@platecms/delta-types 1.16.1 → 1.18.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platecms/delta-types",
-  "version": "1.16.1",
+  "version": "1.18.0",
   "description": "This package contains various utility types.",
   "license": "UNLICENSED",
   "publishConfig": {
@@ -17,8 +17,8 @@
     "src/**/*"
   ],
   "peerDependencies": {
-    "@platecms/delta-cast": "1.16.1",
-    "@platecms/delta-plate-resource-notation": "1.16.1",
+    "@platecms/delta-cast": "1.18.0",
+    "@platecms/delta-plate-resource-notation": "1.18.0",
     "class-transformer": "0.5.1",
     "reflect-metadata": "0.2.2",
     "tslib": "2.8.1"

package/src/index.ts

@@ -4,7 +4,7 @@ export * from "./lib/content-value-type.type";
 export * from "./lib/primitive.type";
 export * from "./lib/stage.enum";
 export * from "./lib/header-keys.enum";
-export * from "./lib/action-type.enum";
+export * from "./lib/permissions.type";
 export * from "./lib/processed-asset-options.interface";
 export * from "./lib/language-status.enum";
 export type * from "./lib/language-option.interface";

package/src/lib/permissions.type.spec.ts

@@ -0,0 +1,524 @@
+import {
+  PRESET_PERMISSION_SETS,
+  PermissionAction,
+  PermissionResource,
+  Permissions,
+  compactPermissions,
+  getMissingPermissions,
+  hasPermissions,
+  isValidPermissions,
+  mergePermissions,
+} from "./permissions.type";
+
+describe("isValidPermissions", () => {
+  const unknownResource = "PlateMaintainer";
+
+  it.each([
+    { description: "null", value: null },
+    { description: "undefined", value: undefined },
+    { description: "boolean", value: true },
+    { description: "number", value: 1 },
+    { description: "string", value: "x" },
+    { description: "array", value: [] },
+    { description: "empty object", value: {} },
+    {
+      description: "only explicit false grants",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: false,
+        },
+      },
+    },
+    {
+      description: "resource with empty actions object",
+      value: {
+        [PermissionResource.CHANNEL]: {},
+      },
+    },
+    {
+      description: "invalid resource key",
+      value: { [unknownResource]: { read: true } },
+    },
+    {
+      description: "resource value is null",
+      value: { [PermissionResource.CHANNEL]: null },
+    },
+    {
+      description: "resource value is a string",
+      value: { [PermissionResource.CHANNEL]: "read" },
+    },
+    {
+      description: "resource value is a number",
+      value: { [PermissionResource.CHANNEL]: 1 },
+    },
+    {
+      description: "resource value is a boolean",
+      value: { [PermissionResource.CHANNEL]: true },
+    },
+    {
+      description: "resource value is an array",
+      value: { [PermissionResource.CHANNEL]: ["read"] },
+    },
+    {
+      description: "action not allowed on resource",
+      value: {
+        [PermissionResource.ORGANIZATION]: {
+          [PermissionAction.CREATE]: true,
+        },
+      },
+    },
+    {
+      description: "unknown action key",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          notAnAction: true,
+        },
+      },
+    },
+    {
+      description: "unknown resource key alongside a valid grant",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+        [unknownResource]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "unknown action key alongside a valid grant",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+          notAnAction: true,
+        },
+      },
+    },
+    {
+      description: "grant value is a string",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: "yes",
+        },
+      },
+    },
+    {
+      description: "grant value is a number",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: 1,
+        },
+      },
+    },
+    {
+      description: "grant value is null",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: null,
+        },
+      },
+    },
+    {
+      description: "grant value is undefined",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: undefined,
+        },
+      },
+    },
+    {
+      description: "grant value is an object",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: {},
+        },
+      },
+    },
+  ])("returns false for $description", ({ value }) => {
+    // Act & Assert
+    expect(isValidPermissions(value)).toBe(false);
+  });
+
+  it.each([
+    {
+      description: "mixed true and false grants across resources",
+      value: {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: false,
+        },
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: false,
+        },
+      },
+    },
+    {
