@antelopejs/dms 0.5.6 → 0.6.1

package/frontend-vue/layers/dms-layout/app/build/components/pages/settings/roles/role-permissions.ts

@@ -0,0 +1,463 @@
+import type { RolePermissionNode } from "./role-types";
+
+/** Lookups over the permission tree the editor needs on every toggle. */
+export interface PermissionIndex {
+  nodes: Map<string, RolePermissionNode>;
+  parents: Map<string, string>;
+  /** Every id of a node's subtree, the node included. */
+  subtrees: Map<string, string[]>;
+  allIds: string[];
+}
+
+/** A top-level block of the tree, collapsible, with its own count. */
+export interface PermissionArea {
+  node: RolePermissionNode;
+  /**
+   * The top-level permission the area sits under (`pages`, `settings`…),
+   * itself grantable: the tree shows it as a heading above its areas.
+   */
+  sectionNode?: RolePermissionNode;
+  /** Label of the section the area belongs to, when it has one. */
+  section?: string;
+}
+
+/** A search hit, under the path that locates it. */
+export interface PermissionSearchHit {
+  heading: string;
+  node: RolePermissionNode;
+  areaId: string;
+}
+
+/** What a grant changed: the new selection and what it added on its own. */
+export interface PermissionGrant {
+  selection: Set<string>;
+  autoAdded: string[];
+}
+
+/** How a permission differs from the saved role. */
+export type PermissionChange = "added" | "removed" | null;
+
+/**
+ * What every row of the nested tree reads its state from and reports its
+ * clicks to, handed down the branches as one object.
+ */
+export interface PermissionRowContext {
+  index: PermissionIndex;
+  selection: Set<string>;
+  /** Ids of the open collapsible rows. */
+  expanded: Set<string>;
+  stateOf: (node: RolePermissionNode) => SelectionState;
+  changeOf: (id: string) => PermissionChange;
+  requiresOf: (node: RolePermissionNode) => string[];
+  autoAddedHintOf: (id: string) => string | undefined;
+  isDisabled: (node: RolePermissionNode) => boolean;
+  disabledHint: string;
+  toggle: (id: string, checked: boolean) => void;
+  toggleExpanded: (id: string) => void;
+}
+
+/** Id of the element listing a collapsible row's children (`aria-controls`). */
+export function childrenElementId(id: string): string {
+  return `role-permission-children-${id}`;
+}
+
+/** State of a checkbox standing for a set of permissions. */
+export type SelectionState = boolean | "indeterminate";
+
+/** Permissions of a subtree that are selected, out of how many. */
+export interface SelectionCount {
+  selected: number;
+  total: number;
+}
+
+const PATH_SEPARATOR = " › ";
+
+function indexNode(
+  index: PermissionIndex,
+  node: RolePermissionNode,
+  parentId?: string,
+): string[] {
+  index.nodes.set(node.id, node);
+  if (parentId) index.parents.set(node.id, parentId);
+  const subtree = [
+    node.id,
+    ...(node.children ?? []).flatMap((child) =>
+      indexNode(index, child, node.id),
+    ),
+  ];
+  index.subtrees.set(node.id, subtree);
+  return subtree;
+}
+
+/** Index a permission tree for the toggles, counts and searches. */
+export function buildPermissionIndex(
+  tree: RolePermissionNode[],
+): PermissionIndex {
+  const index: PermissionIndex = {
+    nodes: new Map(),
+    parents: new Map(),
+    subtrees: new Map(),
+    allIds: [],
+  };
+  index.allIds = tree.flatMap((node) => indexNode(index, node));
+  return index;
+}
+
+/** Ids of a node's ancestors, closest first. */
+export function ancestorIds(index: PermissionIndex, id: string): string[] {
+  const ancestors: string[] = [];
+  let current = index.parents.get(id);
+  while (current) {
+    ancestors.push(current);
+    current = index.parents.get(current);
+  }
+  return ancestors;
+}
+
+/** Whether a node has children: a collapsible row rather than a leaf. */
+export function hasChildren(node: RolePermissionNode): boolean {
+  return (node.children?.length ?? 0) > 0;
+}
+
+/**
+ * The collapsible rows of the tree, depth by depth: the areas with children
+ * are depth 1, their children with children depth 2, and so on. Section
+ * headings are not collapsible and have no depth.
