@almadar/std 16.235.0 → 16.237.0

package/behaviors/registry/ui/core/atoms/std-app-layout.orb

@@ -116,6 +116,29 @@
         {
           "category": "interaction",
           "config": {
+            "accessDeniedDescription": {
+              "default": "Ask an administrator if you need it.",
+              "label": "Access-denied message",
+              "tier": "presentation",
+              "type": "string"
+            },
+            "accessDeniedTitle": {
+              "default": "You don't have access to this page",
+              "label": "Access-denied title",
+              "tier": "presentation",
+              "type": "string"
+            },
+            "allowedRoles": {
+              "default": [],
+              "description": "Roles (matched against viewerRole) allowed to see this page's content. Empty = everyone; anyone else sees the access-denied state instead. Nav items and top-bar actions carry their own `roles` the same way.",
+              "items": {
+                "type": "string"
+              },
+              "label": "Who may open this page?",
+              "synonyms": "access, permission, restrict, only for, roles allowed, who can see",
+              "tier": "policy",
+              "type": "[string]"
+            },
             "appName": {
               "default": "App",
               "description": "Name shown in the top-left of the chrome header.",
@@ -145,13 +168,6 @@
               "tier": "internal",
               "type": "string"
             },
-            "detailSlot": {
-              "default": "modal",
-              "description": "Slot where detail/edit views render",
-              "label": "Detail slot",
-              "tier": "internal",
-              "type": "slot"
-            },
             "layoutMode": {
               "default": "sidebar",
               "description": "sidebar = left rail; topnav = top bar; bottomnav = mobile tab bar; minimal = no nav.",
@@ -208,6 +224,14 @@
                     "name": "label",
                     "required": true,
                     "type": "string"
+                  },
+                  "roles": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "name": "roles",
+                    "required": false,
+                    "type": "array"
                   }
                 },
                 "type": "object"
@@ -300,6 +324,14 @@
                     "required": false,
                     "type": "string"
                   },
+                  "roles": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "name": "roles",
+                    "required": false,
+                    "type": "array"
+                  },
                   "variant": {
                     "name": "variant",
                     "required": false,
@@ -334,6 +366,13 @@
               "synonyms": "signed in user, current user, account, profile, persona, who am i",
               "tier": "presentation",
               "type": "string"
+            },
+            "viewerRole": {
+              "default": "",
+              "description": "The signed-in viewer's role that allowedRoles and each nav item's / top-bar action's `roles` are checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only items with no `roles` show and a page with allowedRoles is denied.",
+              "label": "Viewer's role",
+              "tier": "policy",
+              "type": "string"
             }
           },
           "effectRow": [
@@ -548,12 +587,139 @@
                           ],
                           "currentPath": "@config.currentPath",
                           "layoutMode": "@config.layoutMode",
-                          "navItems": "@config.navItems",
+                          "navItems": [
+                            "array/map",
+                            [
+                              "array/filter",
+                              "@config.navItems",
+                              [
+                                "fn",
+                                "item",
+                                [
+                                  "or",
+                                  [
+                                    "=",
+                                    [
+                                      "array/len",
+                                      [
+                                        "object/get",
+                                        "@item",
+                                        "roles",
+                                        []
+                                      ]
+                                    ],
+                                    0.0
+                                  ],
+                                  [
+                                    "array/includes",
+                                    [
+                                      "object/get",
+                                      "@item",
+                                      "roles",
+                                      []
+                                    ],
+                                    "@config.viewerRole"
+                                  ]
+                                ]
+                              ]
+                            ],
+                            [
+                              "fn",
+                              "item",
+                              [
+                                "if",
+                                [
+                                  "object/has",
+                                  "@item",
+                                  "children"
+                                ],
+                                [
+                                  "object/merge",
+                                  "@item",
+                                  {
+                                    "children": [
+                                      "array/filter",
+                                      [
+                                        "object/get",
+                                        "@item",
+                                        "children",
+                                        []
+                                      ],
+                                      [
+                                        "fn",
+                                        "child",
+                                        [
+                                          "or",
+                                          [
+                                            "=",
+                                            [
+                                              "array/len",
+                                              [
+                                                "object/get",
+                                                "@child",
+                                                "roles",
+                                                []
+                                              ]
+                                            ],
+                                            0.0
+                                          ],
+                                          [
+                                            "array/includes",
+                                            [
+                                              "object/get",
+                                              "@child",
+                                              "roles",
+                                              []
+                                            ],
+                                            "@config.viewerRole"
+                                          ]
+                                        ]
+                                      ]
+                                    ]
+                                  }
