@xemahq/contracts 0.77.0 → 0.78.0

package/dist/authorization-module/platform/xema_sharing.fga

@@ -13,6 +13,21 @@ module xema_sharing
 #   explicit-share — named manager / editor / viewer tuples.
 # Nothing short-circuits: org-shared is a tuple, read and revocable.
 #
+# A HUMAN SHARE'S HOLDER IS A MEMBERSHIP INSTANCE, not a user: every share
+# level admits `membership#holder` (and `membership#holder with
+# xema_share_not_expired`) INSTEAD OF `user`. A share bound to a membership
+# ends with that membership and never revives on rejoin (see `membership` in
+# xema_core). `org_viewer` is not a share level and is unchanged.
+#
+# AN ORG-SCOPED OWNER IS A MEMBERSHIP INSTANCE TOO: on every org-scoped kind
+# (document, connector-migration, biome-lifecycle-approval, capability-grant,
+# output-route, and a professional mailbox) `owner` admits `membership#holder`
+# INSTEAD OF `user`, so leaving ends the ownership and a rejoin (a new
+# membership id) never revives it; a demotion keeps the id and so the owner.
+# Personal-space owners stay `user`: a personal mailbox (`xema_mailbox` admits
+# both subject types, the writer picks by owner scope), a personal portal and
+# a user memory. `xema_store-listing` is system-scoped, not org-scoped.
+#
 # A share may EXPIRE: `xema_share_not_expired` is evaluated against
 # `current_time`, which the PDP supplies on every check — no sweeper.
 #
@@ -31,10 +46,10 @@ module xema_sharing
 
 type xema_document
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -43,10 +58,10 @@ type xema_document
 
 type xema_mailbox
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [user, membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -57,9 +72,9 @@ type xema_portal
   relations
     define parent: [org]
     define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner or xema_admin from parent
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner or xema_admin from parent
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -68,10 +83,10 @@ type xema_portal
 
 type xema_connector-migration
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -81,9 +96,9 @@ type xema_connector-migration
 type xema_store-listing
   relations
     define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -92,10 +107,10 @@ type xema_store-listing
 
 type xema_biome-lifecycle-approval
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -105,9 +120,9 @@ type xema_biome-lifecycle-approval
 type xema_memory
   relations
     define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -116,10 +131,10 @@ type xema_memory
 
 type xema_capability-grant
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor
@@ -128,10 +143,10 @@ type xema_capability-grant
 
 type xema_output-route
   relations
-    define owner: [user, agent, service, external-subject, team#member, role#assignee]
-    define manager: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
-    define editor: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
-    define viewer: [user, user with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
+    define owner: [membership#holder, agent, service, external-subject, team#member, role#assignee]
+    define manager: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or owner
+    define editor: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or manager
+    define viewer: [membership#holder, membership#holder with xema_share_not_expired, agent, agent with xema_share_not_expired, external-subject, external-subject with xema_share_not_expired, team#member, team#member with xema_share_not_expired, role#assignee, role#assignee with xema_share_not_expired] or editor
     define org_viewer: [org#member]
     define can_manage: manager
     define can_edit: editor