feat(permissions): add permission manifest constant, types utilities, my-org tarball

packages/core/package.json

@@ -52,7 +52,7 @@
   },
   "dependencies": {
     "@auth0/myaccount-js": "1.0.0-beta.0",
-    "@auth0/myorganization-js": "1.1.0",
+    "@auth0/myorganization-js": "file:../../auth0-myorganization-js-1.1.0.tgz",
     "zod": "^3.22.4"
   }
 }

packages/core/src/index.ts

@@ -44,6 +44,20 @@ export {
   configQueryKeys,
   idpConfigQueryKeys,
 } from './services/my-organization/config/config-query-keys';
+export { PERMISSION_MANIFEST } from './services/my-organization/permissions/permission-manifest';
+export { permissionQueryKeys } from './services/my-organization/permissions/permission-query-keys';
+export {
+  hasPermission,
+  hasAnyPermission,
+  hasAllPermissions,
+  getUserTier,
+} from './services/my-organization/permissions/permission-utils';
+export type { OauthScope } from './services/my-organization/permissions/permission-manifest';
+export type {
+  PermissionTier,
+  GetUserPermissionsRequestParameters,
+  GetUserPermissionsResponseContent,
+} from './services/my-organization/permissions/permission-types';
 
 export * from './services/my-account';
 

packages/core/src/services/my-organization/permissions/__tests__/permission-utils.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  getUserTier,
+  hasAllPermissions,
+  hasAnyPermission,
+  hasPermission,
+} from '../permission-utils';
+
+describe('permission-utils', () => {
+  describe('hasPermission', () => {
+    it('returns true when the permission is present', () => {
+      expect(
+        hasPermission(
+          ['read:my_org:members', 'delete:my_org:memberships'],
+          'delete:my_org:memberships',
+        ),
+      ).toBe(true);
+    });
+
+    it('returns false when the permission is absent', () => {
+      expect(hasPermission(['read:my_org:members'], 'delete:my_org:memberships')).toBe(false);
+    });
+
+    it('returns false for an empty permission list', () => {
+      expect(hasPermission([], 'read:my_org:members')).toBe(false);
+    });
+  });
+
+  describe('hasAnyPermission', () => {
+    it('returns true when at least one permission is present', () => {
+      expect(
+        hasAnyPermission(
+          ['read:my_org:members'],
+          ['delete:my_org:memberships', 'read:my_org:members'],
+        ),
+      ).toBe(true);
+    });
+
+    it('returns false when none of the permissions are present', () => {
+      expect(
+        hasAnyPermission(
+          ['read:my_org:members'],
+          ['delete:my_org:memberships', 'create:my_org:member_roles'],
+        ),
+      ).toBe(false);
+    });
+
+    it('returns true when the required list is empty (vacuously satisfied)', () => {
+      expect(hasAnyPermission([], [])).toBe(true);
+    });
+  });
+
+  describe('hasAllPermissions', () => {
+    it('returns true only when every required permission is present', () => {
+      expect(
+        hasAllPermissions(
+          ['read:my_org:members', 'delete:my_org:memberships'],
+          ['read:my_org:members', 'delete:my_org:memberships'],
+        ),
+      ).toBe(true);
+    });
+
+    it('returns false when any required permission is missing', () => {
+      expect(
+        hasAllPermissions(
+          ['read:my_org:members'],
+          ['read:my_org:members', 'delete:my_org:memberships'],
+        ),
+      ).toBe(false);
+    });
+
+    it('returns true when the required list is empty (vacuously satisfied)', () => {
+      expect(hasAllPermissions([], [])).toBe(true);
+    });
+  });
+
+  describe('getUserTier', () => {
+    it('returns "admin" when the user can delete the resource', () => {
+      expect(getUserTier(['read:my_org:domains', 'delete:my_org:domains'], 'domains')).toBe(
+        'admin',
+      );
+    });
+
+    it('returns "editor" when the user can create/update but not delete', () => {
+      expect(getUserTier(['read:my_org:domains', 'update:my_org:domains'], 'domains')).toBe(
+        'editor',
+      );
+      expect(getUserTier(['create:my_org:domains'], 'domains')).toBe('editor');
+    });
+
+    it('returns "viewer" for read-only access', () => {
+      expect(getUserTier(['read:my_org:members'], 'members')).toBe('viewer');
+    });
+
+    it('returns "viewer" when the user has no permissions for the resource', () => {
+      expect(getUserTier(['read:my_org:domains'], 'members')).toBe('viewer');
+      expect(getUserTier([], 'members')).toBe('viewer');
+    });
+
+    it('matches the resource segment exactly (sub-resources are distinct)', () => {
+      expect(getUserTier(['delete:my_org:member_roles'], 'member_roles')).toBe('admin');
+      expect(getUserTier(['create:my_org:member_roles'], 'member_roles')).toBe('editor');
+      expect(getUserTier(['read:my_org:members', 'delete:my_org:member_roles'], 'members')).toBe(
+        'viewer',
+      );
+    });
+
+    it('does not conflate distinct resources that share a prefix', () => {
+      expect(getUserTier(['delete:my_org:memberships'], 'members')).toBe('viewer');
+      expect(getUserTier(['delete:my_org:memberships'], 'memberships')).toBe('admin');
+    });
+  });
+});

