slotlock 0.9.0 → 0.10.0

package/workspace-sso.d.ts

@@ -0,0 +1,131 @@
+import type { SlotlockOidcAlgorithm } from './oidc.js';
+import type { SlotlockSql } from './store.js';
+import { type SlotlockWorkspaceRole } from './workspace-roles.js';
+/** The providers a team may connect: their own rules apply (oidc.ts, dashboard). */
+export type SlotlockSsoKind = 'okta' | 'entra' | 'google_workspace' | 'oidc';
+/** Why a change to a team's single sign-on, or a sign-in through it, was refused. */
+export type SlotlockSsoRefusal = 'not_found' | 'not_allowed' | 'no_verified_domain' | 'secret_required' | 'conflict' | 'stale_config' | 'untested' | 'no_breakglass_owner' | 'role_not_allowed' | 'owner_not_mappable' | 'invalid_value' | 'mapping_limit' | 'connection_inactive' | 'guest_refused' | 'not_member' | 'identity_taken' | 'identity_untrusted' | 'hd_mismatch' | 'member_cap' | 'invalid_max_age' | 'no_active_connection' | 'stale_sso_proof';
+/** A team's connection, as saved. */
+export interface SlotlockSsoConnection {
+    id: string;
+    kind: SlotlockSsoKind;
+    status: 'draft' | 'tested' | 'active' | 'disabled';
+    issuer: string;
+    clientId: string;
+    /** The client secret as sealed (null for Google Workspace, which uses Slotlock's own client). */
+    secretSealed: string | null;
+    secretLast4: string | null;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    jwksUri: string;
+    algorithms: SlotlockOidcAlgorithm[];
+    issParameter: boolean;
+    entraTenant: string | null;
+    groupsClaim: string;
+    jitEnabled: boolean;
+    defaultRole: 'viewer' | 'member' | 'developer';
+    configVersion: number;
+    testedVersion: number | null;
+    lastTestedAt: Date | null;
+    lastTestClaims: Record<string, unknown> | null;
+    requireSso: boolean;
+    maxAgeHours: number;
+}
+/** A connection as its callback reads it: with its team. */
+export interface SlotlockSsoConnectionForSignIn {
+    id: string;
+    tenantRef: string;
+    handle: string;
+    name: string;
+    kind: SlotlockSsoKind;
+    status: SlotlockSsoConnection['status'];
+    issuer: string;
+    clientId: string;
+    secretSealed: string | null;
+    tokenEndpoint: string;
+    jwksUri: string;
+    algorithms: SlotlockOidcAlgorithm[];
+    issParameter: boolean;
+    entraTenant: string | null;
+    groupsClaim: string;
+    configVersion: number;
+}
+/** What a sign-in through a team's provider gave: who, and what happened. */
+export interface SlotlockSsoSignIn {
+    person: string | null;
+    /** `joined`, `signed_in`, `role_changed` (alone); `linked`, `proof` (signed in already). */
+    outcome: 'joined' | 'signed_in' | 'role_changed' | 'linked' | 'proof' | null;
+    refusal: SlotlockSsoRefusal | null;
+    role: SlotlockWorkspaceRole | null;
+}
+export interface SlotlockWorkspaceSso {
+    connection(tenantRef: string): Promise<SlotlockSsoConnection | null>;
+    connectionById(id: string): Promise<SlotlockSsoConnectionForSignIn | null>;
+    /** A team's active connection, by its handle or a domain it holds verified. */
+    route(by: {
+        handle?: string;
+        domain?: string;
+    }): Promise<{
+        id: string;
