create-astram-app 0.3.0 → 0.4.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astram-app",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "MIT",
   "description": "Scaffolder for a new Astram app — emits a running, framework-enforced consumer project (empty src/features/ + deny-by-default enforcement) that installs the immutable @astram/core, @astram/guard, and @astram/sdk framework.",
   "type": "module",

package/template/frontend/package.json

@@ -12,7 +12,7 @@
     "test": "node --test src/**/*.test.mjs"
   },
   "dependencies": {
-    "@astram/frontend-core": "^0.2.0",
+    "@astram/frontend-core": "^0.3.0",
     "@astram/sdk": "^0.2.0",
     "@radix-ui/react-alert-dialog": "^1.1.19",
     "@radix-ui/react-avatar": "^1.1.10",

package/template/frontend/src/App.jsx

@@ -28,6 +28,7 @@ import UsersPage from './pages/users/UsersPage';
 import UserForm from './pages/users/UserForm';
 import AccessPage from './pages/access/AccessPage';
 import AccessForm from './pages/access/AccessForm';
+import RecordPoliciesPage from './pages/access/RecordPoliciesPage';
 import AuditPage from './pages/audit/AuditPage';
 import GrantsPage from './pages/cross-tenant/GrantsPage';
 import GrantForm from './pages/cross-tenant/GrantForm';
@@ -155,6 +156,17 @@ export default function App() {
         <Route path="add" element={<AccessForm />} />
         <Route path="edit/:uuid" element={<AccessForm />} />
       </Route>
+      {/* Guided rule-builder — author/list/delete record-access policies (§9.1). Gated
+          identity:role:read (policy authoring IS access administration; the write gate is
+          role:update, enforced server-side on POST/DELETE). */}
+      <Route
+        path="/record-policies"
+        element={
+          <RequireAuth gate="identity:role:read">
+            <RecordPoliciesPage />
+          </RequireAuth>
+        }
+      />
       {/* Cross-tenant grants — the grant book (mine + incoming) is a LAYOUT route; the
           Offer form (`offer`) renders as a routed-modal overlay under it. The pending
           Inbox is a sibling route. All gated `identity:role:read` (mirrors nav.js). */}

package/template/frontend/src/auth/AuthContext.jsx

@@ -17,6 +17,8 @@ import {
   createAuthService,
   createCrossTenantService,
   createIdentityService,
+  createRecordPolicyService,
+  createRecordShareService,
   isAuthenticated,
   principalOf,
 } from '@astram/frontend-core';
@@ -66,6 +68,11 @@ export function AuthProvider({ children }) {
       identity: createIdentityService(http),
       audit: createAuditService(http),
       crossTenant: createCrossTenantService(http),
+      // The guided rule-builder surface (§9.1) — author/list/delete record-access policies +
+      // the field/operator schema that drives the builder's dropdowns.
+      recordPolicy: createRecordPolicyService(http),
+      // The owner-share surface (§9.2) — share/unshare/list a record's shares (owner-only).
+      recordShare: createRecordShareService(http),
       account: createAccountService(http),
       // The @astram/sdk ShieldClient (Phase E slice 1) — a UX-convenience projection of
       // the caller's OWN coarse grants, fetched once per session via `getAuthFacts`.
@@ -81,7 +88,8 @@ export function AuthProvider({ children }) {
       store,
     };
   }
-  const { auth, identity, audit, crossTenant, account, shield, store } = services.current;
+  const { auth, identity, audit, crossTenant, recordPolicy, recordShare, account, shield, store } =
+    services.current;
 
   const [state, setState] = useState(() => store.load()); // SessionState | null
   // The signed-in user's DISPLAY profile (name/email/company/roles) from GET /auth/me.
@@ -284,6 +292,11 @@ export function AuthProvider({ children }) {
       // The shared cross-tenant grant service (offer/accept/revoke + inbox/mine +
       // offerable-types) — same injected web http client.
       crossTenant,
+      // The shared guided rule-builder service (author/list/delete record policies + the
+      // field/operator schema) — same injected web http client.
+      recordPolicy,
+      // The shared owner-share service (share/unshare/list a record's shares) — same client.
+      recordShare,
       // The shared self-scoped account service (change-password today; profile/MFA
       // later) — same injected web http client.
       account,
@@ -306,7 +319,7 @@ export function AuthProvider({ children }) {
         ),
     }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [state, auth, identity, audit, crossTenant, account, shield, profile, mustReenroll, authFacts],
+    [state, auth, identity, audit, crossTenant, recordPolicy, recordShare, account, shield, profile, mustReenroll, authFacts],
   );
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;

