@postxl/schema 1.6.0 → 1.7.0

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export { zProjectSchema } from './project-schema/project-schema.transformer';
+export * from './project-schema/project-schema.auth';
 export * from './project-schema/project-schema.brands';
 export * from './project-schema/project-schema.types';
 export type { ProjectSchemaJSON } from './project-schema/project-schema.json-decoder';

package/dist/index.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.zProjectSchema = void 0;
 var project_schema_transformer_1 = require("./project-schema/project-schema.transformer");
 Object.defineProperty(exports, "zProjectSchema", { enumerable: true, get: function () { return project_schema_transformer_1.zProjectSchema; } });
+__exportStar(require("./project-schema/project-schema.auth"), exports);
 __exportStar(require("./project-schema/project-schema.brands"), exports);
 __exportStar(require("./project-schema/project-schema.types"), exports);
 __exportStar(require("./enum/enum.defaults"), exports);

package/dist/model/model.json-decoder.d.ts

@@ -4,6 +4,29 @@ export declare const zModelJSON: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.Z
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     isReadonly: z.ZodOptional<z.ZodBoolean>;
+    auth: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        write: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        adminUi: z.ZodOptional<z.ZodObject<{
+            visibleFor: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
     schema: z.ZodOptional<z.ZodString>;
     databaseName: z.ZodOptional<z.ZodString>;
     excelName: z.ZodOptional<z.ZodString>;

package/dist/model/model.json-decoder.js

@@ -5,6 +5,7 @@ const zod_1 = require("zod");
 const utils_1 = require("@postxl/utils");
 const brands_1 = require("../field/shared/brands");
 const normalize_named_collection_1 = require("../normalize-named-collection");
+const project_schema_auth_1 = require("../project-schema/project-schema.auth");
 exports.zModelNameJSON = zod_1.z
     //
     .string()
@@ -39,6 +40,7 @@ exports.zModelJSON = zod_1.z.preprocess((input) => {
         .boolean()
         .optional()
         .describe(`Indicates if the model is readonly. To be used for system models that should not be editable through actions (e.g. Mutation, Action).`),
+    auth: project_schema_auth_1.zAuthRuleSetJSON.optional().describe('Authorization rules for this model.'),
     //
     schema: zod_1.z
         //

package/dist/model/model.transformer.d.ts

@@ -21,6 +21,29 @@ export declare function modelJSONTransformer(input: ModelJSON, ctx: z.Refinement
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 export type ModelEnriched = ReturnType<typeof modelJSONTransformer>;
@@ -41,6 +64,29 @@ declare function addDefaults({ description, fields, standardFields, seed, faker,
         items: number;
     };
     name: string;
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     schema?: string | undefined;
     defaultField?: string | undefined;
     labelField?: string | undefined;
@@ -69,6 +115,29 @@ declare function brandModel({ name, schema, databaseName, standardFields, defaul
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 type BrandedModel = ReturnType<typeof brandModel>;
@@ -93,6 +162,29 @@ declare function combineFields({ fields, standardFields, ...model }: BrandedMode
         seed: number;
         items: number;
     };
+    auth?: {
+        read?: {
+            anyRole: string[];
+        } | undefined;
+        write?: {
+            anyRole: string[];
+        } | undefined;
+        create?: {
+            anyRole: string[];
+        } | undefined;
+        update?: {
+            anyRole: string[];
+        } | undefined;
+        delete?: {
+            anyRole: string[];
+        } | undefined;
+        actions?: Record<string, {
+            anyRole: string[];
+        }> | undefined;
+        adminUi?: {
+            visibleFor: string[];
+        } | undefined;
+    } | undefined;
     source?: Record<string, unknown> | undefined;
 };
 export type CombinedFields = ReturnType<typeof combineFields>;

package/dist/model/model.types.d.ts

@@ -1,4 +1,5 @@
 import * as Field from '../field';
+import { AuthRuleSet } from '../project-schema/project-schema.auth';
 import { DatabaseSchemaName } from '../project-schema/project-schema.brands';
 import * as Branded from './model.brands';
 export type Models = Map<Branded.ModelName, Model>;
@@ -39,6 +40,7 @@ export type Model = {
          */
         items: number;
     };
+    auth?: AuthRuleSet;
 };
 export type ModelIndex = Field.FieldName[];
 export type Seed = Record<string, unknown>;

