node-type-registry 0.19.0 → 0.20.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/authz/authz-allow-all.js +10 -10
- package/authz/authz-composite.js +28 -28
- package/authz/authz-deny-all.js +10 -10
- package/authz/authz-direct-owner-any.js +19 -18
- package/authz/authz-direct-owner.js +17 -16
- package/authz/authz-entity-membership.js +39 -38
- package/authz/authz-member-list.js +17 -16
- package/authz/authz-membership-check.js +34 -34
- package/authz/authz-not-read-only.js +23 -22
- package/authz/authz-org-hierarchy.js +33 -31
- package/authz/authz-peer-ownership.js +40 -39
- package/authz/authz-publishable.js +26 -24
- package/authz/authz-related-entity-membership.js +57 -55
- package/authz/authz-related-member-list.js +35 -32
- package/authz/authz-related-peer-ownership.js +62 -59
- package/authz/authz-temporal.js +32 -30
- package/authz/index.d.ts +9 -9
- package/authz/index.js +19 -19
- package/blueprint-types.generated.js +1 -1
- package/codegen/generate-types.js +1 -1
- package/data/data-composite-field.js +27 -25
- package/data/data-direct-owner.js +24 -23
- package/data/data-entity-membership.js +24 -23
- package/data/data-force-current-user.js +17 -16
- package/data/data-id.js +16 -15
- package/data/data-immutable-fields.js +20 -19
- package/data/data-inflection.js +33 -32
- package/data/data-inherit-from-parent.js +31 -29
- package/data/data-job-trigger.js +87 -84
- package/data/data-jsonb.js +27 -26
- package/data/data-owned-fields.js +25 -23
- package/data/data-ownership-in-entity.js +21 -21
- package/data/data-peoplestamps.js +19 -19
- package/data/data-publishable.js +16 -16
- package/data/data-slug.js +21 -19
- package/data/data-soft-delete.js +14 -14
- package/data/data-status-field.js +32 -31
- package/data/data-tags.js +23 -22
- package/data/data-timestamps.js +15 -15
- package/data/index.d.ts +17 -17
- package/data/index.js +35 -35
- package/data/search-bm25.js +34 -33
- package/data/search-full-text.js +49 -47
- package/data/search-spatial-aggregate.js +77 -74
- package/data/search-spatial.js +51 -50
- package/data/search-trgm.js +20 -19
- package/data/search-unified.js +170 -162
- package/data/search-vector.js +104 -101
- package/data/table-organization-settings.js +13 -13
- package/data/table-user-profiles.js +13 -13
- package/data/table-user-settings.js +13 -13
- package/esm/authz/authz-allow-all.js +10 -10
- package/esm/authz/authz-composite.js +28 -28
- package/esm/authz/authz-deny-all.js +10 -10
- package/esm/authz/authz-direct-owner-any.js +19 -18
- package/esm/authz/authz-direct-owner.js +17 -16
- package/esm/authz/authz-entity-membership.js +39 -38
- package/esm/authz/authz-member-list.js +17 -16
- package/esm/authz/authz-membership-check.js +34 -34
- package/esm/authz/authz-not-read-only.js +23 -22
- package/esm/authz/authz-org-hierarchy.js +33 -31
- package/esm/authz/authz-peer-ownership.js +40 -39
- package/esm/authz/authz-publishable.js +26 -24
- package/esm/authz/authz-related-entity-membership.js +57 -55
- package/esm/authz/authz-related-member-list.js +35 -32
- package/esm/authz/authz-related-peer-ownership.js +62 -59
- package/esm/authz/authz-temporal.js +32 -30
- package/esm/authz/index.d.ts +9 -9
- package/esm/authz/index.js +9 -9
- package/esm/blueprint-types.generated.js +1 -1
