@postxl/schema 1.5.0 → 1.7.0

package/dist/extract-inline-enums.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Extracts inline enum definitions from model fields and promotes them to top-level enums.
+ *
+ * When a field's `type` is an object or array (instead of a string), it is treated as an
+ * inline enum definition. The enum members are extracted, a name is generated as
+ * `{ModelName}{PascalCase(fieldName)}`, and the field's `type` is replaced with that name.
+ *
+ * Inline enum format examples:
+ *
+ * Object format:
+ *   "type": { "Draft": "description", "Published": "description" }
+ *
+ * Array format:
+ *   "type": ["Draft", { "value": "Published", "description": "..." }]
+ *
+ * The field's `description` is copied to the enum and also kept on the field.
+ * The enum's database schema is derived from the parent model's `schema` property.
+ */
+export declare function extractInlineEnumDefinitions(input: Record<string, unknown>): Record<string, unknown>;

package/dist/extract-inline-enums.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractInlineEnumDefinitions = extractInlineEnumDefinitions;
+const utils_1 = require("@postxl/utils");
+/**
+ * Extracts inline enum definitions from model fields and promotes them to top-level enums.
+ *
+ * When a field's `type` is an object or array (instead of a string), it is treated as an
+ * inline enum definition. The enum members are extracted, a name is generated as
+ * `{ModelName}{PascalCase(fieldName)}`, and the field's `type` is replaced with that name.
+ *
+ * Inline enum format examples:
+ *
+ * Object format:
+ *   "type": { "Draft": "description", "Published": "description" }
+ *
+ * Array format:
+ *   "type": ["Draft", { "value": "Published", "description": "..." }]
+ *
+ * The field's `description` is copied to the enum and also kept on the field.
+ * The enum's database schema is derived from the parent model's `schema` property.
+ */
+function extractInlineEnumDefinitions(input) {
+    const models = input.models;
+    if (!models || typeof models !== 'object') {
+        return input;
+    }
+    const extractedEnums = [];
+    const existingEnumNames = getExistingEnumNames(input.enums);
+    const generatedEnumNames = new Set();
+    let modelsModified = false;
+    const createProcessField = (modelSchema) => (modelName, fieldName, fieldDef) => {
+        const type = fieldDef.type;
+        if (type === undefined || type === null || typeof type === 'string') {
+            return undefined;
+        }
+        // type is an object or array — this is an inline enum definition
+        const enumName = modelName + (0, utils_1.toPascalCase)(fieldName);
+        if (existingEnumNames.has(enumName)) {
+            throw new Error(`Inline enum "${enumName}" generated from field "${modelName}.${fieldName}" conflicts with an existing top-level enum of the same name. ` +
+                `Rename the field or define the enum in the top-level "enums" section instead.`);
+        }
+        if (generatedEnumNames.has(enumName)) {
+            throw new Error(`Inline enum "${enumName}" generated from field "${modelName}.${fieldName}" conflicts with another inline enum of the same name. ` +
+                `Rename one of the fields to avoid the collision.`);
+        }
+        generatedEnumNames.add(enumName);
+        const enumDef = {
+            name: enumName,
+            members: type,
+        };
+        // Copy description to the enum (it stays on the field as well)
+        if (fieldDef.description !== undefined) {
+            enumDef.description = fieldDef.description;
+        }
+        // Use the parent model's schema for the enum
+        if (modelSchema !== undefined) {
+            enumDef.schema = modelSchema;
+        }
+        extractedEnums.push(enumDef);
+        // Build the modified field: replace type with enum name, remove schema (not a field property)
+        const modifiedField = {};
+        for (const [key, value] of Object.entries(fieldDef)) {
+            if (key === 'type') {
+                modifiedField.type = enumName;
+            }
+            else if (key === 'schema') {
+                // schema is not a field property — skip it
+                continue;
+            }
+            else {
+                modifiedField[key] = value;
+            }
+        }
+        return modifiedField;
+    };
+    let newModels = models;
+    if (Array.isArray(models)) {
+        const modifiedModels = models.map((model) => {
+            if (!model || typeof model !== 'object' || !model.name) {
+                return model;
+            }
+            const modelSchema = model.schema;