packages/core/src/services/my-organization/permissions/permission-manifest.ts

@@ -0,0 +1,43 @@
+/**
+ * MyOrganization permission manifest.
+ *
+ * The full, type-safe set of MyOrganization API permissions
+ * @module permission-manifest
+ * @internal
+ */
+import type { MyOrganization } from '@auth0/myorganization-js';
+
+export type OauthScope = MyOrganization.OauthScope;
+
+export const PERMISSION_MANIFEST: readonly OauthScope[] = [
+  // Members
+  'read:my_org:members',
+  'delete:my_org:memberships',
+  // Member Roles
+  'create:my_org:member_roles',
+  'delete:my_org:member_roles',
+  // Invitations
+  'read:my_org:member_invitations',
+  'create:my_org:member_invitations',
+  'delete:my_org:member_invitations',
+  // Identity Providers
+  'create:my_org:identity_providers',
+  'update:my_org:identity_providers',
+  'delete:my_org:identity_providers',
+  'update:my_org:identity_providers_detach',
+  // IDP Domains, Provisioning, SCIM
+  'create:my_org:identity_providers_domains',
+  'delete:my_org:identity_providers_domains',
+  'create:my_org:identity_providers_provisioning',
+  'update:my_org:identity_providers_provisioning',
+  'delete:my_org:identity_providers_provisioning',
+  'create:my_org:identity_providers_scim_tokens',
+  'delete:my_org:identity_providers_scim_tokens',
+  // Domains
+  'create:my_org:domains',
+  'update:my_org:domains',
+  'delete:my_org:domains',
+  'read:my_org:identity_providers',
+  // Org Details
+  'update:my_org:details',
+];

packages/core/src/services/my-organization/permissions/permission-query-keys.ts

@@ -0,0 +1,8 @@
+/**
+ * Permission query keys for TanStack Query cache management.
+ * @module permission-query-keys
+ */
+export const permissionQueryKeys = {
+  all: ['permissions'] as const,
+  list: () => [...permissionQueryKeys.all, 'list'] as const,
+};

packages/core/src/services/my-organization/permissions/permission-types.ts

@@ -0,0 +1,16 @@
+/**
+ * Permission type definitions.
+ * @module permission-types
+ * @internal
+ */
+import type { MyOrganization } from '@auth0/myorganization-js';
+
+/** Response body of `GET /my-org/user-permissions` — the granted subset of requested permissions. */
+export type GetUserPermissionsResponseContent = MyOrganization.GetUserPermissionsResponseContent;
+
+/** Request parameters for `GET /my-org/user-permissions` (comma-separated permission list). */
+export type GetUserPermissionsRequestParameters =
+  MyOrganization.GetUserPermissionsRequestParameters;
+
+/** Behavior tier a user falls into for a given resource, derived from their permissions. */
+export type PermissionTier = 'admin' | 'editor' | 'viewer';

