@owlmeans/iam 0.1.18-rc.8 → 0.1.18

package/build/runtime.d.ts

@@ -0,0 +1,75 @@
+import { type EntrypointProtocol, type OpenRequest, type OpenValue } from '@owlmeans/entrypoint';
+import type { IamRuntimeAck, IamRuntimeGrant, IamRuntimeGrantList, IamRuntimeGrantQuery, IamRuntimeGrantRequest, IamRuntimeMember, IamRuntimeMemberInvite, IamRuntimeMemberList, IamRuntimeMemberParams, IamRuntimeMemberUpdate, IamRuntimeOrganization, IamRuntimeOrganizationCreate, IamRuntimeOrganizationList, IamRuntimeOrganizationParams, IamRuntimeOrganizationUpdate, IamRuntimePermissionList, IamRuntimeProtocolOptions } from './runtime/types.js';
+export type IamRuntimeProtocols = ReturnType<typeof declareRuntime>;
+declare const declareRuntime: (opts: IamRuntimeProtocolOptions) => Readonly<{
+    base: EntrypointProtocol<OpenRequest, OpenValue>;
+    organizations: Readonly<{
+        /** Any subject: its own organizations. */
+        list: EntrypointProtocol<{}, IamRuntimeOrganizationList>;
+        /** Any subject of a tenanted client; the caller becomes its owner. */
+        create: EntrypointProtocol<{
+            body: IamRuntimeOrganizationCreate;
+        }, IamRuntimeOrganization>;
+        /** Owner. */
+        update: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationParams>;
+            body: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationUpdate>;
+        }>, IamRuntimeOrganization>;
+    }>;
+    members: Readonly<{
+        /** Member. */
+        list: EntrypointProtocol<{
+            params: IamRuntimeOrganizationParams;
+        }, IamRuntimeMemberList>;
+        /** Owner. Find-or-create by e-mail, idempotent. */
+        add: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationParams>;
+            body: import("@owlmeans/entrypoint").Typed<IamRuntimeMemberInvite>;
+        }>, IamRuntimeMember>;
+        /** Owner. */
+        update: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeMemberParams>;
+            body: import("@owlmeans/entrypoint").Typed<IamRuntimeMemberUpdate>;
+        }>, IamRuntimeMember>;
+        /** Owner, or the member itself. */
+        remove: EntrypointProtocol<{
+            params: IamRuntimeMemberParams;
+        }, IamRuntimeAck>;
+    }>;
+    permissions: Readonly<{
+        /** Member. */
+        list: EntrypointProtocol<{
+            params: IamRuntimeOrganizationParams;
+        }, IamRuntimePermissionList>;
+    }>;
+    grants: Readonly<{
+        /** Owner. */
+        list: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationParams>;
+            query: import("@owlmeans/entrypoint").Typed<IamRuntimeGrantQuery>;
+        }>, IamRuntimeGrantList>;
+        /** Owner. */
+        assign: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationParams>;
+            body: import("@owlmeans/entrypoint").Typed<IamRuntimeGrantRequest>;
+        }>, IamRuntimeGrant>;
+        /** Owner. */
+        revoke: EntrypointProtocol<import("@owlmeans/entrypoint").RequestFromSources<{
+            params: import("@owlmeans/entrypoint").Typed<IamRuntimeOrganizationParams>;
+            body: import("@owlmeans/entrypoint").Typed<IamRuntimeGrantRequest>;
+        }>, IamRuntimeAck>;
+    }>;
+}>;
+/**
+ * Declare the runtime IAM API — the provider-side surface a tenanted client's server calls on behalf
+ * of its signed-in subject: the subject's organizations, their members, the grantable definitions
+ * and the grants inside one organization.
+ *
+ * Every leaf hangs under ONE base carrying `IAM_RUNTIME_GUARD`, so none can be reached without the
+ * provider's own access token; the caller's client and account come from that token, the
+ * organization from the path. Owner/member checks, the tenancy-config gate and the write rules are
+ * the serving process's — a declaration decides nothing.
+ */
+export declare const makeIamRuntimeProtocols: (opts: IamRuntimeProtocolOptions) => IamRuntimeProtocols;
+export {};
+//# sourceMappingURL=runtime.d.ts.map

