@valentine-efagene/qshelter-common 2.0.89 → 2.0.90

package/dist/generated/client/models/index.d.ts

@@ -53,6 +53,7 @@ export * from './Settings';
 export * from './Social';
 export * from './StepEventAttachment';
 export * from './Tenant';
+export * from './TenantMembership';
 export * from './Transaction';
 export * from './User';
 export * from './UserRole';

package/dist/generated/client/models/index.js

@@ -53,6 +53,7 @@ export * from './Settings';
 export * from './Social';
 export * from './StepEventAttachment';
 export * from './Tenant';
+export * from './TenantMembership';
 export * from './Transaction';
 export * from './User';
 export * from './UserRole';

package/dist/src/events/policies/policy-event.d.ts

@@ -13,29 +13,61 @@ export declare enum PolicyEventType {
     PERMISSION_DELETED = "POLICY.PERMISSION_DELETED",
     ROLE_PERMISSION_ASSIGNED = "POLICY.ROLE_PERMISSION_ASSIGNED",
     ROLE_PERMISSION_REVOKED = "POLICY.ROLE_PERMISSION_REVOKED",
+    TENANT_MEMBERSHIP_CREATED = "POLICY.TENANT_MEMBERSHIP_CREATED",
+    TENANT_MEMBERSHIP_UPDATED = "POLICY.TENANT_MEMBERSHIP_UPDATED",
+    TENANT_MEMBERSHIP_DELETED = "POLICY.TENANT_MEMBERSHIP_DELETED",
     FULL_SYNC_REQUESTED = "POLICY.FULL_SYNC_REQUESTED"
 }
+/**
+ * Role data with tenant scoping
+ */
 export interface RoleData {
     id: string;
     name: string;
     description?: string | null;
+    tenantId?: string | null;
+    isSystem?: boolean;
+    isActive?: boolean;
 }
+/**
+ * Permission with path-based authorization
+ * Matches the authorizer's expected policy structure
+ */
 export interface PermissionData {
     id: string;
     name: string;
     description?: string | null;
-    resource: string;
-    action: string;
+    path: string;
+    methods: string[];
+    effect: 'ALLOW' | 'DENY';
+    tenantId?: string | null;
 }
+/**
+ * Role with full permission details for policy sync
+ */
 export interface RolePermissionData {
     roleId: string;
     roleName: string;
+    tenantId?: string | null;
     permissions: Array<{
         id: string;
-        resource: string;
-        action: string;
+        path: string;
+        methods: string[];
+        effect: 'ALLOW' | 'DENY';
     }>;
 }
+/**
+ * Tenant membership data for federated users
+ */
+export interface TenantMembershipData {
+    id: string;
+    userId: string;
+    tenantId: string;
+    roleId: string;
+    roleName: string;
+    isActive: boolean;
+    isDefault: boolean;
+}
 export interface PolicyEventMeta {
     source: string;
     timestamp: string;
@@ -86,4 +118,17 @@ export interface FullSyncRequestedEvent extends PolicyEvent<{
 }> {
     eventType: PolicyEventType.FULL_SYNC_REQUESTED;
 }
-export type AnyPolicyEvent = RoleCreatedEvent | RoleUpdatedEvent | RoleDeletedEvent | PermissionCreatedEvent | PermissionUpdatedEvent | PermissionDeletedEvent | RolePermissionAssignedEvent | RolePermissionRevokedEvent | FullSyncRequestedEvent;
+export interface TenantMembershipCreatedEvent extends PolicyEvent<TenantMembershipData> {
+    eventType: PolicyEventType.TENANT_MEMBERSHIP_CREATED;
+}
+export interface TenantMembershipUpdatedEvent extends PolicyEvent<TenantMembershipData> {
+    eventType: PolicyEventType.TENANT_MEMBERSHIP_UPDATED;
+}
+export interface TenantMembershipDeletedEvent extends PolicyEvent<{
+    membershipId: string;
+    userId: string;
+    tenantId: string;
+}> {
+    eventType: PolicyEventType.TENANT_MEMBERSHIP_DELETED;
+}
+export type AnyPolicyEvent = RoleCreatedEvent | RoleUpdatedEvent | RoleDeletedEvent | PermissionCreatedEvent | PermissionUpdatedEvent | PermissionDeletedEvent | RolePermissionAssignedEvent | RolePermissionRevokedEvent | FullSyncRequestedEvent | TenantMembershipCreatedEvent | TenantMembershipUpdatedEvent | TenantMembershipDeletedEvent;

