@opengeni/core 2.7.5-canary.3 → 2.7.5-canary.4

package/dist/access/index.d.ts

@@ -91,6 +91,13 @@ export declare function requireCanonicalLocalAccountAdministrator(c: Context, de
     authorization: AccessGrantAuthorization;
 }>;
 export declare function requireAccessGrantAuthorization(c: Context, deps: AccessDeps, workspaceId: string, permission?: Permission): Promise<AccessGrantAuthorization>;
+/**
+ * Settings administration is narrower than workspace administration. The
+ * canonical managed-cookie owner may configure their Personal workspace, but
+ * never acquires the admin wildcard (and its membership/delegation powers).
+ * Only use this boundary for workspace configuration, not access management.
+ */
+export declare function requireWorkspaceSettingsGrant(c: Context, deps: AccessDeps, workspaceId: string): Promise<AccessGrant>;
 export declare function requirePermission(grant: AccessGrant, permission: Permission): void;
 /**
  * Require a permission to be present literally on the grant. This deliberately

package/dist/index.js

@@ -1988,7 +1988,8 @@ import {
   ensureManagedAccessForUser,
   findActiveApiKeyByHash,
   getWorkspaceGrant,
-  requireWorkspace
+  requireWorkspace,
+  resolveNamedManagedPersonalWorkspaceGrant
 } from "@opengeni/db";
 import { HTTPException } from "hono/http-exception";
 var bearerPrefix = "Bearer ";
@@ -2110,6 +2111,21 @@ async function requireAccessGrantAuthorization(c, deps, workspaceId, permission)
   const context = await requireAccessContext(c, deps);
   return await accessGrantAuthorization(context, deps, workspaceId, permission);
 }
+async function requireWorkspaceSettingsGrant(c, deps, workspaceId) {
+  const authorization = await requireAccessGrantAuthorization(c, deps, workspaceId);
+  const grant = requireResolvedAccessGrantAuthorization(authorization, workspaceId);
+  if (hasPermission(grant.permissions, "workspace:admin")) return grant;
+  if (authorization.canonicalManagedHumanSession && await resolveNamedManagedPersonalWorkspaceGrant(deps.db, {
+    accountId: grant.accountId,
+    workspaceId,
+    subjectId: authorization.authenticatedSubjectId
+  })) {
+    return grant;
+  }
+  throw new HTTPException(403, {
+    message: "workspace settings require a workspace administrator or Personal workspace owner"
+  });
+}
 async function accessGrantAuthorization(context, deps, workspaceId, permission) {
   const principalKind = hostedHumanSessionPrincipalKind(context);
   let grant = context.workspaceGrants.find((candidate) => candidate.workspaceId === workspaceId) ?? await getWorkspaceGrant(
@@ -16688,6 +16704,7 @@ export {
   requireSessionAuthorizationListScope,
   requireVariableSetEncryption,
   requireVariableSetForApi,
+  requireWorkspaceSettingsGrant,
   resolveCapabilityPack,
   resolveCatalogSettings,
   resolveChildGoalFromAcceptedSnapshot,