@xemahq/authorization-internal-api-client 0.4.15 → 0.4.17
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -13,6 +13,8 @@ export declare const resourcesControllerRegister: (registerResourceOwnershipDto:
|
|
|
13
13
|
export declare const getResourcesControllerListVisibleUrl: () => string;
|
|
14
14
|
/**
|
|
15
15
|
* Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
|
|
16
|
+
*
|
|
17
|
+
* Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
|
|
16
18
|
* @summary List the instances of a resource type a subject may see
|
|
17
19
|
*/
|
|
18
20
|
export declare const resourcesControllerListVisible: (listVisibleResourcesDto: ListVisibleResourcesDto, options?: RequestInit) => Promise<VisibleResourcesDtoDataEnvelope>;
|
|
@@ -25,6 +25,8 @@ const getResourcesControllerListVisibleUrl = () => {
|
|
|
25
25
|
exports.getResourcesControllerListVisibleUrl = getResourcesControllerListVisibleUrl;
|
|
26
26
|
/**
|
|
27
27
|
* Unions OpenFGA owner/shared-with visibility (usersets expanded transitively) with org-shared instances. Org scope is forced from the caller context. Used by platform BFFs to visibility-filter a list on behalf of the end user they serve.
|
|
28
|
+
*
|
|
29
|
+
* Supplying `minLevel` narrows the question from "may this subject SEE it" to "does this subject hold at least this LEVEL on it": the answer becomes owner ∪ shared at or above that rung, and org-shared instances drop out because org-shared is a visibility pattern rather than a rung. That is the question a BFF asks to decide who may MANAGE an instance, and answering it here is what keeps the caller from having to expand identity groups itself — OpenFGA expands `team#member` and `role#assignee` usersets transitively.
|
|
28
30
|
* @summary List the instances of a resource type a subject may see
|
|
29
31
|
*/
|
|
30
32
|
const resourcesControllerListVisible = async (listVisibleResourcesDto, options) => {
|
|
@@ -7,6 +7,8 @@ import type { ResourceSubjectRefDto } from './resourceSubjectRefDto.js';
|
|
|
7
7
|
export interface ListVisibleResourcesDto {
|
|
8
8
|
/** Resource kind/type slug. */
|
|
9
9
|
resourceType: string;
|
|
10
|
+
/** The resource kind's own name for the MINIMUM level the subject must hold. Omitted = the visibility question (owner ∪ shared at any level ∪ org-shared). Present = the authority question (owner ∪ shared at or above this level); org-shared instances are NOT included, because org-shared is a visibility pattern rather than a rung. */
|
|
11
|
+
minLevel?: string;
|
|
10
12
|
/** The subject whose visible instances are enumerated. */
|
|
11
13
|
subject: ResourceSubjectRefDto;
|
|
12
14
|
}
|