@tatara/cli 0.4.0 → 0.6.0

package/templates/features/authz/files/src/core/authz/services/members.ts

@@ -1,84 +0,0 @@
-import { invalidateMember } from "#core/authz/cache";
-import { type OverlayEffect, type Scope, SYSTEM_ACTOR } from "#core/authz/constants";
-import { store } from "#core/authz/db/store";
-import { audit } from "#core/authz/services/audit";
-import { validateGrants } from "#core/authz/services/grants";
-import { NotFoundError } from "@tatara/http";
-
-export async function getMember(orgId: string, userId: string) {
-	const [roles, overlays] = await Promise.all([
-		store.memberRoles(orgId, userId),
-		store.listOverlays(orgId, userId),
-	]);
-	return { userId, orgId, roles, overlays };
-}
-
-export async function assignRole(actorId: string | null, orgId: string, userId: string, roleId: string) {
-	const role = await store.findRole(orgId, roleId);
-	if (!role) throw new NotFoundError("Role");
-	const added = await store.assignRole(orgId, userId, roleId, actorId);
-	invalidateMember(userId, orgId);
-	if (added && actorId) {
-		await audit({ orgId, actorId, targetUserId: userId, changeType: "member_role_assigned", after: { roleId, key: role.key } });
-	}
-	return added;
-}
-
-export async function revokeRole(actorId: string, orgId: string, userId: string, roleId: string) {
-	const removed = await store.revokeRole(orgId, userId, roleId);
-	if (!removed) throw new NotFoundError("Role assignment");
-	invalidateMember(userId, orgId);
-	await audit({ orgId, actorId, targetUserId: userId, changeType: "member_role_revoked", before: { roleId } });
-}
-
-/** Removes all of a user's access in an org; called when they stop being a member. */
-export async function removeMemberAccess(orgId: string, userId: string, actorId = SYSTEM_ACTOR) {
-	const removed = await store.removeMember(orgId, userId);
-	invalidateMember(userId, orgId);
-	if (removed.roles + removed.overlays > 0) {
-		await audit({
-			orgId,
-			actorId,
-			targetUserId: userId,
-			changeType: "member_removed",
-			before: removed,
-		});
-	}
-	return removed;
-}
-
-export interface OverlayInput {
-	resource: string;
-	action: string;
-	scope?: Scope | null;
-	effect: OverlayEffect;
-	reason?: string | null;
-	expiresAt?: Date | null;
-}
-
-/** Per-user grant or deny, optionally expiring. Deny always wins over any grant. */
-export async function addOverlay(actorId: string | null, orgId: string, userId: string, input: OverlayInput) {
-	const [grant] = validateGrants([input], { allowMeta: input.effect === "deny" });
-	if (!grant) throw new NotFoundError("Permission");
-	const id = await store.addOverlay({
-		orgId,
-		userId,
-		...grant,
-		effect: input.effect,
-		grantedBy: actorId,
-		reason: input.reason ?? null,
-		expiresAt: input.expiresAt ?? null,
-	});
-	invalidateMember(userId, orgId);
-	if (actorId) {
-		await audit({ orgId, actorId, targetUserId: userId, changeType: "overlay_granted", after: { id, ...grant, effect: input.effect } });
-	}
-	return id;
-}
-
-export async function removeOverlay(actorId: string, orgId: string, userId: string, overlayId: string) {
-	const removed = await store.removeOverlay(orgId, userId, overlayId);
-	if (!removed) throw new NotFoundError("Overlay");
-	invalidateMember(userId, orgId);
-	await audit({ orgId, actorId, targetUserId: userId, changeType: "overlay_revoked", before: removed });
-}

