@postxl/schema 1.6.0 → 1.8.0

package/dist/model/model.transformer.js

@@ -65,7 +65,7 @@ function addDefaults({ description, fields, standardFields, seed, faker, ...inpu
         },
     };
 }
-function brandModel({ name, schema, databaseName, standardFields, defaultField, labelField, keyField, ...input }) {
+function brandModel({ name, schema, databaseName, standardFields, defaultField, labelField, keyField, defaultSort, ...input }) {
     return {
         ...input,
         name: (0, model_brands_1.toModelName)(name),
@@ -75,6 +75,7 @@ function brandModel({ name, schema, databaseName, standardFields, defaultField,
         defaultFieldName: defaultField ? Field.toFieldName(defaultField) : undefined,
         labelFieldName: labelField ? Field.toFieldName(labelField) : undefined,
         keyFieldName: keyField ? Field.toFieldName(keyField) : undefined,
+        defaultSort: defaultSort?.map((fieldName) => Field.toFieldName(fieldName)),
     };
 }
 function combineFields({ fields, standardFields, ...model }, ctx) {

package/dist/model/model.types.d.ts

@@ -1,4 +1,5 @@
 import * as Field from '../field';
+import { AuthRuleSet } from '../project-schema/project-schema.auth';
 import { DatabaseSchemaName } from '../project-schema/project-schema.brands';
 import * as Branded from './model.brands';
 export type Models = Map<Branded.ModelName, Model>;
@@ -20,6 +21,11 @@ export type Model = {
      * Always defined since id field is always present.
      */
     keyField: Field.FieldDatabaseNative;
+    /**
+     * Default sort order used by generated admin views when no explicit sort is provided.
+     * Entries are field names sorted ascending in the given order.
+     */
+    defaultSort: Field.FieldName[];
     indexes: ModelIndex[];
     seed: Seed[];
     /**
@@ -39,6 +45,7 @@ export type Model = {
          */
         items: number;
     };
+    auth?: AuthRuleSet;
 };
 export type ModelIndex = Field.FieldName[];
 export type Seed = Record<string, unknown>;

package/dist/project-schema/project-schema.auth.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+export declare const zAuthRoleRuleJSON: z.ZodObject<{
+    anyRole: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const zAuthRuleSetJSON: z.ZodObject<{
+    read: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    write: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    create: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    update: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    delete: z.ZodOptional<z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+    adminUi: z.ZodOptional<z.ZodObject<{
+        visibleFor: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const zAuthScopeRuleSetJSON: z.ZodObject<{
+    actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        anyRole: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const zProjectAuthJSON: z.ZodObject<{
+    provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+    roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+    defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+    scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type AuthRoleRuleJSON = z.infer<typeof zAuthRoleRuleJSON>;
+export type AuthRuleSetJSON = z.infer<typeof zAuthRuleSetJSON>;
+export type AuthScopeRuleSetJSON = z.infer<typeof zAuthScopeRuleSetJSON>;
+export type ProjectAuthJSON = z.infer<typeof zProjectAuthJSON>;
+export type AuthRoleRule = AuthRoleRuleJSON;
+export type AuthRuleSet = AuthRuleSetJSON;
+export type AuthScopeRuleSet = AuthScopeRuleSetJSON;
+export type ProjectAuth = ProjectAuthJSON;

