node-type-registry 0.19.0 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/authz/authz-allow-all.js +10 -10
- package/authz/authz-composite.js +28 -28
- package/authz/authz-deny-all.js +10 -10
- package/authz/authz-direct-owner-any.js +19 -18
- package/authz/authz-direct-owner.js +17 -16
- package/authz/authz-entity-membership.js +39 -38
- package/authz/authz-member-list.js +17 -16
- package/authz/authz-membership-check.js +34 -34
- package/authz/authz-not-read-only.js +23 -22
- package/authz/authz-org-hierarchy.js +33 -31
- package/authz/authz-peer-ownership.js +40 -39
- package/authz/authz-publishable.js +26 -24
- package/authz/authz-related-entity-membership.js +57 -55
- package/authz/authz-related-member-list.js +35 -32
- package/authz/authz-related-peer-ownership.js +62 -59
- package/authz/authz-temporal.js +32 -30
- package/authz/index.d.ts +9 -9
- package/authz/index.js +19 -19
- package/blueprint-types.generated.js +1 -1
- package/codegen/generate-types.js +1 -1
- package/data/data-composite-field.js +27 -25
- package/data/data-direct-owner.js +24 -23
- package/data/data-entity-membership.js +24 -23
- package/data/data-force-current-user.js +17 -16
- package/data/data-id.js +16 -15
- package/data/data-immutable-fields.js +20 -19
- package/data/data-inflection.js +33 -32
- package/data/data-inherit-from-parent.js +31 -29
- package/data/data-job-trigger.js +87 -84
- package/data/data-jsonb.js +27 -26
- package/data/data-owned-fields.js +25 -23
- package/data/data-ownership-in-entity.js +21 -21
- package/data/data-peoplestamps.js +19 -19
- package/data/data-publishable.js +16 -16
- package/data/data-slug.js +21 -19
- package/data/data-soft-delete.js +14 -14
- package/data/data-status-field.js +32 -31
- package/data/data-tags.js +23 -22
- package/data/data-timestamps.js +15 -15
- package/data/index.d.ts +17 -17
- package/data/index.js +35 -35
- package/data/search-bm25.js +34 -33
- package/data/search-full-text.js +49 -47
- package/data/search-spatial-aggregate.js +77 -74
- package/data/search-spatial.js +51 -50
- package/data/search-trgm.js +20 -19
- package/data/search-unified.js +170 -162
- package/data/search-vector.js +104 -101
- package/data/table-organization-settings.js +13 -13
- package/data/table-user-profiles.js +13 -13
- package/data/table-user-settings.js +13 -13
- package/esm/authz/authz-allow-all.js +10 -10
- package/esm/authz/authz-composite.js +28 -28
- package/esm/authz/authz-deny-all.js +10 -10
- package/esm/authz/authz-direct-owner-any.js +19 -18
- package/esm/authz/authz-direct-owner.js +17 -16
- package/esm/authz/authz-entity-membership.js +39 -38
- package/esm/authz/authz-member-list.js +17 -16
- package/esm/authz/authz-membership-check.js +34 -34
- package/esm/authz/authz-not-read-only.js +23 -22
- package/esm/authz/authz-org-hierarchy.js +33 -31
- package/esm/authz/authz-peer-ownership.js +40 -39
- package/esm/authz/authz-publishable.js +26 -24
- package/esm/authz/authz-related-entity-membership.js +57 -55
- package/esm/authz/authz-related-member-list.js +35 -32
- package/esm/authz/authz-related-peer-ownership.js +62 -59
- package/esm/authz/authz-temporal.js +32 -30
- package/esm/authz/index.d.ts +9 -9
- package/esm/authz/index.js +9 -9
- package/esm/blueprint-types.generated.js +1 -1
- package/esm/codegen/generate-types.js +1 -1
- package/esm/data/data-composite-field.js +27 -25
- package/esm/data/data-direct-owner.js +24 -23
- package/esm/data/data-entity-membership.js +24 -23
- package/esm/data/data-force-current-user.js +17 -16
- package/esm/data/data-id.js +16 -15
- package/esm/data/data-immutable-fields.js +20 -19
- package/esm/data/data-inflection.js +33 -32
- package/esm/data/data-inherit-from-parent.js +31 -29
- package/esm/data/data-job-trigger.js +87 -84
- package/esm/data/data-jsonb.js +27 -26
- package/esm/data/data-owned-fields.js +25 -23
- package/esm/data/data-ownership-in-entity.js +21 -21
- package/esm/data/data-peoplestamps.js +19 -19
- package/esm/data/data-publishable.js +16 -16
- package/esm/data/data-slug.js +21 -19
- package/esm/data/data-soft-delete.js +14 -14
- package/esm/data/data-status-field.js +32 -31
- package/esm/data/data-tags.js +23 -22
- package/esm/data/data-timestamps.js +15 -15
- package/esm/data/index.d.ts +17 -17
- package/esm/data/index.js +17 -17
