@antelopejs/dms 0.0.1

package/dist/implementations/dms/page.js

@@ -0,0 +1,894 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DMSController = exports.internal = exports.GetFrontendModules = exports.createIgnoreFilter = exports.AddFrontendModule = void 0;
+exports.userCanAccessPage = userCanAccessPage;
+exports.NotifyMenuChanged = NotifyMenuChanged;
+exports.cancelPendingMenuNotifications = cancelPendingMenuNotifications;
+exports.buildPagePayload = buildPagePayload;
+exports.filterPermissionsForBypassedSurfaces = filterPermissionsForBypassedSurfaces;
+exports.resolveUserPermissions = resolveUserPermissions;
+exports.buildSiteLayoutPayload = buildSiteLayoutPayload;
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_core_1 = require("@antelopejs/interface-core");
+const logging_1 = require("@antelopejs/interface-core/logging");
+const component_1 = require("@antelopejs/interface-dms/component");
+const db_1 = require("@antelopejs/interface-dms/db");
+const page_1 = require("@antelopejs/interface-dms/page");
+const permissions_1 = require("@antelopejs/interface-dms/permissions");
+const realtime_1 = require("@antelopejs/interface-dms/realtime");
+const request_tenant_1 = require("@antelopejs/interface-dms/request-tenant");
+const tenant_access_1 = require("@antelopejs/interface-dms/tenant-access");
+const tenant_scoped_model_1 = require("@antelopejs/interface-dms/tenant-scoped-model");
+const auth_1 = require("@antelopejs/interface-dms/auth");
+const component_target_1 = require("@antelopejs/interface-dms/page/component-target");
+const realtime_2 = require("../../realtime");
+const fire_and_forget_1 = require("@antelopejs/interface-dms/utils/fire-and-forget");
+const dev_reload_1 = require("./dev-reload");
+const frontend_modules_1 = require("./frontend-modules");
+const frontend_bootstrap_1 = require("./frontend-bootstrap");
+const quick_actions_1 = require("./quick-actions");
+const route_params_1 = require("./route-params");
+const warn_once_1 = require("./warn-once");
+var frontend_modules_2 = require("./frontend-modules");
+Object.defineProperty(exports, "AddFrontendModule", { enumerable: true, get: function () { return frontend_modules_2.AddFrontendModule; } });
+Object.defineProperty(exports, "createIgnoreFilter", { enumerable: true, get: function () { return frontend_modules_2.createIgnoreFilter; } });
+Object.defineProperty(exports, "GetFrontendModules", { enumerable: true, get: function () { return frontend_modules_2.GetFrontendModules; } });
+const pagesBySlug = {};
+const categoriesByFullId = {};
+const navigationTree = {
+    displayName: "",
+    children: {},
+    childrenOrders: [],
+    id: "",
+    fullId: "",
+    fullSlug: "",
+    category: undefined,
+};
+const OMIT_SHARED_PAGE_QUERY_VALUE = "false";
+(0, dev_reload_1.setSlugProvider)(() => Object.keys(pagesBySlug));
+function resolvePagePermissionId(permission, fullId) {
+    if (permission instanceof component_1.Action) {
+        return permission.permissionId ?? fullId;
+    }
+    return permission?.id || fullId;
+}
+function warnOnSlugCollision(existing, incoming) {
+    if (!existing || existing.fullId === incoming.fullId)
+        return;
+    (0, warn_once_1.warnOnceFor)(incoming, "slug-collision", `[dms] "${incoming.fullId}" claims the slug "${incoming.fullSlug}", already served by "${existing.fullId}": the later registration wins.`);
+}
+function findNavigableCategoryBySlug(slug) {
+    return Object.values(categoriesByFullId).find((category) => !category.urlTransparent && category.fullSlug === slug);
+}
+function buildNavigableCategoryIndex() {
+    const bySlug = {};
+    for (const category of Object.values(categoriesByFullId)) {
+        if (category.urlTransparent)
+            continue;
+        bySlug[category.fullSlug] = category;
+    }
+    return bySlug;
+}
+function findEntryByFullId(registry, fullId) {
+    return Object.values(registry).find((entry) => entry.fullId === fullId);
+}
+function findPageByFullId(fullId) {
+    return findEntryByFullId(pagesBySlug, fullId);
+}
+function findNavigationEntryByFullId(fullId) {
+    return categoriesByFullId[fullId] ?? findPageByFullId(fullId);
+}
+async function userCanAccessPage(user, fullId, memberModel, roleModel, tenantId) {
+    const info = findPageByFullId(fullId);
+    if (!info)
+        return false;
+    if (!user)
+        return !(0, page_1.isInsideModule)(info) && info.publicAccess === true;
+    const access = await (0, tenant_access_1.CheckTenantAccess)(user._id, tenantId);
+    if (!(0, tenant_access_1.gateAllowsSurface)(info, !access.allowed))
+        return false;
+    const roleIds = await getRoleIdsForUser(memberModel, user);