+            const newFields = processFields(model.name, model.fields, createProcessField(modelSchema));
+            if (newFields === undefined) {
+                return model;
+            }
+            modelsModified = true;
+            return { ...model, fields: newFields };
+        });
+        if (modelsModified) {
+            newModels = modifiedModels;
+        }
+    }
+    else {
+        const modifiedModels = {};
+        for (const [modelName, modelDef] of Object.entries(models)) {
+            if (!modelDef || typeof modelDef !== 'object') {
+                modifiedModels[modelName] = modelDef;
+                continue;
+            }
+            const model = modelDef;
+            const modelSchema = model.schema;
+            const newFields = processFields(modelName, model.fields, createProcessField(modelSchema));
+            if (newFields === undefined) {
+                modifiedModels[modelName] = modelDef;
+            }
+            else {
+                modelsModified = true;
+                modifiedModels[modelName] = { ...model, fields: newFields };
+            }
+        }
+        if (modelsModified) {
+            newModels = modifiedModels;
+        }
+    }
+    if (extractedEnums.length === 0) {
+        return input;
+    }
+    return {
+        ...input,
+        models: newModels,
+        enums: mergeEnums(input.enums, extractedEnums),
+    };
+}
+function processFields(modelName, fields, processField) {
+    if (!fields || typeof fields !== 'object') {
+        return undefined;
+    }
+    let anyModified = false;
+    if (Array.isArray(fields)) {
+        const modifiedFields = fields.map((field) => {
+            if (!field || typeof field !== 'object' || !field.name) {
+                return field;
+            }
+            const result = processField(modelName, field.name, field);
+            if (result === undefined) {
+                return field;
+            }
+            anyModified = true;
+            return result;
+        });
+        return anyModified ? modifiedFields : undefined;
+    }
+    const modifiedFields = {};
+    for (const [fieldName, fieldDef] of Object.entries(fields)) {
+        if (!fieldDef || typeof fieldDef !== 'object') {
+            modifiedFields[fieldName] = fieldDef;
+            continue;
+        }
+        const result = processField(modelName, fieldName, fieldDef);
+        if (result === undefined) {
+            modifiedFields[fieldName] = fieldDef;
+        }
+        else {
+            anyModified = true;
+            modifiedFields[fieldName] = result;
+        }
+    }
+    return anyModified ? modifiedFields : undefined;
+}
+function getExistingEnumNames(enums) {
+    const names = new Set();
+    if (Array.isArray(enums)) {
+        for (const e of enums) {
+            if (e && typeof e === 'object' && typeof e.name === 'string') {
+                names.add(e.name);
+            }
+        }
+    }
+    else if (enums && typeof enums === 'object') {
+        for (const key of Object.keys(enums)) {
+            names.add(key);
+        }
+    }
+    return names;
+}
+function mergeEnums(existing, extracted) {
+    if (existing === undefined || existing === null) {
+        return extracted;
+    }
+    if (Array.isArray(existing)) {
+        return [...existing, ...extracted];
+    }
+    if (typeof existing === 'object') {
+        // Existing enums are in object format — convert extracted enums to object format and merge
+        const result = { ...existing };
+        for (const enumDef of extracted) {
+            const { name, ...rest } = enumDef;
+            result[name] = rest;
+        }
+        return result;
+    }
+    return existing;
+}

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { zProjectSchema } from './project-schema/project-schema.transformer';
+export * from './project-schema/project-schema.auth';
 export * from './project-schema/project-schema.brands';
 export * from './project-schema/project-schema.types';
 export type { ProjectSchemaJSON } from './project-schema/project-schema.json-decoder';

package/dist/index.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.zProjectSchema = void 0;
 var project_schema_transformer_1 = require("./project-schema/project-schema.transformer");
 Object.defineProperty(exports, "zProjectSchema", { enumerable: true, get: function () { return project_schema_transformer_1.zProjectSchema; } });
+__exportStar(require("./project-schema/project-schema.auth"), exports);
 __exportStar(require("./project-schema/project-schema.brands"), exports);
 __exportStar(require("./project-schema/project-schema.types"), exports);
 __exportStar(require("./enum/enum.defaults"), exports);

