Add identity access controls

AgentCompany-New/src/shared/commands.ts

@@ -3,10 +3,13 @@ import type {
   ComplianceExportType,
   ComplianceSubjectType,
   LegalHoldEntityType,
+  IdentitySource,
+  PrincipalType,
   ProviderDataPolicy,
   ProviderExecutionMode,
   RetentionFreezeScopeType,
   RiskLevel,
+  RoleKey,
   SearchEntityType,
   SocialPlatform,
   TaskPriority,
@@ -86,6 +89,24 @@ export interface DecideApprovalInput {
   decidedByEmployeeId: string;
 }
 
+export interface SyncEmployeeIdentityInput {
+  orgId: string;
+  employeeId: string;
+  source: IdentitySource;
+  externalSubject: string;
+  email: string | null;
+}
+
+export interface GrantRoleInput {
+  orgId: string;
+  principalType: PrincipalType;
+  principalId: string;
+  roleKey: RoleKey;
+  scopeType: "organization" | "workspace" | "project" | "department";
+  scopeId: string;
+  grantedByEmployeeId: string;
+}
+
 export interface SendMessageInput {
   orgId: string;
   spaceId: string;

AgentCompany-New/src/shared/desktop-api.ts

@@ -22,6 +22,7 @@ import type {
   DeleteOrganizationInput,
   ImportFileInput,
   ImportSkillDirectoryInput,
+  GrantRoleInput,
   LaunchProviderSignInInput,
   LaunchSocialLoginInput,
   ResolveAgentSkillsInput,
@@ -33,6 +34,7 @@ import type {
   SetLegalHoldStateInput,
   SetRetentionFreezeStateInput,
   SetScheduledPostStateInput,
+  SyncEmployeeIdentityInput,
   UpdateProviderPolicyInput,
   UpdateTaskStatusInput,
 } from "./commands";
@@ -52,6 +54,8 @@ export interface DesktopApi {
   updateTaskStatus(input: UpdateTaskStatusInput): Promise<DesktopResult<AppSnapshot>>;
   createApproval(input: CreateApprovalInput): Promise<DesktopResult<AppSnapshot>>;
   decideApproval(input: DecideApprovalInput): Promise<DesktopResult<AppSnapshot>>;
+  syncEmployeeIdentity(input: SyncEmployeeIdentityInput): Promise<DesktopResult<AppSnapshot>>;
+  grantRole(input: GrantRoleInput): Promise<DesktopResult<AppSnapshot>>;
   createChatSpace(input: CreateChatSpaceInput): Promise<DesktopResult<AppSnapshot>>;
   sendMessage(input: SendMessageInput): Promise<DesktopResult<AppSnapshot>>;
   markChatSpaceRead(input: MarkChatSpaceReadInput): Promise<DesktopResult<AppSnapshot>>;