package/templates/features/authz/files/src/core/authz/services/roles.ts

@@ -1,73 +0,0 @@
-import { invalidateAll } from "#core/authz/cache";
-import { store } from "#core/authz/db/store";
-import { audit } from "#core/authz/services/audit";
-import { validateGrants } from "#core/authz/services/grants";
-import { SYSTEM_ROLE_KEYS } from "#core/authz/system-roles";
-import type { RoleRow } from "#core/authz/types";
-import { BusinessRuleError, ConflictError, NotFoundError } from "@tatara/http";
-
-export interface RoleInput {
-	key: string;
-	name: string;
-	description?: string | null;
-	grants: { resource: string; action: string; scope?: string | null }[];
-}
-
-export function listRoles(orgId: string): Promise<RoleRow[]> {
-	return store.listRoles(orgId);
-}
-
-async function customRole(orgId: string, roleId: string): Promise<RoleRow> {
-	const role = await store.findRole(orgId, roleId);
-	if (!role) throw new NotFoundError("Role");
-	if (role.isSystem) throw new BusinessRuleError("SYSTEM_ROLE_IMMUTABLE", "Built-in roles cannot be changed");
-	return role;
-}
-
-export async function createRole(actorId: string, orgId: string, input: RoleInput): Promise<RoleRow> {
-	if (SYSTEM_ROLE_KEYS.has(input.key)) {
-		throw new ConflictError(`"${input.key}" is a built-in role key`);
-	}
-	if (await store.findRoleByKey(orgId, input.key)) throw new ConflictError(`Role "${input.key}" exists`);
-	const grants = validateGrants(input.grants, { allowMeta: false });
-	const id = await store.createRole({
-		orgId,
-		key: input.key,
-		name: input.name,
-		description: input.description ?? null,
-		isSystem: false,
-		grants,
-	});
-	const role = await store.findRole(orgId, id);
-	if (!role) throw new NotFoundError("Role");
-	await audit({ orgId, actorId, changeType: "role_created", after: role });
-	return role;
-}
-
-export async function updateRole(
-	actorId: string,
-	orgId: string,
-	roleId: string,
-	input: Partial<Omit<RoleInput, "key">>,
-): Promise<RoleRow> {
-	const before = await customRole(orgId, roleId);
-	await store.updateRole(roleId, {
-		...(input.name === undefined ? {} : { name: input.name }),
-		...(input.description === undefined ? {} : { description: input.description }),
-		...(input.grants ? { grants: validateGrants(input.grants, { allowMeta: false }) } : {}),
-	});
-	invalidateAll();
-	const after = await customRole(orgId, roleId);
-	await audit({ orgId, actorId, changeType: "role_updated", before, after });
-	return after;
-}
-
-export async function deleteRole(actorId: string, orgId: string, roleId: string): Promise<void> {
-	const role = await customRole(orgId, roleId);
-	if (role.memberCount > 0) {
-		throw new ConflictError(`Role "${role.key}" is assigned to ${role.memberCount} member(s)`);
-	}
-	await store.deleteRole(roleId);
-	invalidateAll();
-	await audit({ orgId, actorId, changeType: "role_deleted", before: role });
-}

package/templates/features/authz/files/src/core/authz/services/sync.ts

@@ -1,34 +0,0 @@
-import { invalidateAll } from "#core/authz/cache";
-import { SYSTEM_ORG_ID } from "#core/authz/constants";
-import { store } from "#core/authz/db/store";
-import { validateGrants } from "#core/authz/services/grants";
-import { SYSTEM_ROLES } from "#core/authz/system-roles";
-import { grantKey } from "#core/authz/types";
-import { catalog } from "#generated/permissions";
-
-/** Creates or updates every built-in role so its grants match the code. Idempotent. */
-export async function syncSystemRoles(): Promise<{ created: string[]; updated: string[] }> {
-	const created: string[] = [];
-	const updated: string[] = [];
-	for (const meta of SYSTEM_ROLES) {
-		const grants = validateGrants(
-			(catalog.roleGrants[meta.key] ?? []).map(([resource, action, scope]) => ({ resource, action, scope })),
-			{ allowMeta: true },
-		);
-		const existing = await store.findRoleByKey(SYSTEM_ORG_ID, meta.key);
-		if (!existing) {
-			await store.createRole({ orgId: SYSTEM_ORG_ID, key: meta.key, name: meta.name, description: meta.description, isSystem: true, grants });
-			created.push(meta.key);
-			continue;
-		}
-		const want = new Set(grants.map(grantKey));
-		const have = new Set(existing.grants.map(grantKey));
-		const same = want.size === have.size && [...want].every((k) => have.has(k));
-		if (!same || existing.name !== meta.name || existing.description !== meta.description) {
-			await store.updateRole(existing.id, { name: meta.name, description: meta.description, grants });
-			updated.push(meta.key);
-		}
-	}
-	if (created.length || updated.length) invalidateAll();
-	return { created, updated };
-}

