@wtfalch/authz-store 0.2.1 → 0.3.0

package/dist/policy-schema.d.ts

@@ -166,6 +166,7 @@ export declare const policyRoles: import("drizzle-orm/pg-core").PgTableWithColum
                 boundary: {
                     kind: "organisation";
                     organisationId: string;
+                    descendants?: boolean | undefined;
                 } | {
                     kind: "organisations";
                     organisationIds: string[];
@@ -204,6 +205,7 @@ export declare const policyRoles: import("drizzle-orm/pg-core").PgTableWithColum
                 boundary: {
                     kind: "organisation";
                     organisationId: string;
+                    descendants?: boolean | undefined;
                 } | {
                     kind: "organisations";
                     organisationIds: string[];
@@ -507,6 +509,7 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
             data: {
                 kind: "organisation";
                 organisationId: string;
+                descendants?: boolean | undefined;
             } | {
                 kind: "organisations";
                 organisationIds: string[];
@@ -527,6 +530,7 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
             $type: {
                 kind: "organisation";
                 organisationId: string;
+                descendants?: boolean | undefined;
             } | {
                 kind: "organisations";
                 organisationIds: string[];
@@ -684,6 +688,451 @@ export declare const policyAssignments: import("drizzle-orm/pg-core").PgTableWit
     };
     dialect: "pg";
 }>;
+/**
+ * A human principal's time-boxed request to exercise a subset of the
+ * ELEVATED permissions they are otherwise only eligible for (ADR 0016, "No
+ * standing authority"). Ported from Boule's `drizzle/0014_activations.sql`
+ * (authz#83 wave 11b, `migrations/0005_activations.sql` here);
+ * `authz_roles.updated_by` above and the `'activation'`
+ * `authz_assignments.source` value that same source file added are already
+ * in `0001_baseline.sql`, so only these two tables land in the new file.
+ */
+export declare const policyActivations: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "authz_activations";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        applicationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "application_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        platformId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "platform_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        principalClass: import("drizzle-orm/pg-core").PgColumn<{
+            name: "principal_class";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        permissions: import("drizzle-orm/pg-core").PgColumn<{
+            name: "permissions";
+            tableName: "authz_activations";
+            dataType: "array";
+            columnType: "PgArray";
+            data: string[];
+            driverParam: string | string[];
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: import("drizzle-orm").Column<{
+                name: "permissions";
+                tableName: "authz_activations";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: false;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            baseBuilder: import("drizzle-orm/pg-core").PgColumnBuilder<{
+                name: "permissions";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                enumValues: [string, ...string[]];
+                driverParam: string;
+            }, {}, {}, import("drizzle-orm").ColumnBuilderExtraConfig>;
+            size: undefined;
+        }>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reference: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reference";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "requested_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        startsAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "starts_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        roleId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "role_id";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ended_at";
+            tableName: "authz_activations";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        endedBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "ended_by";
+            tableName: "authz_activations";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+/**
+ * One row per decision on an activation, never edited -- the two-person
+ * approval and self-approve-after-wait counting is a host's own check, not a
+ * DB constraint (ADR 0016).
+ */
+export declare const policyActivationApprovals: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "authz_activation_approvals";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        activationId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "activation_id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        approverId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "approver_id";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        approverClass: import("drizzle-orm/pg-core").PgColumn<{
+            name: "approver_class";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        decision: import("drizzle-orm/pg-core").PgColumn<{
+            name: "decision";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        reason: import("drizzle-orm/pg-core").PgColumn<{
+            name: "reason";
+            tableName: "authz_activation_approvals";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        decidedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "decided_at";
+            tableName: "authz_activation_approvals";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export declare const policyVersion: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "authz_policy_version";
     schema: undefined;

