auth/account_schema.ts

Account — authentication identity. You log in as an account.

Actor — the entity that acts. Owns cells, holds role_grants, appears in audit trails.

Zod schema for the actor summary returned in admin account listings.

Zod schema for an admin account listing entry (account + actor + role_grants + pending offers).

Zod schema for admin-facing account data — extends SessionAccountJson with audit fields.

API token for CLI/programmatic access.

Server-side auth session row, keyed by blake3 hash of the session token. Structurally identical to the wire shape AuthSessionJson — kept as the DB-row name so query signatures keep saying which side of the boundary they read.

Zod schema for AuthSession — id is the blake3 hash, safe for client.

Zod schema for client-safe API token listing (excludes token_hash).

Whether role_grants holds a live global grant of role — scope_id is null and the grant passes is_role_grant_active.

This is the question a role gate asks. A scoped grant confers its role on one resource only, and a scoped grant of a builtin role (admin, keeper) confers nothing, so matching on the role name alone would read a grant for one resource as authority everywhere. Server-side the same rule is has_scoped_role(ctx, role, null) over a request context and query_account_has_global_role in SQL; this is the form for a bare list of grants — AuthState.role_grants, an admin listing row.

The scope match is scope_id === null, so a grant decoded without the field is not read as global. Client-side the answer shapes the UI and nothing else: the server re-checks every request.

Whether a role grant is live, from its wire fields — not revoked, and not past expires_at.

Server-side this is belt-and-suspenders: every role_grant a request context holds came through query_role_grant_find_active_for_actor, whose revoked_at IS NULL AND (expires_at IS NULL OR expires_at > NOW()) is the authoritative gate on both spines (the Rust twin's in-memory RoleGrantRow carries no timestamps at all and re-checks nothing).

expires_at arrives second-truncated, so the expiry check is is_iso8601_seconds_live (timestamp.ts): it admits through the end of the second the stamp names, so the predicate can never report a grant expired *before* the SQL gate would — a bare expires_at > now would deny an admitted grant for up to a second.

Zod schema for a pending role_grant offer surfaced in admin account listings.

Deliberately narrower than RoleGrantOfferJson: omits message and decline_reason so cross-admin visibility of the listing does not expose grantor-authored text that the audit log also withholds. Full offer payloads remain available through the offer-specific RPC surface and the audit log when admins need them.

from_username is resolved server-side so multi-admin deployments can see at a glance whose pending offer is blocking a "+ {role}" button; the resolution runs inside the listing query's parallel batch.

Maximum length of the optional free-form revoked_reason attached to a revoked role_grant. Bounds the value at the schema layer so both the admin input (when the route surfaces a reason field) and the revokee-facing role_grant_revoke WS notification validate against the same ceiling. Counted in UTF-16 code units.

Role grant — time-bounded, revocable grant of a role to an actor.

Zod schema for the role_grant summary returned in admin account listings.

Account without sensitive fields, scoped to the authenticated user's own session.

Zod schema for SessionAccount — account without sensitive fields.

A session's storage key — the blake3 hash of its raw token, branded so a bare string can't stand in for one. Blake3Hash (primitive_schemas.ts) is the shape; this is the meaning. Mint only via hash_session_token, or SessionId.parse at an external boundary.

The raw token itself is never typed — it stays a string that exists only long enough to be hashed.

Convert an Account to an AdminAccountJson for admin listings.

Convert an Account to a SessionAccount by stripping sensitive fields.