rastack 0.0.51 → 0.0.52

package/src/define/markers.ts

@@ -0,0 +1,83 @@
+/**
+ * Entity-level authorization markers — auth as *TypeScript types*.
+ *
+ * Class and interface entities have no options bag, so their access policy is
+ * expressed the same way their columns are: in the type system. Attach a
+ * marker with `implements` (classes) or `extends` (interfaces) and the
+ * compiler reads the policy straight off the heritage clause:
+ *
+ * ```ts
+ * import { AdminGroups, IsAuthenticated, Owner, Group } from "rastack/auth";
+ *
+ * // Per-user rows: RLS on `owner`, staff sees everything.
+ * export class Itinerary implements IsAuthenticated, AdminGroups<"staff"> {
+ *   owner!: string & Owner;
+ *   notes!: string;
+ * }
+ *
+ * // Group-owned dataset: rows belong to a team and are *physically stored*
+ * // under that team's own storage prefix (groups/{team}/…).
+ * export class Report implements IsAuthenticated, AdminGroups<"staff"> {
+ *   team!: string & Group;
+ *   title!: string;
+ * }
+ * ```
+ *
+ * The markers are phantom types: every property is optional and never exists
+ * at runtime, so `implements` needs no members and instances stay plain data.
+ * Each marker family uses its own phantom key, so markers combine freely —
+ * while two *permission* markers on one entity conflict in the type checker,
+ * which is exactly right.
+ *
+ * JSDoc equivalents exist for every marker (`@rastackPermission`,
+ * `@rastackAdminGroups staff, ops`, `@rastackScope owner|group|shared`, and
+ * field-level `@owner` / `@group`), mirroring the column-constraint tags.
+ */
+
+/** The permission gate carried in the type system. */
+export interface PermissionOf<P extends string> {
+  readonly __rastackPermission?: P;
+}
+
+/** Every path requires a verified identity (this is also the default). */
+export interface IsAuthenticated extends PermissionOf<"authenticated"> {}
+
+/** Anonymous callers may read (list/retrieve); writes require identity. */
+export interface IsAuthenticatedOrReadOnly extends PermissionOf<"authenticatedOrReadOnly"> {}
+
+/** No gate — every caller may read and write. Opt-in, never the default. */
+export interface IsPublic extends PermissionOf<"public"> {}
+
+/**
+ * Token groups (`cognito:groups`) that bypass row-level security on this
+ * entity — the "is admin" role, driven from scopes: `implements
+ * AdminGroups<"staff" | "ops">`. Members see and act on every row.
+ */
+export interface AdminGroups<G extends string> {
+  readonly __rastackAdminGroups?: G;
+}
+
+/** Storage scope carried in the type system. */
+export interface ScopeOf<S extends string> {
+  readonly __rastackScope?: S;
+}
+
+/**
+ * Physically partition the entity's table per identity
+ * (`tenants/{sub}/…`) — the prefix object-storage IAM can fence per user.
+ * Combine with an `Owner` field brand.
+ */
+export interface OwnerScoped extends ScopeOf<"owner"> {}
+
+/**
+ * Physically partition the entity's table per group (`groups/{name}/…`).
+ * This is the default whenever a `Group` field brand is present — declare it
+ * only for emphasis or with a JSDoc-configured group field.
+ */
+export interface GroupScoped extends ScopeOf<"group"> {}
+
+/**
+ * Keep rows in one shared table (row-level filters still apply). Use to opt a
+ * `Group`-branded entity out of the default per-group physical partitioning.
+ */
+export interface SharedStorage extends ScopeOf<"shared"> {}

package/src/define/types.ts

@@ -0,0 +1,11 @@
+/**
+ * The `rastack/types` compatibility surface — one module aliasing the two
+ * split authoring subpaths: `rastack/db` (the `DbConfig` column brands) and
+ * `rastack/auth` (the entity-level auth markers + `Owner`/`Group` brands).
+ * Prefer those; everything stays re-exported here so existing imports keep
+ * working. The compiler maps all three specifiers (see `compile/program.ts`);
+ * the published package re-exports the same modules from `tools/types.ts`.
+ */
+
+export * from "./db";
+export * from "./markers";