- package/esm/data/search-bm25.js +34 -33
- package/esm/data/search-full-text.js +49 -47
- package/esm/data/search-spatial-aggregate.js +77 -74
- package/esm/data/search-spatial.js +51 -50
- package/esm/data/search-trgm.js +20 -19
- package/esm/data/search-unified.js +170 -162
- package/esm/data/search-vector.js +104 -101
- package/esm/data/table-organization-settings.js +13 -13
- package/esm/data/table-user-profiles.js +13 -13
- package/esm/data/table-user-settings.js +13 -13
- package/esm/index.d.ts +3 -3
- package/esm/index.js +3 -3
- package/esm/module-presets/auth-email-magic.js +2 -2
- package/esm/module-presets/auth-email.js +8 -8
- package/esm/module-presets/auth-passkey.js +4 -4
- package/esm/module-presets/auth-sso.js +7 -7
- package/esm/module-presets/full.js +1 -1
- package/esm/module-presets/index.d.ts +5 -5
- package/esm/module-presets/index.js +4 -4
- package/esm/relation/index.d.ts +1 -1
- package/esm/relation/index.js +1 -1
- package/esm/relation/relation-belongs-to.js +41 -40
- package/esm/relation/relation-has-many.js +42 -41
- package/esm/relation/relation-has-one.js +42 -41
- package/esm/relation/relation-many-to-many.js +70 -68
- package/esm/relation/relation-spatial.js +54 -54
- package/esm/view/index.d.ts +3 -3
- package/esm/view/index.js +3 -3
- package/esm/view/view-aggregated.js +50 -48
- package/esm/view/view-composite.js +18 -18
- package/esm/view/view-filtered-table.js +37 -36
- package/esm/view/view-joined-tables.js +65 -61
- package/esm/view/view-table-projection.js +29 -28
- package/index.d.ts +3 -3
- package/index.js +3 -3
- package/module-presets/auth-email-magic.js +2 -2
- package/module-presets/auth-email.js +8 -8
- package/module-presets/auth-passkey.js +4 -4
- package/module-presets/auth-sso.js +7 -7
- package/module-presets/full.js +1 -1
- package/module-presets/index.d.ts +5 -5
- package/module-presets/index.js +7 -7
- package/package.json +2 -2
- package/relation/index.d.ts +1 -1
- package/relation/index.js +3 -3
- package/relation/relation-belongs-to.js +41 -40
- package/relation/relation-has-many.js +42 -41
- package/relation/relation-has-one.js +42 -41
- package/relation/relation-many-to-many.js +70 -68
- package/relation/relation-spatial.js +54 -54
- package/view/index.d.ts +3 -3
- package/view/index.js +7 -7
- package/view/view-aggregated.js +50 -48
- package/view/view-composite.js +18 -18
- package/view/view-filtered-table.js +37 -36
- package/view/view-joined-tables.js +65 -61
- package/view/view-table-projection.js +29 -28
package/authz/authz-allow-all.js
CHANGED
|
@@ -2,16 +2,16 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzAllowAll = void 0;
|
|
4
4
|
exports.AuthzAllowAll = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
5
|
+
name: 'AuthzAllowAll',
|
|
6
|
+
slug: 'authz_allow_all',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Public Access',
|
|
9
|
+
description: 'Allows all access. Generates TRUE expression.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {}
|
|
13
13
|
},
|
|
14
|
-
|
|
15
|
-
|
|
14
|
+
tags: [
|
|
15
|
+
'authz'
|
|
16
16
|
]
|
|
17
17
|
};
|
package/authz/authz-composite.js
CHANGED
|
@@ -2,41 +2,41 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzComposite = void 0;
|
|
4
4
|
exports.AuthzComposite = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
5
|
+
name: 'AuthzComposite',
|
|
6
|
+
slug: 'authz_composite',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Composite Policy',
|
|
9
|
+
description: 'Composite authorization policy that combines multiple authorization nodes using boolean logic (AND/OR). The data field contains a JSONB AST with nested authorization nodes.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
description: 'A composite policy containing nested authorization nodes combined with boolean logic',
|
|
13
|
+
properties: {
|
|
14
|
+
BoolExpr: {
|
|
15
|
+
type: 'object',
|
|
16
|
+
description: 'Boolean expression combining multiple authorization nodes',
|
|
17
|
+
properties: {
|
|
18
|
+
boolop: {
|
|
19
|
+
type: 'string',
|
|
20
|
+
enum: [
|
|
21
|
+
'AND_EXPR',
|
|
22
|
+
'OR_EXPR',
|
|
23
|
+
'NOT_EXPR'
|
|
24
24
|
],
|
|
25
|
-
|
|
25
|
+
description: 'Boolean operator: AND_EXPR, OR_EXPR, or NOT_EXPR'
|
|
26
26
|
},
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