+    const permissions = await (0, permissions_1.GetEffectiveUserPermissions)(user, tenantId, roleIds, roleModel);
+    if (permissions.has(WILDCARD_PERMISSION))
+        return true;
+    if ((0, page_1.isInsideModule)(info))
+        return false;
+    if (info.authOnly)
+        return true;
+    return (0, permissions_1.HasPermission)(permissions, resolvePagePermissionId(info.permission, info.fullId));
+}
+function addToTree(newPageInfo) {
+    const parts = newPageInfo.fullId.split(".");
+    let currentLevel = navigationTree.children;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const part = parts[i];
+        if (!currentLevel[part]) {
+            currentLevel[part] = {
+                displayName: "none",
+                children: {},
+                childrenOrders: [],
+                id: "",
+                fullId: "",
+                fullSlug: "",
+                category: undefined,
+            };
+        }
+        currentLevel = currentLevel[part].children;
+    }
+    const lastPart = parts[parts.length - 1];
+    const existingChildren = currentLevel[lastPart]?.children || {};
+    const existingChildrenOrders = currentLevel[lastPart]?.childrenOrders || [];
+    currentLevel[lastPart] = {
+        ...newPageInfo,
+        children: existingChildren,
+        childrenOrders: existingChildrenOrders,
+    };
+    updateChildrenOrders(navigationTree);
+}
+function compareText(a, b) {
+    if (a === b)
+        return 0;
+    return a < b ? -1 : 1;
+}
+function compareMenuChildren(a, b) {
+    return ((a.order ?? 0) - (b.order ?? 0) ||
+        compareText(a.displayName, b.displayName) ||
+        compareText(a.id, b.id));
+}
+function sortChildIdsByOrder(children) {
+    return Object.keys(children).sort((a, b) => compareMenuChildren(children[a], children[b]));
+}
+function updateChildrenOrders(node) {
+    node.childrenOrders = sortChildIdsByOrder(node.children);
+    for (const child of node.childrenOrders) {
+        updateChildrenOrders(node.children[child]);
+    }
+}
+function removeFromTree(fullId) {
+    const parts = fullId.split(".");
+    const levels = [
+        navigationTree.children,
+    ];
+    let currentLevel = navigationTree.children;
+    for (let i = 0; i < parts.length - 1; i++) {
+        const node = currentLevel[parts[i]];
+        if (!node)
+            return;
+        currentLevel = node.children;
+        levels.push(currentLevel);
+    }
+    const target = currentLevel[parts[parts.length - 1]];
+    if (!target)
+        return;
+    if (Object.keys(target.children).length > 0) {
+        currentLevel[parts[parts.length - 1]] = {
+            ...target,
+            displayName: "none",
+            id: "",
+            fullId: "",
+            fullSlug: "",
+            category: undefined,
+        };
+        updateChildrenOrders(navigationTree);
+        return;
+    }
+    for (let i = parts.length - 1; i >= 0; i--) {
+        const level = levels[i];
+        const node = level[parts[i]];
+        if (!node)
+            return;
+        if (i < parts.length - 1 &&
+            (node.fullId || Object.keys(node.children).length > 0)) {
+            break;
+        }
+        delete level[parts[i]];
+    }
+    updateChildrenOrders(navigationTree);
+}
+const moduleRegistry = {};
+const dynamicMenuProviders = [];
+const nodeProviders = new WeakMap();
+const HTTP_FORBIDDEN = 403;
+const WILDCARD_PERMISSION = "*";
+const ERROR_UNAUTHORIZED = "error.unauthorized";
+function notifyStructureChanged() {
+    (0, dev_reload_1.scheduleBroadcast)();
+    schedulePublishMenuChanged(undefined);
+}
+function NotifyMenuChanged(tenantId) {
+    (0, dev_reload_1.scheduleBroadcast)();
+    schedulePublishMenuChanged(tenantId);
+}
+const MODULE_CONTEXT_GONE = "ERR_MODULE_CONTEXT_INVALIDATED";
+function isModuleContextGone(error) {
+    return (typeof error === "object" &&
+        error !== null &&
+        error.code === MODULE_CONTEXT_GONE);
+}
+function ignoreModuleContextGone(error) {
+    if (!isModuleContextGone(error))
+        throw error;
+}
+const MENU_NOTIFICATION_WINDOW_MS = 250;
+const lastMenuPublishAt = new Map();
+const pendingMenuNotifications = new Map();
+function schedulePublishMenuChanged(tenantId) {
+    const target = tenantId ?? realtime_2.MENU_BROADCAST_TOPIC;
+    const publish = () => {
+        lastMenuPublishAt.set(target, Date.now());
+        try {
+            (0, fire_and_forget_1.fireAndForget)(publishMenuChanged(tenantId).catch(ignoreModuleContextGone), "menu change notification");
+        }
+        catch (error) {
+            ignoreModuleContextGone(error);
+        }
+    };
+    const sinceLast = Date.now() - (lastMenuPublishAt.get(target) ?? 0);