+                                ],
+                                "@item"
+                              ]
+                            ]
+                          ],
                           "notificationClickEvent": "@config.notificationClickEvent",
                           "notifications": "@config.notifications",
                           "searchEvent": "@config.searchEvent",
                           "sidebarContent": "@config.sidebarTrait",
-                          "topBarActions": "@config.topBarActions",
+                          "topBarActions": [
+                            "array/filter",
+                            "@config.topBarActions",
+                            [
+                              "fn",
+                              "action",
+                              [
+                                "or",
+                                [
+                                  "=",
+                                  [
+                                    "array/len",
+                                    [
+                                      "object/get",
+                                      "@action",
+                                      "roles",
+                                      []
+                                    ]
+                                  ],
+                                  0.0
+                                ],
+                                [
+                                  "array/includes",
+                                  [
+                                    "object/get",
+                                    "@action",
+                                    "roles",
+                                    []
+                                  ],
+                                  "@config.viewerRole"
+                                ]
+                              ]
+                            ]
+                          ],
                           "type": "@config.layoutPattern",
                           "user": [
                             "if",
@@ -577,6 +743,236 @@
                 "event": "INIT",
                 "eventId": "evt_01KXG04FMZTB492XA0Y6A8FXFN",
                 "from": "composing",
+                "guard": [
+                  "or",
+                  [
+                    "=",
+                    [
+                      "array/len",
+                      "@config.allowedRoles"
+                    ],
+                    0.0
+                  ],
+                  [
+                    "array/includes",
+                    "@config.allowedRoles",
+                    "@config.viewerRole"
+                  ]
+                ],
+                "to": "composing"
+              },
+              {
+                "effects": [
+                  [
+                    "fetch",
+                    "AppLayoutData",
+                    {
+                      "emit": {
+                        "failure": "AppLayoutStateLoadFailed",
+                        "success": "AppLayoutStateLoaded"
+                      }
+                    }
+                  ],
+                  [
+                    "render-ui",
+                    "main",
+                    {
+                      "children": [
+                        {
+                          "appName": "@config.appName",
+                          "children": [
+                            {
+                              "children": [
+                                {
+                                  "description": "@config.accessDeniedDescription",
+                                  "icon": "lock",
+                                  "title": "@config.accessDeniedTitle",
+                                  "type": "empty-state"
+                                }
+                              ],
+                              "className": "@config.contentClassName",
+                              "direction": "vertical",
+                              "gap": "lg",
+                              "type": "stack"
+                            }
+                          ],
+                          "currentPath": "@config.currentPath",
+                          "layoutMode": "@config.layoutMode",
+                          "navItems": [
+                            "array/map",
+                            [
+                              "array/filter",
+                              "@config.navItems",
+                              [
+                                "fn",
+                                "item",
+                                [
+                                  "or",
+                                  [
+                                    "=",
+                                    [
+                                      "array/len",
+                                      [
+                                        "object/get",
+                                        "@item",
+                                        "roles",
+                                        []
+                                      ]
+                                    ],
+                                    0.0
+                                  ],
+                                  [
+                                    "array/includes",
+                                    [
+                                      "object/get",
+                                      "@item",
+                                      "roles",
+                                      []
+                                    ],
+                                    "@config.viewerRole"
+                                  ]
+                                ]
+                              ]
+                            ],
+                            [
+                              "fn",
+                              "item",
+                              [
+                                "if",
+                                [
+                                  "object/has",
+                                  "@item",
+                                  "children"
+                                ],
+                                [
+                                  "object/merge",
+                                  "@item",
+                                  {
+                                    "children": [
+                                      "array/filter",
+                                      [
+                                        "object/get",
+                                        "@item",
+                                        "children",
+                                        []
+                                      ],
+                                      [
+                                        "fn",
+                                        "child",
+                                        [
+                                          "or",
+                                          [
+                                            "=",
+                                            [
+                                              "array/len",
+                                              [
+                                                "object/get",
+                                                "@child",
+                                                "roles",
+                                                []
+                                              ]
+                                            ],
+                                            0.0
+                                          ],
+                                          [
+                                            "array/includes",
+                                            [
