permdock 0.0.0 → 0.2.0

package/dist/permissions-CDgvKG5L.d.ts

@@ -0,0 +1,52 @@
+import { g as ResourceInit, u as InferPermissionTree } from "./permissions-DttnqqxC.js";
+import { r as Role, t as Plan } from "./vocabulary-DA8a8zif.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/testing/saas/permissions.d.ts
+declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;
+declare const SaasDocSchema: StandardSchemaV1<SaasDoc>;
+declare const SaasFolderSchema: StandardSchemaV1<SaasFolder>;
+/** A folder in an org's tree; `restricted` keeps grants held on its ancestors out. */
+type SaasFolder = {
+  readonly id: string;
+  readonly orgId: string;
+  readonly parentId: string | null;
+  readonly name: string;
+  readonly restricted: boolean;
+};
+type SaasProject = {
+  readonly id: string;
+  readonly orgId: string;
+  readonly ownerId: string;
+  readonly name: string;
+  readonly archived: boolean;
+};
+type SaasDoc = {
+  readonly id: string;
+  readonly orgId: string;
+  readonly teamId: string | null;
+  readonly title: string;
+  readonly locked: boolean;
+};
+type CrudActions = readonly ["read", "update", "delete"];
+type CrudCollection = readonly ["create", "list"];
+type Collection<C extends readonly string[]> = ResourceInit<unknown, readonly [], C>;
+type SaasDefinition = {
+  readonly project: ResourceInit<SaasProject, CrudActions, CrudCollection>;
+  readonly doc: ResourceInit<SaasDoc, CrudActions, CrudCollection>;
+  readonly folder: ResourceInit<SaasFolder, CrudActions, CrudCollection>;
+  readonly member: Collection<readonly ["list", "invite", "assignRole"]>;
+  readonly settings: Collection<readonly ["manage"]>;
+  readonly billing: Collection<readonly ["read", "manage"]>;
+  readonly analytics: Collection<readonly ["read"]>;
+  readonly audit: Collection<readonly ["read"]>;
+  readonly sso: Collection<readonly ["manage"]>;
+  readonly apiKey: Collection<readonly ["manage", "create", "revokeAll"]>;
+  readonly integration: Collection<readonly ["read"]>;
+};
+declare const saasPermissions: InferPermissionTree<SaasDefinition>;
+type SaasRoleName = "owner" | "admin" | "member" | "viewer" | "lead" | "collaborator";
+declare const saasRoles: { readonly [K in SaasRoleName]: Role<K>; };
+declare const saasPlans: { readonly [K in "free" | "pro"]: Plan<K>; };
+declare const saasTenantRoleNames: readonly ["owner", "admin", "member", "viewer"];
+//#endregion
+export { SaasProject as a, saasPlans as c, SaasFolderSchema as i, saasRoles as l, SaasDocSchema as n, SaasProjectSchema as o, SaasFolder as r, saasPermissions as s, SaasDoc as t, saasTenantRoleNames as u };

package/dist/permissions-CpZrivYv.js

@@ -0,0 +1,142 @@
+import { b as resource, n as definePermissions } from "./permissions-DVoF6dMt.js";
+import { s as crud } from "./src-CSbUiozF.js";
+import { b as definePlans, x as defineRoles } from "./grantee-Cv5Sogfv.js";
+//#region src/testing/saas/schema.ts
+function accepts(kind, value) {
+	switch (kind) {
+		case "string": return typeof value === "string";
+		case "boolean": return typeof value === "boolean";
+		case "nullable-string": return value === null || typeof value === "string";
+		default: return kind;
+	}
+}
+/** A dependency-free Standard Schema for flat fixture rows. */
+function rowSchema(shape) {
+	return { "~standard": {
+		version: 1,
+		vendor: "permdock-testing",
+		validate(value) {
+			if (typeof value !== "object" || value === null) return { issues: [{ message: "expected an object" }] };
+			const record = value;
+			const issues = [];
+			for (const [field, kind] of Object.entries(shape)) if (!accepts(kind, record[field])) issues.push({
+				message: `expected ${kind}`,
+				path: [field]
+			});
+			return issues.length > 0 ? { issues } : { value: record };
+		}
+	} };
+}
+//#endregion
+//#region src/testing/saas/permissions.ts
+const SaasProjectSchema = rowSchema({
+	id: "string",
+	orgId: "string",
+	ownerId: "string",
+	name: "string",
+	archived: "boolean"
+});
+const SaasDocSchema = rowSchema({
+	id: "string",
+	orgId: "string",
+	teamId: "nullable-string",
+	title: "string",
+	locked: "boolean"
+});
+const SaasFolderSchema = rowSchema({
+	id: "string",
+	orgId: "string",
+	parentId: "nullable-string",
+	name: "string",
+	restricted: "boolean"
+});
+const saasPermissions = definePermissions({
+	project: resource(SaasProjectSchema, crud({ relations: { org: {
+		field: "orgId",
+		memberOf: "tenant"
+	} } })),
+	doc: resource(SaasDocSchema, crud({ relations: {
+		org: {
+			field: "orgId",
+			memberOf: "tenant"
+		},
+		team: {
+			field: "teamId",
+			memberOf: "team"
+		}
+	} })),
+	folder: resource(SaasFolderSchema, crud({
+		parent: {
+			field: "parentId",
+			resource: "folder"
+		},
+		restricted: "restricted",
+		relations: {
+			org: {
+				field: "orgId",
+				memberOf: "tenant"
+			},
+			viewer: {
+				edge: "folder_share",
+				object: "folder_id",
+				expiresAt: "expires_at"
+			},
+			editor: {
+				edge: "folder_editor",
+				object: "folder_id"
+			}
+		}
+	})),
+	member: resource({ collection: [
+		"list",
+		"invite",
+		"assignRole"
+	] }),
+	settings: resource({ collection: ["manage"] }),
+	billing: resource({ collection: ["read", "manage"] }),
+	analytics: resource({ collection: ["read"] }),
+	audit: resource({ collection: ["read"] }),
+	sso: resource({ collection: ["manage"] }),
+	apiKey: resource({ collection: [
+		"manage",
+		"create",
+		"revokeAll"
+	] }),
+	integration: resource({ collection: ["read"] })
+});
+const saasRoles = defineRoles({
+	owner: {
+		on: "tenant",
+		assignable: true
+	},
+	admin: {
+		on: "tenant",
+		assignable: true
+	},
+	member: {
+		on: "tenant",
+		assignable: true
+	},
+	viewer: {
+		on: "tenant",
+		assignable: true
+	},
+	lead: {
+		on: "team",
+		assignable: true
+	},
+	/** Resource-scoped; `role(..., { on: saasPermissions.project })` in the policy. */
+	collaborator: { assignable: true }
+});
+const saasPlans = definePlans({
+	free: {},
+	pro: {}
+});
+const saasTenantRoleNames = [
+	"owner",
+	"admin",
+	"member",
+	"viewer"
+];
+//#endregion
+export { saasPlans as a, rowSchema as c, saasPermissions as i, SaasFolderSchema as n, saasRoles as o, SaasProjectSchema as r, saasTenantRoleNames as s, SaasDocSchema as t };