+    if (sinceLast >= MENU_NOTIFICATION_WINDOW_MS) {
+        publish();
+        return;
+    }
+    if (pendingMenuNotifications.has(target))
+        return;
+    const timer = setTimeout(() => {
+        pendingMenuNotifications.delete(target);
+        publish();
+    }, MENU_NOTIFICATION_WINDOW_MS - sinceLast);
+    timer.unref?.();
+    pendingMenuNotifications.set(target, timer);
+}
+function cancelPendingMenuNotifications() {
+    for (const timer of pendingMenuNotifications.values()) {
+        clearTimeout(timer);
+    }
+    pendingMenuNotifications.clear();
+}
+async function publishMenuChanged(tenantId) {
+    await (0, realtime_2.getRealtimeBroker)().publish({
+        topic: tenantId ? (0, realtime_2.buildMenuTopic)(tenantId) : realtime_2.MENU_BROADCAST_TOPIC,
+        type: realtime_2.MENU_CHANGED_EVENT_TYPE,
+        ts: Date.now(),
+    });
+}
+var internal;
+(function (internal) {
+    internal.RegisterCategory = {
+        register: (categoryInfo) => {
+            if (!categoryInfo.urlTransparent) {
+                warnOnSlugCollision(findNavigableCategoryBySlug(categoryInfo.fullSlug), categoryInfo);
+            }
+            categoriesByFullId[categoryInfo.fullId] = categoryInfo;
+            if (!categoryInfo.hidden) {
+                addToTree(categoryInfo);
+                notifyStructureChanged();
+            }
+        },
+        unregister: (categoryInfo) => {
+            if (categoriesByFullId[categoryInfo.fullId] !== categoryInfo) {
+                return;
+            }
+            delete categoriesByFullId[categoryInfo.fullId];
+            if (!categoryInfo.hidden) {
+                removeFromTree(categoryInfo.fullId);
+                notifyStructureChanged();
+            }
+            if ((0, page_1.isInsideModule)(categoryInfo)) {
+                (0, permissions_1.UnmarkModuleScopedPermission)(resolvePagePermissionId(categoryInfo.permission, categoryInfo.fullId));
+            }
+        },
+    };
+    internal.RegisterPage = {
+        register: (pageInfo) => {
+            warnOnSlugCollision(pagesBySlug[pageInfo.fullSlug], pageInfo);
+            pagesBySlug[pageInfo.fullSlug] = pageInfo;
+            if (!pageInfo.hidden) {
+                addToTree(pageInfo);
+                notifyStructureChanged();
+            }
+        },
+        unregister: (pageInfo) => {
+            if (pagesBySlug[pageInfo.fullSlug] !== pageInfo) {
+                page_1.internal.clearPageMetadata(pageInfo.fullId, pageInfo);
+                return;
+            }
+            delete pagesBySlug[pageInfo.fullSlug];
+            if (!pageInfo.hidden) {
+                removeFromTree(pageInfo.fullId);
+                notifyStructureChanged();
+            }
+            if ((0, page_1.isInsideModule)(pageInfo)) {
+                (0, permissions_1.UnmarkModuleScopedPermission)(resolvePagePermissionId(pageInfo.permission, pageInfo.fullId));
+            }
+            page_1.internal.clearPageMetadata(pageInfo.fullId, pageInfo);
+            (0, page_1.ClearPageLayoutBySlug)(pageInfo.fullSlug);
+            realtime_1.internal.RegisterPageTopic.unregister(pageInfo.fullId);
+        },
+    };
+    internal.RegisterModule = {
+        register: (info) => {
+            moduleRegistry[info.id] = info;
+            notifyStructureChanged();
+        },
+        unregister: (info) => {
+            delete moduleRegistry[info.id];
+            page_1.internal.clearModuleResolution(info.id);
+            notifyStructureChanged();
+        },
+    };
+    internal.RegisterDynamicMenuProvider = {
+        register: (info) => {
+            dynamicMenuProviders.push(info);
+            notifyStructureChanged();
+        },
+        unregister: (info) => {
+            const index = dynamicMenuProviders.indexOf(info);
+            if (index >= 0)
+                dynamicMenuProviders.splice(index, 1);
+            notifyStructureChanged();
+        },
+    };
+    internal.RegisterPageExtension = {
+        register: (info) => {
+            page_1.internal.applyPageExtension(info);
+            (0, dev_reload_1.scheduleBroadcast)();
+        },
+        unregister: (info) => {
+            page_1.internal.revokePageExtension(info);
+            (0, dev_reload_1.scheduleBroadcast)();
+        },
+    };
+})(internal || (exports.internal = internal = {}));
+class DMSController extends (0, interface_api_1.Controller)("/dms") {
+    async frontend(requestContext, clientUrl, renderer, rendererVersion) {
+        return (0, frontend_modules_1.buildFrontendManifest)(requestContext, clientUrl, renderer, rendererVersion, this.bootstrapHeader);
+    }