package/dist/project-schema/project-schema.auth.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.zProjectAuthJSON = exports.zAuthScopeRuleSetJSON = exports.zAuthRuleSetJSON = exports.zAuthRoleRuleJSON = void 0;
+const zod_1 = require("zod");
+const zNonEmptyRole = zod_1.z.string().min(1, { error: 'Role must not be empty.' });
+exports.zAuthRoleRuleJSON = zod_1.z.object({
+    anyRole: zod_1.z
+        .array(zNonEmptyRole)
+        .min(1, { error: 'anyRole must contain at least one role.' })
+        .describe('Allow access when the user has at least one of the listed roles.'),
+});
+exports.zAuthRuleSetJSON = zod_1.z.object({
+    read: exports.zAuthRoleRuleJSON.optional().describe('Role rule for read access to model data.'),
+    write: exports.zAuthRoleRuleJSON.optional().describe('Role rule for write access shorthand (create, update, delete).'),
+    create: exports.zAuthRoleRuleJSON.optional().describe('Role rule for create access.'),
+    update: exports.zAuthRoleRuleJSON.optional().describe('Role rule for update access.'),
+    delete: exports.zAuthRoleRuleJSON.optional().describe('Role rule for delete access.'),
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for model actions. Keys are action names, e.g. "publish".'),
+    adminUi: zod_1.z
+        .object({
+        visibleFor: zod_1.z
+            .array(zNonEmptyRole)
+            .min(1, { error: 'visibleFor must contain at least one role.' })
+            .describe('Roles that can see and access this model in the Admin UI.'),
+    })
+        .optional()
+        .describe('Admin UI visibility settings for this schema/model.'),
+});
+exports.zAuthScopeRuleSetJSON = zod_1.z.object({
+    actions: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthRoleRuleJSON)
+        .optional()
+        .describe('Role rules for actions within this scope. Keys are action names or "*".'),
+});
+exports.zProjectAuthJSON = zod_1.z.object({
+    provider: zod_1.z
+        .literal('keycloak')
+        .optional()
+        .default('keycloak')
+        .describe('Authentication/authorization provider used by generated projects.'),
+    roleClaimPath: zod_1.z
+        .string()
+        .min(1)
+        .optional()
+        .default('realm_access.roles')
+        .describe('JWT claim path that contains roles, e.g. "realm_access.roles".'),
+    defaultDeny: zod_1.z
+        .boolean()
+        .optional()
+        .default(true)
+        .describe('If true, access is denied when no matching auth rule is configured.'),
+    scopes: zod_1.z
+        .record(zod_1.z.string().min(1), exports.zAuthScopeRuleSetJSON)
+        .optional()
+        .describe('Authorization rules for non-model action scopes (for example "import").'),
+});

package/dist/project-schema/project-schema.json-decoder.d.ts

@@ -1,19 +1,103 @@
 import { z } from 'zod';
 export declare const zSchemaName: z.ZodString;
+export declare const zSchemaJSON: z.ZodObject<{
+    name: z.ZodString;
+    auth: z.ZodOptional<z.ZodObject<{
+        read: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        write: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        create: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        update: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        delete: z.ZodOptional<z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+        actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            anyRole: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>>;
+        adminUi: z.ZodOptional<z.ZodObject<{
+            visibleFor: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
 export declare const zProjectSchemaJSON: z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
     name: z.ZodString;
     slug: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;
@@ -24,6 +108,7 @@ export declare const zProjectSchemaJSON: z.ZodPipe<z.ZodTransform<unknown, unkno
         defaultField: z.ZodOptional<z.ZodString>;
         labelField: z.ZodOptional<z.ZodString>;
         keyField: z.ZodOptional<z.ZodString>;
+        defaultSort: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PXL.FieldName", "out">>>;
         indexes: z.ZodOptional<z.ZodArray<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PXL.FieldName", "out">>>>;
         seed: z.ZodOptional<z.ZodArray<z.ZodAny>>;
         source: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;

package/dist/project-schema/project-schema.json-decoder.js

@@ -33,19 +33,24 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.zProjectSchemaJSON = exports.zSchemaName = void 0;
+exports.zProjectSchemaJSON = exports.zSchemaJSON = exports.zSchemaName = void 0;
 const zod_1 = require("zod");
 const utils_1 = require("@postxl/utils");
 const Enum = __importStar(require("../enum"));
 const extract_inline_enums_1 = require("../extract-inline-enums");
 const Model = __importStar(require("../model"));
 const normalize_named_collection_1 = require("../normalize-named-collection");
+const project_schema_auth_1 = require("./project-schema.auth");
 exports.zSchemaName = zod_1.z
     //
     .string()
     .min(1, { error: 'Schema name must not be empty' })
     .regex(/^\w+$/, { error: 'Schema name can only contain letters, numbers and underscores.' })
     .describe('Name of the database schema.');
+exports.zSchemaJSON = zod_1.z.object({
+    name: exports.zSchemaName,
+    auth: project_schema_auth_1.zAuthRuleSetJSON.optional(),
+});
 exports.zProjectSchemaJSON = zod_1.z
     // We want to keep any extra fields that are not defined in the schema. However, these fields should
     // not really be exposed as "main fields" of the parsed schema - instead, they should be nested under
@@ -101,7 +106,7 @@ exports.zProjectSchemaJSON = zod_1.z
         .describe('The version of the project/schema. Should follow semantic versioning, see https://semver.org/.'),
     schemas: zod_1.z
         //
-        .array(exports.zSchemaName)
+        .array(zod_1.z.union([exports.zSchemaName, exports.zSchemaJSON]))
         .min(1, {
         error: 'Schemas of the project must not be empty! If you want to use the default schemas, omit this field.',
     })
@@ -111,6 +116,9 @@ exports.zProjectSchemaJSON = zod_1.z
         //
         .optional()
         .describe(`The default database schema that is used if model/enum does not specify a schema. If not provided, the default schema "Data" is used.`),
+    auth: project_schema_auth_1.zProjectAuthJSON
+        .optional()
+        .describe('Project-level authentication settings (provider, role claim path, and default behavior).'),
     systemUser: zod_1.z
         //
         .record(zod_1.z.string(), zod_1.z.any())