package/build/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,KAAK,kBAAkB,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAIzI,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAA;AAY9b,MAAM,MAAM,mBAAmB,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAA;AAEnE,QAAA,MAAM,cAAc,SAAU,yBAAyB;;;QAejD,0CAA0C;;QAK1C,sEAAsE;;;;QAQtE,aAAa;;;;;;;QAWb,cAAc;;;;QAQd,mDAAmD;;;;;QAQnD,aAAa;;;;;QAQb,mCAAmC;;;;;;QAWnC,cAAc;;;;;;QAWd,aAAa;;;;;QAQb,aAAa;;;;;QAQb,aAAa;;;;;;EAUlB,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,SAAU,yBAAyB,KAAG,mBAA2C,CAAA"}

package/build/runtime.js

@@ -0,0 +1,75 @@
+import { contract, openProtocol, protocol, typed } from '@owlmeans/entrypoint';
+import { backend, route, RouteMethod } from '@owlmeans/route';
+import { IAM_RUNTIME_GUARD, IAM_RUNTIME_PATH, IAM_RUNTIME_ROUTES, IamRuntimeAckSchema, IamRuntimeGrantQuerySchema, IamRuntimeMemberInviteSchema, IamRuntimeMemberParamsSchema, IamRuntimeOrganizationCreateSchema, IamRuntimeOrganizationParamsSchema, IamRuntimeOrganizationUpdateSchema } from './consts.js';
+import { aliases } from './consts.local.js';
+import { IamRuntimeOrganizationSchema, IamRuntimeOrganizationListSchema, IamRuntimeMemberSchema, IamRuntimeMemberListSchema, IamRuntimeMemberUpdateSchema, IamRuntimePermissionListSchema, IamRuntimeGrantSchema, IamRuntimeGrantListSchema, IamRuntimeGrantRequestSchema } from './schemas.js';
+const declareRuntime = (opts) => {
+    const { service } = opts;
+    const base = openProtocol(route(aliases.base, opts.path ?? IAM_RUNTIME_PATH, backend({ service })), { guards: IAM_RUNTIME_GUARD });
+    // A route's service is never inherited from its parent, so each leaf names it too: a leaf left
+    // unpinned would be mounted by every process that happens to bind the tree.
+    const leaf = (alias, path, method) => route(alias, path, backend({ parent: base, service }, method));
+    return Object.freeze({
+        base,
+        organizations: Object.freeze({
+            /** Any subject: its own organizations. */
+            list: protocol(leaf(aliases.organization.list, IAM_RUNTIME_ROUTES.organizations, RouteMethod.GET), contract(typed(IamRuntimeOrganizationListSchema))),
+            /** Any subject of a tenanted client; the caller becomes its owner. */
+            create: protocol(leaf(aliases.organization.create, IAM_RUNTIME_ROUTES.organizations, RouteMethod.POST), contract.request({ body: typed(IamRuntimeOrganizationCreateSchema) }, typed(IamRuntimeOrganizationSchema))),
+            /** Owner. */
+            update: protocol(leaf(aliases.organization.update, IAM_RUNTIME_ROUTES.organization, RouteMethod.POST), contract.request({
+                params: typed(IamRuntimeOrganizationParamsSchema),
+                body: typed(IamRuntimeOrganizationUpdateSchema),
+            }, typed(IamRuntimeOrganizationSchema))),
+        }),
+        members: Object.freeze({
+            /** Member. */
+            list: protocol(leaf(aliases.member.list, IAM_RUNTIME_ROUTES.members, RouteMethod.GET), contract.request({ params: typed(IamRuntimeOrganizationParamsSchema) }, typed(IamRuntimeMemberListSchema))),
+            /** Owner. Find-or-create by e-mail, idempotent. */
+            add: protocol(leaf(aliases.member.add, IAM_RUNTIME_ROUTES.members, RouteMethod.POST), contract.request({
+                params: typed(IamRuntimeOrganizationParamsSchema),
+                body: typed(IamRuntimeMemberInviteSchema),
+            }, typed(IamRuntimeMemberSchema))),
+            /** Owner. */
+            update: protocol(leaf(aliases.member.update, IAM_RUNTIME_ROUTES.member, RouteMethod.POST), contract.request({
+                params: typed(IamRuntimeMemberParamsSchema),
+                body: typed(IamRuntimeMemberUpdateSchema),
+            }, typed(IamRuntimeMemberSchema))),
+            /** Owner, or the member itself. */
+            remove: protocol(leaf(aliases.member.remove, IAM_RUNTIME_ROUTES.memberRemove, RouteMethod.POST), contract.request({ params: typed(IamRuntimeMemberParamsSchema) }, typed(IamRuntimeAckSchema))),
+        }),
+        permissions: Object.freeze({
+            /** Member. */
+            list: protocol(leaf(aliases.permission.list, IAM_RUNTIME_ROUTES.permissions, RouteMethod.GET), contract.request({ params: typed(IamRuntimeOrganizationParamsSchema) }, typed(IamRuntimePermissionListSchema))),
+        }),
+        grants: Object.freeze({
+            /** Owner. */
+            list: protocol(leaf(aliases.grant.list, IAM_RUNTIME_ROUTES.grants, RouteMethod.GET), contract.request({
+                params: typed(IamRuntimeOrganizationParamsSchema),
+                query: typed(IamRuntimeGrantQuerySchema),
+            }, typed(IamRuntimeGrantListSchema))),
+            /** Owner. */
+            assign: protocol(leaf(aliases.grant.assign, IAM_RUNTIME_ROUTES.grants, RouteMethod.POST), contract.request({
+                params: typed(IamRuntimeOrganizationParamsSchema),
+                body: typed(IamRuntimeGrantRequestSchema),
+            }, typed(IamRuntimeGrantSchema))),
+            /** Owner. */
+            revoke: protocol(leaf(aliases.grant.revoke, IAM_RUNTIME_ROUTES.grantsRevoke, RouteMethod.POST), contract.request({
+                params: typed(IamRuntimeOrganizationParamsSchema),
+                body: typed(IamRuntimeGrantRequestSchema),
+            }, typed(IamRuntimeAckSchema))),
+        }),
+    });
+};
+/**
+ * Declare the runtime IAM API — the provider-side surface a tenanted client's server calls on behalf
+ * of its signed-in subject: the subject's organizations, their members, the grantable definitions
+ * and the grants inside one organization.
+ *
+ * Every leaf hangs under ONE base carrying `IAM_RUNTIME_GUARD`, so none can be reached without the
+ * provider's own access token; the caller's client and account come from that token, the
+ * organization from the path. Owner/member checks, the tenancy-config gate and the write rules are
+ * the serving process's — a declaration decides nothing.
+ */
+export const makeIamRuntimeProtocols = (opts) => declareRuntime(opts);
+//# sourceMappingURL=runtime.js.map

