@anzusystems/common-admin 1.47.0-beta.dev-1790143991 → 2.0.0-rc.1

package/dist/domains/anzuUser/composables/userCrossSystemSearch.d.ts

@@ -0,0 +1,25 @@
+import { UserSystemResult } from '../store/userCrossSystemStore';
+import { AnyUserSystemDescriptor } from './userSystemDescriptor';
+import { UserSystemRefreshHook } from './userSystemProbe';
+import { IntegerId } from '../../../shared/types/common';
+export interface CrossSystemSearchParams {
+    descriptors: AnyUserSystemDescriptor[];
+    refreshHook?: UserSystemRefreshHook | undefined;
+}
+export declare const isEmailTerm: (term: string) => boolean;
+/**
+ * The cross-system fan-out.
+ *
+ * No calls to the current-user endpoints go out at all: the buttons in a row are decided by the
+ * probe's answer rather than by `<Acl>`, so there is nothing to load nine current users for. The
+ * budget is nine calls when searching by id, eighteen when searching by e-mail.
+ */
+export declare const useUserCrossSystemSearch: (params: CrossSystemSearchParams) => {
+    search: (term: string) => Promise<boolean>;
+    searchById: (id: IntegerId) => Promise<void>;
+    searchByEmail: (email: string) => Promise<void>;
+    refreshSystem: (system: string) => Promise<void>;
+    resultFor: (system: string) => UserSystemResult | undefined;
+    unresolvedSystems: import('vue').ComputedRef<string[]>;
+    cancel: () => void;
+};

package/dist/domains/anzuUser/composables/userCrossSystemSearch.js

@@ -0,0 +1,95 @@
+import { SortOrder as e } from "../../api/types/SortOrder.js";
+import { useApiFetchList as t } from "../../api/composables/useApiFetchList.js";
+import { usePagination as n } from "../../api/composables/pagination.js";
+import { useAnzuUserEmailLookupFilter as r } from "../filter/anzuUserFilter.js";
+import { UserSystemAccess as i, UserSystemLoad as a, UserSystemPresence as o, isAuthoritativelyAbsent as s } from "../utils/userSystemState.js";
+import { CrossSystemPhase as c, useUserCrossSystemStore as l } from "../store/userCrossSystemStore.js";
+import { useUserSystemProbe as u } from "./userSystemProbe.js";
+import { computed as d } from "vue";
+//#region src/domains/anzuUser/composables/userCrossSystemSearch.ts
+var f = /^[^\s@]+@[^\s@]+$/, p = (e) => f.test(e.trim()), m = (f) => {
+	let m = l(), { descriptors: h, refreshHook: g } = f, _ = new Map(h.map((e) => [e.system, u({
+		descriptor: e,
+		refreshHook: g
+	})])), v = 0, y = () => {
+		v++, _.forEach((e) => e.cancel());
+	}, b = async (e, t, n) => {
+		let r = _.get(e.system);
+		r && (m.patchAxes(e.system, {
+			...r.axes.value,
+			load: a.Loading
+		}), await r.probe(t), n === v && m.setResult(e.system, {
+			axes: r.axes.value,
+			user: r.user.value
+		}));
+	}, x = async (e) => {
+		let t = ++v;
+		m.resetResults(), m.resolvedId = e, m.phase = c.VerifyingById, await Promise.allSettled(h.map((n) => b(n, e, t))), t === v && (m.phase = c.Done);
+	}, S = async (i, a) => {
+		if (!i.isEnabled()) return null;
+		let { filterData: o, filterConfig: s } = r();
+		o.email = a;
+		let { pagination: c } = n("id", e.Desc, { rowsPerPage: 1 }), { execute: l } = t({
+			client: i.client,
+			system: i.system,
+			entity: i.entity,
+			urlTemplate: i.endpoints.list
+		});
+		try {
+			return (await l(c, o, s))[0] ?? null;
+		} catch {
+			return null;
+		}
+	}, C = async (e) => {
+		let t = ++v;
+		m.resetResults(), m.phase = c.MatchingEmail;
+		let n = await Promise.all(h.map(async (t) => ({
+			system: t.system,
+			user: await S(t, e)
+		})));
+		if (t !== v) return;
+		let r = /* @__PURE__ */ new Map();
+		for (let e of n) e.user?.id && r.set(e.system, e.user.id);
+		let s = new Set(r.values());
+		if (s.size > 1) {
+			m.identityConflict = r, m.phase = c.Done;
+			for (let e of n) e.user && m.setResult(e.system, {
+				axes: {
+					load: a.Loaded,
+					presence: o.Present,
+					access: i.Ok,
+					enabled: e.user.enabled
+				},
+				user: e.user
+			});
+			return;
+		}
+		let l = s.values().next().value;
+		l === void 0 ? m.phase = c.Done : await x(l);
+	};
+	return {
+		search: async (e) => {
+			let t = e.trim();
+			if (t.length === 0) return !1;
+			if (m.searchTerm = t, p(t)) return await C(t), !0;
+			let n = Number(t);
+			return !Number.isInteger(n) || n <= 0 ? (y(), m.resetResults(), m.termRejected = !0, !1) : (await x(n), !0);
+		},
+		searchById: x,
+		searchByEmail: C,
+		refreshSystem: async (e) => {
+			let t = h.find((t) => t.system === e), n = m.resolvedId;
+			t && n !== null && await b(t, n, v);
+		},
+		resultFor: (e) => m.results.get(e),
+		unresolvedSystems: d(() => h.filter((e) => e.isEnabled()).filter((e) => {
+			let t = m.results.get(e.system);
+			return t === void 0 || !s(t.axes);
+		}).map((e) => e.system)),
+		cancel: y
+	};
+};
+//#endregion
+export { p as isEmailTerm, m as useUserCrossSystemSearch };
+
+//# sourceMappingURL=userCrossSystemSearch.js.map