+                                              "object/get",
+                                              "@child",
+                                              "roles",
+                                              []
+                                            ],
+                                            "@config.viewerRole"
+                                          ]
+                                        ]
+                                      ]
+                                    ]
+                                  }
+                                ],
+                                "@item"
+                              ]
+                            ]
+                          ],
+                          "notificationClickEvent": "@config.notificationClickEvent",
+                          "notifications": "@config.notifications",
+                          "searchEvent": "@config.searchEvent",
+                          "sidebarContent": "@config.sidebarTrait",
+                          "topBarActions": [
+                            "array/filter",
+                            "@config.topBarActions",
+                            [
+                              "fn",
+                              "action",
+                              [
+                                "or",
+                                [
+                                  "=",
+                                  [
+                                    "array/len",
+                                    [
+                                      "object/get",
+                                      "@action",
+                                      "roles",
+                                      []
+                                    ]
+                                  ],
+                                  0.0
+                                ],
+                                [
+                                  "array/includes",
+                                  [
+                                    "object/get",
+                                    "@action",
+                                    "roles",
+                                    []
+                                  ],
+                                  "@config.viewerRole"
+                                ]
+                              ]
+                            ]
+                          ],
+                          "type": "@config.layoutPattern",
+                          "user": [
+                            "if",
+                            "@config.viewerName",
+                            {
+                              "avatar": "@config.viewerAvatar",
+                              "email": "@config.viewerEmail",
+                              "name": "@config.viewerName"
+                            },
+                            null
+                          ]
+                        }
+                      ],
+                      "className": "min-h-screen w-full",
+                      "data-theme": "@config.theme",
+                      "fullHeight": true,
+                      "type": "box"
+                    }
+                  ]
+                ],
+                "event": "INIT",
+                "eventId": "evt_01KXG04FMZTB492XA0Y6A8FXFN",
+                "from": "composing",
+                "guard": [
+                  "not",
+                  [
+                    "or",
+                    [
+                      "=",
+                      [
+                        "array/len",
+                        "@config.allowedRoles"
+                      ],
+                      0.0
+                    ],
+                    [
+                      "array/includes",
+                      "@config.allowedRoles",
+                      "@config.viewerRole"
+                    ]
+                  ]
+                ],
                 "to": "composing"
               },
               {
@@ -645,6 +1041,10 @@
           {
             "name": "icon",
             "type": "string"
+          },
+          {
+            "name": "roles",
+            "type": "[string]"
           }
         ],
         "NavItem": [
@@ -691,9 +1091,17 @@
                 "name": "children",
                 "properties": [],
                 "type": "[NavItem]"
+              },
+              {
+                "name": "roles",
+                "type": "[string]"
               }
             ],
             "type": "[object]"
+          },
+          {
+            "name": "roles",
+            "type": "[string]"
           }
         ],
         "NotificationSpec": [

package/behaviors/registry/ui/core/atoms/std-app-search.orb

@@ -267,6 +267,14 @@
                     "required": false,
                     "type": "string"
                   },
+                  "roles": {
+                    "items": {
+                      "type": "string"
+                    },
+                    "name": "roles",
+                    "required": false,
+                    "type": "array"
+                  },
                   "variant": {
                     "name": "variant",
                     "required": false,
@@ -387,6 +395,13 @@
               "label": "Search field",
               "tier": "presentation",
               "type": "string"
+            },
+            "viewerRole": {
+              "default": "",
+              "description": "The signed-in viewer's role that each action's `roles` is checked against. Bind it explicitly at the call site (e.g. `viewerRole: @user.role`) in an app whose identity carries a role; left empty, only actions with no `roles` show.",
+              "label": "Viewer's role",
+              "tier": "policy",
+              "type": "string"
             }
           },
           "effectRow": [
@@ -770,7 +785,40 @@
                         {
                           "entity": "@payload.data",
                           "fields": "@config.resultFields",
-                          "itemActions": "@config.resultActions",
+                          "itemActions": [
+                            "array/filter",
+                            "@config.resultActions",
+                            [
+                              "fn",
+                              "action",
+                              [
+                                "or",
+                                [
+                                  "=",
+                                  [
+                                    "array/len",
+                                    [
+                                      "object/get",
+                                      "@action",
+                                      "roles",
+                                      []
+                                    ]
+                                  ],
+                                  0.0
+                                ],
+                                [
+                                  "array/includes",
+                                  [
+                                    "object/get",
+                                    "@action",
+                                    "roles",
+                                    []
+                                  ],
+                                  "@config.viewerRole"
+                                ]
+                              ]
+                            ]
+                          ],
                           "type": "data-grid"
                         }
                       ],
@@ -974,6 +1022,10 @@
           {
             "name": "hidden",
             "type": "boolean"
+          },
+          {
+            "name": "roles",
+            "type": "[string]"
           }
         ],
         "AppSearchFieldSpec": [