package/test/auth.spec.ts

@@ -0,0 +1,207 @@
+/**
+ * Tests for the `rastack/auth` core — the client-side mirror of the access
+ * rules `rastack-api-core` enforces (see `rust/rastack-api-core/tests/access.rs`
+ * for the server side of the same matrix). The semantics here must track the
+ * Rust `check_permission` / `enforced_owner` exactly: `can()` answers "would
+ * the server accept this request?", so the components can limit the paths they
+ * expose instead of surfacing 401s.
+ */
+
+import {
+  anonymousAuth,
+  authFromClaims,
+  bypassesRls,
+  can,
+  canActOnRow,
+  isAdmin,
+  ownsRow,
+  policyFromManifest,
+  policyFromOpenApi,
+  trustedAuth,
+  userAuth,
+  type ResourcePolicy,
+} from "../auth/core";
+
+const rls: ResourcePolicy = {
+  permission: "authenticated",
+  access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
+};
+
+describe("rastack/auth — the permission gate (can)", () => {
+  it("defaults to authenticated — secure by default, like the server", () => {
+    expect(can(anonymousAuth(), {}, "list")).toBe(false);
+    expect(can(anonymousAuth(), undefined, "create")).toBe(false);
+    expect(can(userAuth("u1"), {}, "list")).toBe(true);
+    expect(can(userAuth("u1"), undefined, "delete")).toBe(true);
+  });
+
+  it("public admits everyone, for every action", () => {
+    const policy: ResourcePolicy = { permission: "public" };
+    for (const action of [
+      "list",
+      "retrieve",
+      "create",
+      "update",
+      "delete",
+    ] as const) {
+      expect(can(anonymousAuth(), policy, action)).toBe(true);
+    }
+  });
+
+  it("authenticatedOrReadOnly admits anonymous reads but not writes", () => {
+    const policy: ResourcePolicy = { permission: "authenticatedOrReadOnly" };
+    expect(can(anonymousAuth(), policy, "list")).toBe(true);
+    expect(can(anonymousAuth(), policy, "retrieve")).toBe(true);
+    expect(can(anonymousAuth(), policy, "create")).toBe(false);
+    expect(can(anonymousAuth(), policy, "update")).toBe(false);
+    expect(can(anonymousAuth(), policy, "delete")).toBe(false);
+    expect(can(userAuth("u1"), policy, "delete")).toBe(true);
+  });
+
+  it("row-secured resources need a subject (the server answers 401 without one)", () => {
+    // Authenticated but subject-less — e.g. a machine token without `sub`.
+    const noSub = { authenticated: true, groups: [] };
+    expect(can(noSub, rls, "list")).toBe(false);
+    expect(can(userAuth("u1"), rls, "list")).toBe(true);
+    // A configured admin group bypasses row-level security.
+    expect(can({ ...noSub, groups: ["staff"] }, rls, "list")).toBe(true);
+  });
+
+  it("trusted contexts (dev without auth) pass everything", () => {
+    expect(can(trustedAuth(), rls, "delete")).toBe(true);
+  });
+
+  it("a missing identity gates nothing — the server stays the enforcer", () => {
+    expect(can(undefined, rls, "delete")).toBe(true);
+    expect(can(null, { permission: "authenticated" }, "create")).toBe(true);
+  });
+});
+
+describe("rastack/auth — row-level security helpers", () => {
+  const mine = { id: 1, owner: "u1" };
+  const theirs = { id: 2, owner: "u2" };
+
+  it("owners own their rows; others don't", () => {
+    expect(ownsRow(userAuth("u1"), rls, mine)).toBe(true);
+    expect(ownsRow(userAuth("u1"), rls, theirs)).toBe(false);
+  });
+
+  it("admin groups and trusted contexts bypass the owner filter", () => {
+    expect(bypassesRls(userAuth("u1", ["staff"]), rls)).toBe(true);
+    expect(ownsRow(userAuth("u1", ["staff"]), rls, theirs)).toBe(true);
+    expect(ownsRow(trustedAuth(), rls, theirs)).toBe(true);
+    expect(bypassesRls(userAuth("u1", ["other"]), rls)).toBe(false);
+  });
+
+  it("unsecured resources are owned by everyone", () => {
+    expect(ownsRow(userAuth("u1"), {}, theirs)).toBe(true);
+  });
+
+  it("canActOnRow combines the gate and ownership", () => {
+    expect(canActOnRow(userAuth("u1"), rls, "update", mine)).toBe(true);
+    expect(canActOnRow(userAuth("u1"), rls, "update", theirs)).toBe(false);