package/template/frontend/src/components/ShareDialog.jsx

@@ -0,0 +1,269 @@
+/**
+ * ShareDialog — the reusable OWNER-SHARE widget (§9.2 / list-scoping engine Phase 6).
+ *
+ * A record's owner opens this from a record's detail/list to manage WHO can see it: it lists the
+ * record's current shares (grantee NAMES, never raw uuids), lets the owner add a share (grantee
+ * kind → user/role searchable picker → action → Add), and revoke one with a confirm. The server
+ * enforces owner-only (a non-owner gets 403); the tenant + sharer are resolved server-side.
+ *
+ * Props:
+ *   open, onOpenChange — dialog control.
+ *   typeKey, recordId  — the record being shared (the owner-bound is server-enforced).
+ *   recordLabel        — a human label for the title (never the uuid).
+ *   actions            — the action vocabulary to offer (defaults to ['read']).
+ */
+import { useCallback, useEffect, useState } from 'react';
+import { Share2, Trash2 } from 'lucide-react';
+import { toast } from 'sonner';
+import { useAuth } from '@/auth/AuthContext';
+import {
+  Dialog,
+  DialogContent,
+  DialogHeader,
+  DialogTitle,
+  DialogDescription,
+} from '@/components/ui/dialog';
+import { Button } from '@/components/ui/button';
+import { Label } from '@/components/ui/label';
+import { Badge } from '@/components/ui/badge';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+import { SearchableSelect } from '@/components/ui/searchable-select';
+import ConfirmDialog from '@/components/ConfirmDialog';
+
+export default function ShareDialog({
+  open,
+  onOpenChange,
+  typeKey,
+  recordId,
+  recordLabel,
+  actions = ['read'],
+}) {
+  const { tokens, recordShare, identity } = useAuth();
+  const token = tokens?.accessToken;
+
+  const [shares, setShares] = useState([]);
+  const [loading, setLoading] = useState(false);
+  const [error, setError] = useState('');
+
+  // The add-share form.
+  const [granteeKind, setGranteeKind] = useState('user');
+  const [grantee, setGrantee] = useState(null); // { value, label }
+  const [action, setAction] = useState(actions[0] ?? 'read');
+  const [adding, setAdding] = useState(false);
+
+  const [revokeTarget, setRevokeTarget] = useState(null);
+  const [revokeBusy, setRevokeBusy] = useState(false);
+
+  const load = useCallback(async () => {
+    if (!token || !open) return;
+    setLoading(true);
+    const r = await recordShare.listShares(token, typeKey, recordId);
+    if (r.ok) {
+      setShares(r.shares);
+      setError('');
+    } else {
+      setShares([]);
+      setError(r.error || 'Could not load the shares.');
+    }
+    setLoading(false);
+  }, [recordShare, token, typeKey, recordId, open]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  // Reset the grantee picker when the kind flips (user vs role are different directories).
+  useEffect(() => {
+    setGrantee(null);
+  }, [granteeKind]);
+
+  // Fetch grantee options (users or roles) for the searchable picker — value=uuid, label=name.
+  const fetchGrantees = useCallback(
+    async ({ search, page }) => {
+      const opts = { page, limit: 10, search };
+      const r =
+        granteeKind === 'role'
+          ? await identity.listRoles(token, opts)
+          : await identity.listUsers(token, opts);
+      if (!r.ok) return { options: [], total: 0, page: page ?? 1 };
+      const options = (r.rows || []).map((row) => ({
+        value: row.id ?? row.uuid,
+        label:
+          granteeKind === 'role'
+            ? row.fields?.name ?? '(role)'
+            : row.fields?.username ?? row.fields?.email ?? '(user)',
+      }));
+      return { options, total: r.total ?? options.length, page: page ?? 1 };
+    },
+    [identity, token, granteeKind],
+  );
+
+  const onAdd = async () => {
+    if (!grantee) {
+      toast.error('Pick a grantee.');
+      return;
+    }
+    setAdding(true);
+    const r = await recordShare.share(token, {
+      typeKey,
+      recordId,
+      granteeKind,
+      granteeUuid: grantee.value,
+      action,
+    });
+    setAdding(false);
+    if (!r.ok) {
+      toast.error(r.error || 'Could not share the record.');
+      return;
+    }
+    toast.success('Shared');
+    setGrantee(null);
+    await load();
+  };
+
+  const onConfirmRevoke = async () => {
+    if (!revokeTarget) return;
+    setRevokeBusy(true);
+    const r = await recordShare.unshare(token, {
+      typeKey,
+      recordId,
+      granteeKind: revokeTarget.granteeKind,
+      granteeUuid: revokeTarget.granteeUuid,
+      action: revokeTarget.action,
+    });
+    setRevokeBusy(false);
+    if (!r.ok) {
+      toast.error(r.error || 'Could not revoke the share.');
+      return;
+    }
+    setRevokeTarget(null);
+    toast.success('Share revoked');
+    await load();
+  };
