From 6d9d134f66e742680852c3cb6b8bef5edcecb084 Mon Sep 17 00:00:00 2001 From: Lambdius Date: Wed, 4 Nov 2026 07:58:13 +0000 Subject: [PATCH 1/2] feat(events): add HR employment termination contracts --- package.json | 2 +- src/enums.ts | 3 + src/kafka/realm.schema.json | 120 ++++++++++++++++++++++++++++++++++++ src/types.ts | 43 +++++++++++++ 4 files changed, 167 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index be20b6a..865d675 100644 --- a/package.json +++ b/package.json @@ -3,7 +3,7 @@ "description": "Shared Kafka/gRPC contracts and common enums between MonadIAM services", "author": "Daniil Egorov (https://github.com/Lambdius)", "license": "UNLICENSED", - "version": "3.4.2", + "version": "3.5.0", "types": "dist/index.d.ts", "main": "dist/index.js", "exports": { diff --git a/src/enums.ts b/src/enums.ts index ae04120..4283e99 100644 --- a/src/enums.ts +++ b/src/enums.ts @@ -159,6 +159,9 @@ export enum RealmTopicAction { MEMBERSHIP_JOIN_REQUESTED = "MEMBERSHIP_JOIN_REQUESTED", MEMBERSHIP_JOIN_CONFIRMED = "MEMBERSHIP_JOIN_CONFIRMED", MEMBERSHIP_JOIN_REJECTED = "MEMBERSHIP_JOIN_REJECTED", + MEMBERSHIP_LEAVE_REQUESTED = "MEMBERSHIP_LEAVE_REQUESTED", + MEMBERSHIP_LEAVE_CONFIRMED = "MEMBERSHIP_LEAVE_CONFIRMED", + MEMBERSHIP_LEAVE_REJECTED = "MEMBERSHIP_LEAVE_REJECTED", BOOTSTRAP_ORGANIZATION_REQUESTED = "BOOTSTRAP_ORGANIZATION_REQUESTED", BOOTSTRAP_PROJECT_REQUESTED = "BOOTSTRAP_PROJECT_REQUESTED", BOOTSTRAP_CONFIRMED = "BOOTSTRAP_CONFIRMED", diff --git a/src/kafka/realm.schema.json b/src/kafka/realm.schema.json index 3deb0d5..dee51b1 100644 --- a/src/kafka/realm.schema.json +++ b/src/kafka/realm.schema.json @@ -167,6 +167,126 @@ } } }, + { + "type": "object", + "additionalProperties": false, + "required": ["actionType", "payload"], + "properties": { + "actionType": { + "const": "MEMBERSHIP_LEAVE_REQUESTED" + }, + "payload": { + "type": "object", + "additionalProperties": false, + "required": ["actor", "realm", "input"], + "properties": { + "actor": { + "type": "string" + }, + "realm": { + "type": "string" + }, + "input": { + "type": "object", + "additionalProperties": false, + "required": ["organization", "process", "account"], + "properties": { + "organization": { + "type": "string" + }, + "process": { + "type": "string" + }, + "account": { + "type": "string" + } + } + } + } + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": ["actionType", "payload"], + "properties": { + "actionType": { + "const": "MEMBERSHIP_LEAVE_CONFIRMED" + }, + "payload": { + "type": "object", + "additionalProperties": false, + "required": ["actor", "realm", "input"], + "properties": { + "actor": { + "type": "string" + }, + "realm": { + "type": "string" + }, + "input": { + "type": "object", + "additionalProperties": false, + "required": ["organization", "process", "account"], + "properties": { + "organization": { + "type": "string" + }, + "process": { + "type": "string" + }, + "account": { + "type": "string" + } + } + } + } + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": ["actionType", "payload"], + "properties": { + "actionType": { + "const": "MEMBERSHIP_LEAVE_REJECTED" + }, + "payload": { + "type": "object", + "additionalProperties": false, + "required": ["actor", "realm", "input"], + "properties": { + "actor": { + "type": "string" + }, + "realm": { + "type": "string" + }, + "input": { + "type": "object", + "additionalProperties": false, + "required": ["organization", "process", "account", "reason"], + "properties": { + "organization": { + "type": "string" + }, + "process": { + "type": "string" + }, + "account": { + "type": "string" + }, + "reason": { + "type": "string" + } + } + } + } + } + } + }, { "type": "object", "additionalProperties": false, diff --git a/src/types.ts b/src/types.ts index ddaed7d..0c6806f 100644 --- a/src/types.ts +++ b/src/types.ts @@ -255,6 +255,9 @@ declare global { | MembershipJoinRequestedMessage | MembershipJoinConfirmedMessage | MembershipJoinRejectedMessage + | MembershipLeaveRequestedMessage + | MembershipLeaveConfirmedMessage + | MembershipLeaveRejectedMessage | BootstrapOrganizationRequestedMessage | BootstrapProjectRequestedMessage | BootstrapConfirmedMessage @@ -316,6 +319,46 @@ declare global { }; }; + type MembershipLeaveRequestedMessage = { + actionType: RealmTopicAction.MEMBERSHIP_LEAVE_REQUESTED; + payload: { + actor: string; + realm: string; + input: { + organization: string; + process: string; + account: string; + }; + }; + }; + + type MembershipLeaveConfirmedMessage = { + actionType: RealmTopicAction.MEMBERSHIP_LEAVE_CONFIRMED; + payload: { + actor: string; + realm: string; + input: { + organization: string; + process: string; + account: string; + }; + }; + }; + + type MembershipLeaveRejectedMessage = { + actionType: RealmTopicAction.MEMBERSHIP_LEAVE_REJECTED; + payload: { + actor: string; + realm: string; + input: { + organization: string; + process: string; + account: string; + reason: string; + }; + }; + }; + type BootstrapOrganizationRequestedMessage = { actionType: RealmTopicAction.BOOTSTRAP_ORGANIZATION_REQUESTED; payload: { From 419ea71b095986ef08e2562ce0682efa60b92641 Mon Sep 17 00:00:00 2001 From: Lambdius Date: Wed, 4 Nov 2026 08:01:09 +0000 Subject: [PATCH 2/2] fix(datasets): grant assigned request read access to approvers --- .../role-permission-assignment.dataset.ts | 50 +++++++++++++++++++ 1 file changed, 50 insertions(+) diff --git a/src/datasets/demo/access-control/role-permission-assignment.dataset.ts b/src/datasets/demo/access-control/role-permission-assignment.dataset.ts index 75aae81..105aeb1 100644 --- a/src/datasets/demo/access-control/role-permission-assignment.dataset.ts +++ b/src/datasets/demo/access-control/role-permission-assignment.dataset.ts @@ -22762,6 +22762,18 @@ const dataset = [ created_at: new Date("2026-01-01T00:00:00.000Z"), version: 1, }, + // nimbus.people-operator / hr_request.read_assigned + { + id: "c75f1cff-7d19-41da-b8c1-3eefbd4dc268", + role_id: "55d7a15b-3536-40d2-ba80-a2675b9e86c7", + permission_id: "8be5a7ed-7333-444d-8c43-7b18b9bf053d", + realm_id: "2fd2dfdd-8df2-4ad6-83a3-cc2333888f28", + scope: AssignmentScope.REALM, + is_system_managed: false, + is_revoked: false, + created_at: new Date("2026-01-01T00:00:00.000Z"), + version: 1, + }, // nimbus.people-operator / hr_approval_step.read_assigned { id: "e8dc63c8-7e5a-40a5-ae9b-8d1628d793a5", @@ -23146,6 +23158,18 @@ const dataset = [ created_at: new Date("2026-01-01T00:00:00.000Z"), version: 1, }, + // orbit.people-operator / hr_request.read_assigned + { + id: "c65fc831-fcb2-4e54-9388-8ee7b9799280", + role_id: "36be95f8-d94d-4732-bd4b-7e58e7ffaf5e", + permission_id: "8be5a7ed-7333-444d-8c43-7b18b9bf053d", + realm_id: "0a583c93-bbc0-4af6-978d-4b8000fa72be", + scope: AssignmentScope.REALM, + is_system_managed: false, + is_revoked: false, + created_at: new Date("2026-01-01T00:00:00.000Z"), + version: 1, + }, // orbit.people-operator / hr_approval_step.read_assigned { id: "2950ed94-1d77-44ad-83bf-6bdd4fb7931d", @@ -47818,6 +47842,19 @@ const redis = [ version: 1, permission_realm_id: "74e70d3a-5130-4b3a-9ab6-cbfe430a5813", }, + // nimbus.people-operator / hr_request.read_assigned + { + id: "c75f1cff-7d19-41da-b8c1-3eefbd4dc268", + role_id: "55d7a15b-3536-40d2-ba80-a2675b9e86c7", + permission_id: "8be5a7ed-7333-444d-8c43-7b18b9bf053d", + realm_id: "2fd2dfdd-8df2-4ad6-83a3-cc2333888f28", + scope: AssignmentScope.REALM, + is_system_managed: false, + is_revoked: false, + created_at: new Date("2026-01-01T00:00:00.000Z"), + version: 1, + permission_realm_id: "74e70d3a-5130-4b3a-9ab6-cbfe430a5813", + }, // nimbus.people-operator / hr_approval_step.read_assigned { id: "e8dc63c8-7e5a-40a5-ae9b-8d1628d793a5", @@ -48234,6 +48271,19 @@ const redis = [ version: 1, permission_realm_id: "74e70d3a-5130-4b3a-9ab6-cbfe430a5813", }, + // orbit.people-operator / hr_request.read_assigned + { + id: "c65fc831-fcb2-4e54-9388-8ee7b9799280", + role_id: "36be95f8-d94d-4732-bd4b-7e58e7ffaf5e", + permission_id: "8be5a7ed-7333-444d-8c43-7b18b9bf053d", + realm_id: "0a583c93-bbc0-4af6-978d-4b8000fa72be", + scope: AssignmentScope.REALM, + is_system_managed: false, + is_revoked: false, + created_at: new Date("2026-01-01T00:00:00.000Z"), + version: 1, + permission_realm_id: "74e70d3a-5130-4b3a-9ab6-cbfe430a5813", + }, // orbit.people-operator / hr_approval_step.read_assigned { id: "2950ed94-1d77-44ad-83bf-6bdd4fb7931d",