+    expect(canActOnRow(anonymousAuth(), rls, "update", mine)).toBe(false);
+  });
+});
+
+describe("rastack/auth — group-owned datasets", () => {
+  // A group dataset: rows belong to a team, physically partitioned per group.
+  const grouped: ResourcePolicy = {
+    permission: "authenticated",
+    access: { groupField: "team", scope: "group", adminGroups: ["staff"] },
+  };
+  const blueRow = { id: 1, team: "blue" };
+
+  it("members read; identities in no group can read (empty) but never write", () => {
+    const dana = userAuth("dana", ["blue"]);
+    const loner = userAuth("lonnie", []);
+    expect(can(dana, grouped, "list")).toBe(true);
+    expect(can(dana, grouped, "create")).toBe(true);
+    // Reads outside any group just come back empty — but a write can never
+    // succeed, so the UI shouldn't offer it.
+    expect(can(loner, grouped, "list")).toBe(true);
+    expect(can(loner, grouped, "create")).toBe(false);
+    expect(can(loner, grouped, "delete")).toBe(false);
+  });
+
+  it("row membership mirrors the server's group guard", () => {
+    expect(ownsRow(userAuth("dana", ["blue"]), grouped, blueRow)).toBe(true);
+    expect(ownsRow(userAuth("erin", ["green"]), grouped, blueRow)).toBe(false);
+    expect(
+      canActOnRow(userAuth("erin", ["green"]), grouped, "update", blueRow),
+    ).toBe(false);
+    // adminGroups members act across groups.
+    expect(ownsRow(userAuth("sam", ["staff"]), grouped, blueRow)).toBe(true);
+  });
+
+  it("owner + group guards both apply when a policy carries both", () => {
+    const both: ResourcePolicy = {
+      access: { ownerField: "owner", groupField: "team" },
+    };
+    const row = { id: 1, owner: "dana", team: "blue" };
+    expect(ownsRow(userAuth("dana", ["blue"]), both, row)).toBe(true);
+    expect(ownsRow(userAuth("dana", ["green"]), both, row)).toBe(false);
+    expect(ownsRow(userAuth("erin", ["blue"]), both, row)).toBe(false);
+  });
+
+  it("isAdmin is the scope-driven admin role", () => {
+    expect(isAdmin(userAuth("sam", ["staff"]), grouped)).toBe(true);
+    expect(isAdmin(userAuth("dana", ["blue"]), grouped)).toBe(false);
+    expect(isAdmin(trustedAuth(), grouped)).toBe(true);
+  });
+});
+
+describe("rastack/auth — building an identity", () => {
+  it("authFromClaims reads sub and cognito:groups from a decoded token", () => {
+    const auth = authFromClaims({
+      sub: "u1",
+      "cognito:groups": ["staff", 42],
+      email: "x@y.z",
+    });
+    expect(auth).toEqual({ authenticated: true, sub: "u1", groups: ["staff"] });
+    expect(authFromClaims({}).authenticated).toBe(false);
+  });
+});
+
+describe("rastack/auth — policy lookup", () => {
+  const manifest = {
+    resources: [
+      { app: "airports", model: "airport", fields: [] },
+      {
+        app: "airports",
+        model: "itinerary",
+        fields: [],
+        permission: "authenticated",
+        access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
+      },
+    ],
+  };
+
+  it("policyFromManifest extracts permission + access", () => {
+    expect(policyFromManifest(manifest, "airports.itinerary")).toEqual(rls);
+    expect(
+      policyFromManifest(manifest, { app: "airports", model: "airport" }),
+    ).toEqual({});
+    expect(policyFromManifest(manifest, "airports.missing")).toBeUndefined();
+    // Accepts the JSON string form the provider may hold.
+    expect(
+      policyFromManifest(JSON.stringify(manifest), "airports.itinerary"),
+    ).toEqual(rls);
+  });
+
+  it("policyFromOpenApi reads the x-rastack-permission / x-rastack-access stamps", () => {
+    const doc = {
+      paths: {
+        "/api/airports/v1/itinerary/": {
+          get: {
+            operationId: "listItinerary",
+            "x-rastack-permission": "authenticated",
+            "x-rastack-access": rls.access,
+          },
+        },
+      },
+    };
+    expect(policyFromOpenApi(doc, "airports.itinerary")).toEqual(rls);
+    expect(policyFromOpenApi(doc, "airports.airport")).toBeUndefined();
+  });
+});