+      description: "true grant after earlier all-false resource",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: false,
+        },
+        [PermissionResource.ROLE]: {
+          [PermissionAction.CREATE]: true,
+        },
+      },
+    },
+    {
+      description: "organization read and update",
+      value: {
+        [PermissionResource.ORGANIZATION]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: true,
+        },
+      },
+    },
+    {
+      description: "true grant with null sibling actions",
+      value: {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: null,
+          [PermissionAction.CREATE]: undefined,
+        },
+      },
+    },
+  ])("returns true for $description", ({ value }) => {
+    // Act & Assert
+    expect(isValidPermissions(value)).toBe(true);
+  });
+});
+
+describe("mergePermissions", () => {
+  it.each([
+    {
+      description: "no inputs",
+      inputs: [] as Parameters<typeof mergePermissions>,
+      expected: {},
+    },
+    {
+      description: "empty permission objects",
+      inputs: [{}, {}],
+      expected: {},
+    },
+    {
+      description: "null and undefined resource actions are skipped",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: null,
+          [PermissionResource.ROLE]: undefined,
+        },
+      ],
+      expected: {},
+    },
+    {
+      description: "false grants are ignored",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: false,
+            [PermissionAction.CREATE]: false,
+          },
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {},
+      },
+    },
+    {
+      description: "empty actions object is kept as empty resource map",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {},
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {},
+      },
+    },
+    {
+      description: "true grants are kept",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: true,
+          },
+          [PermissionResource.ROLE]: {
+            [PermissionAction.CREATE]: true,
+          },
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+        [PermissionResource.ROLE]: {
+          [PermissionAction.CREATE]: true,
+        },
+      },
+    },
+    {
+      description: "OR-merges true grants across inputs",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: true,
+          },
+        },
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.UPDATE]: true,
+          },
+          [PermissionResource.ROLE]: {
+            [PermissionAction.READ]: true,
+          },
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: true,
+        },
+        [PermissionResource.ROLE]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "later false does not clear an earlier true",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: true,
+          },
+        },
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: false,
+          },
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "earlier false then later true results in true",
+      inputs: [
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: false,
+          },
+        },
+        {
+          [PermissionResource.CHANNEL]: {
+            [PermissionAction.READ]: true,
+          },
+        },
+      ],
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+  ])("returns expected result for $description", ({ inputs, expected }) => {
+    // Act
+    const result = mergePermissions(...(inputs as Permissions[]));
+
+    // Assert
+    expect(result).toEqual(expected);
+  });
+});
+
+describe("getMissingPermissions", () => {
+  it("returns only requested true grants that are unavailable", () => {
+    // Arrange
+    const availablePermissions: Permissions = {
+      [PermissionResource.CONTENT_ITEM]: {
+        [PermissionAction.READ]: true,
+      },
+    };
+    const permissions: Permissions = {
+      [PermissionResource.CONTENT_ITEM]: {
+        [PermissionAction.READ]: true,
+        [PermissionAction.UPDATE]: true,
+        [PermissionAction.REMOVE]: false,
+      },
+      [PermissionResource.TAG]: {
+        [PermissionAction.READ]: true,
+      },
+    };
+
+    // Act
+    const result = getMissingPermissions(availablePermissions, permissions);
+
+    // Assert
+    expect(result).toStrictEqual({
+      [PermissionResource.CONTENT_ITEM]: {
+        [PermissionAction.UPDATE]: true,
+      },
+      [PermissionResource.TAG]: {
+        [PermissionAction.READ]: true,
+      },
+    });
+  });
+});
+
+describe("hasPermissions", () => {
+  it("returns true when all requested grants are available", () => {
+    // Act & Assert
+    expect(
+      hasPermissions(PRESET_PERMISSION_SETS.contentEditor, {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.READ]: true,
+        },