- package/esm/codegen/generate-types.js +1 -1
- package/esm/data/data-composite-field.js +27 -25
- package/esm/data/data-direct-owner.js +24 -23
- package/esm/data/data-entity-membership.js +24 -23
- package/esm/data/data-force-current-user.js +17 -16
- package/esm/data/data-id.js +16 -15
- package/esm/data/data-immutable-fields.js +20 -19
- package/esm/data/data-inflection.js +33 -32
- package/esm/data/data-inherit-from-parent.js +31 -29
- package/esm/data/data-job-trigger.js +87 -84
- package/esm/data/data-jsonb.js +27 -26
- package/esm/data/data-owned-fields.js +25 -23
- package/esm/data/data-ownership-in-entity.js +21 -21
- package/esm/data/data-peoplestamps.js +19 -19
- package/esm/data/data-publishable.js +16 -16
- package/esm/data/data-slug.js +21 -19
- package/esm/data/data-soft-delete.js +14 -14
- package/esm/data/data-status-field.js +32 -31
- package/esm/data/data-tags.js +23 -22
- package/esm/data/data-timestamps.js +15 -15
- package/esm/data/index.d.ts +17 -17
- package/esm/data/index.js +17 -17
- package/esm/data/search-bm25.js +34 -33
- package/esm/data/search-full-text.js +49 -47
- package/esm/data/search-spatial-aggregate.js +77 -74
- package/esm/data/search-spatial.js +51 -50
- package/esm/data/search-trgm.js +20 -19
- package/esm/data/search-unified.js +170 -162
- package/esm/data/search-vector.js +104 -101
- package/esm/data/table-organization-settings.js +13 -13
- package/esm/data/table-user-profiles.js +13 -13
- package/esm/data/table-user-settings.js +13 -13
- package/esm/index.d.ts +3 -3
- package/esm/index.js +3 -3
- package/esm/module-presets/auth-email-magic.js +2 -2
- package/esm/module-presets/auth-email.js +8 -8
- package/esm/module-presets/auth-passkey.js +4 -4
- package/esm/module-presets/auth-sso.js +7 -7
- package/esm/module-presets/full.js +1 -1
- package/esm/module-presets/index.d.ts +5 -5
- package/esm/module-presets/index.js +4 -4
- package/esm/relation/index.d.ts +1 -1
- package/esm/relation/index.js +1 -1
- package/esm/relation/relation-belongs-to.js +41 -40
- package/esm/relation/relation-has-many.js +42 -41
- package/esm/relation/relation-has-one.js +42 -41
- package/esm/relation/relation-many-to-many.js +70 -68
- package/esm/relation/relation-spatial.js +54 -54
- package/esm/view/index.d.ts +3 -3
- package/esm/view/index.js +3 -3
- package/esm/view/view-aggregated.js +50 -48
- package/esm/view/view-composite.js +18 -18
- package/esm/view/view-filtered-table.js +37 -36
- package/esm/view/view-joined-tables.js +65 -61
- package/esm/view/view-table-projection.js +29 -28
- package/index.d.ts +3 -3
- package/index.js +3 -3
- package/module-presets/auth-email-magic.js +2 -2
- package/module-presets/auth-email.js +8 -8
- package/module-presets/auth-passkey.js +4 -4
- package/module-presets/auth-sso.js +7 -7
- package/module-presets/full.js +1 -1
- package/module-presets/index.d.ts +5 -5
- package/module-presets/index.js +7 -7
- package/package.json +2 -2
- package/relation/index.d.ts +1 -1
- package/relation/index.js +3 -3
- package/relation/relation-belongs-to.js +41 -40
- package/relation/relation-has-many.js +42 -41
- package/relation/relation-has-one.js +42 -41
- package/relation/relation-many-to-many.js +70 -68
- package/relation/relation-spatial.js +54 -54
- package/view/index.d.ts +3 -3