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="max-w-lg">
+        <DialogHeader>
+          <DialogTitle className="flex items-center gap-2">
+            <Share2 className="size-4" />
+            Share {recordLabel ? `“${recordLabel}”` : 'record'}
+          </DialogTitle>
+          <DialogDescription>
+            Grant a user or role access to this record. Only you (the owner) can manage its shares.
+          </DialogDescription>
+        </DialogHeader>
+
+        {/* Current shares */}
+        <div className="space-y-2">
+          <Label>Shared with</Label>
+          {loading ? (
+            <div className="text-sm text-muted-foreground">Loading…</div>
+          ) : error ? (
+            <div className="text-sm text-destructive">{error}</div>
+          ) : shares.length === 0 ? (
+            <div className="text-sm text-muted-foreground">Not shared with anyone yet.</div>
+          ) : (
+            <ul className="divide-y divide-border rounded-md border border-border">
+              {shares.map((s) => (
+                <li
+                  key={`${s.granteeKind}:${s.granteeUuid}:${s.action}`}
+                  className="flex items-center justify-between px-3 py-2"
+                >
+                  <span className="flex items-center gap-2 text-sm">
+                    <span className="font-medium text-foreground">{s.granteeName}</span>
+                    <span className="text-xs text-muted-foreground">({s.granteeKind})</span>
+                    <Badge variant="secondary" className="font-normal">
+                      {s.action}
+                    </Badge>
+                  </span>
+                  <Button
+                    type="button"
+                    variant="ghost"
+                    size="sm"
+                    className="text-destructive hover:bg-destructive/10 hover:text-destructive"
+                    onClick={() => setRevokeTarget(s)}
+                  >
+                    <Trash2 className="size-4" />
+                    Revoke
+                  </Button>
+                </li>
+              ))}
+            </ul>
+          )}
+        </div>
+
+        {/* Add a share */}
+        <div className="mt-2 space-y-3 rounded-md border border-border p-3">
+          <Label>Add access</Label>
+          <div className="flex flex-wrap items-end gap-2">
+            <div className="space-y-1">
+              <Label className="text-xs text-muted-foreground">Grantee kind</Label>
+              <Select value={granteeKind} onValueChange={setGranteeKind}>
+                <SelectTrigger className="w-28">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  <SelectItem value="user">User</SelectItem>
+                  <SelectItem value="role">Role</SelectItem>
+                </SelectContent>
+              </Select>
+            </div>
+            <div className="min-w-48 flex-1 space-y-1">
+              <Label className="text-xs text-muted-foreground">
+                {granteeKind === 'role' ? 'Role' : 'User'}
+              </Label>
+              <SearchableSelect
+                value={grantee?.value ?? null}
+                selectedLabel={grantee?.label ?? null}
+                onChange={(value) =>
+                  setGrantee(value ? { value, label: grantee?.label ?? '' } : null)
+                }
+                onLabelChange={(label) =>
+                  setGrantee((g) => (g ? { ...g, label: label ?? '' } : g))
+                }
+                fetchPage={fetchGrantees}
+                placeholder={`Pick a ${granteeKind}`}
+              />
+            </div>
+            <div className="space-y-1">
+              <Label className="text-xs text-muted-foreground">Action</Label>
+              <Select value={action} onValueChange={setAction}>
+                <SelectTrigger className="w-28">
+                  <SelectValue />
+                </SelectTrigger>
+                <SelectContent>
+                  {actions.map((a) => (
+                    <SelectItem key={a} value={a}>
+                      {a}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>
+            <Button type="button" size="sm" onClick={onAdd} disabled={adding || !grantee}>
+              {adding ? 'Adding…' : 'Add'}
+            </Button>
+          </div>
+        </div>
+      </DialogContent>
+
+      <ConfirmDialog
+        open={!!revokeTarget}
+        title={revokeTarget ? `Revoke ${revokeTarget.granteeName}'s access?` : 'Revoke access?'}
+        message="This removes their access to this record. This cannot be undone."
+        confirmLabel="Revoke"
+        destructive
+        busy={revokeBusy}
+        onConfirm={onConfirmRevoke}
+        onCancel={() => setRevokeTarget(null)}
+      />
+    </Dialog>
+  );
+}