package/dist/project-schema/project-schema.transformer.d.ts

@@ -11,14 +11,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     description: z.ZodOptional<z.ZodString>;
     projectType: z.ZodDefault<z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"standalone">, z.ZodLiteral<"workspace">]>>>;
     version: z.ZodOptional<z.ZodString>;
-    schemas: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    schemas: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        name: z.ZodString;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>]>>>;
     defaultSchema: z.ZodOptional<z.ZodString>;
+    auth: z.ZodOptional<z.ZodObject<{
+        provider: z.ZodDefault<z.ZodOptional<z.ZodLiteral<"keycloak">>>;
+        roleClaimPath: z.ZodDefault<z.ZodOptional<z.ZodString>>;
+        defaultDeny: z.ZodDefault<z.ZodOptional<z.ZodBoolean>>;
+        scopes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
     systemUser: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
     standardModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     models: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodTransform<unknown, unknown>, z.ZodObject<{
         name: z.ZodString;
         description: z.ZodOptional<z.ZodString>;
         isReadonly: z.ZodOptional<z.ZodBoolean>;
+        auth: z.ZodOptional<z.ZodObject<{
+            read: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            write: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            create: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            update: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            delete: z.ZodOptional<z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+            actions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+                anyRole: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>>;
+            adminUi: z.ZodOptional<z.ZodObject<{
+                visibleFor: z.ZodArray<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
         schema: z.ZodOptional<z.ZodString>;
         databaseName: z.ZodOptional<z.ZodString>;
         excelName: z.ZodOptional<z.ZodString>;
@@ -29,6 +87,7 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
         defaultField: z.ZodOptional<z.ZodString>;
         labelField: z.ZodOptional<z.ZodString>;
         keyField: z.ZodOptional<z.ZodString>;
+        defaultSort: z.ZodOptional<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PXL.FieldName", "out">>>;
         indexes: z.ZodOptional<z.ZodArray<z.ZodArray<z.core.$ZodBranded<z.ZodString, "PXL.FieldName", "out">>>>;
         seed: z.ZodOptional<z.ZodArray<z.ZodAny>>;
         source: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
@@ -56,14 +115,72 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
     source: Record<string, unknown>;
     description?: string | undefined;
     version?: string | undefined;
-    schemas?: string[] | undefined;
+    schemas?: (string | {
+        name: string;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
+    })[] | undefined;
     defaultSchema?: string | undefined;
+    auth?: {
+        provider: "keycloak";
+        roleClaimPath: string;
+        defaultDeny: boolean;
+        scopes?: Record<string, {
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+        }> | undefined;
+    } | undefined;
     systemUser?: Record<string, any> | undefined;
     standardModels?: string[] | undefined;
     models?: {
         name: string;
         description?: string | undefined;
         isReadonly?: boolean | undefined;
+        auth?: {
+            read?: {
+                anyRole: string[];
+            } | undefined;
+            write?: {
+                anyRole: string[];
+            } | undefined;
+            create?: {
+                anyRole: string[];
+            } | undefined;
+            update?: {
+                anyRole: string[];
+            } | undefined;
+            delete?: {
+                anyRole: string[];
+            } | undefined;
+            actions?: Record<string, {
+                anyRole: string[];
+            }> | undefined;
+            adminUi?: {
+                visibleFor: string[];
+            } | undefined;
+        } | undefined;
         schema?: string | undefined;
         databaseName?: string | undefined;
         excelName?: string | undefined;
@@ -75,6 +192,7 @@ export declare const zProjectSchema: z.ZodPipe<z.ZodPipe<z.ZodTransform<unknown,
         defaultField?: string | undefined;
         labelField?: string | undefined;
         keyField?: string | undefined;
+        defaultSort?: (string & z.core.$brand<"PXL.FieldName">)[] | undefined;
         indexes?: (string & z.core.$brand<"PXL.FieldName">)[][] | undefined;
         seed?: any[] | undefined;
         source?: Record<string, unknown> | undefined;

