@openhi/types 0.0.49 → 0.0.50

package/lib/auth/jwt-claims.d.ts

@@ -1,3 +1,5 @@
+import type { PlatformRoleCode } from "../control/constants";
+import type { OrganizationRoleCode } from "../data/organization-role";
 /**
  * Canonical projection of the runtime JWT claim contract defined in ADR-014.
  *
@@ -6,6 +8,12 @@
  * token without them; `ohi_uid` and `ohi_uname` are set at user
  * provisioning and are present in every issued token thereafter.
  *
+ * The role claims (`ohi_organization_roles`, `ohi_platform_roles`) are
+ * populated by the pre-token-generation Lambda per ADR-019 (organization
+ * roles) and ADR 2026-03-13-02 (platform roles). Each is absent when no
+ * source data exists, present-and-empty when source data exists but yields
+ * no recognized codes, and otherwise a deduplicated code list.
+ *
  * @see https://github.com/codedrifters/openhi-planning/blob/main/docs/src/content/docs/requirements/architectural-decisions/ADR-014-cognito-authn-runtime-jwt-claim-model.md
  */
 export interface OhiJwtClaims {
@@ -19,4 +27,28 @@ export interface OhiJwtClaims {
     ohi_uid: string;
     /** Platform user display name. */
     ohi_uname: string;
+    /** Workspace-scoped organization (clinical) role codes for the current
+     *  workspace. Absent when the user has no linked Membership. */
+    ohi_organization_roles?: ReadonlyArray<OrganizationRoleCode>;
+    /** Platform role codes that apply to the current tenant/workspace scope.
+     *  Absent when the user has no RoleAssignment. */
+    ohi_platform_roles?: ReadonlyArray<PlatformRoleCode>;
+}
+/**
+ * Result of previewing the OpenHI claims a given user would receive at their
+ * next sign-in (`GET /User/:id/$claims`). Computed by the same resolution
+ * logic the pre-token-generation Lambda uses, so the preview never drifts
+ * from real token issuance.
+ *
+ * When `wouldBeRejected` is true the user would receive a token with no
+ * `ohi_*` claims, and `openHiContextMiddleware` would reject their API
+ * requests with a 403 — `reason` explains why.
+ */
+export interface OhiUserClaimsPreview {
+    /** The claims the user would receive, or `null` when they would receive none. */
+    claims: OhiJwtClaims | null;
+    /** True when the user would receive no usable claims (a 403 on every request). */
+    wouldBeRejected: boolean;
+    /** Human-readable explanation, present only when `wouldBeRejected` is true. */
+    reason?: string;
 }

