Allow declaring content scope dimensions at runtime

[fraxachun]

Problem

Content scope dimensions were only known implicitly from the keys of the availableContentScopes values. An optional dimension that is not part of availableContentScopes (e.g. one with too many values to enumerate) therefore had no runtime representation at all — it could neither be declared nor used with arbitrary values.

Solution

Add an optional availableContentScopeDimensions option to the UserPermissionsModule to declare the content scope dimensions (with optional labels) at runtime. When omitted, the dimensions are derived from the keys of availableContentScopes as before, so existing apps are unaffected. The declared dimensions are used to represent access to all content scopes as a per-dimension wildcard ({ domain: "*", ... }), which therefore also covers dimensions that are not part of availableContentScopes.

A content scope for a dimension that is not part of availableContentScopes may now hold any value (including the "*" wildcard).

Removing checkContentScopes

Content scopes are no longer validated against availableContentScopes (the checkContentScopes method is removed), because:

• It was not the authorization boundary. Access is enforced per request by isAllowed / isScopeWithin, which compares the requested resource's scope against the user's granted scopes and never consults availableContentScopes. A stale content scope (e.g. one pointing at a removed domain) matches no real resource, so it cannot cause an over-grant.
• It gave no durable guarantee. availableContentScopes can be resolved dynamically (a factory), so validating at write time says nothing about validity later: a scope valid when saved can become invalid after a config change, and vice versa.
• It became incoherent. With dimensions that can live outside availableContentScopes and hold any value (including "*"), availableContentScopes no longer describes the full space of valid content scopes, so matching against it would reject legitimate scopes.

Example

UserPermissionsModule.forRootAsync({
    useFactory: () => ({
        availableContentScopes: [ ... ],
        availableContentScopeDimensions: [{ name: "domain", label: "Domain (Website)" }, { name: "language" }, { name: "product" }],
        // ...
    }),
    // ...
});

Stacked pull request

This is layer 3 of 4 of a stacked pull request. Review and merge bottom-up (each layer targets the one above it):

1. Support wildcard values for content scope dimensions → main (Support wildcard values for content scope dimensions #6114)
2. Summarize a user's content scopes per dimension in the users list → Support wildcard values for content scope dimensions #6114 (Remove the Permissions and Scopes columns from the user permissions users list #6135)
3. Allow declaring content scope dimensions at runtime (this PR) → Remove the Permissions and Scopes columns from the user permissions users list #6135 (Allow declaring content scope dimensions at runtime #6115)
4. Rework content scopes management in the user permissions panel → Allow declaring content scope dimensions at runtime #6115 (Rework content scopes management in the user permissions panel #6116)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR adds a runtime representation for content scope dimensions (e.g. domain, language, product) by introducing a new availableContentScopeDimensions option on UserPermissionsModule and exposing it via a new userPermissionsAvailableContentScopeDimensions GraphQL query. This enables optional/non-enumerable dimensions (too many values to list in availableContentScopes) to be declared and surfaced in the admin UI while keeping backward compatibility by deriving dimensions from availableContentScopes when not configured.

Changes:

• Add availableContentScopeDimensions option (with optional labels) and a ContentScopeDimension type to declare dimensions at runtime.
• Expose dimensions via userPermissionsAvailableContentScopeDimensions query and implement getAvailableContentScopeDimensions() in UserPermissionsService.
• Update content scope validation/filtering to only validate the enumerable part (dimensions present in availableContentScopes), allowing free values (including *) for declared non-enumerable dimensions; add/adjust tests and demo wiring.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/api/cms-api/src/user-permissions/user-permissions.types.ts	Adds ContentScopeDimension config type and availableContentScopeDimensions option.
packages/api/cms-api/src/user-permissions/user-permissions.service.ts	Implements dimension retrieval and updates scope validation/matching for non-enumerable dimensions.
packages/api/cms-api/src/user-permissions/user-permissions.service.spec.ts	Adds unit tests for dimension derivation and updated validation semantics.
packages/api/cms-api/src/user-permissions/user-content-scopes.resolver.ts	Adds GraphQL query for available scope dimensions.
packages/api/cms-api/src/user-permissions/user-content-scopes.resolver.spec.ts	Tests the new resolver query and updates content scope test data.
packages/api/cms-api/src/user-permissions/dto/content-scope.ts	Adds GraphQL ContentScopeDimension object type.
packages/api/cms-api/src/index.ts	Exports the new ContentScopeDimension type from the public API.
packages/api/cms-api/schema.gql	Updates schema with the new type and query.
demo/api/src/content-scope/content-scope.interface.ts	Extends demo content scope with optional product dimension.
demo/api/src/auth/access-control.service.ts	Uses wildcard for product in demo content scopes.
demo/api/src/auth/access-control.service.spec.ts	Updates expectations for added product wildcard dimension.
demo/api/src/app.module.ts	Declares product via availableContentScopeDimensions in demo module config.
demo/api/schema.gql	Updates demo schema with the new type and query.
.changeset/content-scope-dimensions.md	Adds changeset describing the new runtime dimension capability.

[fraxachun]

Re-linking this PR to the working session (stacked: #6114 → #6115 → #6116).

---

Generated by Claude Code