package/template/frontend/src/pages/access/RecordPoliciesPage.jsx

@@ -0,0 +1,390 @@
+/**
+ * RecordPoliciesPage — the GUIDED RULE-BUILDER (§9.1 / list-scoping engine Phase 5).
+ *
+ * Author record-access policies through a STRUCTURED, no-code form — never a raw expression:
+ *   pick object type → load its schema → pick action + effect → add conditions
+ *   (field dropdown → operator dropdown VALID for that field's type → value input typed per
+ *   operator) → Save. The current policies for the selected type are listed with delete-confirm.
+ *
+ * ⛔ The field/operator dropdowns come from the SERVER schema
+ * (`GET /identity/record-policies/schema`), so the builder can only compose combinations the
+ * server accepts — one source of truth, no client-side operator table. The server re-validates
+ * (`validateGuidedPolicy`) and enforces the delegated-admin ceiling on save.
+ * ⛔ The target TENANT is never sent — the server authors in the caller's own tenant.
+ * ⛔ No raw UUID is shown — `policyId` is a delete key only.
+ */
+import { useCallback, useEffect, useMemo, useState } from 'react';
+import { ShieldCheck, Plus, Trash2, Info } from 'lucide-react';
+import { toast } from 'sonner';
+import { useAuth } from '@/auth/AuthContext';
+import AppShell from '@/shell/AppShell';
+import PageHeader from '@/components/PageHeader';
+import EntityList from '@/components/EntityList';
+import ConfirmDialog from '@/components/ConfirmDialog';
+import { Badge } from '@/components/ui/badge';
+import { Button } from '@/components/ui/button';
+import { Input } from '@/components/ui/input';
+import { Label } from '@/components/ui/label';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select';
+
+/** The object types this app lets an admin author policies for. Extend as the app grows. */
+const AUTHORABLE_TYPES = ['note'];
+
+/** Human labels for the closed operator set. */
+const OPERATOR_LABELS = {
+  eq: 'equals',
+  ne: 'does not equal',
+  in: 'is any of',
+  not_in: 'is none of',
+  gt: 'is greater than',
+  lt: 'is less than',
+  gte: 'is at least',
+  lte: 'is at most',
+  contains: 'contains',
+  not_contains: 'does not contain',
+  is_null: 'is empty',
+  is_not_null: 'is not empty',
+};
+
+/** A fresh, empty condition row. */
+const emptyCondition = () => ({ field: '', operator: '', value: '' });
+
+export default function RecordPoliciesPage() {
+  const { tokens, recordPolicy } = useAuth();
+  const token = tokens?.accessToken;
+
+  const [typeKey, setTypeKey] = useState(AUTHORABLE_TYPES[0] ?? '');
+  const [schema, setSchema] = useState(null);
+  const [policies, setPolicies] = useState([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState('');
+
+  // The in-progress policy being built.
+  const [action, setAction] = useState('');
+  const [effect, setEffect] = useState('allow');
+  const [conditions, setConditions] = useState([emptyCondition()]);
+  const [saving, setSaving] = useState(false);
+
+  const [deleteTarget, setDeleteTarget] = useState(null);
+  const [deleteBusy, setDeleteBusy] = useState(false);
+
+  const fieldsByKey = useMemo(() => {
+    const m = new Map();
+    for (const f of schema?.fields ?? []) m.set(f.key, f);
+    return m;
+  }, [schema]);
+
+  const load = useCallback(async () => {
+    if (!token || !typeKey) return;
+    setLoading(true);
+    const [s, p] = await Promise.all([
+      recordPolicy.schema(token, typeKey),
+      recordPolicy.list(token, typeKey),
+    ]);
+    if (s.ok) {
+      setSchema(s.schema);
+      // Default the action to the type's first action.
+      setAction((prev) => prev || s.schema.actions?.[0] || '');
+      setError('');
+    } else {
+      setSchema(null);
