[Backport v8] Allow declaring content scope dimensions at runtime

[VPS-thodax]

Backport of #6115 to v8.x.x.

Note

This PR is stacked on #6292 (the backport of #6114 to v8.x.x, layer 1). It targets claude/backport-v8-6114 because v8.x.x doesn't have the wildcard content scope dimension support (#6114) yet. Once #6292 is merged into v8.x.x, this PR's base will need to be retargeted to v8.x.x (or GitHub will do so automatically once #6292 merges, matching how the original stacked PRs behaved).

Original description

Problem

Content scope dimensions were only known implicitly from the keys of the availableContentScopes values. An optional dimension that is not part of availableContentScopes (e.g. one with too many values to enumerate) therefore had no runtime representation at all — it could neither be declared nor used with arbitrary values.

Solution

Add an optional availableContentScopeDimensions option to the UserPermissionsModule to declare the content scope dimensions (with optional labels) at runtime. When omitted, the dimensions are derived from the keys of availableContentScopes as before, so existing apps are unaffected. The declared dimensions are used to represent access to all content scopes as a per-dimension wildcard ({ domain: "*", ... }), which therefore also covers dimensions that are not part of availableContentScopes.

A content scope for a dimension that is not part of availableContentScopes may now hold any value (including the "*" wildcard).

Removing checkContentScopes

Content scopes are no longer validated against availableContentScopes (the checkContentScopes method is removed) — see the original PR (#6115) for the full rationale.

Backport notes

Cherry-picking the squash commit (f4d091fa71ffe1c3c0f72431bbdb6151b6e93faa) from main onto claude/backport-v8-6114 produced conflicts in two files, both resolved by applying the incoming change against v8.x.x's existing code:

• packages/api/cms-api/src/user-permissions/user-content-scopes.resolver.ts: the incoming code used userService.findUserOrThrow(userId), but findUserOrThrow doesn't exist on v8.x.x (it was introduced by a later, unrelated main commit). Kept using v8.x.x's existing userService.getUser(userId) instead, combined with the new filterContentScopesForUser (already present via Support wildcard values for content scope dimensions #6114's backport).
• demo/api/src/content-scope/content-scope.interface.ts: module augmentation naming conflict (@dextinity/cms-api vs. @comet/cms-api, matching v8.x.x's pre-rename package naming — see [Backport v8] Remove the Permissions and Scopes columns from the user permissions users list #6280 for precedent). Kept @comet/cms-api and added the new product dimension.

Also converted the cherry-picked user-permissions.service.spec.ts from vitest to jest (matching @comet/cms-api's test runner on this branch — same adjustment as #6144/#6280), and updated the changeset package name from @dextinity/cms-api to @comet/cms-api (per the pre-rename naming convention, per the routine's own caveat).

Verification

• @comet/cms-api: build, lint (prettier/eslint/tsc) pass.
• @comet/cms-api full test suite: 204/204 passing, including the 7 new tests for getAvailableContentScopeDimensions/filterContentScopesForUser.
• demo/api: api-generator regenerates cleanly with no diff to the generated files; lint (prettier/eslint/tsc) passes.
• demo/api AppModule/GraphQLModule initialize correctly via pnpm run console --help (schema/block-meta regenerate); it only fails afterwards on connecting to Postgres, since the full Docker demo could not be started in this sandbox — Docker Hub image pulls are blocked by the environment's network policy (403 from CloudFront), consistent with the same limitation noted on prior v8 backport PRs (e.g. [Backport v8] Remove the Permissions and Scopes columns from the user permissions users list #6280, [Backport v8] Support wildcard values for content scope dimensions #6292). Please verify the runtime-declared content scope dimensions manually before merging.

---

🤖 Generated with Claude Code

https://claude.ai/code/session_01DeZZCJgNydRxnbPuRBkTjp

---

Generated by Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}