packages/core/src/services/my-organization/permissions/permission-utils.ts

@@ -0,0 +1,90 @@
+/**
+ * Permission checks for MyOrganization UI gating.
+ * @module permission-utils
+ * @internal
+ */
+import type { OauthScope } from './permission-manifest';
+import type { PermissionTier } from './permission-types';
+
+/**
+ * Whether the user holds `required`.
+ * @param userPermissions - Granted permissions.
+ * @param required - Permission to check.
+ * @returns `true` if present.
+ * @internal
+ */
+export function hasPermission(userPermissions: readonly string[], required: OauthScope): boolean {
+  return userPermissions.includes(required);
+}
+
+/**
+ * Whether the user holds at least one of `required`.
+ * @param userPermissions - Granted permissions.
+ * @param required - Candidate permissions.
+ * @returns `true` if any match, or `required` is empty.
+ * @internal
+ */
+export function hasAnyPermission(
+  userPermissions: readonly string[],
+  required: readonly OauthScope[],
+): boolean {
+  if (required.length === 0) {
+    return true;
+  }
+  const granted = new Set(userPermissions);
+  return required.some((permission) => granted.has(permission));
+}
+
+/**
+ * Whether the user holds every one of `required`.
+ * @param userPermissions - Granted permissions.
+ * @param required - Required permissions.
+ * @returns `true` if all match, or `required` is empty.
+ * @internal
+ */
+export function hasAllPermissions(
+  userPermissions: readonly string[],
+  required: readonly OauthScope[],
+): boolean {
+  if (required.length === 0) {
+    return true;
+  }
+  const granted = new Set(userPermissions);
+  return required.every((permission) => granted.has(permission));
+}
+
+/**
+ * Verbs held for `resource`, matched exactly against `<verb>:my_org:<resource>`.
+ * @param userPermissions - Granted permissions.
+ * @param resource - Resource segment (e.g. `members`, `domains`).
+ * @returns The distinct verbs for that resource.
+ */
+function getResourceVerbs(userPermissions: readonly string[], resource: string): Set<string> {
+  const verbs = new Set<string>();
+  for (const permission of userPermissions) {
+    const [verb, , resourceSegment] = permission.split(':');
+    if (verb && resourceSegment === resource) {
+      verbs.add(verb);
+    }
+  }
+  return verbs;
+}
+
+/**
+ * Behavior tier for `resource`: delete → admin, create/update → editor, else viewer.
+ * @param userPermissions - Granted permissions.
+ * @param resource - Resource segment to evaluate.
+ * @returns The {@link PermissionTier}.
+ * @internal
+ */
+export function getUserTier(userPermissions: readonly string[], resource: string): PermissionTier {
+  const verbs = getResourceVerbs(userPermissions, resource);
+
+  if (verbs.has('delete')) {
+    return 'admin';
+  }
+  if (verbs.has('create') || verbs.has('update')) {
+    return 'editor';
+  }
+  return 'viewer';
+}

packages/react/src/components/auth0/my-organization/__tests__/domain-table.test.tsx

@@ -8,7 +8,6 @@ import {
   createMockDomain,
   createMockVerifiedDomain,
   createMockIdentityProvider,
-  createMockIdentityProviderAssociatedWithDomain,
   createMockDomainTableProps,
   createMockCreateAction,
   createMockVerifyAction,
@@ -595,19 +594,6 @@ describe('DomainTable', () => {
         ).mockResolvedValue({
           identity_providers: [provider],
         });
-        (
-          apiService.organization.domains.identityProviders.get as ReturnType<typeof vi.fn>
-        ).mockResolvedValue({
-          identity_providers: [
-            createMockIdentityProviderAssociatedWithDomain({
-              id: provider.id,
-              name: provider.name,
-              display_name: provider.display_name,
-              strategy: provider.strategy,
-              is_associated: true,
-            }),
-          ],
-        });
 
         renderWithProviders(<DomainTable {...createMockDomainTableProps({ onOpenProvider })} />);