package/test/compile.spec.ts

@@ -81,7 +81,10 @@ describe("rastack compile — resource analysis & FK inference", () => {
 
     const airportField = terminal.fields.find((f) => f.name === "airport");
     expect(airportField?.type).toBe("fk");
-    expect(airportField?.relation).toEqual({ app: "airports", model: "airport" });
+    expect(airportField?.relation).toEqual({
+      app: "airports",
+      model: "airport",
+    });
 
     expect(terminal.relations).toEqual([
       { field: "airport", target: "airports.airport", kind: "fk" },
@@ -132,7 +135,9 @@ describe("rastack compile — resource analysis & FK inference", () => {
     });
 
     // Resources without an access block stay unstamped.
-    expect(findResource(resources, "airports", "airport").access).toBeUndefined();
+    expect(
+      findResource(resources, "airports", "airport").access,
+    ).toBeUndefined();
   });
 
   it("reports no collisions for a valid graph", () => {
@@ -176,9 +181,9 @@ describe("rastack compile — OpenAPI emission", () => {
     // Local-mode sync extensions, confirmed on update.
     const flightList = doc.paths["/api/airports/v1/flight/"];
     expect(flightList.get["x-rastack-sync"]).toBe("local");
-    expect(doc.paths["/api/airports/v1/flight/{id}/"].put["x-rastack-sync"]).toBe(
-      "confirmed",
-    );
+    expect(
+      doc.paths["/api/airports/v1/flight/{id}/"].put["x-rastack-sync"],
+    ).toBe("confirmed");
     expect(doc.paths["/api/airports/v1/gate/"].get["x-rastack-sync-load"]).toBe(
       "lazy",
     );
@@ -186,19 +191,25 @@ describe("rastack compile — OpenAPI emission", () => {
       doc.paths["/api/airports/v1/booking/"].post["x-rastack-sync-client-ids"],
     ).toBe(true);
 
-    // Access-controlled resource carries the access extension on every op.
+    // Access-controlled resource carries the full policy on every op — the
+    // permission gate plus the access block `rastack/auth` mirrors in the UI.
     const itineraryList = doc.paths["/api/airports/v1/itinerary/"];
+    expect(itineraryList.get["x-rastack-permission"]).toBe("authenticated");
     expect(itineraryList.get["x-rastack-access"]).toEqual({
       ownerField: "owner",
       scope: "owner",
+      adminGroups: ["staff"],
     });
     expect(
       doc.paths["/api/airports/v1/itinerary/{id}/"].delete["x-rastack-access"],
-    ).toEqual({ ownerField: "owner", scope: "owner" });
+    ).toEqual({ ownerField: "owner", scope: "owner", adminGroups: ["staff"] });
     // Unscoped resources stay unstamped.
     expect(
       doc.paths["/api/airports/v1/airport/"].get["x-rastack-access"],
     ).toBeUndefined();
+    expect(
+      doc.paths["/api/airports/v1/airport/"].get["x-rastack-permission"],
+    ).toBeUndefined();
   });
 