+    async frontendModules(out, renderer, rendererVersion) {
+        await (0, frontend_modules_1.writeFrontendModules)(out, renderer, rendererVersion, this.bootstrapHeader);
+    }
+    async userPermissions(requestContext, roleModel, memberModel, user) {
+        return resolveUserPermissions(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+    }
+    async siteLayout(requestContext, roleModel, memberModel, user) {
+        return buildSiteLayoutPayload(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+    }
+    async modulesListing(requestContext, roleModel, memberModel, user) {
+        const accessContext = await buildAccessContext(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+        (0, interface_api_util_1.assert)(accessContext.gated.isOwner, HTTP_FORBIDDEN, ERROR_UNAUTHORIZED);
+        return Object.values(moduleRegistry).map((info) => ({
+            ...info,
+            hasAccess: true,
+            landingSlug: resolveModuleLandingSlug(info),
+        }));
+    }
+    async pageLayout(requestContext, roleModel, memberModel, user, slug) {
+        (0, interface_api_util_1.assert)(slug, 400, "error.slug_required");
+        const normalizedSlug = slug.startsWith("/") ? slug : `/${slug}`;
+        const handler = (0, page_1.GetPageLayoutBySlug)(normalizedSlug);
+        (0, interface_api_util_1.assert)(handler, 404, "error.page_not_found");
+        return handler(user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext));
+    }
+    async page(requestContext, roleModel, memberModel, user) {
+        (0, interface_api_util_1.assert)(this.pagePath, 400, "error.path_required");
+        return buildPagePayload(this.pagePath, user, memberModel, roleModel, (0, request_tenant_1.getRequestTenantId)(requestContext), this.sharedPage !== OMIT_SHARED_PAGE_QUERY_VALUE);
+    }
+}
+exports.DMSController = DMSController;
+__decorate([
+    (0, interface_api_1.Parameter)(frontend_bootstrap_1.BOOTSTRAP_HEADER, "header"),
+    __metadata("design:type", Object)
+], DMSController.prototype, "bootstrapHeader", void 0);
+__decorate([
+    (0, interface_api_1.Parameter)("path", "query"),
+    __metadata("design:type", String)
+], DMSController.prototype, "pagePath", void 0);
+__decorate([
+    (0, interface_api_1.Parameter)("shared", "query"),
+    __metadata("design:type", Object)
+], DMSController.prototype, "sharedPage", void 0);
+__decorate([
+    (0, interface_api_1.Get)("/frontend"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, interface_api_1.Parameter)("clientUrl", "query")),
+    __param(2, (0, interface_api_1.Parameter)("renderer", "query")),
+    __param(3, (0, interface_api_1.Parameter)("rendererVersion", "query")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, Object, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "frontend", null);
+__decorate([
+    (0, interface_api_1.Get)("/frontend/modules"),
+    __param(0, (0, interface_api_1.WriteStream)("application/zip")),
+    __param(1, (0, interface_api_1.Parameter)("renderer", "query")),
+    __param(2, (0, interface_api_1.Parameter)("rendererVersion", "query")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Function, Object, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "frontendModules", null);
+__decorate([
+    (0, interface_api_1.Get)("/permissions"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.RoleModel)),
+    __param(2, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.TenantMemberModel)),
+    __param(3, (0, auth_1.IfAuthUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, db_1.RoleModel,
+        db_1.TenantMemberModel, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "userPermissions", null);
+__decorate([
+    (0, interface_api_1.Get)("/sitelayout"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.RoleModel)),
+    __param(2, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.TenantMemberModel)),
+    __param(3, (0, auth_1.IfAuthUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, db_1.RoleModel,
+        db_1.TenantMemberModel, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "siteLayout", null);
+__decorate([
+    (0, interface_api_1.Get)("/modules-listing"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.RoleModel)),
+    __param(2, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.TenantMemberModel)),
+    __param(3, (0, auth_1.IfAuthUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, db_1.RoleModel,
+        db_1.TenantMemberModel, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "modulesListing", null);
+__decorate([
+    (0, interface_api_1.Get)("/pagelayout"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.RoleModel)),