+        tenantRef: string;
+        handle: string;
+        name: string;
+        authorizationEndpoint: string;
+        clientId: string;
+        kind: SlotlockSsoKind;
+        entraTenant: string | null;
+    } | null>;
+    save(params: {
+        tenantRef: string;
+        actor: string;
+        id: string;
+        kind: SlotlockSsoKind;
+        issuer: string;
+        clientId: string;
+        secretSealed: string | null;
+        secretLast4: string | null;
+        authorizationEndpoint: string;
+        tokenEndpoint: string;
+        jwksUri: string;
+        algorithms: readonly SlotlockOidcAlgorithm[];
+        issParameter: boolean;
+        entraTenant: string | null;
+    }): Promise<{
+        id: string;
+        enforcementOff: boolean;
+    } | {
+        refusal: SlotlockSsoRefusal;
+        id?: string;
+    }>;
+    recordTest(tenantRef: string, actor: string, id: string, version: number, claims: Record<string, unknown>): Promise<SlotlockSsoRefusal | null>;
+    setStatus(tenantRef: string, actor: string, id: string, status: 'active' | 'disabled'): Promise<SlotlockSsoRefusal | null>;
+    remove(tenantRef: string, actor: string, id: string): Promise<SlotlockSsoRefusal | null>;
+    setProvisioning(tenantRef: string, actor: string, jit: boolean, defaultRole: string, groupsClaim: string): Promise<SlotlockSsoRefusal | null>;
+    setMapping(tenantRef: string, actor: string, value: string, role: string | null): Promise<SlotlockSsoRefusal | null>;
+    mappings(tenantRef: string): Promise<{
+        value: string;
+        role: SlotlockWorkspaceRole;
+    }[]>;
+    signIn(params: {
+        connectionId: string;
+        issuer: string;
+        subject: string;
+        entraTid: string | null;
+        entraOid: string | null;
+        email: string | null;
+        emailOk: boolean;
+        groups: readonly string[];
+        overage: boolean;
+        guest: boolean;
+        sessionPerson: string | null;
+        memberCap: number | null;
+    }): Promise<SlotlockSsoSignIn>;
+    /** A session's proof from the connection, now; `scoped` for a session begun through it alone. */
+    /** `configVersion`: the connection's configuration the sign-in went through, where known. */
+    recordProof(sid: string, person: string, connectionId: string, scoped: boolean, configVersion?: number): Promise<boolean>;
+    requireSso(tenantRef: string, actor: string, sid: string, on: boolean, maxAgeHours: number): Promise<SlotlockSsoRefusal | null>;
+    bypass(tenantRef: string, person: string, sid: string): Promise<SlotlockSsoRefusal | null>;
+    prune(): Promise<number>;
+}
+/** Through the functions of ddl-sso.ts. */
+export declare function createSlotlockWorkspaceSso(sql: SlotlockSql): SlotlockWorkspaceSso;

package/workspace-sso.js

@@ -0,0 +1,180 @@
+// A team's single sign-on as the dashboard reaches it (teams phase 5.3–5.5): through the SECURITY
+// DEFINER functions of ddl-sso.ts, which check the actor's role, lock the team and decide whom a
+// provider's sign-in is. Tokens are checked before (oidc.ts); secrets are sealed before (oidc.ts
+// createSlotlockSecretBox), so only a sealed secret ever reaches the database.
