@vertesia/common 1.2.0 → 1.3.0-dev.20260620.091720Z

package/src/apikey.ts

@@ -1,15 +1,27 @@
-import { UserGroupRef } from "./group.js";
-import { ProjectRef, ProjectRoles } from "./project.js";
-import { AccountRef } from "./user.js";
+import type { PropertyConditions } from './access-control.js';
+import type { UserGroupRef } from './group.js';
+import type { ProjectRef, SystemRoles } from './project.js';
+import type { AccountRef } from './user.js';
+
+/**
+ * Content security conditions in the JWT, keyed by permission type.
+ * Each key maps to an array of condition sets — at query time, any matching set grants access ($or).
+ * Presence of this object in the JWT switches content access from allow-all to restrict mode.
+ */
+export interface ContentSecurity {
+    read?: PropertyConditions[];
+    write?: PropertyConditions[];
+    delete?: PropertyConditions[];
+}
 
 export enum ApiKeyTypes {
-    secret = "sk",
+    secret = 'sk',
 }
 export interface ApiKey {
     id: string;
     name: string;
     type: ApiKeyTypes;
-    role: ProjectRoles;
+    role: SystemRoles;
     maskedValue?: string; //masked value
     can_retrieve_value?: boolean;
     account: string; // the account id
@@ -24,7 +36,7 @@ export interface ApiKey {
 
 export interface CreateOrUpdateApiKeyPayload extends Partial<ApiKey> {}
 
-export interface ApiKeyWithValue extends Omit<ApiKey, "maskedValue"> {
+export interface ApiKeyWithValue extends ApiKey {
     value: string;
 }
 
@@ -59,17 +71,31 @@ export interface AuthTokenPayload {
     type: PrincipalType;
     account: AccountRef;
 
-    account_roles: ProjectRoles[];
+    account_roles: SystemRoles[];
     accounts: AccountRef[];
 
     project?: ProjectRef;
-    project_roles?: ProjectRoles[];
+    project_roles?: SystemRoles[];
 
     /**
      * The app names enabled for this token. Defaults to an empty array if no apps are enabled.
      */
     apps: string[];
 
+    /**
+     * Apps in `apps[]` whose UI surface is restricted for this principal — present only on
+     * user tokens, and only when at least one app applies. Such apps grant functional access
+     * (tools, endpoints, contributions) but the portal must hide them from navigation unless
+     * the user holds an explicit app_member ACE.
+     *
+     * UI consumers should treat an app as visible when:
+     *   `apps.includes(name) && !ui_restrictions?.includes(name)`
+     *
+     * Omitted entirely when empty to keep the JWT compact. Not emitted on agent or service
+     * tokens — those carry only the functional `apps[]` set.
+     */
+    ui_restrictions?: string[];
+
     /**
      * The user ID (if any) attached to the token.
      * This is set when the token is a user token or an agent token running as a user.
@@ -80,6 +106,10 @@ export interface AuthTokenPayload {
     /** groups */
     groups?: UserGroupRef[]; //group ids
 
+    /** Content security conditions keyed by permission (read/write/delete).
+     *  Presence triggers restrict mode: project:* is dropped from security filters. */
+    content_security?: ContentSecurity;
+
     /**
      * API endpoints information to be used with this token.
      * Either a n API domain like 'api.vertesia.io' | 'api-preview.vertesia.io' | 'api-staging.vertesia.io' | 'local'
@@ -91,6 +121,7 @@ export interface AuthTokenPayload {
               studio: string;
               store: string;
               token?: string;
+              git?: string;
           };
 
     iss: string; //issuer
@@ -121,10 +152,11 @@ export interface AuthTokenPayload {
 }
 
 export enum PrincipalType {
-    User = "user",
-    Group = "group",
-    ApiKey = "apikey",
-    ServiceAccount = "service_account",
-    Agent = "agent",
-    Schedule = "schedule",
+    User = 'user',
+    OAuthAccess = 'oauth_access',
+    Group = 'group',
+    ApiKey = 'apikey',
+    ServiceAccount = 'service_account',
+    Agent = 'agent',
+    Schedule = 'schedule',
 }

package/src/apps.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'vitest';
+import { effectiveAppAccessControl } from './apps.js';
+
+describe('effectiveAppAccessControl', () => {
+    it("returns 'all' when neither installation nor manifest set the field", () => {
+        expect(effectiveAppAccessControl({}, {})).toBe('all');
+    });
+
+    it("returns 'all' when both inputs are null/undefined", () => {
+        expect(effectiveAppAccessControl(null, null)).toBe('all');
+        expect(effectiveAppAccessControl(undefined, undefined)).toBe('all');
+        expect(effectiveAppAccessControl(null, undefined)).toBe('all');
+    });
+
+    it('falls back to the manifest default when the installation has no override', () => {
+        expect(effectiveAppAccessControl({}, { access_control: 'ui' })).toBe('ui');
+        expect(effectiveAppAccessControl({}, { access_control: 'none' })).toBe('none');
+        expect(effectiveAppAccessControl({}, { access_control: 'all' })).toBe('all');
+    });
+
+    it('lets the installation override the manifest default for all three values', () => {
+        expect(effectiveAppAccessControl({ access_control: 'ui' }, { access_control: 'all' })).toBe('ui');
+        expect(effectiveAppAccessControl({ access_control: 'none' }, { access_control: 'ui' })).toBe('none');
+        expect(effectiveAppAccessControl({ access_control: 'all' }, { access_control: 'none' })).toBe('all');
+    });
+
+    it('treats null arguments the same as undefined', () => {
+        expect(effectiveAppAccessControl(null, { access_control: 'ui' })).toBe('ui');
+        expect(effectiveAppAccessControl({ access_control: 'ui' }, null)).toBe('ui');
+    });
+
+    it('treats null/undefined access_control fields the same as the field being absent', () => {
+        expect(effectiveAppAccessControl({ access_control: undefined }, { access_control: 'ui' })).toBe('ui');
+        // The override accepts AppAccessControl | null at the payload boundary; nullish should fall through.
+        expect(effectiveAppAccessControl({ access_control: undefined }, { access_control: undefined })).toBe('all');
+    });
+});