+      }),
+    ).toBe(true);
+  });
+
+  it("returns false when a requested grant is unavailable", () => {
+    // Act & Assert
+    expect(
+      hasPermissions(PRESET_PERMISSION_SETS.contentViewer, {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.UPDATE]: true,
+        },
+      }),
+    ).toBe(false);
+  });
+});
+
+describe("compactPermissions", () => {
+  it.each([
+    {
+      description: "empty object",
+      value: {},
+      expected: {},
+    },
+    {
+      description: "already compact true grants",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "false grants are omitted",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: false,
+        },
+      },
+      expected: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "null and undefined grants are omitted",
+      value: {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.READ]: true,
+          [PermissionAction.UPDATE]: null,
+          [PermissionAction.CREATE]: undefined,
+        },
+      },
+      expected: {
+        [PermissionResource.CONTENT_ITEM]: {
+          [PermissionAction.READ]: true,
+        },
+      },
+    },
+    {
+      description: "resource with only false grants is omitted",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: false,
+          [PermissionAction.CREATE]: false,
+        },
+      },
+      expected: {},
+    },
+    {
+      description: "empty actions object is omitted",
+      value: {
+        [PermissionResource.CHANNEL]: {},
+      },
+      expected: {},
+    },
+    {
+      description: "null and undefined resource actions are omitted",
+      value: {
+        [PermissionResource.CHANNEL]: null,
+        [PermissionResource.ROLE]: undefined,
+      },
+      expected: {},
+    },
+    {
+      description: "empty resources are omitted next to compact grants",
+      value: {
+        [PermissionResource.CHANNEL]: {
+          [PermissionAction.READ]: false,
+        },
+        [PermissionResource.ROLE]: {
+          [PermissionAction.CREATE]: true,
+        },
+        [PermissionResource.ORGANIZATION]: {},
+      },
+      expected: {
+        [PermissionResource.ROLE]: {
+          [PermissionAction.CREATE]: true,
+        },
+      },
+    },
+  ])("returns expected result for $description", ({ value, expected }) => {
+    // Act
+    const result = compactPermissions(value as Permissions);
+
+    // Assert
+    expect(result).toEqual(expected);
+  });
+
+  it("does not mutate the input object", () => {
+    // Arrange
+    const value = {
+      [PermissionResource.CHANNEL]: {
+        [PermissionAction.READ]: true,
+        [PermissionAction.UPDATE]: false,
+      },
+      [PermissionResource.ROLE]: {
+        [PermissionAction.CREATE]: false,
+      },
+    };
+
+    // Act
+    const result = compactPermissions(value);
+
+    // Assert
+    expect(result).toEqual({
+      [PermissionResource.CHANNEL]: {
+        [PermissionAction.READ]: true,
+      },
+    });
+    expect(value).toEqual({
+      [PermissionResource.CHANNEL]: {
+        [PermissionAction.READ]: true,
+        [PermissionAction.UPDATE]: false,
+      },
+      [PermissionResource.ROLE]: {
+        [PermissionAction.CREATE]: false,
+      },
+    });
+  });
+});

package/src/lib/permissions.type.ts

@@ -0,0 +1,698 @@
+/**
+ * Resources that can appear in a permission grant.
+ * String values match GraphQL / OPA resource type names (e.g. `"ContentItem"`).
+ */
+export enum PermissionResource {
+  CONTENT_TYPE = "ContentType",
+  CONTENT_ITEM = "ContentItem",
+  CONTENT_VALUE = "ContentValue",
+  ASSET = "Asset",
+  TAG = "Tag",
+  CONTENT_EXPERIENCE = "ContentExperience",
+  EXPERIENCE_COMPONENT = "ExperienceComponent",
+  BUILDING_BLOCK = "BuildingBlock",
+  BUILDING_BLOCK_FIELD = "BuildingBlockField",
+  BUILDING_BLOCK_FIELD_FULFILLMENT = "BuildingBlockFieldFulfillment",
+  PATH_PART = "PathPart",
+  CONTENT_FIELD = "ContentField",
+  CHANNEL = "Channel",
+  THEME = "Theme",
+  TEMPLATE = "Template",
+  BLUEPRINT = "Blueprint",
+  GRID = "Grid",
+  GRID_DEFINITION = "GridDefinition",
+  GRID_PLACEMENT = "GridPlacement",
+  ORGANIZATION = "Organization",
+  ROLE = "Role",
+  ROLE_ASSIGNMENT = "RoleAssignment",
+  INVITATION = "Invitation",
+  API_TOKEN = "ApiToken",
+  LANGUAGE = "Language",
+  ISSUE = "Issue",
+  PUBLICATION = "Publication",
+  CONTENT_VALIDATION_RULE = "ContentValidationRule",
+  SCHEDULED_PUBLICATION = "ScheduledPublication",
+}
+
+/**
+ * Resources that OPA authorizes but a Role cannot grant.
+ * @remarks Deliberately kept out of {@link PermissionResource}: these are application-level and decided by the OPA
+ * policy, so they must never appear in a Role's {@link Permissions}.