+      setError(s.error || 'Could not load the policy schema for this type.');
+    }
+    setPolicies(p.ok ? p.policies : []);
+    setLoading(false);
+  }, [recordPolicy, token, typeKey]);
+
+  useEffect(() => {
+    load();
+  }, [load]);
+
+  // Reset the builder when the type changes (fields/actions differ per type).
+  useEffect(() => {
+    setAction('');
+    setConditions([emptyCondition()]);
+  }, [typeKey]);
+
+  const setCondition = (i, patch) =>
+    setConditions((cs) => cs.map((c, idx) => (idx === i ? { ...c, ...patch } : c)));
+  const addCondition = () => setConditions((cs) => [...cs, emptyCondition()]);
+  const removeCondition = (i) =>
+    setConditions((cs) => (cs.length <= 1 ? cs : cs.filter((_, idx) => idx !== i)));
+
+  const onSave = async () => {
+    if (!action) {
+      toast.error('Pick an action.');
+      return;
+    }
+    // Build the structured conditions, dropping incomplete rows; a nullary op needs no value.
+    const built = [];
+    for (const c of conditions) {
+      if (!c.field || !c.operator) continue;
+      const fieldSchema = fieldsByKey.get(c.field);
+      const isNullary = fieldSchema?.nullaryOperators?.includes(c.operator);
+      const isArray = fieldSchema?.arrayOperators?.includes(c.operator);
+      if (isNullary) {
+        built.push({ field: c.field, operator: c.operator });
+      } else if (isArray) {
+        const values = String(c.value ?? '')
+          .split(',')
+          .map((v) => v.trim())
+          .filter(Boolean);
+        built.push({ field: c.field, operator: c.operator, value: values });
+      } else {
+        built.push({ field: c.field, operator: c.operator, value: c.value });
+      }
+    }
+
+    setSaving(true);
+    const r = await recordPolicy.author(token, { typeKey, action, effect, conditions: built });
+    setSaving(false);
+    if (!r.ok) {
+      toast.error(r.error || 'Could not author the policy.');
+      return;
+    }
+    toast.success('Policy authored');
+    setConditions([emptyCondition()]);
+    await load();
+  };
+
+  const onConfirmDelete = async () => {
+    if (!deleteTarget) return;
+    setDeleteBusy(true);
+    const r = await recordPolicy.remove(token, deleteTarget.policyId);
+    setDeleteBusy(false);
+    if (!r.ok) {
+      toast.error(r.error || 'Could not delete the policy.');
+      return;
+    }
+    setDeleteTarget(null);
+    toast.success('Policy deleted');
+    await load();
+  };
+
+  // Render one policy as a human sentence: "allow read where branch equals north AND …".
+  const describe = (policy) => {
+    const parts = (policy.conditions ?? []).map((c) => {
+      const label = OPERATOR_LABELS[c.operator] ?? c.operator;
+      const val = Array.isArray(c.value) ? c.value.join(', ') : c.value;
+      const isNullary = c.operator === 'is_null' || c.operator === 'is_not_null';
+      return `${c.field} ${label}${isNullary ? '' : ` ${val}`}`;
+    });
+    const where = parts.length ? ` where ${parts.join(' AND ')}` : ' (all records)';
+    return `${policy.effect} ${policy.action}${where}`;
+  };
+
+  const policyColumns = [
+    {
+      key: 'effect',
+      label: 'Effect',
+      render: (row) => (
+        <Badge variant={row.policy.effect === 'deny' ? 'destructive' : 'success'} className="capitalize font-normal">
+          {row.policy.effect}
+        </Badge>
+      ),
+    },
+    { key: 'action', label: 'Action', render: (row) => row.policy.action },
+    { key: 'rule', label: 'Rule', render: (row) => <span className="text-sm">{describe(row.policy)}</span> },
+    {
+      key: 'rowActions',
+      label: '',
+      render: (row) => (
+        <div className="flex justify-end">
+          <Button
