);
+  const readOnly = observational.filter((permission) => !secretValue.has(permission));
+  permissionSets = { canonical, observational, readOnly };
+  return permissionSets;
+}
+
+/** Custom has no implicit permissions. Presets are expanded only by this helper. */
+export function organizationAccessPresetPermissions(
+  preset: OrganizationAccessPreset,
+): Permission[] {
+  return preset === "full"
+    ? [...sets().canonical]
+    : preset === "read_only"
+      ? [...sets().readOnly]
+      : [];
+}
+
+/** True when nothing can be changed, including an empty set and secret-value reads. */
+export function isReadOnlyPermissionSet(permissions: readonly Permission[]): boolean {
+  return permissions.every((permission) =>
+    sets().observational.includes(aliases[permission] ?? permission),
+  );
+}
+
+const OrganizationAccessPolicyInput = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      preset: OrganizationAccessPreset,
+      // Lazy for the same module-order reason as `sets()` above.
+      permissions: z.array(z.lazy(() => Permission)),
+      workspaceScope: OrganizationWorkspaceScope,
+    })
+    .strict(),
+);
+
+export type OrganizationAccessPolicy = z.infer<typeof OrganizationAccessPolicyInput>;
+
+/** Canonical ordering, alias mapping and labels; never adds an unrequested grant. */
+export function normalizeOrganizationAccessPolicy(
+  policy: OrganizationAccessPolicy,
+): OrganizationAccessPolicy {
+  const parsed = OrganizationAccessPolicyInput.parse(policy);
+  const requested = new Set(
+    parsed.permissions.map((permission) => aliases[permission] ?? permission),
+  );
+  // `connections:write` includes connecting one's own accounts, so a policy
+  // saved before the narrow permission existed keeps its exact meaning.
+  if (requested.has("connections:write")) requested.add("connections:personal");
+  const { canonical, readOnly } = sets();
+  const permissions = canonical.filter((permission) => requested.has(permission));
+  const same = (candidate: readonly Permission[]) =>
+    candidate.length === permissions.length &&
+    candidate.every((permission) => requested.has(permission));
+  return {
+    preset: same(canonical) ? "full" : same(readOnly) ? "read_only" : "custom",
+    permissions,
+    workspaceScope:
+      parsed.workspaceScope.kind === "selected"
+        ? { kind: "selected", workspaceIds: [...parsed.workspaceScope.workspaceIds].sort() }
+        : { kind: "all" },
+  };
+}
+
+export const OrganizationAccessPolicy = /* @__PURE__ */ defineSchema(() =>
+  OrganizationAccessPolicyInput.transform(normalizeOrganizationAccessPolicy),
+);
+
+/** Change what a connected agent can do. Only the person who connected it can. */
+export const UpdateOrganizationMcpConnectionRequest = /* @__PURE__ */ defineSchema(() =>
+  z.object({ access: OrganizationAccessPolicy }).strict(),
+);
+
+/**
+ * The answer to a pending agent sign-in: deny it, or approve it for one
+ * organization with the access the agent gets there.
+ */
+export const McpConnectionDecision = /* @__PURE__ */ defineSchema(() =>
+  z.discriminatedUnion("decision", [
+    z.object({ decision: z.literal("deny") }).strict(),
+    z
+      .object({
+        decision: z.literal("approve"),
+        organizationId: primitives.uuid,
+        access: OrganizationAccessPolicy,
+      })
+      .strict(),
+  ]),
+);
+
+/* ----------------------------------------------------------------------------
+   Service accounts: an organization identity with no person behind it. It
+   holds organization API keys; its role caps what those keys can be given.
+   Up to admin, never owner.
+   -------------------------------------------------------------------------- */
+
+export const OrganizationServiceAccountRole = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["admin", "member"]),
+);
+export type OrganizationServiceAccountRole = z.infer<typeof OrganizationServiceAccountRole>;
+
+/** What only an organization administrator can do; a member service account's keys never hold it. */
+export const ORGANIZATION_ADMIN_ONLY_PERMISSIONS: readonly Permission[] = [
+  "account:admin",
+  "members:manage",
+  "billing:manage",
+  "api_keys:manage",
+  "usage_allowances:manage",
+];
+
+/** The permissions a service account's keys may hold, given its role. */
+export function serviceAccountAllowsPermission(
+  role: OrganizationServiceAccountRole,
+  permission: Permission,
+): boolean {
+  return role === "admin" || !ORGANIZATION_ADMIN_ONLY_PERMISSIONS.includes(permission);
+}
+
+export const OrganizationServiceAccount = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    id: primitives.uuid,
+    organizationId: primitives.uuid,
+    name: z.string().min(1).max(200),
+    description: primitives.nullableString,
+    role: OrganizationServiceAccountRole,
+    /** Keys that are not revoked, including expired ones. */
+    activeKeyCount: primitives.nonnegativeInteger,
+    createdAt: primitives.string,
+    updatedAt: primitives.string,
+  }),
+);
+export type OrganizationServiceAccount = z.infer<typeof OrganizationServiceAccount>;
+
+export const ListOrganizationServiceAccountsResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    serviceAccounts: z.array(OrganizationServiceAccount),
+  }),
+);
+export type ListOrganizationServiceAccountsResponse = z.infer<
+  typeof ListOrganizationServiceAccountsResponse
+>;
+
+export const CreateOrganizationServiceAccountRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      name: primitives.string.trim().min(1).max(200),
+      description: primitives.string.trim().min(1).max(500).optional(),
+      role: OrganizationServiceAccountRole.default("member"),
+    })
+    .strict(),
+);
+export type CreateOrganizationServiceAccountRequest = z.infer<
+  typeof CreateOrganizationServiceAccountRequest
+>;
+
+export const UpdateOrganizationServiceAccountRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      name: primitives.string.trim().min(1).max(200).optional(),
+      description: primitives.string.trim().min(1).max(500).nullable().optional(),
+      role: OrganizationServiceAccountRole.optional(),
+    })
+    .strict()
+    .refine((request) => Object.keys(request).length > 0, "At least one change is required"),
+);
+export type UpdateOrganizationServiceAccountRequest = z.infer<
+  typeof UpdateOrganizationServiceAccountRequest
+>;