+    __param(2, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.TenantMemberModel)),
+    __param(3, (0, auth_1.IfAuthUser)()),
+    __param(4, (0, interface_api_1.Parameter)("slug", "query")),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, db_1.RoleModel,
+        db_1.TenantMemberModel, Object, String]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "pageLayout", null);
+__decorate([
+    (0, interface_api_1.Get)("/page"),
+    __param(0, (0, interface_api_1.Context)()),
+    __param(1, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.RoleModel)),
+    __param(2, (0, tenant_scoped_model_1.TenantScopedModel)(db_1.TenantMemberModel)),
+    __param(3, (0, auth_1.IfAuthUser)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, db_1.RoleModel,
+        db_1.TenantMemberModel, Object]),
+    __metadata("design:returntype", Promise)
+], DMSController.prototype, "page", null);
+function matchesPagePattern(pattern, path) {
+    const patternSegments = pattern.split("/").filter(Boolean);
+    const pathSegments = path.split("/").filter(Boolean);
+    return (patternSegments.length === pathSegments.length &&
+        patternSegments.every((segment, index) => segment.startsWith(":") || segment === pathSegments[index]));
+}
+function resolveRegisteredPageSlug(path) {
+    if (pagesBySlug[path])
+        return path;
+    return Object.keys(pagesBySlug).find((pattern) => pattern.includes(":") && matchesPagePattern(pattern, path));
+}
+async function buildPagePayload(...arguments_) {
+    const [slug, user, memberModel, roleModel, tenantId, includeShared = true] = arguments_;
+    const normalizedSlug = `/${slug.replace(/^\/+|\/+$/g, "")}`;
+    const registeredSlug = resolveRegisteredPageSlug(normalizedSlug);
+    (0, interface_api_util_1.assert)(registeredSlug, 404, "error.page_not_found");
+    const handler = (0, page_1.GetPageLayoutBySlug)(registeredSlug);
+    (0, interface_api_util_1.assert)(handler, 404, "error.page_not_found");
+    const route = pagesBySlug[registeredSlug];
+    (0, interface_api_util_1.assert)(route, 404, "error.page_not_found");
+    if (!includeShared) {
+        const layout = await handler(user, memberModel, roleModel, tenantId);
+        const context = await buildAccessContext(user, memberModel, roleModel, tenantId);
+        const routes = await annotateRegistryAccess({ [registeredSlug]: route }, context);
+        return { route: routes[registeredSlug], layout };
+    }
+    const [layout, shared] = await Promise.all([
+        handler(user, memberModel, roleModel, tenantId),
+        buildSiteLayoutPayload(user, memberModel, roleModel, tenantId),
+    ]);
+    return { route: shared.siteLayout.pages[registeredSlug], shared, layout };
+}
+async function getRoleIdsForUser(memberModel, user) {
+    const member = await memberModel.getByUser(user._id);
+    return member?.roleIds ?? [];
+}
+function collectSurfaceBypassFlags() {
+    const flags = new Map();
+    const entries = [
+        ...Object.values(categoriesByFullId),
+        ...Object.values(pagesBySlug),
+    ];
+    for (const entry of entries) {
+        const id = resolvePagePermissionId(entry.permission, entry.fullId);
+        const bypassed = entry.bypassTenantAccessGate === true;
+        flags.set(id, (flags.get(id) ?? true) && bypassed);
+    }
+    return flags;
+}
+function isBypassedPermission(permissionId, surfaces) {
+    let current = permissionId;
+    for (;;) {
+        const bypassed = surfaces.get(current);
+        if (bypassed !== undefined)
+            return bypassed;
+        const separatorIndex = current.lastIndexOf(".");
+        if (separatorIndex <= 0)
+            return false;
+        current = current.slice(0, separatorIndex);
+    }
+}
+function filterPermissionsForBypassedSurfaces(permissions, surfaces) {
+    const hasBypassedSurface = [...surfaces.values()].some(Boolean);
+    if (!hasBypassedSurface) {
+        return new Set();
+    }
+    if (permissions.has(WILDCARD_PERMISSION)) {
+        return new Set([WILDCARD_PERMISSION]);
+    }
+    return new Set([...permissions].filter((id) => isBypassedPermission(id, surfaces)));
+}
+async function resolveUserPermissions(user, memberModel, roleModel, tenantId) {
+    const context = await buildAccessContext(user, memberModel, roleModel, tenantId);
+    return [...context.client.permissions];
+}
+function redactPresentation(entry) {
+    return {
+        ...entry,
+        displayName: "",
+        description: undefined,
+        icon: undefined,
+        permission: undefined,
+    };
+}
+async function annotateRegistryAccess(registry, context) {
+    const annotated = {};
+    for (const [slug, info] of Object.entries(registry)) {