+import { createHash } from 'node:crypto';
+import { isSlotlockWorkspaceRole } from './workspace-roles.js';
+const TEAM = /^team:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const sessionDigest = (sid) => createHash('sha256').update(sid, 'utf8').digest();
+const refusalOf = (value) => value === null || value === undefined ? null : value;
+/** Through the functions of ddl-sso.ts. */
+export function createSlotlockWorkspaceSso(sql) {
+    return {
+        async connection(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_of(${tenantRef}::text)`;
+            if (!row)
+                return null;
+            return {
+                id: row.connection_id,
+                kind: row.kind,
+                status: row.status,
+                issuer: row.issuer,
+                clientId: row.client_id,
+                secretSealed: row.secret_sealed,
+                secretLast4: row.secret_last4,
+                authorizationEndpoint: row.authorization_endpoint,
+                tokenEndpoint: row.token_endpoint,
+                jwksUri: row.jwks_uri,
+                algorithms: row.algorithms,
+                issParameter: row.iss_parameter,
+                entraTenant: row.entra_tenant,
+                groupsClaim: row.groups_claim,
+                jitEnabled: row.jit_enabled,
+                defaultRole: row.default_role,
+                configVersion: Number(row.config_version),
+                testedVersion: row.tested_version === null ? null : Number(row.tested_version),
+                lastTestedAt: row.last_tested_at,
+                lastTestClaims: row.last_test_claims,
+                requireSso: row.require_sso,
+                maxAgeHours: Number(row.sso_max_age_hours),
+            };
+        },
+        async connectionById(id) {
+            if (!UUID.test(id))
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_by_id(${id}::uuid)`;
+            if (!row)
+                return null;
+            return {
+                id,
+                tenantRef: row.team_ref,
+                handle: row.handle,
+                name: row.name,
+                kind: row.kind,
+                status: row.status,
+                issuer: row.issuer,
+                clientId: row.client_id,
+                secretSealed: row.secret_sealed,
+                tokenEndpoint: row.token_endpoint,
+                jwksUri: row.jwks_uri,
+                algorithms: row.algorithms,
+                issParameter: row.iss_parameter,
+                entraTenant: row.entra_tenant,
+                groupsClaim: row.groups_claim,
+                configVersion: Number(row.config_version),
+            };
+        },
+        async route(by) {
+            const handle = by.handle?.trim().toLowerCase() || null;
+            const domain = by.domain?.trim().toLowerCase() || null;
+            if (handle === null && domain === null)
+                return null;
+            const [row] = await sql `SELECT * FROM slotlock.sso_connection_route(${handle}::text, ${domain}::text)`;
+            return row
+                ? {
+                    id: row.connection_id,
+                    tenantRef: row.team_ref,
+                    handle: row.handle,
+                    name: row.name,
+                    authorizationEndpoint: row.authorization_endpoint,
+                    clientId: row.client_id,
+                    kind: row.kind,
+                    entraTenant: row.entra_tenant,
+                }
+                : null;
+        },
+        async save(params) {
+            if (!TEAM.test(params.tenantRef) || !UUID.test(params.id))
+                return { refusal: 'not_found' };
+            const [row] = await sql `
+        SELECT connection_id, refusal, enforcement_off FROM slotlock.save_sso_connection(
+          ${params.tenantRef}::text, ${params.actor}::text, ${params.id}::uuid, ${params.kind}::text, ${params.issuer}::text,
+          ${params.clientId}::text, ${params.secretSealed}::text, ${params.secretLast4}::text,
+          ${params.authorizationEndpoint}::text, ${params.tokenEndpoint}::text, ${params.jwksUri}::text,
+          ${[...params.algorithms]}::text[], ${params.issParameter}::boolean, ${params.entraTenant}::text)`;
+            if (row?.refusal)
+                return { refusal: refusalOf(row.refusal) ?? 'not_allowed', ...(row.connection_id ? { id: row.connection_id } : {}) };
+            return row?.connection_id ? { id: row.connection_id, enforcementOff: row.enforcement_off } : { refusal: 'not_allowed' };
+        },
+        async recordTest(tenantRef, actor, id, version, claims) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.record_sso_test(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${version}::integer,