+            type="button"
+            variant="ghost"
+            size="sm"
+            className="text-destructive hover:bg-destructive/10 hover:text-destructive"
+            onClick={() => setDeleteTarget(row)}
+          >
+            <Trash2 className="size-4" />
+            Delete
+          </Button>
+        </div>
+      ),
+    },
+  ];
+
+  return (
+    <AppShell section="Identity" title="Record policies">
+      <div className="p-4">
+        <PageHeader section="Identity" title="Record policies" icon={ShieldCheck} />
+
+        {/* Type picker */}
+        <div className="mb-6 flex flex-wrap items-end gap-3">
+          <div className="space-y-1">
+            <Label htmlFor="policy-type">Object type</Label>
+            <Select value={typeKey} onValueChange={setTypeKey}>
+              <SelectTrigger id="policy-type" className="w-48">
+                <SelectValue placeholder="Pick a type" />
+              </SelectTrigger>
+              <SelectContent>
+                {AUTHORABLE_TYPES.map((t) => (
+                  <SelectItem key={t} value={t}>
+                    {t}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+
+        {/* The guided builder */}
+        {schema && (
+          <div className="mb-8 rounded-lg border border-border bg-card p-4">
+            <div className="mb-4 text-sm font-medium text-foreground">Build a rule</div>
+
+            <div className="mb-4 flex flex-wrap items-end gap-3">
+              <div className="space-y-1">
+                <Label htmlFor="policy-effect">Effect</Label>
+                <Select value={effect} onValueChange={setEffect}>
+                  <SelectTrigger id="policy-effect" className="w-36">
+                    <SelectValue />
+                  </SelectTrigger>
+                  <SelectContent>
+                    <SelectItem value="allow">Allow</SelectItem>
+                    <SelectItem value="deny">Deny</SelectItem>
+                  </SelectContent>
+                </Select>
+              </div>
+              <div className="space-y-1">
+                <Label htmlFor="policy-action">Action</Label>
+                <Select value={action} onValueChange={setAction}>
+                  <SelectTrigger id="policy-action" className="w-40">
+                    <SelectValue placeholder="Pick an action" />
+                  </SelectTrigger>
+                  <SelectContent>
+                    {(schema.actions ?? []).map((a) => (
+                      <SelectItem key={a} value={a}>
+                        {a}
+                      </SelectItem>
+                    ))}
+                  </SelectContent>
+                </Select>
+              </div>
+            </div>
+
+            <div className="mb-2 text-xs font-medium uppercase tracking-wide text-muted-foreground">
+              Where (all conditions must match)
+            </div>
+            <div className="space-y-2">
+              {conditions.map((c, i) => {
+                const fieldSchema = fieldsByKey.get(c.field);
+                const validOps = fieldSchema?.validOperators ?? [];
+                const isNullary = fieldSchema?.nullaryOperators?.includes(c.operator);
+                const isArray = fieldSchema?.arrayOperators?.includes(c.operator);
+                const isContains = c.operator === 'contains' || c.operator === 'not_contains';
+                return (
+                  <div key={i} className="flex flex-wrap items-center gap-2">
+                    {/* Field */}
+                    <Select
+                      value={c.field}
+                      onValueChange={(field) => setCondition(i, { field, operator: '', value: '' })}