- package/view/index.js +7 -7
- package/view/view-aggregated.js +50 -48
- package/view/view-composite.js +18 -18
- package/view/view-filtered-table.js +37 -36
- package/view/view-joined-tables.js +65 -61
- package/view/view-table-projection.js +29 -28
|
@@ -1,42 +1,44 @@
|
|
|
1
1
|
export const AuthzOrgHierarchy = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
2
|
+
name: 'AuthzOrgHierarchy',
|
|
3
|
+
slug: 'authz_org_hierarchy',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Org Hierarchy',
|
|
6
|
+
description: 'Organizational hierarchy visibility using closure table. Managers can see subordinate data or subordinates can see manager data.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
direction: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
enum: [
|
|
13
|
+
'up',
|
|
14
|
+
'down'
|
|
15
15
|
],
|
|
16
|
-
|
|
16
|
+
description: 'down=manager sees subordinates, up=subordinate sees managers'
|
|
17
17
|
},
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
18
|
+
entity_field: {
|
|
19
|
+
type: 'string',
|
|
20
|
+
format: 'column-ref',
|
|
21
|
+
description: 'Field referencing the org entity',
|
|
22
|
+
default: 'entity_id'
|
|
22
23
|
},
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
24
|
+
anchor_field: {
|
|
25
|
+
type: 'string',
|
|
26
|
+
format: 'column-ref',
|
|
27
|
+
description: 'Field referencing the user (e.g., owner_id)'
|
|
26
28
|
},
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
29
|
+
max_depth: {
|
|
30
|
+
type: 'integer',
|
|
31
|
+
description: 'Optional max depth to limit visibility'
|
|
30
32
|
}
|
|
31
33
|
},
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
34
|
+
required: [
|
|
35
|
+
'direction',
|
|
36
|
+
'anchor_field'
|
|
35
37
|
]
|
|
36
38
|
},
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
39
|
+
tags: [
|
|
40
|
+
'membership',
|
|
41
|
+
'hierarchy',
|
|
42
|
+
'authz'
|
|
41
43
|
]
|
|
42
44
|
};
|
|
@@ -1,54 +1,55 @@
|
|
|
1
1
|
export const AuthzPeerOwnership = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
2
|
+
name: 'AuthzPeerOwnership',
|
|
3
|
+
slug: 'authz_peer_ownership',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Peer Ownership',
|
|
6
|
+
description: 'Peer visibility through shared entity membership. Authorizes access to user-owned rows when the owner and current user are both members of the same entity. Self-joins the SPRT table to find peers.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
owner_field: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
format: 'column-ref',
|
|
13
|
+
description: 'Column name on protected table referencing the owning user (e.g., owner_id)'
|
|
13
14
|
},
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
15
|
+
membership_type: {
|
|
16
|
+
type: [
|
|
17
|
+
'integer',
|
|
18
|
+
'string'
|
|
18
19
|
],
|
|
19
|
-
|
|
20
|
+
description: 'Scope: 1=app, 2=org, 3+=dynamic entity types (or string name resolved via membership_types_module)'
|
|
20
21
|
},
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
22
|
+
entity_type: {
|
|
23
|
+
type: 'string',
|
|
24
|
+
description: "Entity type prefix (e.g. 'channel', 'department'). Resolved to membership_type integer via memberships_module lookup. Use instead of membership_type for readability."