package/templates/features/authz/files/src/core/authz/types.ts

@@ -1,87 +0,0 @@
-import type { OverlayEffect, Scope } from "#core/authz/constants";
-
-export interface PermissionGrant {
-	resource: string;
-	action: string;
-	scope: Scope | null;
-}
-
-export interface OverlayRow extends PermissionGrant {
-	id: string;
-	orgId: string;
-	userId: string;
-	effect: OverlayEffect;
-	grantedBy: string | null;
-	reason: string | null;
-	expiresAt: Date | null;
-	createdAt: Date;
-}
-
-export interface RoleRow {
-	id: string;
-	orgId: string;
-	key: string;
-	name: string;
-	description: string | null;
-	isSystem: boolean;
-	grants: PermissionGrant[];
-	memberCount: number;
-}
-
-export interface AuditRow {
-	id: string;
-	orgId: string;
-	actorId: string;
-	targetUserId: string | null;
-	changeType: string;
-	before: unknown;
-	after: unknown;
-	at: Date;
-}
-
-/** A member's resolved permissions in one org. */
-export interface EffectivePermissions {
-	grants: PermissionGrant[];
-	/** "resource:action:scope|*" keys denied by overlays; deny always wins */
-	denies: Set<string>;
-	roles: string[];
-}
-
-export function grantKey(grant: PermissionGrant): string {
-	return `${grant.resource}:${grant.action}:${grant.scope ?? "*"}`;
-}
-
-/** Everything authz reads and writes; implemented once per ORM in #core/authz/db/store. */
-export interface AuthzStore {
-	roleGrants(orgId: string, userId: string, impliedRoleKeys: string[]): Promise<{
-		roles: string[];
-		grants: PermissionGrant[];
-	}>;
-	activeOverlays(orgId: string, userId: string, now: Date): Promise<OverlayRow[]>;
-	listRoles(orgId: string): Promise<RoleRow[]>;
-	findRole(orgId: string, roleId: string): Promise<RoleRow | null>;
-	findRoleByKey(orgId: string, key: string): Promise<RoleRow | null>;
-	createRole(input: {
-		orgId: string;
-		key: string;
-		name: string;
-		description: string | null;
-		isSystem: boolean;
-		grants: PermissionGrant[];
-	}): Promise<string>;
-	updateRole(
-		roleId: string,
-		input: { name?: string; description?: string | null; grants?: PermissionGrant[] },
-	): Promise<void>;
-	deleteRole(roleId: string): Promise<void>;
-	memberRoles(orgId: string, userId: string): Promise<RoleRow[]>;
-	assignRole(orgId: string, userId: string, roleId: string, by: string | null): Promise<boolean>;
-	revokeRole(orgId: string, userId: string, roleId: string): Promise<boolean>;
-	/** Deletes every role assignment and overlay the user has in the org. */
-	removeMember(orgId: string, userId: string): Promise<{ roles: number; overlays: number }>;
-	listOverlays(orgId: string, userId: string): Promise<OverlayRow[]>;
-	addOverlay(input: Omit<OverlayRow, "id" | "createdAt">): Promise<string>;
-	removeOverlay(orgId: string, userId: string, overlayId: string): Promise<OverlayRow | null>;
-	writeAudit(input: Omit<AuditRow, "id" | "at">): Promise<void>;
-	listAudit(orgId: string, limit: number): Promise<AuditRow[]>;
-}