+ */
+export enum AuthorizationOnlyResource {
+  PLATE_MAINTAINER = "PlateMaintainer",
+}
+
+/**
+ * Every resource that can be sent to OPA as `input.resource.type`.
+ */
+export type AuthorizationResource = AuthorizationOnlyResource | PermissionResource;
+
+/**
+ * Actions that can be granted on a {@link PermissionResource}.
+ * String values are what we send to OPA as `input.action` (e.g. `"read"`).
+ * @remarks Not every action applies to every resource — see {@link RESOURCE_ACTIONS}.
+ */
+export enum PermissionAction {
+  READ = "read",
+  CREATE = "create",
+  UPDATE = "update",
+  REMOVE = "remove",
+}
+
+const CRUD_ACTIONS = [
+  PermissionAction.READ,
+  PermissionAction.CREATE,
+  PermissionAction.UPDATE,
+  PermissionAction.REMOVE,
+] as const;
+
+/**
+ * Catalog of which actions exist per resource.
+ * Keep this the single source of truth when adding resources or actions.
+ * @remarks This is applicability, not grants. Grants are {@link Permissions} objects.
+ * @example
+ * ```ts
+ * RESOURCE_ACTIONS[PermissionResource.CONTENT_ITEM] // ["read", "create", "update", "remove"]
+ * RESOURCE_ACTIONS[PermissionResource.ORGANIZATION] // ["read", "update"]
+ * ```
+ */
+export const RESOURCE_ACTIONS: Record<PermissionResource, readonly PermissionAction[]> = {
+  [PermissionResource.CONTENT_TYPE]: CRUD_ACTIONS,
+  [PermissionResource.CONTENT_ITEM]: CRUD_ACTIONS,
+  [PermissionResource.CONTENT_VALUE]: CRUD_ACTIONS,
+  [PermissionResource.ASSET]: CRUD_ACTIONS,
+  [PermissionResource.TAG]: CRUD_ACTIONS,
+  [PermissionResource.CONTENT_EXPERIENCE]: CRUD_ACTIONS,
+  [PermissionResource.EXPERIENCE_COMPONENT]: CRUD_ACTIONS,
+  [PermissionResource.BUILDING_BLOCK]: CRUD_ACTIONS,
+  [PermissionResource.BUILDING_BLOCK_FIELD]: CRUD_ACTIONS,
+  [PermissionResource.BUILDING_BLOCK_FIELD_FULFILLMENT]: CRUD_ACTIONS,
+  [PermissionResource.PATH_PART]: CRUD_ACTIONS,
+  [PermissionResource.CONTENT_FIELD]: CRUD_ACTIONS,
+  [PermissionResource.CHANNEL]: CRUD_ACTIONS,
+  [PermissionResource.THEME]: CRUD_ACTIONS,
+  [PermissionResource.TEMPLATE]: CRUD_ACTIONS,
+  [PermissionResource.BLUEPRINT]: CRUD_ACTIONS,
+  [PermissionResource.GRID]: CRUD_ACTIONS,
+  [PermissionResource.GRID_DEFINITION]: CRUD_ACTIONS,
+  [PermissionResource.GRID_PLACEMENT]: CRUD_ACTIONS,
+  [PermissionResource.ORGANIZATION]: [PermissionAction.READ, PermissionAction.UPDATE],
+  [PermissionResource.ROLE]: CRUD_ACTIONS,
+  [PermissionResource.ROLE_ASSIGNMENT]: [PermissionAction.READ, PermissionAction.CREATE, PermissionAction.REMOVE],
+  [PermissionResource.INVITATION]: [PermissionAction.READ, PermissionAction.CREATE, PermissionAction.REMOVE],
+  [PermissionResource.API_TOKEN]: CRUD_ACTIONS,
+  [PermissionResource.LANGUAGE]: CRUD_ACTIONS,
+  [PermissionResource.ISSUE]: CRUD_ACTIONS,
+  [PermissionResource.PUBLICATION]: [PermissionAction.READ, PermissionAction.CREATE, PermissionAction.REMOVE],
+  [PermissionResource.CONTENT_VALIDATION_RULE]: CRUD_ACTIONS,
+  [PermissionResource.SCHEDULED_PUBLICATION]: CRUD_ACTIONS,
+} as const satisfies Record<PermissionResource, readonly PermissionAction[]>;
+
+/**
+ * Actions allowed for a specific resource according to {@link RESOURCE_ACTIONS}.