   it("round-trips through the existing hooks codegen", async () => {

package/test/components.spec.ts

@@ -16,6 +16,7 @@ import {
   resolveFieldSpecs,
 } from "../components/auto-form/fields";
 import { buildAutoFormModel } from "../components/auto-form/use-auto-form";
+import { anonymousAuth, userAuth, type ResourcePolicy } from "../auth/core";
 import type {
   TableQuery,
   AutoFormLike,
@@ -406,3 +407,118 @@ describe("buildAutoFormModel — wiring a form hook into field descriptors", ()
     expect(transition).toHaveBeenCalledWith("board");
   });
 });
+
+// Auth handling built into the components: the models mirror the server's
+// `permission` gate + row-level security (rastack/auth) so the UI never
+// offers a write the API would reject.
+describe("component models — authorization gating", () => {
+  const rls: ResourcePolicy = {
+    permission: "authenticated",
+    access: { ownerField: "owner", scope: "owner", adminGroups: ["staff"] },
+  };
+  const readOnly: ResourcePolicy = { permission: "authenticatedOrReadOnly" };
+
+  const makeField = (): AutoFormField =>
+    ({
+      value: "",
+      error: "",
+      type: "text",
+      isChecked: false,
+      isError: false,
+      isDisabled: false,
+      isRequired: false,
+      setValue: jest.fn(),
+      setTouched: jest.fn(),
+    }) as unknown as AutoFormField;
+
+  const form: AutoFormLike = {
+    formValues: { owner: "u1", notes: "hi" },
+    getFormField: () => makeField(),
+    onSubmit: jest.fn(),
+    resetForm: jest.fn(),
+    isSubmitDisabled: false,
+    isSubmitting: false,
+    errors: {},
+  };
+
+  it("auto-form: anonymous writes are blocked by the permission gate", () => {
+    const model = buildAutoFormModel(form, {
+      auth: anonymousAuth(),
+      policy: readOnly,
+      action: "update",
+    });
+    expect(model.canWrite).toBe(false);
+    expect(model.canSubmit).toBe(false);
+
+    const asUser = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: readOnly,
+    });
+    expect(asUser.canWrite).toBe(true);
+  });
+
+  it("auto-form: no identity wired up ⇒ ungated (server stays the enforcer)", () => {
+    const model = buildAutoFormModel(form, { policy: rls });
+    expect(model.canWrite).toBe(true);
+    expect(model.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+  });
+
+  it("auto-form: hides the server-stamped owner field, except for RLS bypassers", () => {
+    const model = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: rls,
+    });
+    expect(model.fields.map((f) => f.name)).toEqual(["notes"]);
+
+    const staff = buildAutoFormModel(form, {
+      auth: userAuth("u1", ["staff"]),
+      policy: rls,
+    });
+    expect(staff.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+
+    // An explicit field list is the author's call — never overridden.
+    const explicit = buildAutoFormModel(form, {
+      auth: userAuth("u1"),
+      policy: rls,
+      fields: ["owner", "notes"],
+    });
+    expect(explicit.fields.map((f) => f.name)).toEqual(["owner", "notes"]);
+  });
+
+  it("data-table: canRead / can / canActOnRow mirror the server's rules", () => {
+    const query = {
+      data: [
+        { id: 1, owner: "u1" },
+        { id: 2, owner: "u2" },
+      ],
+      isLoading: false,
+    } as TableQuery<{ id: number; owner: string }>;
+
+    const anon = buildDataTableModel(query, {
+      auth: anonymousAuth(),
+      policy: rls,
+    });
+    expect(anon.canRead).toBe(false);
+
+    const mine = buildDataTableModel(query, {
+      auth: userAuth("u1"),
+      policy: rls,
+    });
+    expect(mine.canRead).toBe(true);
+    expect(mine.can("delete")).toBe(true);
+    expect(mine.canActOnRow("delete", { id: 1, owner: "u1" })).toBe(true);
+    expect(mine.canActOnRow("delete", { id: 2, owner: "u2" })).toBe(false);
+
+    const anonPublicRead = buildDataTableModel(query, {
+      auth: anonymousAuth(),
+      policy: readOnly,
+    });
+    expect(anonPublicRead.canRead).toBe(true);
+    expect(anonPublicRead.can("create")).toBe(false);
+
+    // No identity wired up ⇒ everything stays enabled.
+    const ungated = buildDataTableModel(query, { policy: rls });
+    expect(ungated.canRead).toBe(true);
+    expect(ungated.can("delete")).toBe(true);
+  });
+});