package/templates/features/authz/files/src/core/authz/validators.ts

@@ -1,99 +0,0 @@
-import { z } from "@hono/zod-openapi";
-import { OVERLAY_EFFECTS, SCOPES } from "#core/authz/constants";
-
-export const grantSchema = z
-	.object({
-		resource: z.string().min(1),
-		action: z.string().min(1),
-		scope: z.enum(SCOPES).nullable().optional(),
-	})
-	.openapi("PermissionGrant");
-
-export const roleSchema = z
-	.object({
-		id: z.string(),
-		key: z.string(),
-		name: z.string(),
-		description: z.string().nullable(),
-		isSystem: z.boolean(),
-		grants: z.array(grantSchema),
-		memberCount: z.number().int(),
-	})
-	.openapi("Role");
-
-export const createRoleSchema = z
-	.object({
-		key: z
-			.string()
-			.regex(/^[a-z][a-z0-9_]{1,62}$/, "lowercase letters, digits and underscores"),
-		name: z.string().trim().min(1).max(120),
-		description: z.string().max(1000).nullable().optional(),
-		grants: z.array(grantSchema).default([]),
-	})
-	.openapi("CreateRole");
-
-export const updateRoleSchema = createRoleSchema.omit({ key: true }).partial().openapi("UpdateRole");
-
-export const overlayInputSchema = z
-	.object({
-		resource: z.string().min(1),
-		action: z.string().min(1),
-		scope: z.enum(SCOPES).nullable().optional(),
-		effect: z.enum(OVERLAY_EFFECTS),
-		reason: z.string().max(500).nullable().optional(),
-		expiresAt: z.iso.datetime().nullable().optional(),
-	})
-	.openapi("OverlayInput");
-
-export const overlaySchema = z
-	.object({
-		id: z.string(),
-		resource: z.string(),
-		action: z.string(),
-		scope: z.enum(SCOPES).nullable(),
-		effect: z.enum(OVERLAY_EFFECTS),
-		reason: z.string().nullable(),
-		expiresAt: z.string().nullable(),
-	})
-	.openapi("Overlay");
-
-export const memberSchema = z
-	.object({
-		userId: z.string(),
-		orgId: z.string(),
-		roles: z.array(roleSchema),
-		overlays: z.array(overlaySchema),
-	})
-	.openapi("Member");
-
-export const myPermissionsSchema = z
-	.object({
-		orgId: z.string(),
-		roles: z.array(z.string()),
-		grants: z.array(grantSchema),
-		denies: z.array(z.string()),
-	})
-	.openapi("MyPermissions");
-
-export const auditEntrySchema = z
-	.object({
-		id: z.string(),
-		actorId: z.string(),
-		targetUserId: z.string().nullable(),
-		changeType: z.string(),
-		before: z.unknown(),
-		after: z.unknown(),
-		at: z.string(),
-	})
-	.openapi("AuditEntry");
-
-export const idParams = z.object({ id: z.string().openapi({ param: { name: "id", in: "path" } }) });
-export const userParams = z.object({
-	userId: z.string().openapi({ param: { name: "userId", in: "path" } }),
-});
-export const userRoleParams = userParams.extend({
-	roleId: z.string().openapi({ param: { name: "roleId", in: "path" } }),
-});
-export const userOverlayParams = userParams.extend({
-	overlayId: z.string().openapi({ param: { name: "overlayId", in: "path" } }),
-});

package/templates/features/better-auth/files/src/core/auth/openapi.ts

@@ -1,60 +0,0 @@
-import type { OpenAPIHono } from "@hono/zod-openapi";
-import { auth } from "#core/auth/auth";
-
-type JsonObject = Record<string, unknown>;
-type OpenApiDocument = ReturnType<OpenAPIHono["getOpenAPI31Document"]>;
-type Paths = NonNullable<OpenApiDocument["paths"]>;
-type Components = NonNullable<OpenApiDocument["components"]>;
-
-interface AuthDocument {
-	paths?: Record<string, JsonObject>;
-	components?: { schemas?: JsonObject; securitySchemes?: JsonObject };
-}
-
-const SCHEMA_REF = "#/components/schemas/";
-
-// better-auth names schemas like the app (User, Member, …); prefix them so neither side is overwritten
-function renameRefs(value: unknown, rename: (name: string) => string): AuthDocument {
-	return JSON.parse(
-		JSON.stringify(value).replaceAll(
-			new RegExp(`"\\$ref":"${SCHEMA_REF}([^"]+)"`, "g"),
-			(_match, name: string) => `"$ref":"${SCHEMA_REF}${rename(name)}"`,
-		),
-	) as AuthDocument;
-}
-
-function retag(paths: Record<string, JsonObject>, tag: string): Record<string, JsonObject> {
-	for (const operations of Object.values(paths)) {
-		for (const operation of Object.values(operations as Record<string, JsonObject>)) {
-			if (operation && typeof operation === "object") operation.tags = [tag];
-		}
-	}
-	return paths;
-}
-
-/** Adds better-auth's endpoints (served under `basePath`) to the app's OpenAPI document. */
-export async function mergeAuthOpenApi(document: OpenApiDocument, basePath: string): Promise<void> {
-	const authDoc = renameRefs(await auth.api.generateOpenAPISchema(), (name) => `Auth${name}`);
-
-	document.paths ??= {};
-	for (const [path, operations] of Object.entries(retag(authDoc.paths ?? {}, "Auth"))) {
-		document.paths[`${basePath}${path}`] = operations as Paths[string];
-	}
-
-	document.components ??= {};
-	document.components.schemas ??= {};
-	for (const [name, schema] of Object.entries(authDoc.components?.schemas ?? {})) {
-		document.components.schemas[`Auth${name}`] = schema as NonNullable<
-			Components["schemas"]
-		>[string];
-	}
-	document.components.securitySchemes = {
-		...(authDoc.components?.securitySchemes as Components["securitySchemes"]),
-		...document.components.securitySchemes,
-	};
-
-	document.tags = [
-		...(document.tags ?? []),
-		{ name: "Auth", description: "Sign-up, sign-in, sessions, organizations (better-auth)" },
-	];
-}