package/dist/project-schema/project-schema.transformer.js

@@ -43,6 +43,21 @@ const Model = __importStar(require("../model"));
 const Branded = __importStar(require("./project-schema.brands"));
 const project_schema_defaults_1 = require("./project-schema.defaults");
 const project_schema_json_decoder_1 = require("./project-schema.json-decoder");
+function extractSchemaNamesAndAuth(schemas) {
+    const schemaNames = [];
+    const schemaAuth = new Map();
+    for (const schema of schemas ?? []) {
+        if (typeof schema === 'string') {
+            schemaNames.push(schema);
+            continue;
+        }
+        schemaNames.push(schema.name);
+        if (schema.auth) {
+            schemaAuth.set(schema.name, schema.auth);
+        }
+    }
+    return { schemaNames, schemaAuth };
+}
 function transformProjectSchemaJSON(input, ctx) {
     const result = (0, utils_1.pipeZodTransformers)(input, ctx, [
         convertRecordsToMaps,
@@ -68,8 +83,9 @@ function convertRecordsToMaps(input) {
     };
 }
 function addDefaults(input) {
-    const schemas = input.schemas ?? [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
-    const defaultSchema = getDefaultSchema(input.schemas, input.defaultSchema);
+    const { schemaNames, schemaAuth } = extractSchemaNamesAndAuth(input.schemas);
+    const schemas = schemaNames.length > 0 ? schemaNames : [project_schema_defaults_1.databaseSchemaNameData, project_schema_defaults_1.databaseSchemaNameConfig];
+    const defaultSchema = getDefaultSchema(schemaNames, input.defaultSchema);
     return {
         name: input.name,
         slug: input.slug,
@@ -77,7 +93,9 @@ function addDefaults(input) {
         projectType: input.projectType ?? 'standalone',
         version: input.version ?? '0.0.1',
         schemas,
+        schemaAuth,
         defaultSchema,
+        ...(input.auth ? { auth: input.auth } : {}),
         systemUser: {
             ...project_schema_defaults_1.defaultSystemUser,
             ...input.systemUser,
@@ -101,12 +119,13 @@ function getDefaultSchema(schemas, defaultSchema) {
     }
     return schemas[0];
 }
-function brandProjectSchema({ name, slug, schemas, defaultSchema, standardModels, standardEnums, ...input }) {
+function brandProjectSchema({ name, slug, schemas, schemaAuth, defaultSchema, standardModels, standardEnums, ...input }) {
     return {
         ...input,
         name: Branded.toProjectSchemaName(name),
         slug: Branded.toProjectSlug(slug),
         databaseSchemas: schemas.map((s) => Branded.toDatabaseSchemaName(s)),
+        schemaAuth: new Map([...schemaAuth.entries()].map(([schemaName, auth]) => [Branded.toDatabaseSchemaName(schemaName), auth])),
         defaultDatabaseSchema: Branded.toDatabaseSchemaName(defaultSchema),
         standardModels: standardModels.map((s) => Model.toModelName(s)),
         standardEnums: standardEnums.map((s) => Enum.toEnumName(s)),
@@ -256,13 +275,30 @@ function decodeFields({ modelsArray, ...projectSchema }, ctx) {
 function transformModels(projectSchema, ctx) {
     const models = new Map();
     for (const inputModelName of projectSchema.modelNames) {
-        const model = transformModel(projectSchema.models.get(inputModelName), projectSchema, ctx);
+        const inputModel = projectSchema.models.get(inputModelName);
+        if (!inputModel) {
+            ctx.addIssue({
+                code: zod_1.z.ZodIssueCode.custom,
+                message: `Model ${inputModelName} is missing after field decoding`,
+            });
+            return zod_1.z.NEVER;
+        }
+        const model = transformModel(inputModel, projectSchema, ctx);
         models.set(model.name, model);
     }
-    return {
-        ...projectSchema,
-        models,
-    };
+    const { auth, ...remainingProjectSchema } = projectSchema;