package/build/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAA6D,MAAM,sBAAsB,CAAA;AACzI,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7D,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,4BAA4B,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,kCAAkC,EAAE,MAAM,aAAa,CAAA;AAC9S,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAA;AAE3C,OAAO,EAAE,4BAA4B,EAAE,gCAAgC,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,8BAA8B,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,4BAA4B,EAAE,MAAM,cAAc,CAAA;AAa/R,MAAM,cAAc,GAAG,CAAC,IAA+B,EAAE,EAAE;IACzD,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;IACxB,MAAM,IAAI,GAA+C,YAAY,CACnE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,gBAAgB,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,EACxE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B,CAAA;IACD,+FAA+F;IAC/F,4EAA4E;IAC5E,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,IAAY,EAAE,MAAmB,EAAE,EAAE,CAChE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;IAEhE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QAEJ,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC;YAC3B,0CAA0C;YAC1C,IAAI,EAAE,QAAQ,CACZ,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,EAClF,QAAQ,CAAC,KAAK,CAA6B,gCAAgC,CAAC,CAAC,CAC9E;YACD,sEAAsE;YACtE,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,EACrF,QAAQ,CAAC,OAAO,CACd,EAAE,IAAI,EAAE,KAAK,CAA+B,kCAAkC,CAAC,EAAE,EACjF,KAAK,CAAyB,4BAA4B,CAAC,CAC5D,CACF;YACD,aAAa;YACb,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EACpF,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC;gBAC/E,IAAI,EAAE,KAAK,CAA+B,kCAAkC,CAAC;aAC9E,EAAE,KAAK,CAAyB,4BAA4B,CAAC,CAAC,CAChE;SACF,CAAC;QAEF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,cAAc;YACd,IAAI,EAAE,QAAQ,CACZ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,EACtE,QAAQ,CAAC,OAAO,CACd,EAAE,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC,EAAE,EACnF,KAAK,CAAuB,0BAA0B,CAAC,CACxD,CACF;YACD,mDAAmD;YACnD,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,kBAAkB,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,CAAC,EACtE,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC;gBAC/E,IAAI,EAAE,KAAK,CAAyB,4BAA4B,CAAC;aAClE,EAAE,KAAK,CAAmB,sBAAsB,CAAC,CAAC,CACpD;YACD,aAAa;YACb,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EACxE,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAAyB,4BAA4B,CAAC;gBACnE,IAAI,EAAE,KAAK,CAAyB,4BAA4B,CAAC;aAClE,EAAE,KAAK,CAAmB,sBAAsB,CAAC,CAAC,CACpD;YACD,mCAAmC;YACnC,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EAC9E,QAAQ,CAAC,OAAO,CACd,EAAE,MAAM,EAAE,KAAK,CAAyB,4BAA4B,CAAC,EAAE,EACvE,KAAK,CAAgB,mBAAmB,CAAC,CAC1C,CACF;SACF,CAAC;QAEF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,cAAc;YACd,IAAI,EAAE,QAAQ,CACZ,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,EAC9E,QAAQ,CAAC,OAAO,CACd,EAAE,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC,EAAE,EACnF,KAAK,CAA2B,8BAA8B,CAAC,CAChE,CACF;SACF,CAAC;QAEF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,aAAa;YACb,IAAI,EAAE,QAAQ,CACZ,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,EACpE,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC;gBAC/E,KAAK,EAAE,KAAK,CAAuB,0BAA0B,CAAC;aAC/D,EAAE,KAAK,CAAsB,yBAAyB,CAAC,CAAC,CAC1D;YACD,aAAa;YACb,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EACvE,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC;gBAC/E,IAAI,EAAE,KAAK,CAAyB,4BAA4B,CAAC;aAClE,EAAE,KAAK,CAAkB,qBAAqB,CAAC,CAAC,CAClD;YACD,aAAa;YACb,MAAM,EAAE,QAAQ,CACd,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,CAAC,EAC7E,QAAQ,CAAC,OAAO,CAAC;gBACf,MAAM,EAAE,KAAK,CAA+B,kCAAkC,CAAC;gBAC/E,IAAI,EAAE,KAAK,CAAyB,4BAA4B,CAAC;aAClE,EAAE,KAAK,CAAgB,mBAAmB,CAAC,CAAC,CAC9C;SACF,CAAC;KACH,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAA+B,EAAuB,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA"}