package/src/organization-integration-policy.ts

@@ -1,36 +1,55 @@
+import * as primitives from "./primitives";
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
 /** Catalog identities, never endpoint/domain matching. Custom transports are explicit categories. */
-export const OrganizationIntegrationKey = z
-  .string()
-  .min(1)
-  .max(200)
-  .regex(/^[a-z0-9][a-z0-9._:-]*$/);
-const keys = z
-  .array(OrganizationIntegrationKey)
-  .max(10000)
-  .refine((values) => new Set(values).size === values.length, "Duplicate integration identities");
-export const OrganizationIntegrationPolicy = z
-  .object({
-    mode: z.enum(["unrestricted", "restricted"]).default("unrestricted"),
-    allowedIntegrationKeys: keys.default([]),
-    revision: z.number().int().nonnegative().safe().default(0),
-  })
-  .strict();
+export const OrganizationIntegrationKey = /* @__PURE__ */ defineSchema(() =>
+  z
+    .string()
+    .min(1)
+    .max(200)
+    .regex(/^[a-z0-9][a-z0-9._:-]*$/),
+);
+const keys = /* @__PURE__ */ defineSchema(() =>
+  z
+    .array(OrganizationIntegrationKey)
+    .max(10000)
+    .refine((values) => new Set(values).size === values.length, "Duplicate integration identities"),
+);
+/**
+ * Who may turn on a reviewed OAuth integration for personal accounts (each
+ * person then connects their own account): any member holding the personal
+ * setup permission, or only integration admins. Admins are unaffected.
+ */
+export const PersonalIntegrationSetupPolicy = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["members", "admins"]),
+);
+export type PersonalIntegrationSetupPolicy = z.infer<typeof PersonalIntegrationSetupPolicy>;
+
+export const OrganizationIntegrationPolicy = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      mode: z.enum(["unrestricted", "restricted"]).default("unrestricted"),
+      allowedIntegrationKeys: keys.default([]),
+      personalIntegrationSetup: PersonalIntegrationSetupPolicy.default("members"),
+      revision: primitives.nonnegativeInteger.safe().default(0),
+    })
+    .strict(),
+);
 export type OrganizationIntegrationPolicy = z.infer<typeof OrganizationIntegrationPolicy>;
 
-export const UpdateOrganizationIntegrationPolicyRequest = z
-  .object({
-    mode: z.enum(["unrestricted", "restricted"]),
-    allowedIntegrationKeys: keys,
-    expectedRevision: z
-      .number()
-      .int()
-      .nonnegative()
-      .max(Number.MAX_SAFE_INTEGER - 1),
-    operationId: z.string().uuid(),
-  })
-  .strict();
+export const UpdateOrganizationIntegrationPolicyRequest = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      mode: z.enum(["unrestricted", "restricted"]),
+      allowedIntegrationKeys: keys,
+      /** Omitted keeps the current setting. */
+      personalIntegrationSetup: PersonalIntegrationSetupPolicy.optional(),
+      expectedRevision: primitives.nonnegativeInteger.max(Number.MAX_SAFE_INTEGER - 1),
+      operationId: primitives.uuid,
+    })
+    .strict(),
+);
 export type UpdateOrganizationIntegrationPolicyRequest = z.infer<
   typeof UpdateOrganizationIntegrationPolicyRequest
 >;