+ * @remarks An {@link AuthorizationOnlyResource} has no entry there, so every action applies — which ones are
+ * actually permitted is up to the OPA policy.
+ */
+export type ActionForResource<TResource extends AuthorizationResource> = TResource extends PermissionResource
+  ? (typeof RESOURCE_ACTIONS)[TResource][number]
+  : PermissionAction;
+
+/**
+ * Nested grant map keyed by {@link PermissionResource}, then action.
+ * @remarks Additive only — missing keys or `false` means not granted. There is no explicit deny.
+ * @example
+ * ```ts
+ * const permissions: Permissions = {
+ *   [PermissionResource.CONTENT_ITEM]: {
+ *     [PermissionAction.READ]: true,
+ *     [PermissionAction.UPDATE]: true,
+ *   },
+ * };
+ * ```
+ */
+export type Permissions = {
+  [TResource in PermissionResource]?: Partial<Record<ActionForResource<TResource>, boolean>>;
+};
+
+/**
+ * A single resource + action check (e.g. for `@AuthorizationOptions` / OPA input).
+ */
+export interface AuthorizationCheck<TResource extends PermissionResource = PermissionResource> {
+  resource: TResource;
+  action: ActionForResource<TResource>;
+}
+
+export const PERMISSION_RESOURCES = new Set<string>(Object.values(PermissionResource));
+
+export const AUTHORIZATION_RESOURCES = new Set<string>([
+  ...PERMISSION_RESOURCES,
+  ...Object.values(AuthorizationOnlyResource),
+]);
+
+export const PRESET_PERMISSION_SETS: Record<string, Permissions> = {
+  admin: {
+    [PermissionResource.CONTENT_TYPE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_ITEM]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_VALUE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ASSET]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.TAG]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_EXPERIENCE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.EXPERIENCE_COMPONENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD_FULFILLMENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.PATH_PART]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_FIELD]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CHANNEL]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.THEME]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.TEMPLATE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.BLUEPRINT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.GRID]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.GRID_DEFINITION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.GRID_PLACEMENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ORGANIZATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.UPDATE]: true,
+    },
+    [PermissionResource.ROLE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ROLE_ASSIGNMENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.INVITATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.API_TOKEN]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.LANGUAGE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ISSUE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.PUBLICATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.SCHEDULED_PUBLICATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_VALIDATION_RULE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+  },
+  contentEditor: {
+    [PermissionResource.CONTENT_TYPE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_ITEM]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_VALUE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ASSET]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.TAG]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_EXPERIENCE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.EXPERIENCE_COMPONENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD_FULFILLMENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.PATH_PART]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_FIELD]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CHANNEL]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.THEME]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.TEMPLATE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BLUEPRINT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.GRID]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.GRID_DEFINITION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.GRID_PLACEMENT]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.ORGANIZATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ROLE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ROLE_ASSIGNMENT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.INVITATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.API_TOKEN]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.LANGUAGE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ISSUE]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.PUBLICATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.SCHEDULED_PUBLICATION]: {
+      [PermissionAction.READ]: true,
+      [PermissionAction.CREATE]: true,
+      [PermissionAction.UPDATE]: true,
+      [PermissionAction.REMOVE]: true,
+    },
+    [PermissionResource.CONTENT_VALIDATION_RULE]: {
+      [PermissionAction.READ]: true,
+    },
+  },
+  contentViewer: {
+    [PermissionResource.CONTENT_TYPE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_ITEM]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_VALUE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ASSET]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.TAG]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_EXPERIENCE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.EXPERIENCE_COMPONENT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BUILDING_BLOCK_FIELD_FULFILLMENT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.PATH_PART]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_FIELD]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CHANNEL]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.THEME]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.TEMPLATE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.BLUEPRINT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.GRID]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.GRID_DEFINITION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.GRID_PLACEMENT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ORGANIZATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ROLE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ROLE_ASSIGNMENT]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.INVITATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.API_TOKEN]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.LANGUAGE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.ISSUE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.PUBLICATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.SCHEDULED_PUBLICATION]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_VALIDATION_RULE]: {
+      [PermissionAction.READ]: true,
+    },
+  },
+  cdaApiToken: {
+    [PermissionResource.CONTENT_EXPERIENCE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.CONTENT_ITEM]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.TAG]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.LANGUAGE]: {
+      [PermissionAction.READ]: true,
+    },
+    [PermissionResource.PATH_PART]: {
+      [PermissionAction.READ]: true,
+    },
+  },
+};
+
+/**
+ * Merges permissions with additive OR semantics.