+ */
+export interface PermissionLevels {
+  /** Ids of the collapsible rows of each depth, `levels[0]` being depth 1. */
+  levels: string[][];
+  /** The collapsible row right above each nested collapsible row. */
+  parents: Map<string, string>;
+}
+
+/** Sort the collapsible rows of the areas by depth, for the level buttons. */
+export function buildPermissionLevels(
+  areas: PermissionArea[],
+): PermissionLevels {
+  const levels: string[][] = [];
+  const parents = new Map<string, string>();
+  const visit = (
+    node: RolePermissionNode,
+    position: number,
+    parentId?: string,
+  ): void => {
+    if (!hasChildren(node)) return;
+    (levels[position] ??= []).push(node.id);
+    if (parentId) parents.set(node.id, parentId);
+    for (const child of node.children ?? []) {
+      visit(child, position + 1, node.id);
+    }
+  };
+  for (const area of areas) visit(area.node, 0);
+  return { levels, parents };
+}
+
+/**
+ * Depth "Expand one level" opens: the shallowest depth with a closed row.
+ * That is also the shallowest depth with a closed row the user can see (all
+ * its parents open), since the shallowest closed row above a hidden one is
+ * itself shown. Every depth above it is fully open, so the whole depth opens
+ * and each of its rows shows. `null` once everything is open.
+ */
+export function nextExpandDepth(
+  levels: PermissionLevels,
+  expanded: Set<string>,
+): number | null {
+  const position = levels.levels.findIndex((ids) =>
+    ids.some((id) => !expanded.has(id)),
+  );
+  return position === -1 ? null : position + 1;
+}
+
+/**
+ * Depth "Collapse one level" closes: the deepest depth with an open row the
+ * user can see (all its parents open, depth by depth). `null` once nothing
+ * shown is open.
+ */
+export function nextCollapseDepth(
+  levels: PermissionLevels,
+  expanded: Set<string>,
+): number | null {
+  // Rows shown open at the current depth: open, under a row shown open.
+  let shownOpen = new Set<string>();
+  let deepest: number | null = null;
+  for (const [position, ids] of levels.levels.entries()) {
+    const parentsShownOpen = shownOpen;
+    shownOpen = new Set(
+      ids.filter(
+        (id) =>
+          expanded.has(id) &&
+          (position === 0 ||
+            parentsShownOpen.has(levels.parents.get(id) ?? "")),
+      ),
+    );
+    if (shownOpen.size === 0) break;
+    deepest = position + 1;
+  }
+  return deepest;
+}
+
+/** Depths fully open from the top: the level the tree is expanded to. */
+export function openDepth(
+  levels: PermissionLevels,
+  expanded: Set<string>,
+): number {
+  return (nextExpandDepth(levels, expanded) ?? levels.levels.length + 1) - 1;
+}
+
+/** The open rows once "Expand one level" opened the next depth. */
+export function expandOneLevel(
+  levels: PermissionLevels,
+  expanded: Set<string>,
+): Set<string> {
+  const depth = nextExpandDepth(levels, expanded);
+  if (depth === null) return expanded;
+  return new Set([...expanded, ...(levels.levels[depth - 1] ?? [])]);
+}
+
+/**
+ * The open rows once "Collapse one level" closed the deepest open depth. The
+ * open rows below it, hidden under a closed parent, close too: reopening a
+ * row then never brings back a deeper level the user collapsed.
+ */
+export function collapseOneLevel(
+  levels: PermissionLevels,
+  expanded: Set<string>,
+): Set<string> {
+  const depth = nextCollapseDepth(levels, expanded);
+  if (depth === null) return expanded;
+  const closing = new Set(levels.levels.slice(depth - 1).flat());
+  return new Set([...expanded].filter((id) => !closing.has(id)));
+}
+
+/**
+ * Split the tree into areas: a top-level permission with children is a
+ * section, and each of its children an area; any other top-level permission
+ * is an area of its own. Below an area, every node with children is a
+ * collapsible row of its own, down to the leaves.
+ */
+export function buildPermissionAreas(
+  tree: RolePermissionNode[],
+  translate: (label: string) => string,
+): PermissionArea[] {
+  return tree.flatMap((node): PermissionArea[] =>
+    hasChildren(node)
+      ? (node.children ?? []).map((child) => ({
+          node: child,
+          sectionNode: node,
+          section: translate(node.label),
+        }))
+      : [{ node }],
+  );
+}
+
+/** How many permissions of a subtree are selected. */
+export function countSelected(
+  index: PermissionIndex,
+  id: string,
+  selection: Set<string>,
+): SelectionCount {
+  const subtree = index.subtrees.get(id) ?? [id];
+  return {
+    selected: subtree.filter((subId) => selection.has(subId)).length,
+    total: subtree.length,
+  };
+}
+
+/**
+ * Checkbox state of a node, by the original roles form's rule: mixed while
+ * only some of its descendants are selected, otherwise checked when the node
+ * itself is. Clicking a mixed box grants, a checked one revokes.