+        const hasAccess = await computeEntryAccess(info, context);
+        annotated[slug] = hasAccess
+            ? { ...info, hasAccess }
+            : { ...redactPresentation(info), hasAccess };
+    }
+    return annotated;
+}
+async function annotateSiteLayoutAccess(context) {
+    return {
+        pages: await annotateRegistryAccess(pagesBySlug, context),
+        categories: await annotateRegistryAccess(buildNavigableCategoryIndex(), context),
+    };
+}
+async function buildSiteLayoutPayload(user, memberModel, roleModel, tenantId) {
+    const accessContext = await buildAccessContext(user, memberModel, roleModel, tenantId);
+    const dynamicChildren = await resolveDynamicChildren(user, tenantId, accessContext);
+    return {
+        siteLayout: await annotateSiteLayoutAccess(accessContext),
+        siteLayoutTree: await addAccessToTree(navigationTree, accessContext, true, dynamicChildren),
+        quickActions: await (0, quick_actions_1.getQuickActionsForUser)((target) => resolveQuickActionTarget(target, accessContext)),
+        modules: await buildModuleAccessMap(accessContext),
+        isOwner: accessContext.gated.isOwner,
+    };
+}
+async function buildAccessContext(user, memberModel, roleModel, tenantId) {
+    const isAuthenticated = !!user;
+    if (!user) {
+        const anonymous = {
+            permissions: new Set(),
+            isOwner: false,
+            isAuthenticated,
+        };
+        return {
+            gated: anonymous,
+            ungated: anonymous,
+            client: anonymous,
+            gateDenied: false,
+            entryAccess: new Map(),
+        };
+    }
+    const roleIds = await getRoleIdsForUser(memberModel, user);
+    const permissions = await (0, permissions_1.GetEffectiveUserPermissions)(user, tenantId, roleIds, roleModel);
+    const ungated = {
+        permissions,
+        isOwner: permissions.has(WILDCARD_PERMISSION),
+        isAuthenticated,
+    };
+    const access = await (0, tenant_access_1.CheckTenantAccess)(user._id, tenantId);
+    if (access.allowed) {
+        return {
+            gated: ungated,
+            ungated,
+            client: ungated,
+            gateDenied: false,
+            entryAccess: new Map(),
+        };
+    }
+    return buildDeniedAccessContext(ungated);
+}
+function buildDeniedAccessContext(ungated) {
+    const { isAuthenticated } = ungated;
+    const clientPermissions = filterPermissionsForBypassedSurfaces(ungated.permissions, collectSurfaceBypassFlags());
+    return {
+        gated: { permissions: new Set(), isOwner: false, isAuthenticated },
+        ungated,
+        client: {
+            permissions: clientPermissions,
+            isOwner: clientPermissions.has(WILDCARD_PERMISSION),
+            isAuthenticated,
+        },
+        gateDenied: true,
+        entryAccess: new Map(),
+    };
+}
+function selectEntryContext(entry, context) {
+    return entry.bypassTenantAccessGate === true
+        ? context.ungated
+        : context.gated;
+}
+async function computeEntryAccess(entry, context) {
+    const cacheKey = entry.fullId;
+    const cached = context.entryAccess.get(cacheKey);
+    if (cached)
+        return cached;
+    const result = computeEntryAccessUncached(entry, context);
+    context.entryAccess.set(cacheKey, result);
+    return result;
+}
+async function computeEntryAccessUncached(entry, context) {
+    if (!(0, tenant_access_1.gateAllowsSurface)(entry, context.gateDenied))
+        return false;
+    const effective = selectEntryContext(entry, context);
+    if (effective.isOwner)
+        return true;
+    if ((0, page_1.isInsideModule)(entry))
+        return false;
+    if (entry.authOnly === true)
+        return effective.isAuthenticated;
+    if (effective.isAuthenticated) {
+        if (context.gateDenied && entry.bypassTenantAccessGate !== true) {
+            return entry.publicAccess === true;
+        }
+        return (0, permissions_1.HasPermission)(effective.permissions, resolvePagePermissionId(entry.permission, entry.fullId));
+    }
+    return entry.publicAccess === true;
+}
+async function addAccessToTree(node, context, isRoot, dynamic) {
+    const hasAccess = isRoot ? true : await computeEntryAccess(node, context);
+    const childrenWithAccess = {};
+    for (const [key, child] of Object.entries(node.children)) {
+        childrenWithAccess[key] = await addAccessToTree(child, context, false, dynamic);
+    }
+    const visible = hasAccess ? node : redactPresentation(node);
+    const dynamicChildren = dynamic.get(node.fullId);
+    if (!dynamicChildren) {
+        return { ...visible, hasAccess, children: childrenWithAccess };
+    }
