[rush-lib] Support access parameter for each project configuration

common/changes/@microsoft/rush/pedrogomes-support-access-restrictions_2025-02-10-07-04.json

@@ -0,0 +1,10 @@
+{
+  "changes": [
+    {
+      "packageName": "@microsoft/rush",
+      "comment": "provides access parameter to restrict packages to be installed",
+      "type": "none"
+    }
+  ],
+  "packageName": "@microsoft/rush"
+}

common/reviews/api/rush-lib.api.md

@@ -1304,6 +1304,8 @@ export class RushConfigurationProject {
     //
     // @internal
     constructor(options: IRushConfigurationProjectOptions);
+    // Warning: (ae-forgotten-export) The symbol "PackageAccessType" needs to be exported by the entry point index.d.ts
+    readonly access: PackageAccessType;
     // @beta
     readonly configuredSubspaceName: string | undefined;
     get consumingProjects(): ReadonlySet<RushConfigurationProject>;
@@ -1335,6 +1337,7 @@ export class RushConfigurationProject {
     readonly tags: ReadonlySet<string>;
     readonly tempProjectName: string;
     readonly unscopedTempProjectName: string;
+    validateAccess(): void;
     // @beta
     get versionPolicy(): VersionPolicy | undefined;
     // @beta

libraries/rush-lib/src/api/RushConfiguration.ts

@@ -960,8 +960,11 @@ export class RushConfiguration {
         allowedProjectTags,
         subspace
       });
-      subspace._addProject(project);
 
+      // Validates project according to its access restrictions
+      project.validateAccess();
+
+      subspace._addProject(project);
       this._projects.push(project);
       if (this._projectsByName.has(project.packageName)) {
         throw new Error(

libraries/rush-lib/src/api/RushConfigurationProject.ts

@@ -29,6 +29,16 @@ export interface IRushConfigurationProjectJson {
   publishFolder?: string;
   tags?: string[];
   subspaceName?: string;
+  access?: PackageAccessType;
+}
+
+/**
+ * The type of package access restrictions
+ */
+export enum PackageAccessType {
+  Private = 'private',
+  Protected = 'protected',
+  Public = 'public'
 }
 
 /**
@@ -206,13 +216,23 @@ export class RushConfigurationProject {
    */
   public readonly configuredSubspaceName: string | undefined;
 
+  /**
+   * Access restrictions
+   */
+  public readonly access: PackageAccessType;
+
   /** @internal */
   public constructor(options: IRushConfigurationProjectOptions) {
     const { projectJson, rushConfiguration, tempProjectName, allowedProjectTags } = options;
-    const { packageName, projectFolder: projectRelativeFolder } = projectJson;
+    const {
+      packageName,
+      projectFolder: projectRelativeFolder,
+      access = PackageAccessType.Public
+    } = projectJson;
     this.rushConfiguration = rushConfiguration;
     this.packageName = packageName;
     this.projectRelativeFolder = projectRelativeFolder;
+    this.access = access;
 
     validateRelativePathField(projectRelativeFolder, 'projectFolder', rushConfiguration.rushJsonFile);
 
@@ -514,6 +534,31 @@ export class RushConfigurationProject {
     }
     return isMain;
   }
+
+  /**
+   * Validates if this project can access its local dependencies.
+   *
+   */
+  public validateAccess(): void {
+    const invalidDeps: string[] = [];
+    for (const project of this.dependencyProjects) {
+      if (project.access === PackageAccessType.Public) {
+        continue;
+      } else if (project.access === PackageAccessType.Private) {
+        invalidDeps.push(project.packageName);
+      } else if (this.subspace.subspaceName !== project.subspace.subspaceName) {
+        invalidDeps.push(project.packageName);
+      }
+    }
+
+    if (invalidDeps.length > 0) {
+      throw new Error(
+        `${this.packageName} doesn't have permissions to access ${invalidDeps.join(
+          ', '
+        )}.\nPlease remove this dependency or update the ${RushConstants.rushJsonFilename} access rights.`
+      );
+    }
+  }
 }
 
 export function validateRelativePathField(relativePath: string, field: string, file: string): void {

libraries/rush-lib/src/schemas/rush.schema.json

@@ -315,6 +315,12 @@
           "subspaceName": {
             "description": "(EXPERIMENTAL) An optional entry for specifying which subspace this project belongs to if the subspaces feature is enabled.",
             "type": "string"
+          },
+          "access": {
+            "description": "Restricts the project to be accessed by others. There are three possible values:\n\n\"public\" - any package can install this project.\n\"protected\" - only packages from the same subspace can install this project.\n\"private\" - no packages can install this project.\n\nThe default value is \"public\".",
+            "enum": ["public", "private", "protected"],
+            "type": "string",
+            "default": "public"
           }
         },
         "additionalProperties": false,