slotlock 0.9.0 → 0.10.0

package/ddl-identity.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Who a person is, as every dashboard table checks it: a GitHub account, a Google account, or a
+ * person a team's identity provider signed in (sso:<uuid>, teams phase 5.4).
+ */
+export declare const SLOTLOCK_PERSON_PATTERN = "^(github:[1-9][0-9]{0,19}|google:[A-Za-z0-9._-]{1,255}|sso:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$";
+/** The tables of verified domains and requests to join: their owner's only. */
+export declare const SLOTLOCK_IDENTITY_TABLES: readonly ["workspace_domains", "workspace_join_requests", "workspace_join_blocks"];
+/** The SECURITY DEFINER functions through which the serving role reaches them. */
+export declare const SLOTLOCK_IDENTITY_FUNCTIONS: readonly ["slotlock.claim_domain(text, text, text, text, text)", "slotlock.workspace_domains_list(text)", "slotlock.record_domain_check(uuid, text, text, text, text, text)", "slotlock.domains_due(integer)", "slotlock.release_domain(text, text, uuid)", "slotlock.set_invite_domain_restriction(text, text, boolean)", "slotlock.set_domain_join_policy(text, text, uuid, text)", "slotlock.discoverable_workspaces(text, text[])", "slotlock.request_to_join(text, text, text[], text, integer)", "slotlock.workspace_join_requests_list(text)", "slotlock.decide_join_request(text, text, uuid, text, text, integer)", "slotlock.workspace_domain_members(text)", "slotlock.prune_workspace_domains()", "slotlock.workspace_invites_restricted(text)"];
+/** How many domains a team may claim or hold at once. */
+export declare const SLOTLOCK_WORKSPACE_DOMAIN_LIMIT = 20;
+/**
+ * How a person's address was verified, as a request to join records it: by a Google Workspace
+ * account of that domain (Google's `hd` claim), the only evidence that lets someone join at once;
+ * or by a Google or GitHub account that verified it once and never checks again, which only asks.
+ */
+export declare const SLOTLOCK_JOIN_EVIDENCE: readonly ["google_workspace", "google", "github"];
+/**
+ * SQL that is true when a team holds its invitations to its verified domains and the invitation
+ * (to `email`, or to the GitHub account `github`) is not to one of them.
+ */
+export declare const SLOTLOCK_INVITE_DOMAIN_REFUSED: (tenant: string, email: string, github: string) => string;
+/** Requests to join a person may make a day, across every team. */
+export declare const SLOTLOCK_JOIN_REQUEST_DAILY_LIMIT = 20;
+export declare const SLOTLOCK_IDENTITY_DDL: string;