package/dist/project-schema/project-schema.auth.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+export declare const zAuthRoleRuleJSON: z.ZodObject<{
+    anyRole: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const zAuthRuleSetJSON: z.ZodObject<{
+    read: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    write: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    create: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    update: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    delete: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    adminUi: z.ZodOptional<z.ZodObject<{
+        visibleFor: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const zAuthScopeRuleSetJSON: z.ZodObject<{
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const zProjectAuthJSON: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+    roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthRoleRuleJSON = z.infer<typeof zAuthRoleRuleJSON>;
+export type AuthRuleSetJSON = z.infer<typeof zAuthRuleSetJSON>;
+export type AuthScopeRuleSetJSON = z.infer<typeof zAuthScopeRuleSetJSON>;
+export type ProjectAuthJSON = z.infer<typeof zProjectAuthJSON>;
+export type AuthRoleRule = AuthRoleRuleJSON;
+export type AuthRuleSet = AuthRuleSetJSON;
+export type AuthScopeRuleSet = AuthScopeRuleSetJSON;
+export type ProjectAuth = ProjectAuthJSON;

package/dist/project-schema/project-schema.auth.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zProjectAuthJSON = exports.zAuthScopeRuleSetJSON = exports.zAuthRuleSetJSON = exports.zAuthRoleRuleJSON = void 0;
+const zod_1 = require("zod");
+const zNonEmptyRole = zod_1.z.string().min(1, { error: 'Role must not be empty.' });
+exports.zAuthRoleRuleJSON = zod_1.z.object({
+    anyRole: zod_1.z
+        .array(zNonEmptyRole)
+        .min(1, { error: 'anyRole must contain at least one role.' })
+        .describe('Allow access when the user has at least one of the listed roles.'),
+});
+exports.zAuthRuleSetJSON = zod_1.z.object({
+    read: exports.zAuthRoleRuleJSON.optional().describe('Role rule for read access to model data.'),
+    write: exports.zAuthRoleRuleJSON.optional().describe('Role rule for write access shorthand (create, update, delete).'),
+    create: exports.zAuthRoleRuleJSON.optional().describe('Role rule for create access.'),
+    update: exports.zAuthRoleRuleJSON.optional().describe('Role rule for update access.'),
+    delete: exports.zAuthRoleRuleJSON.optional().describe('Role rule for delete access.'),
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for model actions. Keys are action names, e.g. "publish".'),
+    adminUi: zod_1.z
+        .object({
+        visibleFor: zod_1.z
+            .array(zNonEmptyRole)
+            .min(1, { error: 'visibleFor must contain at least one role.' })
+            .describe('Roles that can see and access this model in the Admin UI.'),
+    })
+        .optional()
+        .describe('Admin UI visibility settings for this schema/model.'),
+});
+exports.zAuthScopeRuleSetJSON = zod_1.z.object({
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for actions within this scope. Keys are action names or "*".'),
+});
+exports.zProjectAuthJSON = zod_1.z.object({
+    provider: zod_1.z
+        .literal('keycloak')
+        .optional()
+        .default('keycloak')
+        .describe('Authentication/authorization provider used by generated projects.'),
+    roleClaimPath: zod_1.z
+        .string()
+        .min(1)
+        .optional()
+        .default('realm_access.roles')
+        .describe('JWT claim path that contains roles, e.g. "realm_access.roles".'),
+    defaultDeny: zod_1.z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe('If true, access is denied when no matching auth rule is configured.'),
+    scopes: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthScopeRuleSetJSON)
+        .optional()
+        .describe('Authorization rules for non-model action scopes (for example "import").'),
+});

package/dist/project-schema/project-schema.json-decoder.d.ts

@@ -1,19 +1,103 @@
 import { z } from 'zod';
 export declare const zSchemaName: z.ZodString;
+export declare const zSchemaJSON: z.ZodObject<{
+    name: z.ZodString;
+    auth: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        write: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        adminUi: z.ZodOptional<z.ZodObject<{
+            visibleFor: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const zProjectSchemaJSON: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;