|
|
24
25
|
},
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
26
|
+
permission: {
|
|
27
|
+
type: 'string',
|
|
28
|
+
description: 'Single permission name to check on the current user membership (resolved to bitstring mask)'
|
|
28
29
|
},
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
30
|
+
permissions: {
|
|
31
|
+
type: 'array',
|
|
32
|
+
items: {
|
|
33
|
+
type: 'string'
|
|
33
34
|
},
|
|
34
|
-
|
|
35
|
+
description: 'Multiple permission names to check on the current user membership (ORed together into mask)'
|
|
35
36
|
},
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
37
|
+
is_admin: {
|
|
38
|
+
type: 'boolean',
|
|
39
|
+
description: 'If true, require is_admin flag on current user membership'
|
|
39
40
|
},
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
41
|
+
is_owner: {
|
|
42
|
+
type: 'boolean',
|
|
43
|
+
description: 'If true, require is_owner flag on current user membership'
|
|
43
44
|
}
|
|
44
45
|
},
|
|
45
|
-
|
|
46
|
-
|
|
46
|
+
required: [
|
|
47
|
+
'owner_field'
|
|
47
48
|
]
|
|
48
49
|
},
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
50
|
+
tags: [
|
|
51
|
+
'membership',
|
|
52
|
+
'peer',
|
|
53
|
+
'authz'
|
|
53
54
|
]
|
|
54
55
|
};
|
|
@@ -1,32 +1,34 @@
|
|
|
1
1
|
export const AuthzPublishable = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
2
|
+
name: 'AuthzPublishable',
|
|
3
|
+
slug: 'authz_publishable',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Published Content',
|
|
6
|
+
description: 'Published state access control. Restricts access to records that are published.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
is_published_field: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
format: 'column-ref',
|
|
13
|
+
description: 'Boolean field indicating published state',
|
|
14
|
+
default: 'is_published'
|
|
14
15
|
},
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
16
|
+
published_at_field: {
|
|
17
|
+
type: 'string',
|
|
18
|
+
format: 'column-ref',
|
|
19
|
+
description: 'Timestamp field for publish time',
|
|
20
|
+
default: 'published_at'
|
|
19
21
|
},
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
22
|
+
require_published_at: {
|
|
23
|
+
type: 'boolean',
|
|
24
|
+
description: 'Require published_at to be non-null and <= now()',
|
|
25
|
+
default: true
|
|
24
26
|
}
|
|
25
27
|
}
|
|
26
28
|
},
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
29
|
+
tags: [
|
|
30
|
+
'temporal',
|
|
31
|
+
'publishing',
|
|
32
|
+
'authz'
|
|
31
33
|
]
|
|
32
34
|
};
|
|
@@ -1,75 +1,77 @@
|
|
|
1
1
|
export const AuthzRelatedEntityMembership = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
2
|
+
name: 'AuthzRelatedEntityMembership',
|
|
3
|
+
slug: 'authz_related_entity_membership',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Related Entity Membership',
|
|
6
|
+
description: 'JOIN-based membership verification through related tables. Joins SPRT table with another table to verify membership.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
entity_field: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
format: 'column-ref',
|
|
13
|
+
description: 'Column name on protected table referencing the join table'
|
|
13
14
|
},
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
15
|
+
membership_type: {
|
|
16
|
+
type: [
|
|
17
|
+
'integer',
|
|
18
|
+
'string'
|
|
18
19
|
],
|
|
19
|
-
|
|
20
|
+
description: 'Scope: 1=app, 2=org, 3+=dynamic entity types (or string name resolved via membership_types_module)'
|
|
20
21
|
},
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
22
|
+
entity_type: {
|
|
23
|
+
type: 'string',
|
|
24
|
+
description: "Entity type prefix (e.g. 'channel', 'department'). Resolved to membership_type integer via memberships_module lookup. Use instead of membership_type for readability."