package/dist/src/events/policies/policy-event.js

@@ -17,6 +17,10 @@ export var PolicyEventType;
     // Role-Permission association events
     PolicyEventType["ROLE_PERMISSION_ASSIGNED"] = "POLICY.ROLE_PERMISSION_ASSIGNED";
     PolicyEventType["ROLE_PERMISSION_REVOKED"] = "POLICY.ROLE_PERMISSION_REVOKED";
+    // Tenant membership events (for federated users)
+    PolicyEventType["TENANT_MEMBERSHIP_CREATED"] = "POLICY.TENANT_MEMBERSHIP_CREATED";
+    PolicyEventType["TENANT_MEMBERSHIP_UPDATED"] = "POLICY.TENANT_MEMBERSHIP_UPDATED";
+    PolicyEventType["TENANT_MEMBERSHIP_DELETED"] = "POLICY.TENANT_MEMBERSHIP_DELETED";
     // Bulk sync events
     PolicyEventType["FULL_SYNC_REQUESTED"] = "POLICY.FULL_SYNC_REQUESTED";
 })(PolicyEventType || (PolicyEventType = {}));

package/dist/src/events/policies/policy-publisher.d.ts

@@ -1,4 +1,4 @@
-import { PolicyEventType, PolicyEventMeta, RoleData, PermissionData, RolePermissionData } from './policy-event';
+import { PolicyEventType, PolicyEventMeta, RoleData, PermissionData, RolePermissionData, TenantMembershipData } from './policy-event';
 /**
  * Configuration for the policy event publisher
  */
@@ -52,6 +52,18 @@ export declare class PolicyEventPublisher {
      * Publish role permission revoked event
      */
     publishRolePermissionRevoked(data: RolePermissionData, meta?: Partial<PolicyEventMeta>): Promise<string>;
+    /**
+     * Publish tenant membership created event
+     */
+    publishTenantMembershipCreated(data: TenantMembershipData, meta?: Partial<PolicyEventMeta>): Promise<string>;
+    /**
+     * Publish tenant membership updated event
+     */
+    publishTenantMembershipUpdated(data: TenantMembershipData, meta?: Partial<PolicyEventMeta>): Promise<string>;
+    /**
+     * Publish tenant membership deleted event
+     */
+    publishTenantMembershipDeleted(membershipId: string, userId: string, tenantId: string, meta?: Partial<PolicyEventMeta>): Promise<string>;
     /**
      * Publish full sync requested event
      */

package/dist/src/events/policies/policy-publisher.js

@@ -119,6 +119,30 @@ export class PolicyEventPublisher {
     async publishRolePermissionRevoked(data, meta) {
         return this.publish(PolicyEventType.ROLE_PERMISSION_REVOKED, data, meta);
     }
+    /**
+     * Publish tenant membership created event
+     */
+    async publishTenantMembershipCreated(data, meta) {
+        return this.publish(PolicyEventType.TENANT_MEMBERSHIP_CREATED, data, {
+            ...meta,
+            tenantId: data.tenantId,
+        });
+    }
+    /**
+     * Publish tenant membership updated event
+     */
+    async publishTenantMembershipUpdated(data, meta) {
+        return this.publish(PolicyEventType.TENANT_MEMBERSHIP_UPDATED, data, {
+            ...meta,
+            tenantId: data.tenantId,
+        });
+    }
+    /**
+     * Publish tenant membership deleted event
+     */
+    async publishTenantMembershipDeleted(membershipId, userId, tenantId, meta) {
+        return this.publish(PolicyEventType.TENANT_MEMBERSHIP_DELETED, { membershipId, userId, tenantId }, { ...meta, tenantId });
+    }
     /**
      * Publish full sync requested event
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@valentine-efagene/qshelter-common",
-  "version": "2.0.89",
+  "version": "2.0.90",
   "description": "Shared database schemas and utilities for QShelter services",
   "main": "dist/src/index.js",
   "types": "dist/src/index.d.ts",

package/prisma/migrations/20260111091027_rbac_redesign_federated_users/migration.sql

