@vertesia/common 1.5.0-dev.20260722.120446Z → 1.5.0-dev.20260804.124748Z

package/src/principal-context.ts

@@ -1,3 +1,6 @@
+import type { z } from 'zod';
+import type { PrincipalContextFromSchema, PrincipalIdentitySchema } from './api-schemas/user.js';
+
 /**
  * Resolved per-user context consumed by PrincipalSet condition evaluation
  * (`matchConditions` / `resolveConditions`) and by ABAC client-side tooling.
@@ -6,22 +9,15 @@
  * issue time, with the same defaults (clearance = 0, compartments = [],
  * tags = [], properties = {}). Lives in @vertesia/common so both server-side
  * builders and client-side consumers share the exact same shape.
+ *
+ * Derived from `PrincipalContextSchema`, which is composed into `PrincipalIdentitySchema` rather
+ * than published as a component of its own — the document has never carried a `PrincipalContext`
+ * schema, and inventing one would add a `$ref` to every generated client.
  */
-export interface PrincipalContext {
-    clearance: number;
-    compartments: string[];
-    email?: string;
-    tags: string[];
-    properties: Record<string, unknown>;
-}
+export type PrincipalContext = PrincipalContextFromSchema;
 
 /**
- * Response shape of the `/iam/users/identity` endpoint: the current principal's
- * {@link PrincipalContext} plus its id. Distinct from `PrincipalContext` itself
- * because the id is identity metadata, not a merged BLP field — adding it to
- * `PrincipalContext` would unintentionally expose `$principal.id` to
- * PrincipalSet rule evaluation.
+ * Response shape of the `/iam/users/identity` endpoint. Derived from `PrincipalIdentitySchema`,
+ * where its published description lives — Zod reads `.meta()`, not TSDoc.
  */
-export interface PrincipalIdentity extends PrincipalContext {
-    id: string;
-}
+export type PrincipalIdentity = z.infer<typeof PrincipalIdentitySchema>;

package/src/project-values.ts

@@ -0,0 +1,41 @@
+// Project values that exist at runtime — currently the system role catalog.
+//
+// Split out of `project.ts` for the reason `account-values.ts` was split out of `user.ts`: the API
+// schemas need `SystemRoles` at runtime (`z.enum(SystemRoles)`), and `project.ts` needs the types
+// those schemas infer. Re-exported from `project.ts`, so this is a move, not a rename.
+//
+// `//` rather than JSDoc, and not a style preference: `SystemRoles` is the first declaration in the
+// file, and zeno-server's scanner attaches a leading DOC comment to the declaration that follows it.
+// Written as JSDoc, this note became the published `SystemRoles.description` in the OpenAPI
+// document — internal migration commentary shipped to every generated client. The sibling
+// `access-control-values.ts` keeps its JSDoc header only because none of its enums are resolved
+// through that path.
+
+// Moved here from `project.ts` for the same reason: `ResourceVisibilitySchema` is `z.enum(...)` over
+// it, and a runtime import of `project.ts` from the schema modules would be a cycle. The enum stays
+// the single statement of the values — the schema reads them rather than restating them, which is
+// why `ResourceVisibility` is not a canonical alias.
+export enum ResourceVisibility {
+    public = 'public',
+    account = 'account',
+    project = 'project',
+}
+
+export enum SystemRoles {
+    owner = 'owner', // all permissions
+    admin = 'admin', // all permissions
+    manager = 'manager', // all permissions but manage_account, manage_billing
+    developer = 'developer', // all permissions but manage_account, manage_billing, manage_roles, delete
+    application = 'application', // executor + request_pk
+    automation = 'automation', // event-triggered automation runner
+    content_processor = 'content_processor', // trusted system content processing
+    consumer = 'consumer', // required permissions for users of micro apps
+    executor = 'executor', // can only read and execute interactions
+    reader = 'reader', // can only read (browse)
+    auditor = 'auditor', // can read all non-admin resources without mutation permissions
+    support = 'support', // Vertesia support read-only role
+    billing = 'billing', // can only manage billings
+    member = 'member', // can only access, but no specific permissions
+    app_member = 'app_member', // used to mark an user have access to an application. does not provide any permission on its own
+    content_superadmin = 'content_superadmin', // can see all content objects and collections
+}