package/build/schemas.d.ts

@@ -0,0 +1,13 @@
+import type { JSONSchemaType } from 'ajv';
+import type { IamRuntimeGrant, IamRuntimeGrantList, IamRuntimeGrantRequest, IamRuntimeMember, IamRuntimeMemberList, IamRuntimeMemberUpdate, IamRuntimeOrganization, IamRuntimeOrganizationList, IamRuntimePermission, IamRuntimePermissionList } from './runtime/types.js';
+export declare const IamRuntimeOrganizationSchema: JSONSchemaType<IamRuntimeOrganization>;
+export declare const IamRuntimeOrganizationListSchema: JSONSchemaType<IamRuntimeOrganizationList>;
+export declare const IamRuntimeMemberSchema: JSONSchemaType<IamRuntimeMember>;
+export declare const IamRuntimeMemberListSchema: JSONSchemaType<IamRuntimeMemberList>;
+export declare const IamRuntimeMemberUpdateSchema: JSONSchemaType<IamRuntimeMemberUpdate>;
+export declare const IamRuntimePermissionSchema: JSONSchemaType<IamRuntimePermission>;
+export declare const IamRuntimePermissionListSchema: JSONSchemaType<IamRuntimePermissionList>;
+export declare const IamRuntimeGrantSchema: JSONSchemaType<IamRuntimeGrant>;
+export declare const IamRuntimeGrantListSchema: JSONSchemaType<IamRuntimeGrantList>;
+export declare const IamRuntimeGrantRequestSchema: JSONSchemaType<IamRuntimeGrantRequest>;
+//# sourceMappingURL=schemas.d.ts.map