+    const children = mergeDynamicChildren(node.fullId, childrenWithAccess, dynamicChildren);
+    return {
+        ...visible,
+        hasAccess,
+        children,
+        childrenOrders: sortChildIdsByOrder(children),
+    };
+}
+function mergeDynamicChildren(categoryFullId, children, dynamicChildren) {
+    const merged = { ...children };
+    const category = findNavigationEntryByFullId(categoryFullId);
+    for (const node of dynamicChildren) {
+        if (merged[node.id]) {
+            const source = nodeProviders.get(node) ?? category;
+            if (source) {
+                (0, warn_once_1.warnOnceFor)(source, "colliding-entry", `[dms] dynamic menu entry "${node.id}" of category "${categoryFullId}" collides with an existing entry and was skipped.`);
+            }
+            continue;
+        }
+        merged[node.id] = node;
+    }
+    return merged;
+}
+async function resolveDynamicChildren(user, tenantId, context) {
+    const resolved = new Map();
+    const providers = [...dynamicMenuProviders];
+    const perProvider = await Promise.all(providers.map((provider) => resolveProviderNodes(provider, user, tenantId, context)));
+    for (const [index, provider] of providers.entries()) {
+        const nodes = perProvider[index];
+        if (!nodes || nodes.length === 0)
+            continue;
+        const existing = resolved.get(provider.categoryFullId);
+        if (existing) {
+            existing.push(...nodes);
+            continue;
+        }
+        resolved.set(provider.categoryFullId, nodes);
+    }
+    return resolved;
+}
+async function resolveProviderNodes(provider, user, tenantId, context) {
+    const parent = findNavigationEntryByFullId(provider.categoryFullId);
+    if (!parent) {
+        (0, warn_once_1.warnOnceFor)(provider, "unknown-category", `[dms] dynamic menu provider targets unknown category "${provider.categoryFullId}" and was skipped.`);
+        return [];
+    }
+    if (!(await computeEntryAccess(parent, context))) {
+        return [];
+    }
+    const items = await runDynamicMenuResolver(provider, user, tenantId, selectEntryContext(parent, context).permissions);
+    return buildDynamicNodes(provider, items, context);
+}
+const RESOLVER_TIMEOUT_MS = 2000;
+function withResolverTimeout(work, provider) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`resolver did not answer within ${RESOLVER_TIMEOUT_MS}ms (category "${provider.categoryFullId}")`));
+        }, RESOLVER_TIMEOUT_MS);
+        work.then(resolve, reject).finally(() => clearTimeout(timer));
+    });
+}
+async function runDynamicMenuResolver(provider, user, tenantId, permissions) {
+    try {
+        return await withResolverTimeout(Promise.resolve(provider.resolver(user, tenantId, permissions)), provider);
+    }
+    catch (error) {
+        (0, warn_once_1.warnOnceFor)(provider, "resolver-failed", `[dms] dynamic menu provider of category "${provider.categoryFullId}" failed: ${String(error)}`);
+        return [];
+    }
+}
+const ID_SEPARATOR = ".";
+function resolveEntryTarget(provider, item) {
+    const entry = `[dms] dynamic menu entry "${item.id}" of category "${provider.categoryFullId}"`;
+    if (item.id.includes(ID_SEPARATOR)) {
+        (0, warn_once_1.warnOnceFor)(provider, "dotted-id", `${entry} has a dot in its id and was skipped.`);
+        return undefined;
+    }
+    const target = pagesBySlug[item.fullSlug];
+    if (!target) {
+        (0, warn_once_1.warnOnceFor)(provider, "unregistered-target", `${entry} targets unregistered page "${item.fullSlug}" and was skipped.`);
+        return undefined;
+    }
+    const link = (0, route_params_1.fillRouteParams)(item.fullSlug, item.params);
+    if (link === undefined) {
+        (0, warn_once_1.warnOnceFor)(provider, "unmatched-route-params", `${entry} does not fill exactly the route parameters of "${item.fullSlug}" and was skipped.`);
+        return undefined;
+    }
+    return { target, link };
+}
+async function buildDynamicNodes(provider, items, context) {
+    const { categoryFullId } = provider;
+    const nodes = [];
+    const targetAccess = new Map();
+    for (const item of items) {
+        const resolved = resolveEntryTarget(provider, item);
+        if (!resolved)
+            continue;
+        const { target, link } = resolved;
+        if (!(await isTargetPageReachable(target, context, targetAccess))) {
+            continue;
+        }
+        if (item.permissionId &&
+            !clientHoldsPermission(context, item.permissionId)) {
+            continue;
+        }
+        const node = buildDynamicNode(categoryFullId, item, target, link);
+        nodeProviders.set(node, provider);
+        nodes.push(node);
+    }
+    return nodes;