package/dist/project-schema/project-schema.json-decoder.js

@@ -33,19 +33,24 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zProjectSchemaJSON = exports.zSchemaName = void 0;
+exports.zProjectSchemaJSON = exports.zSchemaJSON = exports.zSchemaName = void 0;
 const zod_1 = require("zod");
 const utils_1 = require("@postxl/utils");
 const Enum = __importStar(require("../enum"));
 const extract_inline_enums_1 = require("../extract-inline-enums");
 const Model = __importStar(require("../model"));
 const normalize_named_collection_1 = require("../normalize-named-collection");
+const project_schema_auth_1 = require("./project-schema.auth");
 exports.zSchemaName = zod_1.z
     //
     .string()
     .min(1, { error: 'Schema name must not be empty' })
     .regex(/^\w+$/, { error: 'Schema name can only contain letters, numbers and underscores.' })
     .describe('Name of the database schema.');
+exports.zSchemaJSON = zod_1.z.object({
+    name: exports.zSchemaName,
+    auth: project_schema_auth_1.zAuthRuleSetJSON.optional(),
+});
 exports.zProjectSchemaJSON = zod_1.z
     // We want to keep any extra fields that are not defined in the schema. However, these fields should
     // not really be exposed as "main fields" of the parsed schema - instead, they should be nested under
@@ -101,7 +106,7 @@ exports.zProjectSchemaJSON = zod_1.z
         .describe('The version of the project/schema. Should follow semantic versioning, see https://semver.org/.'),
     schemas: zod_1.z
         //
-        .array(exports.zSchemaName)
+        .array(zod_1.z.union([exports.zSchemaName, exports.zSchemaJSON]))
         .min(1, {
         error: 'Schemas of the project must not be empty! If you want to use the default schemas, omit this field.',
     })
@@ -111,6 +116,9 @@ exports.zProjectSchemaJSON = zod_1.z
         //
         .optional()
         .describe(`The default database schema that is used if model/enum does not specify a schema. If not provided, the default schema "Data" is used.`),
+    auth: project_schema_auth_1.zProjectAuthJSON
+        .optional()
+        .describe('Project-level authentication settings (provider, role claim path, and default behavior).'),
     systemUser: zod_1.z
         //
         .record(zod_1.z.string(), zod_1.z.any())

package/dist/project-schema/project-schema.transformer.d.ts

@@ -11,14 +11,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;
@@ -56,14 +114,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     source: Record<string, unknown>;
     description?: string | undefined;
     version?: string | undefined;
-    schemas?: string[] | undefined;
+    schemas?: (string | {
+        name: string;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
+    })[] | undefined;
     defaultSchema?: string | undefined;
+    auth?: {
+        provider: "keycloak";
+        roleClaimPath: string;
+        defaultDeny: boolean;
+        scopes?: Record<string, {
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+        }> | undefined;
+    } | undefined;
     systemUser?: Record<string, any> | undefined;
     standardModels?: string[] | undefined;
     models?: {
         name: string;
         description?: string | undefined;
         isReadonly?: boolean | undefined;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
         schema?: string | undefined;
         databaseName?: string | undefined;
         excelName?: string | undefined;