+          ${JSON.stringify(claims)}::text::jsonb) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setStatus(tenantRef, actor, id, status) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.set_sso_connection_status(${tenantRef}::text, ${actor}::text, ${id}::uuid, ${status}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async remove(tenantRef, actor, id) {
+            if (!UUID.test(id))
+                return 'not_found';
+            const [row] = await sql `
+        SELECT slotlock.delete_sso_connection(${tenantRef}::text, ${actor}::text, ${id}::uuid) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setProvisioning(tenantRef, actor, jit, defaultRole, groupsClaim) {
+            const [row] = await sql `
+        SELECT slotlock.set_sso_provisioning(${tenantRef}::text, ${actor}::text, ${jit}::boolean, ${defaultRole}::text,
+          ${groupsClaim}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async setMapping(tenantRef, actor, value, role) {
+            const [row] = await sql `
+        SELECT slotlock.set_sso_role_mapping(${tenantRef}::text, ${actor}::text, ${value}::text, ${role}::text) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async mappings(tenantRef) {
+            if (!TEAM.test(tenantRef))
+                return [];
+            const rows = await sql `SELECT * FROM slotlock.sso_role_mappings_of(${tenantRef}::text)`;
+            return rows.flatMap((row) => (isSlotlockWorkspaceRole(row.role) ? [{ value: row.idp_value, role: row.role }] : []));
+        },
+        async signIn(params) {
+            if (!UUID.test(params.connectionId))
+                return { person: null, outcome: null, refusal: 'connection_inactive', role: null };
+            const [row] = await sql `
+        SELECT person, outcome, refusal, member_role FROM slotlock.sso_sign_in(
+          ${params.connectionId}::uuid, ${params.issuer}::text, ${params.subject}::text, ${params.entraTid}::text,
+          ${params.entraOid}::text, ${params.email}::text, ${params.emailOk}::boolean, ${[...params.groups].slice(0, 200)}::text[],
+          ${params.overage}::boolean, ${params.guest}::boolean, ${params.sessionPerson}::text, ${params.memberCap}::integer)`;
+            return {
+                person: row?.person ?? null,
+                outcome: row?.outcome ?? null,
+                refusal: refusalOf(row?.refusal),
+                role: isSlotlockWorkspaceRole(row?.member_role) ? row?.member_role : null,
+            };
+        },
+        async recordProof(sid, person, connectionId, scoped, configVersion) {
+            if (!UUID.test(connectionId))
+                return false;
+            const [row] = await sql `
+        SELECT slotlock.record_sso_proof(${sessionDigest(sid)}::bytea, ${person}::text, ${connectionId}::uuid, ${scoped}::boolean,
+          ${configVersion ?? null}::integer) AS recorded`;
+            return row?.recorded === true;
+        },
+        async requireSso(tenantRef, actor, sid, on, maxAgeHours) {
+            const [row] = await sql `
+        SELECT slotlock.set_require_sso(${tenantRef}::text, ${actor}::text, ${sessionDigest(sid)}::bytea, ${on}::boolean,
+          ${maxAgeHours}::integer) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async bypass(tenantRef, person, sid) {
+            const [row] = await sql `
+        SELECT slotlock.sso_owner_bypass(${tenantRef}::text, ${person}::text, ${sessionDigest(sid)}::bytea) AS refusal`;
+            return refusalOf(row?.refusal);
+        },
+        async prune() {
+            const [row] = await sql `SELECT slotlock.prune_sso() AS pruned`;
+            return Number(row?.pruned ?? 0);
+        },
+    };
+}

package/workspaces.d.ts

@@ -0,0 +1,240 @@
+import type { SlotlockSql } from './store.js';
+import { type SlotlockWorkspaceDomains } from './workspace-domains.js';
+import { type SlotlockWorkspaceSso } from './workspace-sso.js';
+import { type SlotlockWorkspaceScim } from './workspace-scim.js';
+import { type SlotlockWorkspaceRole } from './workspace-roles.js';
+import { type SlotlockResourceScope } from './resource-profile.js';
+/** A GitHub organization the person is an active owner (`admin`) or member of, as GitHub lists it. */
+export interface SlotlockGitHubMembership {
+    id: string;
+    role: 'admin' | 'member';
+}
+/** A person's standing in one workspace now. */
+export interface SlotlockWorkspaceStanding {
+    /** Their role, or null when they do not belong to it (any longer). */
+    role: SlotlockWorkspaceRole | null;
+    /**
+     * The epoch their sessions must carry, or null when the person has no record (never signed in
+     * with this store, or erased): then no session passes. "Sign out everywhere" draws a new one.
