@southwind-ai/shared 0.2.1 → 0.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/src/rbac.ts +30 -0
package/package.json
CHANGED
package/src/rbac.ts
CHANGED
|
@@ -23,6 +23,7 @@ export type PermissionAction =
|
|
|
23
23
|
| "reveal"
|
|
24
24
|
| "approve"
|
|
25
25
|
| "execute"
|
|
26
|
+
| "retry"
|
|
26
27
|
| "manage";
|
|
27
28
|
|
|
28
29
|
export type PermissionAccessRisk =
|
|
@@ -40,6 +41,35 @@ export type DataScope =
|
|
|
40
41
|
| "self"
|
|
41
42
|
| "custom";
|
|
42
43
|
|
|
44
|
+
export type PersistedScopeGrant =
|
|
45
|
+
| { scope: "all" | "tenant" | "self" }
|
|
46
|
+
| {
|
|
47
|
+
scope: "department" | "department-and-children";
|
|
48
|
+
departmentId?: string;
|
|
49
|
+
}
|
|
50
|
+
| { scope: "custom"; dimension: string; values: string[] };
|
|
51
|
+
|
|
52
|
+
/**
|
|
53
|
+
* 后台任务可持久化的最小授权范围快照。
|
|
54
|
+
*
|
|
55
|
+
* 不包含 Permission、凭据、Secret 或业务字段值；恢复执行时仍须重新解析当前 Actor
|
|
56
|
+
* 并重新执行 Feature、Permission、License 与对象绑定检查。
|
|
57
|
+
*/
|
|
58
|
+
export interface AuthorizationScopeSnapshot {
|
|
59
|
+
tenantId: "single-tenant";
|
|
60
|
+
actorId: string;
|
|
61
|
+
departmentId?: string;
|
|
62
|
+
grants: PersistedScopeGrant[];
|
|
63
|
+
roleIds: string[];
|
|
64
|
+
}
|
|
65
|
+
|
|
66
|
+
export interface AgentRunAuthorizationSnapshot {
|
|
67
|
+
permissionKey: string;
|
|
68
|
+
featureKey: string;
|
|
69
|
+
allowedToolKeys: string[];
|
|
70
|
+
toolNetworkMode: "forbidden";
|
|
71
|
+
}
|
|
72
|
+
|
|
43
73
|
export type CredentialState = "active" | "must-change-password";
|
|
44
74
|
|
|
45
75
|
export interface PermissionDefinition {
|