package/dist/policy-schema.js

@@ -46,6 +46,69 @@ export const policyAssignments = pgTable('authz_assignments', {
     index('authz_assignments_role_idx').on(t.tenantId, t.roleId),
     index('authz_assignments_team_idx').on(t.tenantId, t.teamId),
 ]);
+/**
+ * A human principal's time-boxed request to exercise a subset of the
+ * ELEVATED permissions they are otherwise only eligible for (ADR 0016, "No
+ * standing authority"). Ported from Boule's `drizzle/0014_activations.sql`
+ * (authz#83 wave 11b, `migrations/0005_activations.sql` here);
+ * `authz_roles.updated_by` above and the `'activation'`
+ * `authz_assignments.source` value that same source file added are already
+ * in `0001_baseline.sql`, so only these two tables land in the new file.
+ */
+export const policyActivations = pgTable('authz_activations', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    tenantId: uuid('tenant_id').notNull(),
+    applicationId: text('application_id').notNull(),
+    platformId: text('platform_id').notNull(),
+    // Agents and services can never open an activation (no inbox for the
+    // self-approve-wait email, nothing eligible to approve on their behalf),
+    // so unlike memberships.principal_id/authz_assignments.principal_id this
+    // is always a person.
+    principalId: text('principal_id').notNull(),
+    principalClass: text('principal_class').notNull(),
+    // The requested subset of what the principal is eligible for. Checked
+    // against a host's policy `elevated` set in code, not here: that set is
+    // a host's own catalogue data, not the database's.
+    permissions: text('permissions').array().notNull(),
+    reason: text('reason').notNull(),
+    reference: text('reference').notNull(),
+    status: text('status').notNull().default('pending'),
+    requestedAt: timestamp('requested_at', { withTimezone: true }).notNull().defaultNow(),
+    startsAt: timestamp('starts_at', { withTimezone: true }).notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
+    // The non-primary authz_roles row minted with exactly the requested
+    // entries, the same indirection break_glass_sessions.role_id uses.
+    roleId: uuid('role_id').notNull(),
+    endedAt: timestamp('ended_at', { withTimezone: true }),
+    endedBy: text('ended_by'),
+}, (t) => [
+    // Full definition is partial (WHERE status = 'pending') in the shipped
+    // migration; this version of drizzle's table builder cannot express
+    // that predicate, the same gap `src/testing/database.ts` documents for
+    // `bg_active_idx` and the other non-unique partial indexes this package
+    // ships.
+    index('authz_activations_pending_idx').on(t.tenantId, t.principalId),
+    index('authz_activations_tenant_idx').on(t.tenantId, t.requestedAt.desc()),
+]);
+/**
+ * One row per decision on an activation, never edited -- the two-person
+ * approval and self-approve-after-wait counting is a host's own check, not a
+ * DB constraint (ADR 0016).
+ */
+export const policyActivationApprovals = pgTable('authz_activation_approvals', {
+    id: uuid('id').primaryKey().defaultRandom(),
+    activationId: uuid('activation_id').notNull(),
+    // Same owner-column reasoning as policyActivations.principalId above: an
+    // approver is always a person.
+    approverId: text('approver_id').notNull(),
+    approverClass: text('approver_class').notNull(),
+    decision: text('decision').notNull(),
+    reason: text('reason'),
+    decidedAt: timestamp('decided_at', { withTimezone: true }).notNull().defaultNow(),
+}, (t) => [
+    index('authz_activation_approvals_activation_idx').on(t.activationId, t.decidedAt.desc()),
+    index('authz_activation_approvals_approver_idx').on(t.approverId),
+]);
 export const policyVersion = pgTable('authz_policy_version', {
     id: integer('id').primaryKey(),
     version: integer('version').notNull(),