+     */
+    sessionEpoch: number | null;
+    /**
+     * Why there is no role though the person is a member: the team requires single sign-on and this
+     * session holds no recent proof (`sso_required`), or the session was signed in through another
+     * team's provider alone (`sso_scope`). Null otherwise.
+     */
+    refusal?: 'sso_required' | 'sso_scope' | null;
+    /** With sso_required: whether this person (an Owner who signs in with GitHub or Google) may bypass. */
+    mayBypass?: boolean;
+}
+/** What the dashboard reads and records of people and their memberships. */
+export interface SlotlockDashboardWorkspaces {
+    /**
+     * Record a sign-in, returning the epoch to seal into the session. Signing in with GitHub, pass
+     * the organizations GitHub lists the person in: they become memberships (owners Owner, members
+     * Developer), and one GitHub no longer lists ends.
+     */
+    signedIn(person: string, githubOrganizations?: readonly SlotlockGitHubMembership[]): Promise<number>;
+    /**
+     * The person's role in a tenant (its test environment is its live tenant's) and their epoch, for
+     * this session (its id, as the cookie holds it, or null where there is none): a team that requires
+     * single sign-on gives a session without a recent proof no role, and a session scoped to a team's
+     * provider has none elsewhere. Required, so no caller with a session leaves its scope unchecked.
+     */
+    standing(tenantRef: string, person: string, sid: string | null): Promise<SlotlockWorkspaceStanding>;
+    /**
+     * The locations and groups the person is limited to in the tenant (RFC 0004 D1), or null for all
+     * of it. An Owner is never limited.
+     */
+    scope?(tenantRef: string, person: string): Promise<SlotlockResourceScope | null>;
+    /** End every session of the person: a new epoch is drawn, and those sealed under the old are refused. */
+    signOutEverywhere(person: string): Promise<number>;
+    /** Team workspaces, their members and invitations: only with the database (createSlotlockDashboardWorkspaces). */
+    teams?: SlotlockWorkspaceTeams;
+    /** Each session a person signed in with, to list and sign out one by one: only with the database. */
+    sessions?: SlotlockDashboardSessions;
+    /** Teams' verified domains and requests to join through them (workspace-domains.ts): only with the database. */
+    domains?: SlotlockWorkspaceDomains;
+    /** Teams' single sign-on (workspace-sso.ts): only with the database. */
+    sso?: SlotlockWorkspaceSso;
+    /** Teams' SCIM provisioning (workspace-scim.ts): only with the database. */
+    scim?: SlotlockWorkspaceScim;
+}
+/** A session a person signed in with, as their Account page lists it. */
+export interface SlotlockDashboardSession {
+    /** The SHA-256 of the session's id, in hex: names it without revealing it. */
+    id: string;
+    startedAt: Date;
+    lastSeenAt: Date;
+    expiresAt: Date;
+    userAgent: string | null;
+    ipAddress: string | null;
+}
+/** Sessions by person (slotlock.dashboard_sessions): only a digest of each session's id is kept. */
+export interface SlotlockDashboardSessions {
+    started(person: string, sid: string, expiresAt: Date, from: {
+        userAgent?: string;
+        ipAddress?: string;
+    }): Promise<void>;
+    /** Whether the session may go on: false once signed out from another device. Notes it seen. */
+    seen(person: string, sid: string): Promise<boolean>;
+    list(person: string): Promise<SlotlockDashboardSession[]>;
+    /** Sign out one session by its id (SlotlockDashboardSession.id), or every one with null. */
+    end(person: string, id: string | null): Promise<boolean>;
+    /** The id a session is listed under. */
+    idOf(sid: string): string;
+}
+/** A team workspace (team:<uuid>) as a person sees it in their list. */
+export interface SlotlockTeamWorkspace {
+    tenantRef: string;
+    handle: string;
+    name: string;
+    role: SlotlockWorkspaceRole;
+}
+/** An active member of a workspace. */
+export interface SlotlockWorkspaceMember {
+    person: string;
+    role: SlotlockWorkspaceRole;
+    source: 'github_org' | 'invitation' | 'created';