package/build/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,KAAK,CAAA;AAGzC,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAA;AAc1Q,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAW/E,CAAA;AAED,eAAO,MAAM,gCAAgC,EAAE,cAAc,CAAC,0BAA0B,CAKvF,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAE,cAAc,CAAC,gBAAgB,CAYnE,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAK3E,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAQ/E,CAAA;AAED,eAAO,MAAM,0BAA0B,EAAE,cAAc,CAAC,oBAAoB,CAY3E,CAAA;AAED,eAAO,MAAM,8BAA8B,EAAE,cAAc,CAAC,wBAAwB,CAKnF,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,cAAc,CAAC,eAAe,CAYjE,CAAA;AAED,eAAO,MAAM,yBAAyB,EAAE,cAAc,CAAC,mBAAmB,CAKzE,CAAA;AAED,eAAO,MAAM,4BAA4B,EAAE,cAAc,CAAC,sBAAsB,CAU/E,CAAA"}

package/build/schemas.js

@@ -0,0 +1,108 @@
+import { EntitySlugValueSchema, GroupValueSchema } from '@owlmeans/auth';
+import { IamDefaultClass, IamGrantMode, IamGrantOrigin } from './consts.js';
+import { EmailSchema, PermissionNameSchema, ProfileIdSchema, ResourcesSchema, TitleSchema } from './consts.local.js';
+// ---------------------------------------------------------------------------------------------
+// Wire shapes. Organizations travel by `entitySlug` only; a subject is the CALLING client's
+// pairwise `profileId`. Neither an organization id nor an account id ever appears here.
+// ---------------------------------------------------------------------------------------------
+// ---------------------------------------------------------------------------------------------
+// Schemas — closed throughout: the server's AJV strips an undeclared key silently, so a field a
+// caller sends and the schema omits would vanish without an error.
+// ---------------------------------------------------------------------------------------------
+const GroupsSchema = { type: 'array', items: { ...GroupValueSchema }, maxItems: 64 };
+export const IamRuntimeOrganizationSchema = {
+    type: 'object',
+    properties: {
+        entitySlug: { ...EntitySlugValueSchema },
+        title: { ...TitleSchema, nullable: true },
+        owner: { type: 'boolean' },
+        groups: { ...GroupsSchema, nullable: true },
+        home: { type: 'boolean', nullable: true },
+    },
+    required: ['entitySlug', 'owner'],
+    additionalProperties: false,
+};
+export const IamRuntimeOrganizationListSchema = {
+    type: 'object',
+    properties: { items: { type: 'array', items: IamRuntimeOrganizationSchema } },
+    required: ['items'],
+    additionalProperties: false,
+};
+export const IamRuntimeMemberSchema = {
+    type: 'object',
+    properties: {
+        profileId: { ...ProfileIdSchema },
+        email: { ...EmailSchema, nullable: true },
+        name: { ...TitleSchema, nullable: true },
+        owner: { type: 'boolean' },
+        groups: { ...GroupsSchema },
+        managed: { type: 'boolean', nullable: true },
+    },
+    required: ['profileId', 'owner', 'groups'],
+    additionalProperties: false,
+};
+export const IamRuntimeMemberListSchema = {
+    type: 'object',
+    properties: { items: { type: 'array', items: IamRuntimeMemberSchema } },
+    required: ['items'],
+    additionalProperties: false,
+};
+export const IamRuntimeMemberUpdateSchema = {
+    type: 'object',
+    properties: {
+        owner: { type: 'boolean', nullable: true },
+        groups: { ...GroupsSchema, nullable: true },
+    },
+    required: [],
+    additionalProperties: false,
+};
+export const IamRuntimePermissionSchema = {
+    type: 'object',
+    properties: {
+        name: { ...PermissionNameSchema },
+        title: { ...TitleSchema, nullable: true },
+        area: { type: 'string', minLength: 1, maxLength: 64, nullable: true },
+        resourceScoped: { type: 'boolean', nullable: true },
+        managed: { type: 'boolean', nullable: true },
+        defaultClass: { type: 'string', enum: Object.values(IamDefaultClass), nullable: true },
+    },
+    required: ['name'],
+    additionalProperties: false,
+};
+export const IamRuntimePermissionListSchema = {
+    type: 'object',
+    properties: { items: { type: 'array', items: IamRuntimePermissionSchema } },
+    required: ['items'],
+    additionalProperties: false,
+};
+export const IamRuntimeGrantSchema = {
+    type: 'object',
+    properties: {
+        profileId: { ...ProfileIdSchema },
+        permission: { ...PermissionNameSchema },
+        resources: { ...ResourcesSchema },
+        mode: { type: 'string', enum: Object.values(IamGrantMode), nullable: true },
+        origin: { type: 'string', enum: Object.values(IamGrantOrigin), nullable: true },
+        through: { ...GroupValueSchema, nullable: true },
+    },
+    required: ['profileId', 'permission'],
+    additionalProperties: false,
+};
+export const IamRuntimeGrantListSchema = {
+    type: 'object',
+    properties: { items: { type: 'array', items: IamRuntimeGrantSchema } },
+    required: ['items'],
+    additionalProperties: false,
+};
+export const IamRuntimeGrantRequestSchema = {
+    type: 'object',
+    properties: {
+        profileId: { ...ProfileIdSchema },
+        permission: { ...PermissionNameSchema },
+        resources: { ...ResourcesSchema },
+        mode: { type: 'string', enum: Object.values(IamGrantMode), nullable: true },
+    },
+    required: ['profileId', 'permission'],
+    additionalProperties: false,
+};
+//# sourceMappingURL=schemas.js.map