package/dist/model/model.json-decoder.d.ts

@@ -4,6 +4,29 @@ export declare const zModelJSON: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.Z
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     isReadonly: z.ZodOptional<z.ZodBoolean>;
+    auth: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        write: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        adminUi: z.ZodOptional<z.ZodObject<{
+            visibleFor: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     schema: z.ZodOptional<z.ZodString>;
     databaseName: z.ZodOptional<z.ZodString>;
     excelName: z.ZodOptional<z.ZodString>;

package/dist/model/model.json-decoder.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const utils_1 = require("@postxl/utils");
 const brands_1 = require("../field/shared/brands");
 const normalize_named_collection_1 = require("../normalize-named-collection");
+const project_schema_auth_1 = require("../project-schema/project-schema.auth");
 exports.zModelNameJSON = zod_1.z
     //
     .string()
@@ -39,6 +40,7 @@ exports.zModelJSON = zod_1.z.preprocess((input) => {
         .boolean()
         .optional()
         .describe(`Indicates if the model is readonly. To be used for system models that should not be editable through actions (e.g. Mutation, Action).`),
+    auth: project_schema_auth_1.zAuthRuleSetJSON.optional().describe('Authorization rules for this model.'),
     //
     schema: zod_1.z
         //

package/dist/model/model.transformer.d.ts

@@ -21,6 +21,29 @@ export declare function modelJSONTransformer(input: ModelJSON, ctx: z.Refinement
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 export type ModelEnriched = ReturnType<typeof modelJSONTransformer>;
@@ -41,6 +64,29 @@ declare function addDefaults({ description, fields, standardFields, seed, faker,
         items: number;
     };
     name: string;
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     schema?: string | undefined;
     defaultField?: string | undefined;
     labelField?: string | undefined;
@@ -69,6 +115,29 @@ declare function brandModel({ name, schema, databaseName, standardFields, defaul
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 type BrandedModel = ReturnType<typeof brandModel>;
@@ -93,6 +162,29 @@ declare function combineFields({ fields, standardFields, ...model }: BrandedMode
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 export type CombinedFields = ReturnType<typeof combineFields>;

package/dist/model/model.types.d.ts

@@ -1,4 +1,5 @@
 import * as Field from '../field';
+import { AuthRuleSet } from '../project-schema/project-schema.auth';
 import { DatabaseSchemaName } from '../project-schema/project-schema.brands';
 import * as Branded from './model.brands';
 export type Models = Map<Branded.ModelName, Model>;
@@ -39,6 +40,7 @@ export type Model = {
          */
         items: number;
     };
+    auth?: AuthRuleSet;
 };
 export type ModelIndex = Field.FieldName[];
 export type Seed = Record<string, unknown>;

package/dist/project-schema/project-schema.auth.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+export declare const zAuthRoleRuleJSON: z.ZodObject<{
+    anyRole: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const zAuthRuleSetJSON: z.ZodObject<{
+    read: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    write: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    create: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    update: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    delete: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    adminUi: z.ZodOptional<z.ZodObject<{
+        visibleFor: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const zAuthScopeRuleSetJSON: z.ZodObject<{
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const zProjectAuthJSON: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+    roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthRoleRuleJSON = z.infer<typeof zAuthRoleRuleJSON>;
+export type AuthRuleSetJSON = z.infer<typeof zAuthRuleSetJSON>;
+export type AuthScopeRuleSetJSON = z.infer<typeof zAuthScopeRuleSetJSON>;
+export type ProjectAuthJSON = z.infer<typeof zProjectAuthJSON>;
+export type AuthRoleRule = AuthRoleRuleJSON;
+export type AuthRuleSet = AuthRuleSetJSON;
+export type AuthScopeRuleSet = AuthScopeRuleSetJSON;
+export type ProjectAuth = ProjectAuthJSON;