+    // Keep optional field shape clean: only include `auth` when it is actually set,
+    // instead of returning `auth: undefined`.
+    return auth
+        ? {
+            ...remainingProjectSchema,
+            auth,
+            models,
+        }
+        : {
+            ...remainingProjectSchema,
+            models,
+        };
 }
 function transformModel(model, projectSchema, ctx) {
     const fields = transformFields(model, projectSchema, ctx);
@@ -271,14 +307,17 @@ function transformModel(model, projectSchema, ctx) {
     const defaultField = extractDefaultField(model, fields, ctx);
     const labelField = extractLabelField(model, fields, ctx);
     const keyField = extractKeyField(model, fields, idField, ctx);
-    const { defaultFieldName, labelFieldName, keyFieldName, ...remainingModel } = model;
+    const defaultSort = extractDefaultSort(model, fields, ctx);
+    const { defaultFieldName, labelFieldName, keyFieldName, auth, ...remainingModel } = model;
     return {
         ...remainingModel,
+        ...(auth ? { auth } : {}),
         databaseSchema: model.schema ?? projectSchema.defaultDatabaseSchema,
         fields,
         defaultField,
         labelField,
         keyField,
+        defaultSort,
         idField,
     };
 }
@@ -493,6 +532,49 @@ function extractKeyFieldFromFallbacks(fields, idField) {
     // id field is always present and is always a string
     return idField;
 }
+const defaultSortFallbackCandidates = [
+    Field.toFieldName('order'),
+    Field.toFieldName('sequence'),
+    Field.toFieldName('count'),
+    Field.toFieldName('name'),
+    Field.toFieldName('label'),
+    Field.toFieldName('id'),
+];
+function extractDefaultSort(model, fields, ctx) {
+    const idFieldName = Field.standardFieldName_id;
+    const defaultSort = model.defaultSort;
+    if (defaultSort && defaultSort.length > 0) {
+        const result = [];
+        const seen = new Set();
+        for (const fieldName of defaultSort) {
+            if (!fields.has(fieldName)) {
+                ctx.addIssue({
+                    code: zod_1.z.ZodIssueCode.custom,
+                    message: `Default sort field ${fieldName} is not defined in model ${model.name}!`,
+                });
+                return zod_1.z.NEVER;
+            }
+            if (!seen.has(fieldName)) {
+                seen.add(fieldName);
+                result.push(fieldName);
+            }
+        }
+        if (!seen.has(idFieldName) && fields.has(idFieldName)) {
+            result.push(idFieldName);
+        }
+        return result;
+    }
+    const fallbacks = [];
+    for (const candidate of defaultSortFallbackCandidates) {
+        if (fields.has(candidate)) {
+            fallbacks.push(candidate);
+        }
+    }
+    if (!fallbacks.includes(idFieldName) && fields.has(idFieldName)) {
+        fallbacks.push(idFieldName);
+    }
+    return fallbacks;
+}
 function isStringScalarField(field) {
     return field.kind === 'scalar' && field.type === 'string';
 }

package/dist/project-schema/project-schema.types.d.ts

@@ -1,5 +1,6 @@
 import * as Enum from '../enum';
 import * as Model from '../model';
+import { AuthRuleSet, ProjectAuth } from './project-schema.auth';
 import * as Branded from './project-schema.brands';
 /**
  * Overall project configuration.
@@ -39,6 +40,14 @@ export type ProjectSchema = {
      * If not provided, the default schema "Data" is used.
      */
     defaultDatabaseSchema: Branded.DatabaseSchemaName;
+    /**
+     * Global authorization configuration for this project.
+     */
+    auth?: ProjectAuth;
+    /**
+     * Schema-level authorization defaults by database schema.
+     */
+    schemaAuth: Map<Branded.DatabaseSchemaName, AuthRuleSet>;
     /**
      * The system user that is used for root/system tasks, e.g. data seeding.
      */