package/build/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../src/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA;AAExE,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpH,gGAAgG;AAChG,4FAA4F;AAC5F,wFAAwF;AACxF,gGAAgG;AAEhG,gGAAgG;AAChG,gGAAgG;AAChG,mEAAmE;AACnE,gGAAgG;AAEhG,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAW,CAAA;AAE7F,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE,EAAE,GAAG,qBAAqB,EAAE;QACxC,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3C,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1C;IACD,QAAQ,EAAE,CAAC,YAAY,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,gCAAgC,GAA+C;IAC1F,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,EAAE;IAC7E,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAqC;IACtE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;QACjC,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACxC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;QAC1B,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE;QAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC7C;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC;IAC1C,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,EAAE,EAAE;IACvE,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC1C,MAAM,EAAE,EAAE,GAAG,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5C;IACD,QAAQ,EAAE,EAAE;IACZ,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,0BAA0B,GAAyC;IAC9E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,IAAI,EAAE,EAAE,GAAG,oBAAoB,EAAE;QACjC,KAAK,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE;QACzC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;QACrE,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QACnD,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5C,YAAY,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;KACvF;IACD,QAAQ,EAAE,CAAC,MAAM,CAAC;IAClB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,8BAA8B,GAA6C;IACtF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE;IAC3E,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAoC;IACpE,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;QACjC,UAAU,EAAE,EAAE,GAAG,oBAAoB,EAAE;QACvC,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC/E,OAAO,EAAE,EAAE,GAAG,gBAAgB,EAAE,QAAQ,EAAE,IAAI,EAAE;KACjD;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IACrC,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAwC;IAC5E,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE;IACtE,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,oBAAoB,EAAE,KAAK;CAC5B,CAAA;AAED,MAAM,CAAC,MAAM,4BAA4B,GAA2C;IAClF,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;QACjC,UAAU,EAAE,EAAE,GAAG,oBAAoB,EAAE;QACvC,SAAS,EAAE,EAAE,GAAG,eAAe,EAAE;QACjC,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5E;IACD,QAAQ,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;IACrC,oBAAoB,EAAE,KAAK;CAC5B,CAAA"}