+ * @remarks Missing or false entries never clear an existing true grant.
+ */
+export function mergePermissions(...permissionsList: Permissions[]): Permissions {
+  const result: Permissions = {};
+
+  for (const permissions of permissionsList) {
+    for (const [resource, actions] of Object.entries(permissions) as [
+      keyof Permissions,
+      Permissions[keyof Permissions],
+    ][]) {
+      if (actions == null) {
+        continue;
+      }
+
+      const mergedActions: Record<string, boolean> = {
+        ...(result[resource] as Record<string, boolean> | undefined),
+      };
+      for (const [action, granted] of Object.entries(actions)) {
+        if (granted === true) {
+          mergedActions[action] = true;
+        }
+      }
+      result[resource] = mergedActions as Permissions[keyof Permissions];
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Returns a copy of {@link permissions} containing only `true` grants.
+ */
+export function compactPermissions(permissions: Permissions): Permissions {
+  const result: Permissions = {};
+
+  for (const [resource, actions] of Object.entries(permissions) as [
+    keyof Permissions,
+    Permissions[keyof Permissions],
+  ][]) {
+    if (actions == null) {
+      continue;
+    }
+
+    const grantedActions: Record<string, true> = {};
+    for (const [action, granted] of Object.entries(actions)) {
+      if (granted === true) {
+        grantedActions[action] = true;
+      }
+    }
+
+    if (Object.keys(grantedActions).length > 0) {
+      result[resource] = grantedActions as Permissions[keyof Permissions];
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Whether {@link permissions} is a valid permissions object against {@link Permissions}.
+ * @remarks Requires at least one `true` grant. Unknown resources or actions are invalid.
+ */
+export function isValidPermissions(permissions: unknown): permissions is Permissions {
+  if (permissions === null || typeof permissions !== "object" || Array.isArray(permissions)) {
+    return false;
+  }
+
+  let hasGrantedPermission = false;
+
+  for (const [resource, actions] of Object.entries(permissions)) {
+    if (
+      !PERMISSION_RESOURCES.has(resource) ||
+      actions === null ||
+      typeof actions !== "object" ||
+      Array.isArray(actions)
+    ) {
+      return false;
+    }
+
+    const allowedActions = new Set<string>(RESOURCE_ACTIONS[resource as PermissionResource]);
+
+    for (const [action, granted] of Object.entries(actions as Record<string, unknown>)) {
+      if (!allowedActions.has(action)) {
+        return false;
+      }
+
+      if (granted === true) {
+        hasGrantedPermission = true;
+        continue;
+      }
+
+      if (granted !== false && granted != null) {
+        return false;
+      }
+    }
+  }
+
+  return hasGrantedPermission;
+}
+
+/**
+ * Returns the permissions from {@link permissions} that are not granted by {@link availablePermissions}.
+ */
+export function getMissingPermissions(availablePermissions: Permissions, permissions: Permissions): Permissions {
+  const result: Permissions = {};
+
+  for (const [resource, actions] of Object.entries(permissions)) {
+    if (actions == null) {
+      continue;
+    }
+
+    for (const [action, granted] of Object.entries(actions)) {
+      if (
+        granted === true &&
+        availablePermissions[resource as PermissionResource]?.[action as PermissionAction] !== true
+      ) {
+        result[resource as PermissionResource] ??= {};
+        result[resource as PermissionResource]![action as PermissionAction] = true;
+      }
+    }
+  }
+
+  return result;
+}
+
+/**
+ * Whether {@link availablePermissions} contains all granted permissions in {@link permissions}.
+ */
+export function hasPermissions(availablePermissions: Permissions, permissions: Permissions): boolean {
+  return Object.keys(getMissingPermissions(availablePermissions, permissions)).length === 0;
+}

package/src/lib/action-type.enum.ts

@@ -1,7 +0,0 @@
-export const enum ActionType {
-  MANAGE = "manage",
-  CREATE = "create",
-  READ = "read",
-  UPDATE = "update",
-  REMOVE = "remove",
-}