package/dist/domains/anzuUser/composables/userCrossSystemSearch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userCrossSystemSearch.js","names":["EMAIL_PATTERN","isEmailTerm","term","useUserCrossSystemSearch","store","useUserCrossSystemStore","params","probes","descriptors","descriptor","useUserSystemProbe","generation","cancel","probe","runProbe","UserSystemLoad","id","token","searchById","CrossSystemPhase","lookupByEmail","useAnzuUserEmailLookupFilter","email","usePagination","SortOrder","useApiFetchList","execute","pagination","filterData","filterConfig","searchByEmail","found","ids","row","distinctIds","UserSystemPresence","UserSystemAccess","trimmed","item","system","computed","result","isAuthoritativelyAbsent"],"sources":["../../../../src/domains/anzuUser/composables/userCrossSystemSearch.ts"],"sourcesContent":["import { computed } from 'vue'\nimport { useApiFetchList } from '@/domains/api/composables/useApiFetchList'\nimport { usePagination } from '@/domains/api/composables/pagination'\nimport { SortOrder } from '@/domains/api/types/SortOrder'\nimport { useAnzuUserEmailLookupFilter } from '@/domains/anzuUser/filter/anzuUserFilter'\nimport {\n  CrossSystemPhase,\n  useUserCrossSystemStore,\n  type UserSystemResult,\n} from '@/domains/anzuUser/store/userCrossSystemStore'\nimport type { AnyUserSystemDescriptor } from '@/domains/anzuUser/composables/userSystemDescriptor'\nimport { useUserSystemProbe, type UserSystemRefreshHook } from '@/domains/anzuUser/composables/userSystemProbe'\nimport {\n  isAuthoritativelyAbsent,\n  UserSystemAccess,\n  UserSystemLoad,\n  UserSystemPresence,\n} from '@/domains/anzuUser/utils/userSystemState'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\nimport type { IntegerId } from '@/shared/types/common'\n\nexport interface CrossSystemSearchParams {\n  descriptors: AnyUserSystemDescriptor[]\n  refreshHook?: UserSystemRefreshHook | undefined\n}\n\nconst EMAIL_PATTERN = /^[^\\s@]+@[^\\s@]+$/\n\nexport const isEmailTerm = (term: string): boolean => EMAIL_PATTERN.test(term.trim())\n\n/**\n * The cross-system fan-out.\n *\n * No calls to the current-user endpoints go out at all: the buttons in a row are decided by the\n * probe's answer rather than by `<Acl>`, so there is nothing to load nine current users for. The\n * budget is nine calls when searching by id, eighteen when searching by e-mail.\n */\nexport const useUserCrossSystemSearch = (params: CrossSystemSearchParams) => {\n  const store = useUserCrossSystemStore()\n  const { descriptors, refreshHook } = params\n\n  // One probe instance per system, built once: each keeps its own abort token, and rebuilding them\n  // per search would lose the ability to invalidate what is still in flight.\n  const probes = new Map(\n    descriptors.map((descriptor) => [descriptor.system, useUserSystemProbe({ descriptor, refreshHook })])\n  )\n\n  /**\n   * Every search gets a number. A late answer from the previous one is dropped rather than written\n   * over the results of the search the operator is looking at now.