|
|
24
25
|
},
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
26
|
+
obj_table_id: {
|
|
27
|
+
type: 'string',
|
|
28
|
+
format: 'uuid',
|
|
29
|
+
description: 'UUID of the join table (alternative to obj_schema/obj_table)'
|
|
29
30
|
},
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
31
|
+
obj_schema: {
|
|
32
|
+
type: 'string',
|
|
33
|
+
description: 'Schema of the join table (or use obj_table_id)'
|
|
33
34
|
},
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
35
|
+
obj_table: {
|
|
36
|
+
type: 'string',
|
|
37
|
+
description: 'Name of the join table (or use obj_table_id)'
|
|
37
38
|
},
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
39
|
+
obj_field_id: {
|
|
40
|
+
type: 'string',
|
|
41
|
+
format: 'uuid',
|
|
42
|
+
description: 'UUID of field on join table (alternative to obj_field)'
|
|
42
43
|
},
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
44
|
+
obj_field: {
|
|
45
|
+
type: 'string',
|
|
46
|
+
format: 'column-ref',
|
|
47
|
+
description: 'Field name on join table to match against SPRT entity_id'
|
|
46
48
|
},
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
49
|
+
permission: {
|
|
50
|
+
type: 'string',
|
|
51
|
+
description: 'Single permission name to check (resolved to bitstring mask)'
|
|
50
52
|
},
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
53
|
+
permissions: {
|
|
54
|
+
type: 'array',
|
|
55
|
+
items: {
|
|
56
|
+
type: 'string'
|
|
55
57
|
},
|
|
56
|
-
|
|
58
|
+
description: 'Multiple permission names to check (ORed together into mask)'
|
|
57
59
|
},
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
60
|
+
is_admin: {
|
|
61
|
+
type: 'boolean',
|
|
62
|
+
description: 'If true, require is_admin flag'
|
|
61
63
|
},
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
64
|
+
is_owner: {
|
|
65
|
+
type: 'boolean',
|
|
66
|
+
description: 'If true, require is_owner flag'
|
|
65
67
|
}
|
|
66
68
|
},
|
|
67
|
-
|
|
68
|
-
|
|
69
|
+
required: [
|
|
70
|
+
'entity_field'
|
|
69
71
|
]
|
|
70
72
|
},
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
73
|
+
tags: [
|
|
74
|
+
'membership',
|
|
75
|
+
'authz'
|
|
74
76
|
]
|
|
75
77
|
};
|
|
@@ -1,43 +1,46 @@
|
|
|
1
1
|
export const AuthzRelatedMemberList = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
2
|
+
name: 'AuthzRelatedMemberList',
|
|
3
|
+
slug: 'authz_related_member_list',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Related Member List',
|
|
6
|
+
description: 'Array membership check in a related table.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
owned_schema: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
description: 'Schema of the related table'
|
|
13
13
|
},
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
14
|
+
owned_table: {
|
|
15
|
+
type: 'string',
|
|
16
|
+
description: 'Name of the related table'
|
|
17
17
|
},
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
18
|
+
owned_table_key: {
|
|
19
|
+
type: 'string',
|
|
20
|
+
format: 'column-ref',
|
|
21
|
+
description: 'Array column in related table'
|
|
21
22
|
},
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
owned_table_ref_key: {
|
|
24
|
+
type: 'string',
|
|
25
|
+
format: 'column-ref',
|
|
26
|
+
description: 'FK column in related table'
|
|
25
27
|
},
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
28
|
+
this_object_key: {
|
|
29
|
+
type: 'string',
|
|
30
|
+
format: 'column-ref',
|
|
31
|
+
description: 'PK column in protected table'
|
|
29
32
|
}
|
|
30
33
|
},
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
34
|
+
required: [
|
|
35
|
+
'owned_schema',
|
|
36
|
+
'owned_table',
|
|
37
|
+
'owned_table_key',
|
|
38
|
+
'owned_table_ref_key',
|
|
39
|
+
'this_object_key'
|
|
37
40
|
]
|
|
38
41
|
},
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
+
tags: [
|
|
43
|
+
'ownership',
|
|
44
|
+
'authz'
|
|
42
45
|
]
|
|
43
46
|
};
|
|
@@ -1,80 +1,83 @@
|
|
|
1
1
|
export const AuthzRelatedPeerOwnership = {
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
2
|
+
name: 'AuthzRelatedPeerOwnership',
|
|
3
|
+
slug: 'authz_related_peer_ownership',
|
|
4
|
+
category: 'authz',
|
|
5
|
+
display_name: 'Related Peer Ownership',
|
|
6
|
+
description: 'Peer visibility through shared entity membership via a related table. Like AuthzPeerOwnership but the owning user is resolved through a FK JOIN to a related table. Combines SPRT self-join with object table JOIN.',
|
|
7
|
+
parameter_schema: {
|
|
8
|
+
type: 'object',
|
|
9
|
+
properties: {
|
|
10
|
+
entity_field: {
|
|
11
|
+
type: 'string',
|
|
12
|
+
format: 'column-ref',
|
|
13
|
+
description: 'Column name on protected table referencing the related table (e.g., message_id)'
|
|
13
14
|
},
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
15
|
+
membership_type: {
|
|
16
|
+
type: [
|
|
17
|
+
'integer',
|
|
18
|
+
'string'
|
|
18
19
|
],
|
|
19
|
-
|
|
20
|
+
description: 'Scope: 1=app, 2=org, 3+=dynamic entity types (or string name resolved via membership_types_module)'
|
|
20
21
|
},
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
22
|
+
entity_type: {
|
|
23
|
+
type: 'string',
|
|
24
|
+
description: "Entity type prefix (e.g. 'channel', 'department'). Resolved to membership_type integer via memberships_module lookup. Use instead of membership_type for readability."