package/dist/project-schema/project-schema.auth.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zProjectAuthJSON = exports.zAuthScopeRuleSetJSON = exports.zAuthRuleSetJSON = exports.zAuthRoleRuleJSON = void 0;
+const zod_1 = require("zod");
+const zNonEmptyRole = zod_1.z.string().min(1, { error: 'Role must not be empty.' });
+exports.zAuthRoleRuleJSON = zod_1.z.object({
+    anyRole: zod_1.z
+        .array(zNonEmptyRole)
+        .min(1, { error: 'anyRole must contain at least one role.' })
+        .describe('Allow access when the user has at least one of the listed roles.'),
+});
+exports.zAuthRuleSetJSON = zod_1.z.object({
+    read: exports.zAuthRoleRuleJSON.optional().describe('Role rule for read access to model data.'),
+    write: exports.zAuthRoleRuleJSON.optional().describe('Role rule for write access shorthand (create, update, delete).'),
+    create: exports.zAuthRoleRuleJSON.optional().describe('Role rule for create access.'),
+    update: exports.zAuthRoleRuleJSON.optional().describe('Role rule for update access.'),
+    delete: exports.zAuthRoleRuleJSON.optional().describe('Role rule for delete access.'),
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for model actions. Keys are action names, e.g. "publish".'),
+    adminUi: zod_1.z
+        .object({
+        visibleFor: zod_1.z
+            .array(zNonEmptyRole)
+            .min(1, { error: 'visibleFor must contain at least one role.' })
+            .describe('Roles that can see and access this model in the Admin UI.'),
+    })
+        .optional()
+        .describe('Admin UI visibility settings for this schema/model.'),
+});
+exports.zAuthScopeRuleSetJSON = zod_1.z.object({
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for actions within this scope. Keys are action names or "*".'),
+});
+exports.zProjectAuthJSON = zod_1.z.object({
+    provider: zod_1.z
+        .literal('keycloak')
+        .optional()
+        .default('keycloak')
+        .describe('Authentication/authorization provider used by generated projects.'),
+    roleClaimPath: zod_1.z
+        .string()
+        .min(1)
+        .optional()
+        .default('realm_access.roles')
+        .describe('JWT claim path that contains roles, e.g. "realm_access.roles".'),
+    defaultDeny: zod_1.z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe('If true, access is denied when no matching auth rule is configured.'),
+    scopes: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthScopeRuleSetJSON)
+        .optional()
+        .describe('Authorization rules for non-model action scopes (for example "import").'),
+});

package/dist/project-schema/project-schema.json-decoder.d.ts

@@ -1,19 +1,103 @@
 import { z } from 'zod';
 export declare const zSchemaName: z.ZodString;
+export declare const zSchemaJSON: z.ZodObject<{
+    name: z.ZodString;
+    auth: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        write: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        adminUi: z.ZodOptional<z.ZodObject<{
+            visibleFor: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const zProjectSchemaJSON: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;

