operations: enforce community capability limits

crates/crank-core/src/edition.rs

@@ -26,6 +26,12 @@ pub enum OperationSecurityLevel {
     Strict,
 }
 
+impl Default for OperationSecurityLevel {
+    fn default() -> Self {
+        Self::Standard
+    }
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
 pub struct EditionLimits {
     pub max_workspaces: Option<u32>,

crates/crank-core/src/operation.rs

@@ -5,6 +5,7 @@ use serde_json::Value;
 use time::OffsetDateTime;
 
 use crate::{
+    edition::OperationSecurityLevel,
     ids::{AuthProfileId, DescriptorId, OperationId, SampleId},
     protocol::{ExportMode, GraphqlOperationType, HttpMethod, Protocol},
     soap::{
@@ -17,6 +18,10 @@ fn default_operation_category() -> String {
     "general".to_owned()
 }
 
+fn default_operation_security_level() -> OperationSecurityLevel {
+    OperationSecurityLevel::Standard
+}
+
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
 #[serde(rename_all = "snake_case")]
 pub enum OperationStatus {
@@ -217,6 +222,8 @@ pub struct Operation<TSchema, TMapping> {
     #[serde(default = "default_operation_category")]
     pub category: String,
     pub protocol: Protocol,
+    #[serde(default = "default_operation_security_level")]
+    pub security_level: OperationSecurityLevel,
     pub status: OperationStatus,
     pub version: u32,
     pub target: Target,
@@ -272,6 +279,7 @@ mod tests {
 
     use crate::{
         auth::{AuthConfig, AuthProfile, BearerAuthConfig},
+        edition::OperationSecurityLevel,
         ids::{AuthProfileId, OperationId, SampleId},
         operation::{
             ConfigExport, ExecutionConfig, GraphqlTarget, Operation, OperationStatus,
@@ -382,6 +390,7 @@ mod tests {
             display_name: "Create Lead".to_owned(),
             category: "sales".to_owned(),
             protocol: Protocol::Rest,
+            security_level: OperationSecurityLevel::Standard,
             status: OperationStatus::Draft,
             version: 1,
             target: Target::Rest(RestTarget {
@@ -470,6 +479,7 @@ mod tests {
             display_name: "Create Lead".to_owned(),
             category: "sales".to_owned(),
             protocol: Protocol::Rest,
+            security_level: OperationSecurityLevel::Standard,
             status: OperationStatus::Published,
             version: 3,
             target: Target::Rest(RestTarget {
@@ -514,6 +524,7 @@ mod tests {
             serde_yaml::from_str(&yaml).unwrap();
 
         assert!(yaml.contains("protocol: rest"));
+        assert!(yaml.contains("security_level: standard"));
         assert!(yaml.contains("export_mode: portable"));
         assert_eq!(restored, operation);
     }
@@ -526,6 +537,7 @@ name: crm_create_lead
 display_name: Create Lead
 category: sales
 protocol: rest
+security_level: standard
 status: draft
 version: 1
 target:
@@ -557,6 +569,7 @@ updated_at: 2026-03-25T08:10:00Z
         let restored: Operation<serde_json::Value, serde_json::Value> =
             serde_yaml::from_str(yaml).unwrap();
 
+        assert_eq!(restored.security_level, OperationSecurityLevel::Standard);
         assert_eq!(restored.published_at, None);
     }
 }