+ */
+export function checkboxState(
+  index: PermissionIndex,
+  id: string,
+  selection: Set<string>,
+): SelectionState {
+  const descendants = (index.subtrees.get(id) ?? [id]).slice(1);
+  const selected = descendants.filter((descendant) =>
+    selection.has(descendant),
+  ).length;
+  if (selected > 0 && selected < descendants.length) return "indeterminate";
+  return selection.has(id);
+}
+
+/** Checkbox state of a count: all, some or none selected. */
+export function selectionState(count: SelectionCount): SelectionState {
+  if (count.selected === 0) return false;
+  return count.selected === count.total ? true : "indeterminate";
+}
+
+/**
+ * The ids a dotted permission id sits under, itself first: `a.b.c` gives
+ * `a.b.c`, `a.b` and `a`. Granting follows the ids, not the tree, exactly as
+ * the original roles form did: a registered `media.upload` lifted to the top
+ * of the tree still grants `media` with it.
+ */
+export function idPrefixes(id: string): string[] {
+  const parts = id.split(".");
+  return parts.map((_, position) =>
+    parts.slice(0, parts.length - position).join("."),
+  );
+}
+
+/**
+ * Grant a node's whole subtree with every id it sits under (a component
+ * needs its page, a page its category), as the original roles form stored
+ * it. Ids the user may not grant are skipped. Declared dependencies are shown
+ * on the rows but not added: nothing enforces them, and the original form
+ * never stored them either.
+ */
+export function grantPermission(
+  index: PermissionIndex,
+  selection: Set<string>,
+  id: string,
+  canGrant: (permissionId: string) => boolean,
+): PermissionGrant {
+  const subtree = new Set(index.subtrees.get(id) ?? [id]);
+  const wanted = new Set([...subtree, ...idPrefixes(id)]);
+  const added = [...wanted].filter(
+    (wantedId) => !selection.has(wantedId) && canGrant(wantedId),
+  );
+  return {
+    selection: new Set([...selection, ...added]),
+    autoAdded: added.filter(
+      (addedId) => !subtree.has(addedId) && index.nodes.has(addedId),
+    ),
+  };
+}
+
+/**
+ * Revoke a node's subtree. An id it sits under that is a node with children
+ * goes too when none of its descendants is left once the subtree is gone: a
+ * page is granted for its components. Same rule as the original roles form,
+ * which judges every ancestor against that one state, before any ancestor
+ * is dropped: an ancestor above one dropped this way still saw it selected,
+ * and stays.
+ */
+export function revokePermission(
+  index: PermissionIndex,
+  selection: Set<string>,
+  id: string,
+): Set<string> {
+  const removed = new Set(index.subtrees.get(id) ?? [id]);
+  const remaining = new Set(
+    [...selection].filter((kept) => !removed.has(kept)),
+  );
+  const emptied = idPrefixes(id).filter((ancestor) => {
+    const descendants = (index.subtrees.get(ancestor) ?? []).slice(1);
+    return (
+      descendants.length > 0 &&
+      !descendants.some((descendant) => remaining.has(descendant))
+    );
+  });
+  for (const ancestor of emptied) remaining.delete(ancestor);
+  return remaining;
+}
+
+function matchesQuery(
+  node: RolePermissionNode,
+  query: string,
+  translate: (label: string) => string,
+): boolean {
+  return [translate(node.label), node.description, node.id]
+    .filter((text): text is string => Boolean(text))
+    .some((text) => translate(text).toLowerCase().includes(query));
+}
+
+function areaIdOf(
+  index: PermissionIndex,
+  areaIds: Set<string>,
+  id: string,
+): string {
+  return (
+    [id, ...ancestorIds(index, id)].find((candidate) =>
+      areaIds.has(candidate),
+    ) ?? id
+  );
+}
+
+/**
+ * Permissions matching a query, each under the path of its ancestors. Every
+ * node is searched, the section and area headings included.