27
|
+
args: {
|
|
28
|
+
type: 'array',
|
|
29
|
+
description: 'Array of authorization nodes to combine',
|
|
30
|
+
items: {
|
|
31
|
+
type: 'object'
|
|
32
32
|
}
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
35
|
}
|
|
36
36
|
}
|
|
37
37
|
},
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
38
|
+
tags: [
|
|
39
|
+
'composite',
|
|
40
|
+
'authz'
|
|
41
41
|
]
|
|
42
42
|
};
|
package/authz/authz-deny-all.js
CHANGED
|
@@ -2,16 +2,16 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzDenyAll = void 0;
|
|
4
4
|
exports.AuthzDenyAll = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
5
|
+
name: 'AuthzDenyAll',
|
|
6
|
+
slug: 'authz_deny_all',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'No Access',
|
|
9
|
+
description: 'Denies all access. Generates FALSE expression.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {}
|
|
13
13
|
},
|
|
14
|
-
|
|
15
|
-
|
|
14
|
+
tags: [
|
|
15
|
+
'authz'
|
|
16
16
|
]
|
|
17
17
|
};
|
|
@@ -2,28 +2,29 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzDirectOwnerAny = void 0;
|
|
4
4
|
exports.AuthzDirectOwnerAny = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
5
|
+
name: 'AuthzDirectOwnerAny',
|
|
6
|
+
slug: 'authz_direct_owner_any',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Multi-Owner Access',
|
|
9
|
+
description: 'OR logic for multiple ownership fields. Checks if current user matches any of the specified fields.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
entity_fields: {
|
|
14
|
+
type: 'array',
|
|
15
|
+
items: {
|
|
16
|
+
type: 'string',
|
|
17
|
+
format: 'column-ref'
|
|
17
18
|
},
|
|
18
|
-
|
|
19
|
+
description: 'Array of column names to check for ownership'
|
|
19
20
|
}
|
|
20
21
|
},
|
|
21
|
-
|
|
22
|
-
|
|
22
|
+
required: [
|
|
23
|
+
'entity_fields'
|
|
23
24
|
]
|
|
24
25
|
},
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
26
|
+
tags: [
|
|
27
|
+
'ownership',
|
|
28
|
+
'authz'
|
|
28
29
|
]
|
|
29
30
|
};
|
|
@@ -2,25 +2,26 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzDirectOwner = void 0;
|
|
4
4
|
exports.AuthzDirectOwner = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
5
|
+
name: 'AuthzDirectOwner',
|
|
6
|
+
slug: 'authz_direct_owner',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Direct Ownership',
|
|
9
|
+
description: 'Direct equality comparison between a table column and the current user ID. Simplest authorization pattern with no subqueries.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
entity_field: {
|
|
14
|
+
type: 'string',
|
|
15
|
+
format: 'column-ref',
|
|
16
|
+
description: 'Column name containing the owner user ID (e.g., owner_id)'
|
|
16
17
|
}
|
|
17
18
|
},
|
|
18
|
-
|
|
19
|
-
|
|
19
|
+
required: [
|
|
20
|
+
'entity_field'
|
|
20
21
|
]
|
|
21
22
|
},
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
tags: [
|
|
24
|
+
'ownership',
|
|
25
|
+
'authz'
|
|
25
26
|
]
|
|
26
27
|
};
|
|
@@ -2,55 +2,56 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzEntityMembership = void 0;
|
|
4
4
|
exports.AuthzEntityMembership = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
5
|
+
name: 'AuthzEntityMembership',
|
|
6
|
+
slug: 'authz_entity_membership',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Entity Membership',
|
|
9
|
+
description: 'Membership check scoped by a field on the row through the SPRT table. Verifies user has membership in the entity referenced by the row.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
entity_field: {
|
|
14
|
+
type: 'string',
|
|
15
|
+
format: 'column-ref',
|
|
16
|
+
description: 'Column name referencing the entity (e.g., entity_id, org_id)'
|
|
16
17
|
},
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
18
|
+
membership_type: {
|
|
19
|
+
type: [
|
|
20
|
+
'integer',
|
|
21
|
+
'string'
|
|
21
22
|
],
|
|
22
|
-
|
|
23
|
+
description: 'Scope: 1=app, 2=org, 3+=dynamic entity types (or string name resolved via membership_types_module)'
|
|
23
24
|
},
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
25
|
+
entity_type: {
|
|
26
|
+
type: 'string',
|
|
27
|
+
description: "Entity type prefix (e.g. 'channel', 'department'). Resolved to membership_type integer via memberships_module lookup. Use instead of membership_type for readability."