AgentCompany-New/src/shared/domain.ts

@@ -1,8 +1,10 @@
 import type { BoardInterventionRecord as BoardInterventionRecordModel, ChatThreadBoardState as ChatThreadBoardStateModel } from "./board-domain";
 import type { ComplianceExportRecord, LegalHoldRecord, RetentionFreezeRecord } from "./compliance-domain";
+import type { AccessDecisionRecord, EmployeeIdentityRecord, RoleGrantRecord, ServiceIdentityRecord } from "./identity-domain";
 import type { ProviderDataPolicy, ProviderExecutionMode } from "./provider-policy-domain";
 export { BOARD_INTERVENTION_ACTION, BOARD_INTERVENTION_MODE, CHAT_THREAD_BOARD_STATE, type BoardInterventionAction, type BoardInterventionMode, type BoardInterventionRecord, type ChatThreadBoardState } from "./board-domain";
 export { COMPLIANCE_EXPORT_STATE, COMPLIANCE_EXPORT_TYPE, type ComplianceExportRecord, type ComplianceExportState, type ComplianceExportType, type ComplianceSubjectType, type LegalHoldEntityType, type LegalHoldRecord, type RetentionFreezeRecord, type RetentionFreezeScopeType } from "./compliance-domain";
+export { ACCESS_DECISION, IDENTITY_SOURCE, ROLE_KEY, type AccessDecision, type AccessDecisionRecord, type EmployeeIdentityRecord, type IdentitySource, type PrincipalType, type RoleGrantRecord, type RoleKey, type ServiceIdentityRecord } from "./identity-domain";
 export { PROVIDER_DATA_POLICY, PROVIDER_EXECUTION_MODE, type ProviderDataPolicy, type ProviderExecutionMode } from "./provider-policy-domain";
 export { SEARCH_ENTITY_TYPES, type SearchEntityType, type SearchResultRecord } from "./search-domain";
 export const TASK_STATUS = { BACKLOG: "backlog", IN_PROGRESS: "in_progress", REVIEW: "review", DONE: "done" } as const;
@@ -465,5 +467,6 @@ export interface AppSnapshot {
   policyRules: PolicyRuleRecord[];
   migrationReports: MigrationReportRecord[];
   complianceExports: ComplianceExportRecord[]; legalHolds: LegalHoldRecord[]; retentionFreezes: RetentionFreezeRecord[];
+  employeeIdentities: EmployeeIdentityRecord[]; serviceIdentities: ServiceIdentityRecord[]; roleGrants: RoleGrantRecord[]; accessDecisions: AccessDecisionRecord[];
   auditEvents: AuditEventRecord[];
 }

AgentCompany-New/src/shared/identity-domain.ts

@@ -0,0 +1,34 @@
+type ValueOf<T> = T[keyof T];
+
+export const IDENTITY_SOURCE = { BOOTSTRAP: "bootstrap", SSO: "sso", SCIM: "scim" } as const;
+export const ROLE_KEY = {
+  ORG_ADMIN: "org_admin",
+  APPROVAL_DECIDER: "approval_decider",
+  HIRING_MANAGER: "hiring_manager",
+  SCOPED_AGENT: "scoped_agent",
+} as const;
+export const ACCESS_DECISION = { ALLOW: "allow", DENY: "deny" } as const;
+
+export type IdentitySource = ValueOf<typeof IDENTITY_SOURCE>;
+export type RoleKey = ValueOf<typeof ROLE_KEY>;
+export type AccessDecision = ValueOf<typeof ACCESS_DECISION>;
+export type PrincipalType = "employee" | "agent" | "service_identity";
+
+export interface EmployeeIdentityRecord {
+  id: string; orgId: string; employeeId: string; source: IdentitySource; externalSubject: string;
+  email: string | null; active: boolean; createdAt: string; lastSeenAt: string | null;
+}
+
+export interface ServiceIdentityRecord {
+  id: string; orgId: string; agentId: string; name: string; scopeJson: string; createdAt: string;
+}
+
+export interface RoleGrantRecord {
+  id: string; orgId: string; principalType: PrincipalType; principalId: string; roleKey: RoleKey;
+  scopeType: string; scopeId: string; grantedByEmployeeId: string | null; createdAt: string;
+}
+
+export interface AccessDecisionRecord {
+  id: string; orgId: string; principalType: PrincipalType; principalId: string; action: string;
+  resourceType: string; resourceId: string; decision: AccessDecision; reason: string; createdAt: string;
+}

AgentCompany-New/src/shared/ipc.ts

@@ -9,6 +9,8 @@ export const IPC_CHANNELS = {
   updateTaskStatus: "agentcompany:update-task-status",
   createApproval: "agentcompany:create-approval",
   decideApproval: "agentcompany:decide-approval",
+  syncEmployeeIdentity: "agentcompany:sync-employee-identity",
+  grantRole: "agentcompany:grant-role",
   createChatSpace: "agentcompany:create-chat-space",
   sendMessage: "agentcompany:send-message",
   markChatSpaceRead: "agentcompany:mark-chat-space-read",