+ */
+export function searchPermissions(
+  index: PermissionIndex,
+  areas: PermissionArea[],
+  query: string,
+  translate: (label: string) => string,
+): PermissionSearchHit[] {
+  const normalized = query.trim().toLowerCase();
+  if (!normalized) return [];
+  const areaIds = new Set(areas.map((area) => area.node.id));
+  return index.allIds
+    .map((id) => index.nodes.get(id))
+    .filter((node): node is RolePermissionNode => Boolean(node))
+    .filter((node) => matchesQuery(node, normalized, translate))
+    .map((node) => ({
+      heading: joinPath(
+        ancestorIds(index, node.id)
+          .reverse()
+          .map((ancestorId) =>
+            translate(index.nodes.get(ancestorId)?.label ?? ""),
+          ),
+      ),
+      node,
+      areaId: areaIdOf(index, areaIds, node.id),
+    }));
+}
+
+/** Joins path labels the way the editor shows them. */
+export function joinPath(labels: string[]): string {
+  return labels.join(PATH_SEPARATOR);
+}
+
+/** Ids added to and removed from a saved permission set. */
+export interface PermissionDiff {
+  added: string[];
+  removed: string[];
+}
+
+/** Compare the edited selection with the saved permissions. */
+export function diffPermissions(
+  saved: string[],
+  selection: Set<string>,
+): PermissionDiff {
+  const savedIds = new Set(saved);
+  return {
+    added: [...selection].filter((id) => !savedIds.has(id)),
+    removed: [...savedIds].filter((id) => !selection.has(id)),
+  };
+}
+
+/** A run of text, marked when it matches the search query. */
+export interface HighlightSegment {
+  text: string;
+  isMatch: boolean;
+}
+
+/** Split a label around the occurrences of a query, for highlighting. */
+export function highlightSegments(
+  text: string,
+  query: string,
+): HighlightSegment[] {
+  const normalized = query.trim().toLowerCase();
+  if (!normalized) return [{ text, isMatch: false }];
+  const segments: HighlightSegment[] = [];
+  const lowered = text.toLowerCase();
+  let cursor = 0;
+  let found = lowered.indexOf(normalized, cursor);
+  while (found !== -1) {
+    if (found > cursor) {
+      segments.push({ text: text.slice(cursor, found), isMatch: false });
+    }
+    cursor = found + normalized.length;
+    segments.push({ text: text.slice(found, cursor), isMatch: true });
+    found = lowered.indexOf(normalized, cursor);
+  }
+  if (cursor < text.length) {
+    segments.push({ text: text.slice(cursor), isMatch: false });
+  }
+  return segments;
+}

package/frontend-vue/layers/dms-layout/app/build/components/pages/settings/roles/role-types.ts

@@ -0,0 +1,89 @@
+/** A permission of the roles editor tree (`GET /settings/workspace/roles/editor-tree`). */
+export interface RolePermissionNode {
+  id: string;
+  label: string;
+  icon?: string;
+  description?: string;
+  /** Permissions this one needs; granting it grants them too. */
+  dependencies?: string[];
+  children?: RolePermissionNode[];
+}
+
+/** A member shown on a role. */
+export interface RoleMemberPreview {
+  userId: string;
+  name: string;
+}
+
+/** One role of the roles list (`GET /settings/workspace/roles/overview`). */
+export interface RoleSummary {
+  _id: string;
+  name: string;
+  description: string;
+  permissions: string[];
+  permissionCount: number;
+  memberCount: number;
+  members: RoleMemberPreview[];
+  inviteCount: number;
+}
+
+/** The tenant owners, the locked Owner entry of the list. */
+export interface RoleOwnersSummary {
+  memberCount: number;
+  members: RoleMemberPreview[];
+}
+
+/** What the signed-in user may change on the page. */
+export interface RoleEditorCapabilities {
+  canAdd: boolean;
+  canEdit: boolean;
+  canDelete: boolean;
+}
+
+/** Payload of `GET /settings/workspace/roles/overview`. */
+export interface RolesOverview {
+  roles: RoleSummary[];
+  owners: RoleOwnersSummary;
+  totalPermissions: number;
+  /** Permission ids the user may grant; `null` when they may grant any. */
+  grantable: string[] | null;
+  capabilities: RoleEditorCapabilities;
+}
+
+/** The role being edited: a saved role, or a new one not saved yet. */
+export interface RoleDraft {
+  id: string | null;
+  name: string;
+  description: string;
+  permissions: string[];
+}
+
+/** Body of the delete call. */
+export interface RoleDeleteRequest {
+  /** Role given to the holders of the deleted one; none: they just lose it. */
+  reassignTo: string | null;
+}
+
+/** Response of the create and duplicate calls. */
+export interface CreatedRole {
+  id: string;
+}
+
+/** Id of the Owner entry, which is not a stored role. */
+export const OWNER_ENTRY_ID = "__owner__";
+
+/** Id of the role being created, before it is saved. */
+export const NEW_ROLE_ENTRY_ID = "__new__";
+
+/** Base path of the roles page API. */
+export const ROLES_API_PATH = "/settings/workspace/roles";
+
+/** The roles' table data routes, which delete a role. */
+export const ROLES_TABLE_API_PATH = "/api/tables/roles";
+
+/** Bounds mirrored from the backend validation schema. */
+export const ROLE_NAME_MAX_LENGTH = 80;
+export const ROLE_DESCRIPTION_MAX_LENGTH = 240;
+
+/** A field of the role editor's head an error can land on. */
+export type RoleEditorField = "name" | "description";