package/dist/policy.d.ts

@@ -0,0 +1,64 @@
+import { type ResourcePermission, type ResourceRole, type TenantKind } from '@wtfalch/authz';
+import type { StoreBinding } from './binding.js';
+/** One `systemRoles[kind][key]` entry of a host's policy catalogue JSON. */
+export interface PolicyRoleTemplate {
+    readonly key: string;
+    readonly label: string;
+    readonly description: string;
+    readonly revision: number;
+    readonly guards: readonly string[];
+    readonly entries: readonly {
+        readonly permission: string;
+        readonly boundary?: string;
+        readonly scope?: unknown;
+        readonly relation?: string;
+    }[];
+}
+/**
+ * The shape a host's own `policy-catalogue.json` must have for `definePolicy` to build a
+ * `StorePolicy` from it. The store has no catalogue of its own — this is the host's data,
+ * typed so `definePolicy` can be generic over it.
+ */
+export interface PolicyData {
+    readonly permissions: Record<string, ResourcePermission>;
+    readonly defaultCeiling: readonly string[];
+    readonly maxDepth: number;
+    /** Partial: a host's JSON need not define a role set for every `TenantKind` (Boule's has none for `product`); asking for a missing kind throws. */
+    readonly systemRoles: Partial<Record<TenantKind, Record<string, PolicyRoleTemplate>>>;
+    /** ADR 0016: the permissions that are eligible, not standingly usable, by default. */
+    readonly elevated: readonly string[];
+    /** The subset of `elevated` a second person must also approve before it activates. */
+    readonly coApproval: readonly string[];
+}
+/**
+ * A `StoreBinding` plus everything a host's own `policy-catalogue.ts` used to export: the
+ * compiled catalogue, the built-in and starter role templates, and the ADR 0016 sets. Only
+ * `roles.ts` and `boot.ts` need the template methods; everywhere else a plain `StoreBinding`
+ * (which this also is) is enough.
+ */
+export interface StorePolicy extends StoreBinding {
+    readonly defaultCeiling: readonly string[];
+    readonly maxDepth: number;
+    /** ADR 0016: the permissions that are eligible, not standingly usable, by default. */
+    readonly elevated: ReadonlySet<string>;
+    /** The subset of `elevated` a second person must also approve before it activates. */
+    readonly requiresCoApproval: ReadonlySet<string>;
+    readonly offered: readonly string[];
+    /**
+     * ADR 0016: the only true built-in left is `self_service` — resynced on every boot. Every
+     * other `systemRoles` entry (`owner`, `admin`, `billing`, `member`) is a starter role, seeded
+     * once by `starterRoles` below, as an ordinary editable row nothing here resyncs again.
+     */
+    builtInRoles(organisationId: string, kind: TenantKind): Omit<ResourceRole, 'id'>[];
+    /** The starter role set a new tenant of this kind is seeded with once, at creation (ADR 0016). */
+    starterRoles(organisationId: string, kind: TenantKind): Omit<ResourceRole, 'id'>[];
+}
+/**
+ * Builds a `StorePolicy` from a host's own `policy-catalogue.json` data and its
+ * `{ applicationId, platformId }`. Generic over the host's data because every host's catalogue
+ * differs; this function is the one piece of that shape both applications wrote identically.
+ */
+export declare function definePolicy(data: PolicyData, binding: {
+    readonly applicationId: string;
+    readonly platformId: string;
+}): StorePolicy;

package/dist/policy.js

@@ -0,0 +1,65 @@
+import { defineResourceCatalogue, } from '@wtfalch/authz';
+/**
+ * Builds a `StorePolicy` from a host's own `policy-catalogue.json` data and its
+ * `{ applicationId, platformId }`. Generic over the host's data because every host's catalogue
+ * differs; this function is the one piece of that shape both applications wrote identically.
+ */
+export function definePolicy(data, binding) {
+    const namespaces = [
+        ...new Set(Object.keys(data.permissions).map((key) => key.split(/[.:]/)[0])),
+    ];
+    const catalogue = defineResourceCatalogue(namespaces.map((namespace) => ({
+        namespace,
+        permissions: Object.values(data.permissions).filter((p) => p.id.split(/[.:]/)[0] === namespace),
+    })));
+    // A tenant kind this host has no roles for is a configuration error. Seeding it
+    // with nothing would leave the tenant without an owner seat, so fail loudly,
+    // as the hosts' own catalogue did.
+    const rolesFor = (kind) => {
+        const roles = data.systemRoles[kind];
+        if (!roles)
+            throw new Error(`the policy catalogue has no system roles for tenant kind "${kind}"`);
+        return roles;
+    };
+    function roleFrom(organisationId, role, builtIn) {
+        return {
+            key: role.key,
+            applicationId: binding.applicationId,
+            platformId: binding.platformId,
+            organisationId,
+            label: role.label,
+            description: role.description,
+            revision: role.revision,
+            builtIn,
+            guards: [...role.guards],
+            entries: role.entries.map((entry) => ({
+                permission: entry.permission,
+                boundary: (entry.boundary === 'platform'
+                    ? { kind: 'platform' }
+                    : { kind: 'organisation', organisationId }),
+                scope: ('scope' in entry ? entry.scope : { kind: 'organisation' }),
+                relation: ('relation' in entry ? entry.relation : 'any'),
+            })),
+        };
+    }
+    return {
+        applicationId: binding.applicationId,
+        platformId: binding.platformId,
+        catalogue,
+        defaultCeiling: data.defaultCeiling,
+        maxDepth: data.maxDepth,
+        elevated: new Set(data.elevated),
+        requiresCoApproval: new Set(data.coApproval),
+        offered: Object.keys(catalogue).filter((key) => catalogue[key]?.offered),
+        builtInRoles(organisationId, kind) {
+            return Object.values(rolesFor(kind))
+                .filter((role) => role.key === 'self_service')
+                .map((role) => roleFrom(organisationId, role, true));
+        },
+        starterRoles(organisationId, kind) {
+            return Object.values(rolesFor(kind))
+                .filter((role) => role.key !== 'self_service')
+                .map((role) => roleFrom(organisationId, role, false));
+        },
+    };
+}