package/test/entities.spec.ts

@@ -17,6 +17,7 @@ import {
 const workRoot = join(__dirname, "entities-fixtures");
 const appDir = join(workRoot, "app");
 const classesDir = join(workRoot, "classes");
+const authDir = join(workRoot, "auth");
 const cycleDir = join(workRoot, "cycles");
 const hardCycleDir = join(workRoot, "hard-cycles");
 const mixedDir = join(workRoot, "mixed");
@@ -82,7 +83,7 @@ import {
   PrimaryKey,
   Unique,
   UUID,
-} from "rastack/types";
+} from "rastack/db";
 import { Terminal } from "./airports";
 
 /** A reusable column config — "extend DbConfig once, use it everywhere". */
@@ -184,6 +185,60 @@ export class BoardingService {
 export class SplashScreen extends BoardingService {}
 `;
 
+const AUTH_TS = `
+import {
+  AdminGroups,
+  Group,
+  IsAuthenticated,
+  IsAuthenticatedOrReadOnly,
+  Owner,
+  OwnerScoped,
+  SharedStorage,
+} from "rastack/auth";
+
+// Per-user rows: RLS on owner, physically partitioned per identity. The
+// implements clause is policy, not behaviour — still a plain data class.
+export class Itinerary
+  implements IsAuthenticated, AdminGroups<"staff">, OwnerScoped
+{
+  owner!: string & Owner;
+  notes!: string;
+}
+
+// A group-owned dataset — physically partitioned per group by default.
+export class Report
+  implements IsAuthenticatedOrReadOnly, AdminGroups<"staff" | "ops">
+{
+  team!: string & Group;
+  title!: string;
+}
+
+// Group RLS, but explicitly opted out of per-group storage.
+export class Note implements SharedStorage {
+  team!: string & Group;
+  body!: string;
+}
+
+// Interfaces attach the same markers with extends.
+export interface Memo extends IsAuthenticated, AdminGroups<"staff"> {
+  body: string;
+}
+
+/** JSDoc equivalents, tag-for-marker.
+ * @rastackResource
+ * @rastackPermission public
+ * @rastackAdminGroups staff, ops
+ */
+export interface Bulletin {
+  /** @owner */
+  author: string;
+  text: string;
+}
+
+declare function useEntityList<T>(name: string): T[];
+export const m = useEntityList<Memo>("memos");
+`;
+
 function findResource(
   resources: ResourceModel[],
   app: string,
@@ -202,6 +257,8 @@ beforeAll(() => {
   writeFileSync(join(appDir, "screens.tsx"), SCREENS_TSX);
   mkdirSync(classesDir, { recursive: true });
   writeFileSync(join(classesDir, "airports.ts"), CLASSES_TS);
+  mkdirSync(authDir, { recursive: true });
+  writeFileSync(join(authDir, "workspace.ts"), AUTH_TS);
   mkdirSync(cycleDir, { recursive: true });
   writeFileSync(join(cycleDir, "org.ts"), SOFT_CYCLE_TS);
   mkdirSync(hardCycleDir, { recursive: true });
@@ -254,7 +311,10 @@ describe("interface entities — datatypes from the type system", () => {
     expect(field("onTime")).toMatchObject({ type: "bool" });
     expect(field("departure")).toMatchObject({ type: "datetime" });
     expect(field("notes")).toMatchObject({ type: "string", null: true });
-    expect(field("status")).toMatchObject({ type: "string", default: "scheduled" });
+    expect(field("status")).toMatchObject({
+      type: "string",
+      default: "scheduled",
+    });
   });
 
