@vertesia/common 1.2.0 → 1.3.0-dev.20260620.061059Z

package/lib/{types/apikey.d.ts → apikey.d.ts}

@@ -1,6 +1,17 @@
-import { UserGroupRef } from "./group.js";
-import { ProjectRef, ProjectRoles } from "./project.js";
-import { AccountRef } from "./user.js";
+import type { PropertyConditions } from './access-control.js';
+import type { UserGroupRef } from './group.js';
+import type { ProjectRef, SystemRoles } from './project.js';
+import type { AccountRef } from './user.js';
+/**
+ * Content security conditions in the JWT, keyed by permission type.
+ * Each key maps to an array of condition sets — at query time, any matching set grants access ($or).
+ * Presence of this object in the JWT switches content access from allow-all to restrict mode.
+ */
+export interface ContentSecurity {
+    read?: PropertyConditions[];
+    write?: PropertyConditions[];
+    delete?: PropertyConditions[];
+}
 export declare enum ApiKeyTypes {
     secret = "sk"
 }
@@ -8,7 +19,7 @@ export interface ApiKey {
     id: string;
     name: string;
     type: ApiKeyTypes;
-    role: ProjectRoles;
+    role: SystemRoles;
     maskedValue?: string;
     can_retrieve_value?: boolean;
     account: string;
@@ -22,7 +33,7 @@ export interface ApiKey {
 }
 export interface CreateOrUpdateApiKeyPayload extends Partial<ApiKey> {
 }
-export interface ApiKeyWithValue extends Omit<ApiKey, "maskedValue"> {
+export interface ApiKeyWithValue extends ApiKey {
     value: string;
 }
 export interface ApiKeyReadResponse extends ApiKey {
@@ -49,14 +60,27 @@ export interface AuthTokenPayload {
     picture?: string;
     type: PrincipalType;
     account: AccountRef;
-    account_roles: ProjectRoles[];
+    account_roles: SystemRoles[];
     accounts: AccountRef[];
     project?: ProjectRef;
-    project_roles?: ProjectRoles[];
+    project_roles?: SystemRoles[];
     /**
      * The app names enabled for this token. Defaults to an empty array if no apps are enabled.
      */
     apps: string[];
+    /**
+     * Apps in `apps[]` whose UI surface is restricted for this principal — present only on
+     * user tokens, and only when at least one app applies. Such apps grant functional access
+     * (tools, endpoints, contributions) but the portal must hide them from navigation unless
+     * the user holds an explicit app_member ACE.
+     *
+     * UI consumers should treat an app as visible when:
+     *   `apps.includes(name) && !ui_restrictions?.includes(name)`
+     *
+     * Omitted entirely when empty to keep the JWT compact. Not emitted on agent or service
+     * tokens — those carry only the functional `apps[]` set.
+     */
+    ui_restrictions?: string[];
     /**
      * The user ID (if any) attached to the token.
      * This is set when the token is a user token or an agent token running as a user.
@@ -65,6 +89,9 @@ export interface AuthTokenPayload {
     user_id?: string;
     /** groups */
     groups?: UserGroupRef[];
+    /** Content security conditions keyed by permission (read/write/delete).
+     *  Presence triggers restrict mode: project:* is dropped from security filters. */
+    content_security?: ContentSecurity;
     /**
      * API endpoints information to be used with this token.
      * Either a n API domain like 'api.vertesia.io' | 'api-preview.vertesia.io' | 'api-staging.vertesia.io' | 'local'
@@ -74,6 +101,7 @@ export interface AuthTokenPayload {
         studio: string;
         store: string;
         token?: string;
+        git?: string;
     };
     iss: string;
     aud: string;
@@ -101,9 +129,11 @@ export interface AuthTokenPayload {
 }
 export declare enum PrincipalType {
     User = "user",
+    OAuthAccess = "oauth_access",
     Group = "group",
     ApiKey = "apikey",
     ServiceAccount = "service_account",
     Agent = "agent",
     Schedule = "schedule"
 }
+//# sourceMappingURL=apikey.d.ts.map

package/lib/apikey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apikey.d.ts","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC5B,IAAI,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE,kBAAkB,EAAE,CAAC;IAC7B,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC;CACjC;AAED,oBAAY,WAAW;IACnB,MAAM,OAAO;CAChB;AACD,MAAM,WAAW,MAAM;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,EAAE,IAAI,CAAC;IACjB,UAAU,CAAC,EAAE,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,2BAA4B,SAAQ,OAAO,CAAC,MAAM,CAAC;CAAG;AAEvE,MAAM,WAAW,eAAgB,SAAQ,MAAM;IAC3C,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAmB,SAAQ,MAAM;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAC9B,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC5B,KAAK,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,IAAI,EAAE,aAAa,CAAC;IACpB,OAAO,EAAE,UAAU,CAAC;IAEpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;IAEvB,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,aAAa,CAAC,EAAE,WAAW,EAAE,CAAC;IAE9B;;OAEG;IACH,IAAI,EAAE,MAAM,EAAE,CAAC;IAEf;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,aAAa;IACb,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;IAExB;uFACmF;IACnF,gBAAgB,CAAC,EAAE,eAAe,CAAC;IAEnC;;;;OAIG;IACH,SAAS,CAAC,EACJ,MAAM,GACN;QACI,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IAER,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAEhB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;;OAIG;IACH,cAAc,CAAC,EAAE;QACb,8EAA8E;QAC9E,EAAE,CAAC,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf;;;WAGG;QACH,UAAU,CAAC,EAAE,gBAAgB,CAAC;QAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KAC1B,CAAC;CACL;AAED,oBAAY,aAAa;IACrB,IAAI,SAAS;IACb,WAAW,iBAAiB;IAC5B,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,cAAc,oBAAoB;IAClC,KAAK,UAAU;IACf,QAAQ,aAAa;CACxB"}

package/lib/{esm/apikey.js → apikey.js}

@@ -5,6 +5,7 @@ export var ApiKeyTypes;
 export var PrincipalType;
 (function (PrincipalType) {
     PrincipalType["User"] = "user";
+    PrincipalType["OAuthAccess"] = "oauth_access";
     PrincipalType["Group"] = "group";
     PrincipalType["ApiKey"] = "apikey";
     PrincipalType["ServiceAccount"] = "service_account";

package/lib/apikey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apikey.js","sourceRoot":"","sources":["../src/apikey.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAN,IAAY,WAEX;AAFD,WAAY,WAAW;IACnB,4BAAa,CAAA;AACjB,CAAC,EAFW,WAAW,KAAX,WAAW,QAEtB;AAuID,MAAM,CAAN,IAAY,aAQX;AARD,WAAY,aAAa;IACrB,8BAAa,CAAA;IACb,6CAA4B,CAAA;IAC5B,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,mDAAkC,CAAA;IAClC,gCAAe,CAAA;IACf,sCAAqB,CAAA;AACzB,CAAC,EARW,aAAa,KAAb,aAAa,QAQxB"}