feat: add platform access foundation

crates/crank-core/src/access.rs

@@ -0,0 +1,84 @@
+use serde::{Deserialize, Serialize};
+
+use crate::ids::{InvitationId, PlatformApiKeyId, UserId, WorkspaceId};
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UserStatus {
+    Active,
+    Disabled,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum MembershipRole {
+    Owner,
+    Admin,
+    Operator,
+    Viewer,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum InvitationStatus {
+    Pending,
+    Accepted,
+    Revoked,
+    Expired,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlatformApiKeyStatus {
+    Active,
+    Revoked,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum PlatformApiKeyScope {
+    Read,
+    Write,
+    Deploy,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct User {
+    pub id: UserId,
+    pub email: String,
+    pub display_name: String,
+    pub status: UserStatus,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct Membership {
+    pub workspace_id: WorkspaceId,
+    pub user_id: UserId,
+    pub role: MembershipRole,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct InvitationToken {
+    pub id: InvitationId,
+    pub workspace_id: WorkspaceId,
+    pub email: String,
+    pub role: MembershipRole,
+    pub status: InvitationStatus,
+    pub token_hash: String,
+    pub expires_at: String,
+    pub created_at: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct PlatformApiKey {
+    pub id: PlatformApiKeyId,
+    pub workspace_id: WorkspaceId,
+    pub name: String,
+    pub prefix: String,
+    pub scopes: Vec<PlatformApiKeyScope>,
+    pub status: PlatformApiKeyStatus,
+    pub created_at: String,
+    pub last_used_at: Option<String>,
+}

crates/crank-core/src/ids.rs

@@ -43,3 +43,5 @@ define_id!(AuthProfileId);
 define_id!(WorkspaceId);
 define_id!(UserId);
 define_id!(AgentId);
+define_id!(InvitationId);
+define_id!(PlatformApiKeyId);

crates/crank-core/src/lib.rs

@@ -1,3 +1,4 @@
+pub mod access;
 pub mod agent;
 pub mod auth;
 pub mod ids;
@@ -5,13 +6,18 @@ pub mod operation;
 pub mod protocol;
 pub mod workspace;
 
+pub use access::{
+    InvitationStatus, InvitationToken, Membership, MembershipRole, PlatformApiKey,
+    PlatformApiKeyScope, PlatformApiKeyStatus, User, UserStatus,
+};
 pub use agent::{Agent, AgentOperationBinding, AgentStatus, AgentVersion};
 pub use auth::{
     ApiKeyHeaderAuthConfig, ApiKeyQueryAuthConfig, AuthConfig, AuthProfile, BasicAuthConfig,
     BearerAuthConfig, SecretRef,
 };
 pub use ids::{
-    AgentId, AuthProfileId, DescriptorId, OperationId, SampleId, ToolId, UserId, WorkspaceId,
+    AgentId, AuthProfileId, DescriptorId, InvitationId, OperationId, PlatformApiKeyId, SampleId,
+    ToolId, UserId, WorkspaceId,
 };
 pub use operation::{
     ConfigExport, ExecutionConfig, GeneratedDraft, GeneratedDraftStatus, GraphqlTarget,