|
|
27
28
|
},
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
29
|
+
permission: {
|
|
30
|
+
type: 'string',
|
|
31
|
+
description: 'Single permission name to check (resolved to bitstring mask)'
|
|
31
32
|
},
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
33
|
+
permissions: {
|
|
34
|
+
type: 'array',
|
|
35
|
+
items: {
|
|
36
|
+
type: 'string'
|
|
36
37
|
},
|
|
37
|
-
|
|
38
|
+
description: 'Multiple permission names to check (ORed together into mask)'
|
|
38
39
|
},
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
40
|
+
is_admin: {
|
|
41
|
+
type: 'boolean',
|
|
42
|
+
description: 'If true, require is_admin flag'
|
|
42
43
|
},
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
44
|
+
is_owner: {
|
|
45
|
+
type: 'boolean',
|
|
46
|
+
description: 'If true, require is_owner flag'
|
|
46
47
|
}
|
|
47
48
|
},
|
|
48
|
-
|
|
49
|
-
|
|
49
|
+
required: [
|
|
50
|
+
'entity_field'
|
|
50
51
|
]
|
|
51
52
|
},
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
53
|
+
tags: [
|
|
54
|
+
'membership',
|
|
55
|
+
'authz'
|
|
55
56
|
]
|
|
56
57
|
};
|
|
@@ -2,25 +2,26 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzMemberList = void 0;
|
|
4
4
|
exports.AuthzMemberList = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
5
|
+
name: 'AuthzMemberList',
|
|
6
|
+
slug: 'authz_member_list',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Member List',
|
|
9
|
+
description: 'Check if current user is in an array column on the same row.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
array_field: {
|
|
14
|
+
type: 'string',
|
|
15
|
+
format: 'column-ref',
|
|
16
|
+
description: 'Column name containing the array of user IDs'
|
|
16
17
|
}
|
|
17
18
|
},
|
|
18
|
-
|
|
19
|
-
|
|
19
|
+
required: [
|
|
20
|
+
'array_field'
|
|
20
21
|
]
|
|
21
22
|
},
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
tags: [
|
|
24
|
+
'ownership',
|
|
25
|
+
'authz'
|
|
25
26
|
]
|
|
26
27
|
};
|
|
@@ -2,49 +2,49 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzMembership = void 0;
|
|
4
4
|
exports.AuthzMembership = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
5
|
+
name: 'AuthzMembership',
|
|
6
|
+
slug: 'authz_membership_check',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Membership Check',
|
|
9
|
+
description: 'Membership check that verifies the user has membership (optionally with specific permission) without binding to any entity from the row. Uses EXISTS subquery against SPRT table.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
membership_type: {
|
|
14
|
+
type: [
|
|
15
|
+
'integer',
|
|
16
|
+
'string'
|
|
17
17
|
],
|
|
18
|
-
|
|
18
|
+
description: 'Scope: 1=app, 2=org, 3+=dynamic entity types (or string name resolved via membership_types_module)'
|
|
19
19
|
},
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
20
|
+
entity_type: {
|
|
21
|
+
type: 'string',
|
|
22
|
+
description: "Entity type prefix (e.g. 'channel', 'department'). Resolved to membership_type integer via memberships_module lookup. Use instead of membership_type for readability."
