@ossy/policies

Policy domain package for the Ossy platform — access policies as event-sourced entities with create/revoke actions, queries, and an ADR 0006 schema.

What this package provides

| Primitive | File | Id / export | |---|---|---| | Schema | policy.schema.js | @ossy/policies/schema/policy | | Schema ids | schema-ids.js | PolicySchema | | Aggregate | policy.aggregate.js | Policy (kind: 'entity') | | Events | policies.events.js | PoliciesEvents.Created, PoliciesEvents.Revoked | | Queries | policies.queries.js | PoliciesQueries.GetPoliciesForUser | | Action | create.action.js | @ossy/policies/actions/create (CreatePolicy) | | Task | create.task.js | @ossy/policies/tasks/create | | Action | revoke.action.js | @ossy/policies/actions/revoke (RevokePolicy) | | Task | revoke.task.js | @ossy/policies/tasks/revoke |

@ossy/platform loads policies for authenticated users via PoliciesQueries.GetPoliciesForUser and attaches them to req.user.policies.

Policy schema (ADR 0006)

| Schema | Id | Purpose | |---|---|---| | Policy | @ossy/policies/schema/policy | Access rule metadata (effect, assignedTo) |

Policy state is primarily driven by aggregate events; the schema supports manifest discovery and document tooling.

Creating a policy

Call POST /actions with:

{
  "action": "@ossy/policies/actions/create",
  "payload": {
    "belongsTo": "ws-1",
    "assignedTo": "user-2",
    "effect": "allow",
    "actions": ["resource:read"],
    "where": {
      "workspace": "ws-1",
      "location": "/uploads/**",
      "type": "image/*"
    }
  }
}

Required fields: belongsTo, assignedTo, actions, where. effect defaults to allow.

Revoking a policy

Call POST /actions with:

{
  "action": "@ossy/policies/actions/revoke",
  "payload": {
    "policyId": "policy-abc"
  }
}

Server usage

import { Policy, PoliciesEvents, PoliciesQueries, PolicySchema } from '@ossy/policies/server'

PolicySchema.policy
// => '@ossy/policies/schema/policy'

const policies = await PoliciesQueries.GetPoliciesForUser('user-2')

Client usage

import { CreatePolicy, RevokePolicy } from '@ossy/policies'

CreatePolicy.id
// => '@ossy/policies/actions/create'

Event model (ADR 0008)

Policies are event-sourced entities. Policy.View folds:

| Event | Effect | |---|---| | Created | Sets id, belongsTo, assignedTo, effect, actions, where, status: 'active' | | Revoked | Sets status: 'revoked' |

PoliciesEvents.Created emits type: '@ossy/policies/schema/policy', event: 'Created', and resourceId for the policy id.

Migration

| Before | After | |---|---| | policies/actions/create | @ossy/policies/actions/create | | policies/actions/revoke | @ossy/policies/actions/revoke | | (task shared action id) | @ossy/policies/tasks/create | | (task shared action id) | @ossy/policies/tasks/revoke | | PoliciesEvents.PolicyCreated | PoliciesEvents.Created | | PoliciesEvents.PolicyRevoked | PoliciesEvents.Revoked | | Aggregate query type: 'Policy' | type: '@ossy/policies/schema/policy' | | Event field type: 'PolicyCreated' | event: 'Created' with schema type |