+    /** Their GitHub login or verified Google email as they last signed in; null before they have. */
+    display: string | null;
+    joinedAt: Date;
+}
+/** An invitation not accepted or revoked: pending, or expired in the last 30 days. */
+export interface SlotlockWorkspaceInvitation {
+    id: string;
+    email: string | null;
+    githubLogin: string | null;
+    role: SlotlockWorkspaceRole;
+    inviterDisplay: string;
+    sentAt: Date;
+    expiresAt: Date;
+}
+/** What the holder of an invitation's link sees before joining. */
+export interface SlotlockInvitationPreview {
+    id: string;
+    tenantRef: string;
+    workspaceName: string;
+    workspaceHandle: string;
+    inviterDisplay: string;
+    role: SlotlockWorkspaceRole;
+    email: string | null;
+    githubRef: string | null;
+    githubLogin: string | null;
+    state: 'pending' | 'accepted' | 'revoked' | 'expired';
+}
+/** Why a team change was refused. */
+export type SlotlockTeamRefusal = 'invalid_handle' | 'invalid_name' | 'handle_taken' | 'team_limit' | 'not_found' | 'not_allowed' | 'already_member' | 'invitation_limit'
+/** The address was sent SLOTLOCK_INVITATIONS_PER_ADDRESS invitations in the last day. */
+ | 'recipient_limit' | 'member_cap' | 'revoked' | 'accepted' | 'expired' | 'not_for_you' | 'last_owner' | 'sso_owner' | 'confirm' | 'subscription_live' | 'domain_restricted'
+/** An Owner reaches the whole workspace: never limited. */
+ | 'owner';
+/**
+ * Team workspaces through their SECURITY DEFINER functions: each checks the actor's role and
+ * ceiling, keeps an Owner, and serialises changes to one workspace's people.
+ */
+export interface SlotlockWorkspaceTeams {
+    /** How the person is shown to others: their GitHub login or verified Google email. */
+    setDisplay(person: string, display: string | null): Promise<void>;
+    /** A new team workspace with the person its Owner; `cap` free team workspaces a person may create. */
+    create(person: string, name: string, handle: string, cap: number | null): Promise<{
+        tenantRef: string;
+    } | {
+        refusal: SlotlockTeamRefusal;
+    }>;
+    info(tenantRef: string): Promise<{
+        handle: string;
+        name: string;
+    } | null>;
+    /** The team workspaces the person is an active member of. */
+    workspacesOf(person: string): Promise<SlotlockTeamWorkspace[]>;
+    members(tenantRef: string): Promise<SlotlockWorkspaceMember[]>;
+    invitations(tenantRef: string): Promise<SlotlockWorkspaceInvitation[]>;
+    invite(params: {
+        tenantRef: string;
+        inviter: string;
+        to: {
+            email: string;
+        } | {
+            github: string;
+            login: string;
+        };
+        role: SlotlockWorkspaceRole;
+        /** SHA-256 of the token; the token itself is never given. */
+        tokenSha256: Buffer;
+        days: number;
+        dailyLimit: number | null;
+        memberCap: number | null;
+    }): Promise<{
+        id: string;
+    } | {
+        refusal: SlotlockTeamRefusal;
+    }>;
+    preview(tokenSha256: Buffer): Promise<SlotlockInvitationPreview | null>;
+    /** Accept by the token's digest or, one found for the person, by id. `emails` are those the person holds verified. */
+    accept(params: {
+        tokenSha256?: Buffer;
+        id?: string;
+        person: string;
+        emails: readonly string[];
+        memberCap: number | null;
+    }): Promise<{
+        tenantRef: string;
+    } | {
+        refusal: SlotlockTeamRefusal;
+    }>;
+    revoke(tenantRef: string, actor: string, id: string): Promise<boolean>;
+    /** Send again with a new token (the old stops working), held to the limits a new one is. */
+    resend(tenantRef: string, actor: string, id: string, tokenSha256: Buffer, days: number, dailyLimit: number | null, memberCap: number | null): Promise<SlotlockTeamRefusal | null>;
+    changeRole(tenantRef: string, actor: string, person: string, role: SlotlockWorkspaceRole): Promise<SlotlockTeamRefusal | null>;
+    /**
+     * Limit a member to locations and groups, or give them the whole workspace again (null): by an
+     * Owner or Admin not limited themselves, of a member not an Owner (`owner`) whose role they may
+     * grant.