@@ -0,0 +1,79 @@
+/*
+  Warnings:
+
+  - You are about to drop the column `action` on the `permissions` table. All the data in the column will be lost.
+  - You are about to drop the column `resource` on the `permissions` table. All the data in the column will be lost.
+  - A unique constraint covering the columns `[path,tenantId]` on the table `permissions` will be added. If there are existing duplicate values, this will fail.
+  - A unique constraint covering the columns `[name,tenantId]` on the table `roles` will be added. If there are existing duplicate values, this will fail.
+  - Added the required column `path` to the `permissions` table without a default value. This is not possible if the table is not empty.
+
+*/
+-- DropIndex
+DROP INDEX `permissions_name_key` ON `permissions`;
+
+-- DropIndex
+DROP INDEX `permissions_resource_action_key` ON `permissions`;
+
+-- DropIndex
+DROP INDEX `permissions_resource_idx` ON `permissions`;
+
+-- DropIndex
+DROP INDEX `roles_name_key` ON `roles`;
+
+-- AlterTable
+ALTER TABLE `permissions` DROP COLUMN `action`,
+    DROP COLUMN `resource`,
+    ADD COLUMN `effect` ENUM('ALLOW', 'DENY') NOT NULL DEFAULT 'ALLOW',
+    ADD COLUMN `isSystem` BOOLEAN NOT NULL DEFAULT false,
+    ADD COLUMN `methods` JSON NOT NULL,
+    ADD COLUMN `path` VARCHAR(191) NOT NULL,
+    ADD COLUMN `tenantId` VARCHAR(191) NULL;
+
+-- AlterTable
+ALTER TABLE `roles` ADD COLUMN `isActive` BOOLEAN NOT NULL DEFAULT true,
+    ADD COLUMN `isSystem` BOOLEAN NOT NULL DEFAULT false,
+    ADD COLUMN `tenantId` VARCHAR(191) NULL;
+
+-- CreateTable
+CREATE TABLE `tenant_memberships` (
+    `id` VARCHAR(191) NOT NULL,
+    `userId` VARCHAR(191) NOT NULL,
+    `tenantId` VARCHAR(191) NOT NULL,
+    `roleId` VARCHAR(191) NOT NULL,
+    `isActive` BOOLEAN NOT NULL DEFAULT true,
+    `isDefault` BOOLEAN NOT NULL DEFAULT false,
+    `createdAt` DATETIME(3) NOT NULL DEFAULT CURRENT_TIMESTAMP(3),
+    `updatedAt` DATETIME(3) NOT NULL,
+
+    INDEX `tenant_memberships_tenantId_idx`(`tenantId`),
+    INDEX `tenant_memberships_userId_idx`(`userId`),
+    UNIQUE INDEX `tenant_memberships_userId_tenantId_key`(`userId`, `tenantId`),
+    PRIMARY KEY (`id`)
+) DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+
+-- CreateIndex
+CREATE INDEX `permissions_tenantId_idx` ON `permissions`(`tenantId`);
+
+-- CreateIndex
+CREATE UNIQUE INDEX `permissions_path_tenantId_key` ON `permissions`(`path`, `tenantId`);
+
+-- CreateIndex
+CREATE INDEX `roles_tenantId_idx` ON `roles`(`tenantId`);
+
+-- CreateIndex
+CREATE UNIQUE INDEX `roles_name_tenantId_key` ON `roles`(`name`, `tenantId`);
+
+-- AddForeignKey
+ALTER TABLE `roles` ADD CONSTRAINT `roles_tenantId_fkey` FOREIGN KEY (`tenantId`) REFERENCES `tenants`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `permissions` ADD CONSTRAINT `permissions_tenantId_fkey` FOREIGN KEY (`tenantId`) REFERENCES `tenants`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `tenant_memberships` ADD CONSTRAINT `tenant_memberships_userId_fkey` FOREIGN KEY (`userId`) REFERENCES `users`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `tenant_memberships` ADD CONSTRAINT `tenant_memberships_tenantId_fkey` FOREIGN KEY (`tenantId`) REFERENCES `tenants`(`id`) ON DELETE CASCADE ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE `tenant_memberships` ADD CONSTRAINT `tenant_memberships_roleId_fkey` FOREIGN KEY (`roleId`) REFERENCES `roles`(`id`) ON DELETE RESTRICT ON UPDATE CASCADE;