|
|
23
23
|
},
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
24
|
+
permission: {
|
|
25
|
+
type: 'string',
|
|
26
|
+
description: 'Single permission name to check (resolved to bitstring mask)'
|
|
27
27
|
},
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
28
|
+
permissions: {
|
|
29
|
+
type: 'array',
|
|
30
|
+
items: {
|
|
31
|
+
type: 'string'
|
|
32
32
|
},
|
|
33
|
-
|
|
33
|
+
description: 'Multiple permission names to check (ORed together into mask)'
|
|
34
34
|
},
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
35
|
+
is_admin: {
|
|
36
|
+
type: 'boolean',
|
|
37
|
+
description: 'If true, require is_admin flag'
|
|
38
38
|
},
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
39
|
+
is_owner: {
|
|
40
|
+
type: 'boolean',
|
|
41
|
+
description: 'If true, require is_owner flag'
|
|
42
42
|
}
|
|
43
43
|
},
|
|
44
|
-
|
|
44
|
+
required: []
|
|
45
45
|
},
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
46
|
+
tags: [
|
|
47
|
+
'membership',
|
|
48
|
+
'authz'
|
|
49
49
|
]
|
|
50
50
|
};
|
|
@@ -2,33 +2,34 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzNotReadOnly = void 0;
|
|
4
4
|
exports.AuthzNotReadOnly = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
5
|
+
name: 'AuthzNotReadOnly',
|
|
6
|
+
slug: 'authz_not_read_only',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Not Read-Only',
|
|
9
|
+
description: 'Restrictive policy that blocks read-only members from mutations. Checks actor_id + is_read_only IS NOT TRUE on the SPRT. Designed to run as a restrictive counterpart after a permissive AuthzEntityMembership policy has already verified membership.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
entity_field: {
|
|
14
|
+
type: 'string',
|
|
15
|
+
format: 'column-ref',
|
|
16
|
+
description: 'Column name referencing the entity (e.g., entity_id, org_id)'
|
|
16
17
|
},
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
18
|
+
membership_type: {
|
|
19
|
+
type: [
|
|
20
|
+
'integer',
|
|
21
|
+
'string'
|
|
21
22
|
],
|
|
22
|
-
|
|
23
|
+
description: 'Scope: 2=org, 3+=dynamic entity types. Must be >= 2 (entity-scoped).'
|
|
23
24
|
}
|
|
24
25
|
},
|
|
25
|
-
|
|
26
|
-
|
|
26
|
+
required: [
|
|
27
|
+
'entity_field'
|
|
27
28
|
]
|
|
28
29
|
},
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
30
|
+
tags: [
|
|
31
|
+
'membership',
|
|
32
|
+
'authz',
|
|
33
|
+
'restrictive'
|
|
33
34
|
]
|
|
34
35
|
};
|
|
@@ -2,44 +2,46 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.AuthzOrgHierarchy = void 0;
|
|
4
4
|
exports.AuthzOrgHierarchy = {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
5
|
+
name: 'AuthzOrgHierarchy',
|
|
6
|
+
slug: 'authz_org_hierarchy',
|
|
7
|
+
category: 'authz',
|
|
8
|
+
display_name: 'Org Hierarchy',
|
|
9
|
+
description: 'Organizational hierarchy visibility using closure table. Managers can see subordinate data or subordinates can see manager data.',
|
|
10
|
+
parameter_schema: {
|
|
11
|
+
type: 'object',
|
|
12
|
+
properties: {
|
|
13
|
+
direction: {
|
|
14
|
+
type: 'string',
|
|
15
|
+
enum: [
|
|
16
|
+
'up',
|
|
17
|
+
'down'
|
|
18
18
|
],
|
|
19
|
-
|
|
19
|
+
description: 'down=manager sees subordinates, up=subordinate sees managers'
|
|
20
20
|
},
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
21
|
+
entity_field: {
|
|
22
|
+
type: 'string',
|
|
23
|
+
format: 'column-ref',
|
|
24
|
+
description: 'Field referencing the org entity',
|
|
25
|
+
default: 'entity_id'
|
|
25
26
|
},
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
27
|
+
anchor_field: {
|
|
28
|
+
type: 'string',
|
|
29
|
+
format: 'column-ref',
|
|
30
|
+
description: 'Field referencing the user (e.g., owner_id)'
|
|
29
31
|
},
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
32
|
+
max_depth: {
|
|
33
|
+
type: 'integer',
|
|
34
|
+
description: 'Optional max depth to limit visibility'
|
|
33
35
|
}
|
|
34
36
|
},
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
37
|
+
required: [
|
|
38
|
+
'direction',
|
|
39
|
+
'anchor_field'
|
|
38
40
|
]
|
|
39
41
|
},
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
42
|
+
tags: [
|
|
43
|
+
'membership',
|
|
44
|
+
'hierarchy',
|
|
45
|
+
'authz'
|
|
44
46
|
]
|
|
45
47
|
};
|