package/dist/project-schema/project-schema.json-decoder.js

@@ -33,18 +33,24 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zProjectSchemaJSON = exports.zSchemaName = void 0;
+exports.zProjectSchemaJSON = exports.zSchemaJSON = exports.zSchemaName = void 0;
 const zod_1 = require("zod");
 const utils_1 = require("@postxl/utils");
 const Enum = __importStar(require("../enum"));
+const extract_inline_enums_1 = require("../extract-inline-enums");
 const Model = __importStar(require("../model"));
 const normalize_named_collection_1 = require("../normalize-named-collection");
+const project_schema_auth_1 = require("./project-schema.auth");
 exports.zSchemaName = zod_1.z
     //
     .string()
     .min(1, { error: 'Schema name must not be empty' })
     .regex(/^\w+$/, { error: 'Schema name can only contain letters, numbers and underscores.' })
     .describe('Name of the database schema.');
+exports.zSchemaJSON = zod_1.z.object({
+    name: exports.zSchemaName,
+    auth: project_schema_auth_1.zAuthRuleSetJSON.optional(),
+});
 exports.zProjectSchemaJSON = zod_1.z
     // We want to keep any extra fields that are not defined in the schema. However, these fields should
     // not really be exposed as "main fields" of the parsed schema - instead, they should be nested under
@@ -54,13 +60,18 @@ exports.zProjectSchemaJSON = zod_1.z
     .preprocess((input) => {
     if (typeof input === 'object' && input !== null) {
         const original = input;
+        // Extract inline enum definitions from model fields before normalization.
+        // This converts inline enum types (objects/arrays in field.type) to top-level enums
+        // and replaces the field type with the generated enum name.
+        const withExtractedEnums = (0, extract_inline_enums_1.extractInlineEnumDefinitions)(original);
         return {
-            ...original,
-            models: (0, normalize_named_collection_1.normalizeNamedCollection)(original.models),
-            enums: (0, normalize_named_collection_1.normalizeNamedCollection)(original.enums),
+            ...withExtractedEnums,
+            models: (0, normalize_named_collection_1.normalizeNamedCollection)(withExtractedEnums.models),
+            enums: (0, normalize_named_collection_1.normalizeNamedCollection)(withExtractedEnums.enums),
             // We omit models from the source fields as we keep the original input in model.source
-            // as part of the model schema.
-            source: (0, utils_1.omit)(original, 'models'),
+            // as part of the model schema. We use the post-extraction data so that source.enums
+            // reflects the extracted inline enums.
+            source: (0, utils_1.omit)(withExtractedEnums, 'models'),
         };
     }
     return input;
@@ -95,7 +106,7 @@ exports.zProjectSchemaJSON = zod_1.z
         .describe('The version of the project/schema. Should follow semantic versioning, see https://semver.org/.'),
     schemas: zod_1.z
         //
-        .array(exports.zSchemaName)
+        .array(zod_1.z.union([exports.zSchemaName, exports.zSchemaJSON]))
         .min(1, {
         error: 'Schemas of the project must not be empty! If you want to use the default schemas, omit this field.',
     })
@@ -105,6 +116,9 @@ exports.zProjectSchemaJSON = zod_1.z
         //
         .optional()
         .describe(`The default database schema that is used if model/enum does not specify a schema. If not provided, the default schema "Data" is used.`),
+    auth: project_schema_auth_1.zProjectAuthJSON
+        .optional()
+        .describe('Project-level authentication settings (provider, role claim path, and default behavior).'),
     systemUser: zod_1.z
         //
         .record(zod_1.z.string(), zod_1.z.any())

package/dist/project-schema/project-schema.transformer.d.ts

@@ -11,14 +11,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;
@@ -56,14 +114,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     source: Record<string, unknown>;
     description?: string | undefined;
     version?: string | undefined;
-    schemas?: string[] | undefined;
+    schemas?: (string | {
+        name: string;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
+    })[] | undefined;
     defaultSchema?: string | undefined;
+    auth?: {
+        provider: "keycloak";
+        roleClaimPath: string;
+        defaultDeny: boolean;
+        scopes?: Record<string, {
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+        }> | undefined;
+    } | undefined;
     systemUser?: Record<string, any> | undefined;
     standardModels?: string[] | undefined;
     models?: {
         name: string;
         description?: string | undefined;
         isReadonly?: boolean | undefined;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
         schema?: string | undefined;
         databaseName?: string | undefined;
         excelName?: string | undefined;