+     */
+    setScope(tenantRef: string, actor: string, person: string, scope: SlotlockResourceScope | null): Promise<SlotlockTeamRefusal | null>;
+    /** Each member limited to part of the workspace, by person, with what they are limited to. */
+    scopes(tenantRef: string): Promise<ReadonlyMap<string, SlotlockResourceScope>>;
+    /** Remove a member; the actor removing themselves leaves. */
+    remove(tenantRef: string, actor: string, person: string): Promise<SlotlockTeamRefusal | null>;
+    /** Pending invitations meant for the person (their GitHub account, or an email they hold verified). */
+    pendingFor(person: string, emails: readonly string[]): Promise<{
+        id: string;
+        tenantRef: string;
+        workspaceName: string;
+        workspaceHandle: string;
+        inviterDisplay: string;
+        role: SlotlockWorkspaceRole;
+    }[]>;
+    /** Whether a team workspace exists and serves its keys. */
+    isActive(tenantRef: string): Promise<boolean>;
+    /** Delete invitations finished more than 30 days ago; how many went. */
+    prune(): Promise<number>;
+    /** Delete the team in seven days, by an Owner who typed its handle; its keys stop at once. */
+    scheduleDeletion(tenantRef: string, actor: string, handle: string): Promise<SlotlockTeamRefusal | null>;
+    /** Keep a team being deleted, by any of its Owners. */
+    cancelDeletion(tenantRef: string, actor: string): Promise<SlotlockTeamRefusal | null>;
+    /** When a team being deleted goes, or null. */
+    deleteAfter(tenantRef: string): Promise<Date | null>;
+}
+/** Through slotlock.dashboard_sign_in, dashboard_standing and dashboard_sign_out_everywhere. */
+export declare function createSlotlockDashboardWorkspaces(sql: SlotlockSql): SlotlockDashboardWorkspaces;
+/**
+ * Whether a team workspace serves its keys, for `serve`: read through slotlock.workspace_active and
+ * kept for `ttlMs` (30 seconds), so deleting one stops its keys on every server within that.
+ */
+export declare function createSlotlockWorkspaceCheck(sql: SlotlockSql, options?: {
+    ttlMs?: number;
+    now?: () => number;
+    maxEntries?: number;
+}): (tenantRef: string) => Promise<boolean>;
+/**
+ * The same in memory, for tests and for a library deployment with a single server. `setRole` and
+ * `remove` stand in for what the Members page will do.
+ */
+export declare function createSlotlockMemoryDashboardWorkspaces(): SlotlockDashboardWorkspaces & {
+    setRole(tenantRef: string, person: string, role: SlotlockWorkspaceRole, source?: 'github_org' | 'invitation' | 'created'): void;
+    remove(tenantRef: string, person: string): void;
+    /** Limit a member to locations and groups, or (null) give them all of the workspace again. */
+    limit(tenantRef: string, person: string, scope: SlotlockResourceScope | null): void;
+};