package/dist/project-schema/project-schema.transformer.js

@@ -43,6 +43,21 @@ const Model = __importStar(require("../model"));
 const Branded = __importStar(require("./project-schema.brands"));
 const project_schema_defaults_1 = require("./project-schema.defaults");
 const project_schema_json_decoder_1 = require("./project-schema.json-decoder");
+function extractSchemaNamesAndAuth(schemas) {
+    const schemaNames = [];
+    const schemaAuth = new Map();
+    for (const schema of schemas ?? []) {
+        if (typeof schema === 'string') {
+            schemaNames.push(schema);
+            continue;
+        }
+        schemaNames.push(schema.name);
+        if (schema.auth) {
+            schemaAuth.set(schema.name, schema.auth);
+        }
+    }
+    return { schemaNames, schemaAuth };
+}
 function transformProjectSchemaJSON(input, ctx) {
     const result = (0, utils_1.pipeZodTransformers)(input, ctx, [
         convertRecordsToMaps,
@@ -68,8 +83,9 @@ function convertRecordsToMaps(input) {
     };
 }
 function addDefaults(input) {
-    const schemas = input.schemas ?? [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
-    const defaultSchema = getDefaultSchema(input.schemas, input.defaultSchema);
+    const { schemaNames, schemaAuth } = extractSchemaNamesAndAuth(input.schemas);
+    const schemas = schemaNames.length > 0 ? schemaNames : [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
+    const defaultSchema = getDefaultSchema(schemaNames, input.defaultSchema);
     return {
         name: input.name,
         slug: input.slug,
@@ -77,7 +93,9 @@ function addDefaults(input) {
         projectType: input.projectType ?? 'standalone',
         version: input.version ?? '0.0.1',
         schemas,
+        schemaAuth,
         defaultSchema,
+        ...(input.auth ? { auth: input.auth } : {}),
         systemUser: {
             ...project_schema_defaults_1.defaultSystemUser,
             ...input.systemUser,
@@ -101,12 +119,13 @@ function getDefaultSchema(schemas, defaultSchema) {
     }
     return schemas[0];
 }
-function brandProjectSchema({ name, slug, schemas, defaultSchema, standardModels, standardEnums, ...input }) {
+function brandProjectSchema({ name, slug, schemas, schemaAuth, defaultSchema, standardModels, standardEnums, ...input }) {
     return {
         ...input,
         name: Branded.toProjectSchemaName(name),
         slug: Branded.toProjectSlug(slug),
         databaseSchemas: schemas.map((s) => Branded.toDatabaseSchemaName(s)),
+        schemaAuth: new Map([...schemaAuth.entries()].map(([schemaName, auth]) => [Branded.toDatabaseSchemaName(schemaName), auth])),
         defaultDatabaseSchema: Branded.toDatabaseSchemaName(defaultSchema),
         standardModels: standardModels.map((s) => Model.toModelName(s)),
         standardEnums: standardEnums.map((s) => Enum.toEnumName(s)),
@@ -259,10 +278,19 @@ function transformModels(projectSchema, ctx) {
         const model = transformModel(projectSchema.models.get(inputModelName), projectSchema, ctx);
         models.set(model.name, model);
     }
-    return {
-        ...projectSchema,
-        models,
-    };
+    const { auth, ...remainingProjectSchema } = projectSchema;
+    // Keep optional field shape clean: only include `auth` when it is actually set,
+    // instead of returning `auth: undefined`.
+    return auth
+        ? {
+            ...remainingProjectSchema,
+            auth,
+            models,
+        }
+        : {
+            ...remainingProjectSchema,
+            models,
+        };
 }
 function transformModel(model, projectSchema, ctx) {
     const fields = transformFields(model, projectSchema, ctx);
@@ -271,9 +299,10 @@ function transformModel(model, projectSchema, ctx) {
     const defaultField = extractDefaultField(model, fields, ctx);
     const labelField = extractLabelField(model, fields, ctx);
     const keyField = extractKeyField(model, fields, idField, ctx);
-    const { defaultFieldName, labelFieldName, keyFieldName, ...remainingModel } = model;
+    const { defaultFieldName, labelFieldName, keyFieldName, auth, ...remainingModel } = model;
     return {
         ...remainingModel,
+        ...(auth ? { auth } : {}),
         databaseSchema: model.schema ?? projectSchema.defaultDatabaseSchema,
         fields,
         defaultField,

package/dist/project-schema/project-schema.types.d.ts

@@ -1,5 +1,6 @@
 import * as Enum from '../enum';
 import * as Model from '../model';
+import { AuthRuleSet, ProjectAuth } from './project-schema.auth';
 import * as Branded from './project-schema.brands';
 /**
  * Overall project configuration.
@@ -39,6 +40,14 @@ export type ProjectSchema = {
      * If not provided, the default schema "Data" is used.
      */
     defaultDatabaseSchema: Branded.DatabaseSchemaName;
+    /**
+     * Global authorization configuration for this project.
+     */
+    auth?: ProjectAuth;
+    /**
+     * Schema-level authorization defaults by database schema.
+     */
+    schemaAuth: Map<Branded.DatabaseSchemaName, AuthRuleSet>;
     /**
      * The system user that is used for root/system tasks, e.g. data seeding.
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@postxl/schema",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "Decoders for PXL Schema definitions and validation for PXL code generation framework",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -36,7 +36,7 @@
     "directory": "packages/schema"
   },
   "dependencies": {
-    "@postxl/utils": "^1.3.3"
+    "@postxl/utils": "^1.3.4"
   },
   "devDependencies": {},
   "wallaby": {