|
|
24
25
|
},
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
26
|
+
obj_table_id: {
|
|
27
|
+
type: 'string',
|
|
28
|
+
format: 'uuid',
|
|
29
|
+
description: 'UUID of the related table (alternative to obj_schema/obj_table)'
|
|
29
30
|
},
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
31
|
+
obj_schema: {
|
|
32
|
+
type: 'string',
|
|
33
|
+
description: 'Schema of the related table (or use obj_table_id)'
|
|
33
34
|
},
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
35
|
+
obj_table: {
|
|
36
|
+
type: 'string',
|
|
37
|
+
description: 'Name of the related table (or use obj_table_id)'
|
|
37
38
|
},
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
39
|
+
obj_field_id: {
|
|
40
|
+
type: 'string',
|
|
41
|
+
format: 'uuid',
|
|
42
|
+
description: 'UUID of field on related table containing the owner user ID (alternative to obj_field)'
|
|
42
43
|
},
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
44
|
+
obj_field: {
|
|
45
|
+
type: 'string',
|
|
46
|
+
format: 'column-ref',
|
|
47
|
+
description: 'Field name on related table containing the owner user ID (e.g., sender_id)'
|
|
46
48
|
},
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
49
|
+
obj_ref_field: {
|
|
50
|
+
type: 'string',
|
|
51
|
+
format: 'column-ref',
|
|
52
|
+
description: 'Field on related table to select for matching entity_field (defaults to id)'
|
|
50
53
|
},
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
+
permission: {
|
|
55
|
+
type: 'string',
|
|
56
|
+
description: 'Single permission name to check on the current user membership (resolved to bitstring mask)'
|
|
54
57
|
},
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
58
|
+
permissions: {
|
|
59
|
+
type: 'array',
|
|
60
|
+
items: {
|
|
61
|
+
type: 'string'
|
|
59
62
|
},
|
|
60
|
-
|
|
63
|
+
description: 'Multiple permission names to check on the current user membership (ORed together into mask)'
|
|
61
64
|
},
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
+
is_admin: {
|
|
66
|
+
type: 'boolean',
|
|
67
|
+
description: 'If true, require is_admin flag on current user membership'
|
|
65
68
|
},
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
+
is_owner: {
|
|
70
|
+
type: 'boolean',
|
|
71
|
+
description: 'If true, require is_owner flag on current user membership'
|
|
69
72
|
}
|
|
70
73
|
},
|
|
71
|
-
|
|
72
|
-
|
|
74
|
+
required: [
|
|
75
|
+
'entity_field'
|
|
73
76
|
]
|
|
74
77
|
},
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
78
|
+
tags: [
|
|
79
|
+
'membership',
|
|
80
|
+
'peer',
|
|
81
|
+
'authz'
|
|
79
82
|
]
|
|
80
83
|
};
|