+                    >
+                      <SelectTrigger className="w-40">
+                        <SelectValue placeholder="Field" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {(schema.fields ?? []).map((f) => (
+                          <SelectItem key={f.key} value={f.key}>
+                            {f.label}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+
+                    {/* Operator — only those VALID for the chosen field's type */}
+                    <Select
+                      value={c.operator}
+                      onValueChange={(operator) => setCondition(i, { operator, value: '' })}
+                      disabled={!c.field}
+                    >
+                      <SelectTrigger className="w-44">
+                        <SelectValue placeholder="Operator" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {validOps.map((op) => (
+                          <SelectItem key={op} value={op}>
+                            {OPERATOR_LABELS[op] ?? op}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+
+                    {/* Value — hidden for nullary ops; a comma list hint for array ops */}
+                    {!isNullary && (
+                      <Input
+                        className="w-56"
+                        placeholder={isArray ? 'value1, value2, …' : 'value'}
+                        value={c.value ?? ''}
+                        onChange={(e) => setCondition(i, { value: e.target.value })}
+                        disabled={!c.operator}
+                      />
+                    )}
+
+                    <Button
+                      type="button"
+                      variant="ghost"
+                      size="icon"
+                      onClick={() => removeCondition(i)}
+                      disabled={conditions.length <= 1}
+                      aria-label="Remove condition"
+                    >
+                      <Trash2 className="size-4" />
+                    </Button>
+
+                    {isContains && (
+                      <span className="inline-flex items-center gap-1 text-xs text-amber-600 dark:text-amber-500">
+                        <Info className="size-3.5" />
+                        “contains” is not index-friendly on large tables.
+                      </span>
+                    )}
+                  </div>
+                );
+              })}
+            </div>
+
+            <div className="mt-3 flex items-center gap-2">
+              <Button type="button" variant="outline" size="sm" onClick={addCondition}>
+                <Plus className="size-4" />
+                Add condition
+              </Button>
+              <Button type="button" size="sm" onClick={onSave} disabled={saving}>
+                {saving ? 'Saving…' : 'Save policy'}
+              </Button>
+            </div>
+          </div>
+        )}
+
+        {/* Current policies */}
+        <div className="mb-2 text-sm font-medium text-foreground">
+          Current policies for “{typeKey}”
+        </div>
+        <EntityList
+          columns={policyColumns}
+          rows={policies}
+          loading={loading}
+          error={error}
+          emptyLabel="No record policies yet — build one above."
+        />
+      </div>
+
+      <ConfirmDialog
+        open={!!deleteTarget}
+        title="Delete this record policy?"
+        message="This removes the rule. Access to matching records reverts to the remaining policies. This cannot be undone."
+        confirmLabel="Delete"
+        destructive
+        busy={deleteBusy}
+        onConfirm={onConfirmDelete}
+        onCancel={() => setDeleteTarget(null)}
+      />
+    </AppShell>
+  );
+}