+}
+function clientHoldsPermission(context, permissionId) {
+    const { permissions } = context.client;
+    return permissions.has(WILDCARD_PERMISSION) || permissions.has(permissionId);
+}
+async function isTargetPageReachable(target, context, cache) {
+    const cached = cache.get(target.fullSlug);
+    if (cached !== undefined)
+        return cached;
+    const reachable = await computeEntryAccess(target, context);
+    cache.set(target.fullSlug, reachable);
+    return reachable;
+}
+function buildDynamicNode(categoryFullId, item, target, link) {
+    const { id, permissionId: _permissionId, params: _params, ...menuFields } = item;
+    return {
+        ...menuFields,
+        fullSlug: link,
+        id,
+        fullId: `${categoryFullId}.${id}`,
+        layoutUrl: target.layoutUrl,
+        type: "link",
+        category: undefined,
+        children: {},
+        childrenOrders: [],
+        hasAccess: true,
+    };
+}
+async function resolveQuickActionTarget(target, context) {
+    const meta = (0, interface_core_1.GetMetadata)(target.page, page_1.PageMetadata);
+    const pageInfo = meta.pageInfo;
+    if (!pageInfo) {
+        (0, warn_once_1.warnOnceFor)(target, "unregistered-page", `[DMS] Quick action targets "${target.page.name}", which is not a registered page: the action is not served.`);
+        return undefined;
+    }
+    if (!(await computeEntryAccess(pageInfo, context)))
+        return undefined;
+    if (target.type === "event") {
+        return { type: "event", name: target.name, payload: target.payload };
+    }
+    if (target.type === "navigate") {
+        return { type: "navigate", to: pageInfo.fullSlug, query: target.query };
+    }
+    const resolved = resolveOpenFormComponent(meta, target);
+    if (!resolved)
+        return undefined;
+    const [componentKey, component] = resolved;
+    const addPermission = component.getAction("add")?.permissionId;
+    if (addPermission &&
+        !(await (0, permissions_1.HasPermission)(selectEntryContext(pageInfo, context).permissions, addPermission))) {
+        return undefined;
+    }
+    return { type: "openForm", to: pageInfo.fullSlug, component: componentKey };
+}
+function resolveOpenFormComponent(meta, target) {
+    const requested = target.component;
+    const entries = Object.entries(meta.components);
+    if (requested) {
+        const resolved = (0, component_target_1.resolveComponentTarget)(requested, new Map(entries));
+        if (!resolved) {
+            (0, warn_once_1.warnOnceFor)(target, "unknown-component", `[DMS] Quick action targets a component that page "${meta.pageInfo?.fullId}" does not mount: the action is not served.`);
+            return undefined;
+        }
+        return [(0, component_target_1.componentTargetClientId)(resolved), resolved.component];
+    }
+    const formCapable = entries.filter(([, candidate]) => candidate.getAction("add"));
+    if (formCapable.length === 1)
+        return formCapable[0];
+    (0, warn_once_1.warnOnceFor)(target, "ambiguous-form", `[DMS] Quick action opens a form on page "${meta.pageInfo?.fullId}", which mounts ${formCapable.length} components that can create a row: name the one it means. The action is not served.`);
+    return undefined;
+}
+async function buildModuleAccessMap(context) {
+    const result = {};
+    for (const [moduleId, info] of Object.entries(moduleRegistry)) {
+        const hasAccess = await computeModuleAccess(moduleId, context);
+        result[moduleId] = hasAccess
+            ? { ...info, hasAccess }
+            : { ...info, title: "", description: "", icon: "", hasAccess };
+    }
+    return result;
+}
+async function computeModuleAccess(_moduleId, context) {
+    return context.gated.isOwner;
+}
+function resolveModuleLandingSlug(info) {
+    const modulePages = Object.values(pagesBySlug).filter((page) => page.module === info.id);
+    if (modulePages.length === 0) {
+        return `${page_1.MODULE_URL_PREFIX}/${info.id}`;
+    }
+    if (info.landingPage) {
+        const target = modulePages.find((page) => page.id === info.landingPage);
+        if (target)
+            return target.fullSlug;
+        logging_1.Logging.Warn(`[dms] module "${info.id}" declares landingPage "${info.landingPage}" but no page with that id exists in the module. Falling back to the first page by order.`);
+    }
+    const sorted = [...modulePages].sort(comparePagesForLanding);
+    return sorted[0].fullSlug;
+}
+function comparePagesForLanding(a, b) {
+    const orderDelta = (a.order ?? 0) - (b.order ?? 0);
+    if (orderDelta !== 0)
+        return orderDelta;
+    return a.id.localeCompare(b.id);
+}
+//# sourceMappingURL=page.js.map