   it("reads constraint tags (@maxLength/@unique) off interface properties", () => {
@@ -270,13 +330,17 @@ describe("interface entities — datatypes from the type system", () => {
   it("reads column config from DbConfig brand types", () => {
     const { resources } = analyzeProject(appDir);
     const passenger = findResource(resources, "passengers", "passenger");
-    const field = (name: string) => passenger.fields.find((f) => f.name === name);
+    const field = (name: string) =>
+      passenger.fields.find((f) => f.name === name);
 
     expect(field("id")).toMatchObject({ type: "uuid", primaryKey: true });
     expect(field("fullName")).toMatchObject({ type: "string", maxLength: 80 });
     expect(field("age")).toMatchObject({ type: "int" });
     expect(field("loyaltyPoints")).toMatchObject({ type: "float", default: 0 });
-    expect(field("status")).toMatchObject({ type: "string", default: "active" });
+    expect(field("status")).toMatchObject({
+      type: "string",
+      default: "active",
+    });
     expect(field("terminal")).toMatchObject({
       type: "fk",
       null: true,
@@ -305,7 +369,8 @@ describe("interface entities — datatypes from the type system", () => {
     expect(flight.fields.find((f) => f.name === "tags")).toBeUndefined();
     expect(
       diagnostics.some(
-        (d) => d.severity === "warning" && d.message.includes("flights.flight.tags"),
+        (d) =>
+          d.severity === "warning" && d.message.includes("flights.flight.tags"),
       ),
     ).toBe(true);
   });
@@ -406,10 +471,62 @@ describe("class entities — plain data classes", () => {
   });
 });
 
+describe("entity access policy — auth as types", () => {
+  it("reads permission / adminGroups / scope markers off a class's implements clause", () => {
+    const { resources } = analyzeProject(authDir);
+    const itinerary = findResource(resources, "workspace", "itinerary");
+    expect(itinerary.permission).toBe("authenticated");
+    expect(itinerary.access).toEqual({
+      ownerField: "owner",
+      scope: "owner",
+      adminGroups: ["staff"],
+    });
+  });
+
+  it("a Group field makes a group-owned dataset — partitioned per group by default", () => {
+    const { resources } = analyzeProject(authDir);
+    const report = findResource(resources, "workspace", "report");
+    expect(report.permission).toBe("authenticatedOrReadOnly");
+    expect(report.access).toEqual({
+      groupField: "team",
+      scope: "group",
+      adminGroups: ["ops", "staff"],
+    });
+    // The group column is an ordinary string field in the schema.
+    expect(report.fields.find((f) => f.name === "team")?.type).toBe("string");
+  });
+
+  it("SharedStorage opts a Group dataset out of physical partitioning", () => {
+    const { resources } = analyzeProject(authDir);
+    const note = findResource(resources, "workspace", "note");
+    expect(note.access).toEqual({ groupField: "team", scope: "shared" });
+  });
+
+  it("interfaces attach markers via extends; markers add no columns", () => {
+    const { resources } = analyzeProject(authDir);
+    const memo = findResource(resources, "workspace", "memo");
+    expect(memo.permission).toBe("authenticated");
+    expect(memo.access).toEqual({ adminGroups: ["staff"] });
+    expect(memo.fields.map((f) => f.name)).toEqual(["body"]);
+  });
+
+  it("JSDoc tags mirror every marker (@rastackPermission/@rastackAdminGroups/@owner)", () => {
+    const { resources } = analyzeProject(authDir);
+    const bulletin = findResource(resources, "workspace", "bulletin");
+    expect(bulletin.permission).toBe("public");
+    expect(bulletin.access).toEqual({
+      ownerField: "author",
+      adminGroups: ["staff", "ops"],
+    });
+  });
+});
+
 describe("interface entities — circular dependencies", () => {
   it("reports a breakable cycle (optional self-FK) as a warning", () => {
     const { diagnostics } = analyzeProject(cycleDir);
-    const cycle = diagnostics.find((d) => d.message.includes("Circular dependency"));
+    const cycle = diagnostics.find((d) =>
+      d.message.includes("Circular dependency"),
+    );
     expect(cycle).toBeDefined();
     expect(cycle!.severity).toBe("warning");
     expect(cycle!.message).toContain("org.employee → org.employee");