@tillhub/schemas 6.396.0 → 6.397.0

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+# [6.397.0](https://github.com/tillhub/schemas/compare/v6.396.0...v6.397.0) (2025-07-24)
+
+
+### Features
+
+* **UNTIL-12873:** add stricter validation for user scopes ([#1079](https://github.com/tillhub/schemas/issues/1079)) ([9eb8c77](https://github.com/tillhub/schemas/commit/9eb8c77))
+
 # [6.396.0](https://github.com/tillhub/schemas/compare/v6.395.0...v6.396.0) (2025-07-23)
 
 

package/lib/v0/user_permission_templates/base.js

@@ -9,8 +9,15 @@ module.exports = {
         type: 'array',
         uniqueItems: true,
         items: {
-          // Should specify the current permissions for user for validation
-          type: 'string'
+          oneOf: [
+            {
+              type: 'string',
+              enum: require('../../common/permissions').staff.items.enum
+            },
+            {
+              type: 'string'
+            }
+          ]
         }
       },
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tillhub/schemas",
-  "version": "6.396.0",
+  "version": "6.397.0",
   "private": false,
   "description": "All Tillhub API OpenAPI 3 compatible JSON Schemas.",
   "main": "./lib/index.js",

package/test/user_permission_templates/v0/user_permission_templates.v0.spec.js

@@ -1,4 +1,3 @@
-
 const test = require('tape')
 const validate = require('../../helpers/validate-schema')
 
@@ -19,3 +18,33 @@ test('User Permission Templates V0: update schema validation', function (t) {
   t.error(error, 'should not get any error')
   t.end()
 })
+
+test('User Permission Templates V0: scopes validation - valid enum', function (t) {
+  const createRequest = require('../../../lib/v0/user_permission_templates').create.request
+  const validate = require('../../helpers/validate-schema')
+  const validPayload = {
+    name: 'Test Template',
+    scopes: [require('../../../lib/common/permissions').staff.items.enum[0]],
+    active: true,
+    deleted: false
+  }
+  const { valid, error } = validate(createRequest, validPayload)
+  t.ok(valid, 'should accept valid enum value in scopes')
+  t.error(error, 'should not get any error')
+  t.end()
+})
+
+test('User Permission Templates V0: scopes validation - arbitrary string (backward compatible)', function (t) {
+  const createRequest = require('../../../lib/v0/user_permission_templates').create.request
+  const validate = require('../../helpers/validate-schema')
+  const validPayload = {
+    name: 'Test Template',
+    scopes: ['some:custom:permission'],
+    active: true,
+    deleted: false
+  }
+  const { valid, error } = validate(createRequest, validPayload)
+  t.ok(valid, 'should accept arbitrary string in scopes for backward compatibility')
+  t.error(error, 'should not get any error')
+  t.end()
+})