@wtfalch/authz-store 0.1.0

package/dist/policy-schema.js

@@ -0,0 +1,57 @@
+import { sql } from 'drizzle-orm';
+import { boolean, index, integer, jsonb, pgTable, text, timestamp, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
+/** The only role definitions: built-in and custom, across every application module. */
+export const policyRoles = pgTable('authz_roles', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    key: text('key').notNull(),
+    name: text('name').notNull(),
+    description: text('description').notNull().default(''),
+    builtIn: boolean('built_in').notNull().default(false),
+    revision: integer('revision').notNull().default(1),
+    entries: jsonb('entries').$type().notNull(),
+    guards: text('guards').array().notNull().default(sql `'{}'`),
+    createdBy: text('created_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedBy: text('updated_by'),
+}, (t) => [
+    uniqueIndex('authz_roles_tenant_app_key').on(t.tenantId, t.applicationId, t.key),
+    uniqueIndex('authz_roles_boundary_id').on(t.tenantId, t.applicationId, t.platformId, t.id),
+]);
+/** Participation is stored in memberships; all authority comes from these assignments. */
+export const policyAssignments = pgTable('authz_assignments', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    roleId: uuid('role_id').notNull(),
+    principalId: text('principal_id'),
+    principalClass: text('principal_class'),
+    teamId: uuid('team_id'),
+    recipientDescendants: boolean('recipient_descendants').notNull().default(false),
+    boundary: jsonb('boundary').$type().notNull(),
+    scope: jsonb('scope').$type().notNull(),
+    source: text('source').notNull().default('direct'),
+    viaTenantId: uuid('via_tenant_id'),
+    /** One explicit assignment supplies the membership shortcut shown in the people picker. */
+    primary: boolean('primary_assignment').notNull().default(false),
+    expiresAt: timestamp('expires_at', { withTimezone: true }),
+    createdBy: text('created_by'),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('authz_assignments_principal_idx').on(t.tenantId, t.principalClass, t.principalId),
+    index('authz_assignments_role_idx').on(t.tenantId, t.roleId),
+    index('authz_assignments_team_idx').on(t.tenantId, t.teamId),
+]);
+export const policyVersion = pgTable('authz_policy_version', {
+    id: integer('id').primaryKey(),
+    version: integer('version').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    mappingRevision: text('mapping_revision').notNull(),
+    sourceDigest: text('source_digest').notNull(),
+    migratedAt: timestamp('migrated_at', { withTimezone: true }).notNull().defaultNow(),
+});

package/dist/resource-schema.d.ts

@@ -0,0 +1,188 @@
+export interface AppRolePermission {
+    permission: string;
+    relation: 'any' | 'owner' | 'actor' | 'subject';
+}
+export declare const accessTeams: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "access_teams";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "access_teams";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "access_teams";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        parentId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "parent_id";
+            tableName: "access_teams";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "access_teams";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        archivedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "archived_at";
+            tableName: "access_teams";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "access_teams";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export declare const accessTeamMembers: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "access_team_members";
+    schema: undefined;
+    columns: {
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "access_team_members";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        teamId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "team_id";
+            tableName: "access_team_members";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "access_team_members";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalClass: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_class";
+            tableName: "access_team_members";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;

package/dist/resource-schema.js

@@ -0,0 +1,22 @@
+import { sql } from 'drizzle-orm';
+import { index, pgTable, primaryKey, text, timestamp, uniqueIndex, uuid, } from 'drizzle-orm/pg-core';
+export const accessTeams = pgTable('access_teams', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    parentId: uuid('parent_id'),
+    name: text('name').notNull(),
+    archivedAt: timestamp('archived_at', { withTimezone: true }),
+    createdAt: timestamp('created_at', { withTimezone: true }).notNull().default(sql `now()`),
+}, (t) => [
+    uniqueIndex('access_teams_tenant_id_id_key').on(t.tenantId, t.id),
+    index('access_teams_parent_idx').on(t.tenantId, t.parentId),
+]);
+export const accessTeamMembers = pgTable('access_team_members', {
+    tenantId: uuid('tenant_id').notNull(),
+    teamId: uuid('team_id').notNull(),
+    principalId: text('principal_id').notNull(),
+    principalClass: text('principal_class').notNull(),
+}, (t) => [
+    primaryKey({ columns: [t.teamId, t.principalClass, t.principalId] }),
+    index('access_team_members_principal_idx').on(t.tenantId, t.principalId),
+]);