Add policy CRUD endpoints with validation

[Lakes41]

Difficulty: Hard

Type: Feature

Summary

Add API endpoints for creating, updating, listing, and archiving access policies. This allows admin tools to manage policies without editing seed data or database records manually.

Current Behaviour

Policies are evaluated by the policy engine, but there is no complete admin API for policy management.

Expected Behaviour

Authorised admins should be able to manage policies through validated endpoints that enforce community and resource scoping.

Suggested Implementation

Create a policy service and route group under apps/access-api. Validate rule type, policy parameters, resource ID, community ID, and archived state. Update shared types and sdk-lite methods for client access.

Files or Areas Likely Affected

• apps/access-api/src/routes.ts
• apps/access-api/src/services/policyService.ts
• apps/access-api/prisma/schema.prisma
• packages/policy-engine/src/index.ts
• packages/shared-types/src/index.ts
• packages/sdk-lite/src/index.ts

Acceptance Criteria

• Admins can list policies for a community
• Admins can create a policy for a registered resource
• Admins can update supported policy fields
• Admins can archive a policy without deleting history
• Invalid rule parameters are rejected before persistence
• Tests cover valid policies, invalid policies, archive behaviour, and unauthorised access

Additional Notes

This should build on the structured policy model rather than replacing it.

[ekwe7]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery

[ekwe7]

I would love to work on this issue. I have experience building production ready applications and collaborating through GitHub workflows. I'll carefully analyze the current implementation, propose a reliable solution, and submit a well-tested PR. My focus is on clean code, maintainability, and timely delivery

[Thosine-01]

Hi! I’d love to take charge of implementing the full administrative API lifecycle endpoints for your Access Policy management system. Manually manipulating seed data or updating database rows for access control rules is highly error-prone and severely limits operational scalability. I have strong experience building secure multi-tenant backend architectures, extending shared TypeScript SDKs, and designing robust, validated configuration layers.

I will start by extending your schema.prisma file with an indexed soft-delete column to support compliance-safe archiving without discarding historical access records. I’ll implement the dedicated policyService.ts and validate incoming payloads against your policy-engine rule specifications, ensuring invalid policy parameters are rejected at the application border. I will then expose these routes under apps/access-api, extend your packages/shared-types, and add corresponding management methods to packages/sdk-lite. Everything will be backed by detailed integration tests verifying scoped creation, edge-case validation, soft-delete visibility, and strict admin-only authorization blocks.

[clintjeff2]

Hello, I have 6 years of experience working on tasks like this and handling similar challenges across backend, frontend, and smart-contract development. I have carefully read and fully understood the task requirements, and I am confident I can deliver a clean, efficient, and well-tested solution promptly. I always ensure high-quality implementation, maintainability, and adherence to best practices.

Pull request in 5 hours.

[grantfox-oss]

🦊 GrantFox — @Thosine-01 has been assigned to this issue as part of the Official Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #45)
2. Your PR will be reviewed by the Adamantine-guild maintainers

Good luck! Track your progress on GrantFox.