package/lib/auth/jwt-claims.js

@@ -1,3 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiand0LWNsYWltcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoL2p3dC1jbGFpbXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQ2Fub25pY2FsIHByb2plY3Rpb24gb2YgdGhlIHJ1bnRpbWUgSldUIGNsYWltIGNvbnRyYWN0IGRlZmluZWQgaW4gQURSLTAxNC5cbiAqXG4gKiBgb2hpX3RpZGAgYW5kIGBvaGlfd2lkYCBhcmUgb3B0aW9uYWwgYmVjYXVzZSBhIGZyZXNobHktYXV0aGVudGljYXRlZCB1c2VyXG4gKiB0aGF0IGhhcyBub3QgeWV0IGJlZW4gcHJvdmlzaW9uZWQgaW50byBhbnkgdGVuYW50L3dvcmtzcGFjZSByZWNlaXZlcyBhXG4gKiB0b2tlbiB3aXRob3V0IHRoZW07IGBvaGlfdWlkYCBhbmQgYG9oaV91bmFtZWAgYXJlIHNldCBhdCB1c2VyXG4gKiBwcm92aXNpb25pbmcgYW5kIGFyZSBwcmVzZW50IGluIGV2ZXJ5IGlzc3VlZCB0b2tlbiB0aGVyZWFmdGVyLlxuICpcbiAqIEBzZWUgaHR0cHM6Ly9naXRodWIuY29tL2NvZGVkcmlmdGVycy9vcGVuaGktcGxhbm5pbmcvYmxvYi9tYWluL2RvY3Mvc3JjL2NvbnRlbnQvZG9jcy9yZXF1aXJlbWVudHMvYXJjaGl0ZWN0dXJhbC1kZWNpc2lvbnMvQURSLTAxNC1jb2duaXRvLWF1dGhuLXJ1bnRpbWUtand0LWNsYWltLW1vZGVsLm1kXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgT2hpSnd0Q2xhaW1zIHtcbiAgLyoqIFBsYXRmb3JtLWFzc2lnbmVkIFRlbmFudCBJRCBmb3IgdGhlIHJlcXVlc3QgY29udGV4dC4gQWJzZW50IHVudGlsIHRoZVxuICAgKiAgdXNlciBpcyBwcm92aXNpb25lZCBpbnRvIGF0IGxlYXN0IG9uZSB0ZW5hbnQuICovXG4gIG9oaV90aWQ/OiBzdHJpbmc7XG4gIC8qKiBQbGF0Zm9ybS1hc3NpZ25lZCBXb3Jrc3BhY2UgSUQgZm9yIHRoZSByZXF1ZXN0IGNvbnRleHQuIEFic2VudCB1bnRpbFxuICAgKiAgdGhlIHVzZXIgaXMgcHJvdmlzaW9uZWQgaW50byBhdCBsZWFzdCBvbmUgd29ya3NwYWNlIHdpdGhpbiBgb2hpX3RpZGAuICovXG4gIG9oaV93aWQ/OiBzdHJpbmc7XG4gIC8qKiBQbGF0Zm9ybSB1c2VyIElELiBEaXN0aW5jdCBmcm9tIHRoZSBDb2duaXRvIGBzdWJgLiAqL1xuICBvaGlfdWlkOiBzdHJpbmc7XG4gIC8qKiBQbGF0Zm9ybSB1c2VyIGRpc3BsYXkgbmFtZS4gKi9cbiAgb2hpX3VuYW1lOiBzdHJpbmc7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiand0LWNsYWltcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hdXRoL2p3dC1jbGFpbXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgUGxhdGZvcm1Sb2xlQ29kZSB9IGZyb20gXCIuLi9jb250cm9sL2NvbnN0YW50c1wiO1xuaW1wb3J0IHR5cGUgeyBPcmdhbml6YXRpb25Sb2xlQ29kZSB9IGZyb20gXCIuLi9kYXRhL29yZ2FuaXphdGlvbi1yb2xlXCI7XG5cbi8qKlxuICogQ2Fub25pY2FsIHByb2plY3Rpb24gb2YgdGhlIHJ1bnRpbWUgSldUIGNsYWltIGNvbnRyYWN0IGRlZmluZWQgaW4gQURSLTAxNC5cbiAqXG4gKiBgb2hpX3RpZGAgYW5kIGBvaGlfd2lkYCBhcmUgb3B0aW9uYWwgYmVjYXVzZSBhIGZyZXNobHktYXV0aGVudGljYXRlZCB1c2VyXG4gKiB0aGF0IGhhcyBub3QgeWV0IGJlZW4gcHJvdmlzaW9uZWQgaW50byBhbnkgdGVuYW50L3dvcmtzcGFjZSByZWNlaXZlcyBhXG4gKiB0b2tlbiB3aXRob3V0IHRoZW07IGBvaGlfdWlkYCBhbmQgYG9oaV91bmFtZWAgYXJlIHNldCBhdCB1c2VyXG4gKiBwcm92aXNpb25pbmcgYW5kIGFyZSBwcmVzZW50IGluIGV2ZXJ5IGlzc3VlZCB0b2tlbiB0aGVyZWFmdGVyLlxuICpcbiAqIFRoZSByb2xlIGNsYWltcyAoYG9oaV9vcmdhbml6YXRpb25fcm9sZXNgLCBgb2hpX3BsYXRmb3JtX3JvbGVzYCkgYXJlXG4gKiBwb3B1bGF0ZWQgYnkgdGhlIHByZS10b2tlbi1nZW5lcmF0aW9uIExhbWJkYSBwZXIgQURSLTAxOSAob3JnYW5pemF0aW9uXG4gKiByb2xlcykgYW5kIEFEUiAyMDI2LTAzLTEzLTAyIChwbGF0Zm9ybSByb2xlcykuIEVhY2ggaXMgYWJzZW50IHdoZW4gbm9cbiAqIHNvdXJjZSBkYXRhIGV4aXN0cywgcHJlc2VudC1hbmQtZW1wdHkgd2hlbiBzb3VyY2UgZGF0YSBleGlzdHMgYnV0IHlpZWxkc1xuICogbm8gcmVjb2duaXplZCBjb2RlcywgYW5kIG90aGVyd2lzZSBhIGRlZHVwbGljYXRlZCBjb2RlIGxpc3QuXG4gKlxuICogQHNlZSBodHRwczovL2dpdGh1Yi5jb20vY29kZWRyaWZ0ZXJzL29wZW5oaS1wbGFubmluZy9ibG9iL21haW4vZG9jcy9zcmMvY29udGVudC9kb2NzL3JlcXVpcmVtZW50cy9hcmNoaXRlY3R1cmFsLWRlY2lzaW9ucy9BRFItMDE0LWNvZ25pdG8tYXV0aG4tcnVudGltZS1qd3QtY2xhaW0tbW9kZWwubWRcbiAqL1xuZXhwb3J0IGludGVyZmFjZSBPaGlKd3RDbGFpbXMge1xuICAvKiogUGxhdGZvcm0tYXNzaWduZWQgVGVuYW50IElEIGZvciB0aGUgcmVxdWVzdCBjb250ZXh0LiBBYnNlbnQgdW50aWwgdGhlXG4gICAqICB1c2VyIGlzIHByb3Zpc2lvbmVkIGludG8gYXQgbGVhc3Qgb25lIHRlbmFudC4gKi9cbiAgb2hpX3RpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtLWFzc2lnbmVkIFdvcmtzcGFjZSBJRCBmb3IgdGhlIHJlcXVlc3QgY29udGV4dC4gQWJzZW50IHVudGlsXG4gICAqICB0aGUgdXNlciBpcyBwcm92aXNpb25lZCBpbnRvIGF0IGxlYXN0IG9uZSB3b3Jrc3BhY2Ugd2l0aGluIGBvaGlfdGlkYC4gKi9cbiAgb2hpX3dpZD86IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgSUQuIERpc3RpbmN0IGZyb20gdGhlIENvZ25pdG8gYHN1YmAuICovXG4gIG9oaV91aWQ6IHN0cmluZztcbiAgLyoqIFBsYXRmb3JtIHVzZXIgZGlzcGxheSBuYW1lLiAqL1xuICBvaGlfdW5hbWU6IHN0cmluZztcbiAgLyoqIFdvcmtzcGFjZS1zY29wZWQgb3JnYW5pemF0aW9uIChjbGluaWNhbCkgcm9sZSBjb2RlcyBmb3IgdGhlIGN1cnJlbnRcbiAgICogIHdvcmtzcGFjZS4gQWJzZW50IHdoZW4gdGhlIHVzZXIgaGFzIG5vIGxpbmtlZCBNZW1iZXJzaGlwLiAqL1xuICBvaGlfb3JnYW5pemF0aW9uX3JvbGVzPzogUmVhZG9ubHlBcnJheTxPcmdhbml6YXRpb25Sb2xlQ29kZT47XG4gIC8qKiBQbGF0Zm9ybSByb2xlIGNvZGVzIHRoYXQgYXBwbHkgdG8gdGhlIGN1cnJlbnQgdGVuYW50L3dvcmtzcGFjZSBzY29wZS5cbiAgICogIEFic2VudCB3aGVuIHRoZSB1c2VyIGhhcyBubyBSb2xlQXNzaWdubWVudC4gKi9cbiAgb2hpX3BsYXRmb3JtX3JvbGVzPzogUmVhZG9ubHlBcnJheTxQbGF0Zm9ybVJvbGVDb2RlPjtcbn1cblxuLyoqXG4gKiBSZXN1bHQgb2YgcHJldmlld2luZyB0aGUgT3BlbkhJIGNsYWltcyBhIGdpdmVuIHVzZXIgd291bGQgcmVjZWl2ZSBhdCB0aGVpclxuICogbmV4dCBzaWduLWluIChgR0VUIC9Vc2VyLzppZC8kY2xhaW1zYCkuIENvbXB1dGVkIGJ5IHRoZSBzYW1lIHJlc29sdXRpb25cbiAqIGxvZ2ljIHRoZSBwcmUtdG9rZW4tZ2VuZXJhdGlvbiBMYW1iZGEgdXNlcywgc28gdGhlIHByZXZpZXcgbmV2ZXIgZHJpZnRzXG4gKiBmcm9tIHJlYWwgdG9rZW4gaXNzdWFuY2UuXG4gKlxuICogV2hlbiBgd291bGRCZVJlamVjdGVkYCBpcyB0cnVlIHRoZSB1c2VyIHdvdWxkIHJlY2VpdmUgYSB0b2tlbiB3aXRoIG5vXG4gKiBgb2hpXypgIGNsYWltcywgYW5kIGBvcGVuSGlDb250ZXh0TWlkZGxld2FyZWAgd291bGQgcmVqZWN0IHRoZWlyIEFQSVxuICogcmVxdWVzdHMgd2l0aCBhIDQwMyDigJQgYHJlYXNvbmAgZXhwbGFpbnMgd2h5LlxuICovXG5leHBvcnQgaW50ZXJmYWNlIE9oaVVzZXJDbGFpbXNQcmV2aWV3IHtcbiAgLyoqIFRoZSBjbGFpbXMgdGhlIHVzZXIgd291bGQgcmVjZWl2ZSwgb3IgYG51bGxgIHdoZW4gdGhleSB3b3VsZCByZWNlaXZlIG5vbmUuICovXG4gIGNsYWltczogT2hpSnd0Q2xhaW1zIHwgbnVsbDtcbiAgLyoqIFRydWUgd2hlbiB0aGUgdXNlciB3b3VsZCByZWNlaXZlIG5vIHVzYWJsZSBjbGFpbXMgKGEgNDAzIG9uIGV2ZXJ5IHJlcXVlc3QpLiAqL1xuICB3b3VsZEJlUmVqZWN0ZWQ6IGJvb2xlYW47XG4gIC8qKiBIdW1hbi1yZWFkYWJsZSBleHBsYW5hdGlvbiwgcHJlc2VudCBvbmx5IHdoZW4gYHdvdWxkQmVSZWplY3RlZGAgaXMgdHJ1ZS4gKi9cbiAgcmVhc29uPzogc3RyaW5nO1xufVxuIl19

package/package.json

@@ -39,7 +39,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.0.49",
+  "version": "0.0.50",
   "types": "lib/index.d.ts",
   "//": "~~ Generated by projen. To modify, edit .projenrc.js and run \"pnpm exec projen\".",
   "scripts": {