package/dist/project-schema/project-schema.transformer.js

@@ -43,6 +43,21 @@ const Model = __importStar(require("../model"));
 const Branded = __importStar(require("./project-schema.brands"));
 const project_schema_defaults_1 = require("./project-schema.defaults");
 const project_schema_json_decoder_1 = require("./project-schema.json-decoder");
+function extractSchemaNamesAndAuth(schemas) {
+    const schemaNames = [];
+    const schemaAuth = new Map();
+    for (const schema of schemas ?? []) {
+        if (typeof schema === 'string') {
+            schemaNames.push(schema);
+            continue;
+        }
+        schemaNames.push(schema.name);
+        if (schema.auth) {
+            schemaAuth.set(schema.name, schema.auth);
+        }
+    }
+    return { schemaNames, schemaAuth };
+}
 function transformProjectSchemaJSON(input, ctx) {
     const result = (0, utils_1.pipeZodTransformers)(input, ctx, [
         convertRecordsToMaps,
@@ -68,8 +83,9 @@ function convertRecordsToMaps(input) {
     };
 }
 function addDefaults(input) {
-    const schemas = input.schemas ?? [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
-    const defaultSchema = getDefaultSchema(input.schemas, input.defaultSchema);
+    const { schemaNames, schemaAuth } = extractSchemaNamesAndAuth(input.schemas);
+    const schemas = schemaNames.length > 0 ? schemaNames : [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
+    const defaultSchema = getDefaultSchema(schemaNames, input.defaultSchema);
     return {
         name: input.name,
         slug: input.slug,
@@ -77,7 +93,9 @@ function addDefaults(input) {
         projectType: input.projectType ?? 'standalone',
         version: input.version ?? '0.0.1',
         schemas,
+        schemaAuth,
         defaultSchema,
+        ...(input.auth ? { auth: input.auth } : {}),
         systemUser: {
             ...project_schema_defaults_1.defaultSystemUser,
             ...input.systemUser,
@@ -101,12 +119,13 @@ function getDefaultSchema(schemas, defaultSchema) {
     }
     return schemas[0];
 }
-function brandProjectSchema({ name, slug, schemas, defaultSchema, standardModels, standardEnums, ...input }) {
+function brandProjectSchema({ name, slug, schemas, schemaAuth, defaultSchema, standardModels, standardEnums, ...input }) {
     return {
         ...input,
         name: Branded.toProjectSchemaName(name),
         slug: Branded.toProjectSlug(slug),
         databaseSchemas: schemas.map((s) => Branded.toDatabaseSchemaName(s)),
+        schemaAuth: new Map([...schemaAuth.entries()].map(([schemaName, auth]) => [Branded.toDatabaseSchemaName(schemaName), auth])),
         defaultDatabaseSchema: Branded.toDatabaseSchemaName(defaultSchema),
         standardModels: standardModels.map((s) => Model.toModelName(s)),
         standardEnums: standardEnums.map((s) => Enum.toEnumName(s)),
@@ -259,10 +278,19 @@ function transformModels(projectSchema, ctx) {
         const model = transformModel(projectSchema.models.get(inputModelName), projectSchema, ctx);
         models.set(model.name, model);
     }
-    return {
-        ...projectSchema,
-        models,
-    };
+    const { auth, ...remainingProjectSchema } = projectSchema;
+    // Keep optional field shape clean: only include `auth` when it is actually set,
+    // instead of returning `auth: undefined`.
+    return auth
+        ? {
+            ...remainingProjectSchema,
+            auth,
+            models,
+        }
+        : {
+            ...remainingProjectSchema,
+            models,
+        };
 }
 function transformModel(model, projectSchema, ctx) {
     const fields = transformFields(model, projectSchema, ctx);
@@ -271,9 +299,10 @@ function transformModel(model, projectSchema, ctx) {
     const defaultField = extractDefaultField(model, fields, ctx);
     const labelField = extractLabelField(model, fields, ctx);
     const keyField = extractKeyField(model, fields, idField, ctx);
-    const { defaultFieldName, labelFieldName, keyFieldName, ...remainingModel } = model;
+    const { defaultFieldName, labelFieldName, keyFieldName, auth, ...remainingModel } = model;
     return {
         ...remainingModel,
+        ...(auth ? { auth } : {}),
         databaseSchema: model.schema ?? projectSchema.defaultDatabaseSchema,
         fields,
         defaultField,

package/dist/project-schema/project-schema.types.d.ts

@@ -1,5 +1,6 @@
 import * as Enum from '../enum';
 import * as Model from '../model';
+import { AuthRuleSet, ProjectAuth } from './project-schema.auth';
 import * as Branded from './project-schema.brands';
 /**
  * Overall project configuration.
@@ -39,6 +40,14 @@ export type ProjectSchema = {
      * If not provided, the default schema "Data" is used.
      */
     defaultDatabaseSchema: Branded.DatabaseSchemaName;
+    /**
+     * Global authorization configuration for this project.
+     */
+    auth?: ProjectAuth;
+    /**
+     * Schema-level authorization defaults by database schema.
+     */
+    schemaAuth: Map<Branded.DatabaseSchemaName, AuthRuleSet>;
     /**
      * The system user that is used for root/system tasks, e.g. data seeding.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postxl/schema",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Decoders for PXL Schema definitions and validation for PXL code generation framework",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -36,7 +36,7 @@
     "directory": "packages/schema"
   },
   "dependencies": {
-    "@postxl/utils": "^1.3.3"
+    "@postxl/utils": "^1.3.4"
   },
   "devDependencies": {},
   "wallaby": {