package/template/frontend/src/shell/nav.js

@@ -74,6 +74,14 @@ export const NAV_SECTIONS = [
         matchPrefix: true,
         gate: 'identity:role:read',
       },
+      {
+        icon: ShieldCheck,
+        label: 'Record policies',
+        path: '/record-policies',
+        badge: null,
+        matchPrefix: true,
+        gate: 'identity:role:read',
+      },
       {
         icon: Handshake,
         label: 'Cross-tenant',

package/template/server/package.json

@@ -19,11 +19,11 @@
     "postinstall": "node scripts/sync-astram-guide.mjs"
   },
   "dependencies": {
-    "@astram/core": "^1.0.0",
-    "@astram/engine": "^0.1.3",
-    "@astram/guard": "^0.5.0",
+    "@astram/core": "^1.2.0",
+    "@astram/engine": "^0.2.0",
+    "@astram/guard": "^0.6.0",
     "@astram/guide": "^0.1.0",
-    "@astram/identity": "^0.2.0",
+    "@astram/identity": "^0.3.1",
     "@astram/migrate": "^0.2.0",
     "@astram/sdk": "^0.2.0",
     "@nestjs/common": "^11.0.0",

package/template/server/src/app.module.ts

@@ -36,11 +36,12 @@ import { DemoController } from './health/demo.controller';
  * no controllers to write. (Leaving `auth` off keeps the zero-config enforcement
  * boot; turning it on requires the config above, by design — fail-closed.)
  *
- * ── OPTIONAL: the identity ADMIN CONSOLE (companies/users/roles CRUD) ──────────
- * The framework also ships the identity management surface — company/user/role CRUD
- * (memberships, access, audit in later versions) — as controllers you mount by
- * importing ONE module. `@astram/guard` never imports `@astram/identity` (the
- * dependency graph is identity → guard), so the consumer wires it (ADR-0026):
+ * ── OPTIONAL: the identity ADMIN CONSOLE (companies/users/roles CRUD + authz) ───
+ * The framework also ships the identity management surface — company/user/role CRUD,
+ * memberships, access/grants, audit, cross-tenant grants, the GUIDED RULE-BUILDER
+ * (record-access policies), and OWNER SHARES — as controllers you mount by importing
+ * ONE module. `@astram/guard` never imports `@astram/identity` (the dependency graph is
+ * identity → guard), so the consumer wires it (ADR-0026):
  *   1. Turn auth on (above), pass the identity permission keys (so the frontend admin
  *      nav lights up), AND pass `recordAuthorization` (so the decision guard actually
  *      GRANTS — without it, decide() denies every classified route):
@@ -51,19 +52,30 @@ import { DemoController } from './health/demo.controller';
  *          ShieldModule.forRoot({ auth: true,
  *            identityActionKeys: identityAuthActionKeys, identityControlPlaneKeys,
  *            recordAuthorization: buildIdentityRecordAuthorization(authzPool) }),
- *          IdentityFeatureModule.forRoot(),   // mounts /identity/{companies,users,roles}
+ *          IdentityFeatureModule.forRoot(),   // mounts /identity/{companies,users,roles,…}
  *        ],
  *   `IdentityFeatureModule.forRoot()` self-wires the engine from your `APP_DB_*` env
  *   (no separate engine setup). Every route is `@Classified` — enforced by the same
  *   deny-by-default guard; `recordAuthorization` makes that guard render REAL decisions
  *   from your roles' grants. Omit the module and login still works; the admin pages 404.
+ *
+ *   ⛔ IF YOU REGISTER YOUR OWN OWNED OBJECT TYPES (e.g. a `Note`): pass them BOTH to
+ *   `buildIdentityRecordAuthorization(authzPool, [Note])` (so their action keys project
+ *   into gate-5 grants) AND to `IdentityFeatureModule.forRoot({ extraObjects: [Note] })`
+ *   (so the GUIDED RULE-BUILDER schema + the OWNER-SHARE resolver know them — else a
+ *   record of your type is NOT policy-authorable and NOT shareable: "type '…' is not
+ *   registered — cannot share"). The frontend ships the matching pages/widget
+ *   (RecordPoliciesPage, ShareDialog) already wired to `useAuth().recordPolicy` /
+ *   `.recordShare`.
  */
 @Module({
   // Enforcement-only by default (boots with no config). For real login + the identity
-  // admin console, use (see the OPTIONAL blocks above for the full form):
+  // admin console (incl. the guided rule-builder + owner shares), use (see the OPTIONAL
+  // blocks above for the full form + the extraObjects note for your OWN owned types):
   //   imports: [
-  //     ShieldModule.forRoot({ auth: true, identityActionKeys, identityControlPlaneKeys }),
-  //     IdentityFeatureModule.forRoot(),
+  //     ShieldModule.forRoot({ auth: true, identityActionKeys, identityControlPlaneKeys,
+  //       recordAuthorization: buildIdentityRecordAuthorization(authzPool, [/* YourType */]) }),
+  //     IdentityFeatureModule.forRoot({ /* extraObjects: [YourType] */ }),
   //   ],
   imports: [ShieldModule.forRoot()],
   controllers: [HealthController, DemoController],