\n   */\n  let generation = 0\n\n  const cancel = () => {\n    generation++\n    probes.forEach((probe) => probe.cancel())\n  }\n\n  const runProbe = async (descriptor: AnyUserSystemDescriptor, id: IntegerId, token: number) => {\n    const probe = probes.get(descriptor.system)\n    if (!probe) return\n    store.patchAxes(descriptor.system, { ...probe.axes.value, load: UserSystemLoad.Loading })\n    await probe.probe(id)\n    if (token !== generation) return\n    store.setResult(descriptor.system, { axes: probe.axes.value, user: probe.user.value })\n  }\n\n  /** Results are written as they arrive, never through `Promise.all`: one dead backend must not hold up the rest. */\n  const searchById = async (id: IntegerId) => {\n    const token = ++generation\n    store.resetResults()\n    store.resolvedId = id\n    store.phase = CrossSystemPhase.VerifyingById\n    await Promise.allSettled(descriptors.map((descriptor) => runProbe(descriptor, id, token)))\n    if (token !== generation) return\n    store.phase = CrossSystemPhase.Done\n  }\n\n  /** Exact match, `filter_eq[email]`, one row. `startsWith` would match a different person. */\n  const lookupByEmail = async (descriptor: AnyUserSystemDescriptor, email: string): Promise<AnzuUser | null> => {\n    if (!descriptor.isEnabled()) return null\n    const { filterData, filterConfig } = useAnzuUserEmailLookupFilter()\n    filterData.email = email\n    // One row: an exact match either exists or does not, and asking for a page of them would only\n    // cost the backend more.\n    const { pagination } = usePagination('id', SortOrder.Desc, { rowsPerPage: 1 })\n\n    const { execute } = useApiFetchList<AnzuUser>({\n      client: descriptor.client,\n      system: descriptor.system,\n      entity: descriptor.entity,\n      urlTemplate: descriptor.endpoints.list,\n    })\n\n    try {\n      const rows = await execute(pagination, filterData, filterConfig)\n      return rows[0] ?? null\n    } catch {\n      // The second round asks every system by id anyway, so a failure here is not a verdict about\n      // that system -- it only means this round could not contribute an id.\n      return null\n    }\n  }\n\n  /**\n   * Two rounds, and the first one must not lie while the second is still running.\n   *\n   * Between them a row is neither present nor absent: showing \"no account here\" in that window\n   * would invite the operator to press Create for an account that does exist under another address.\n   */\n  const searchByEmail = async (email: string) => {\n    const token = ++generation\n    store.resetResults()\n    store.phase = CrossSystemPhase.MatchingEmail\n\n    const found = await Promise.all(\n      descriptors.map(async (descriptor) => ({\n        system: descriptor.system,\n        user: await lookupByEmail(descriptor, email),\n      }))\n    )\n    if (token !== generation) return\n\n    const ids = new Map<string, IntegerId>()\n    for (const row of found) {\n      if (row.user?.id) ids.set(row.system, row.user.id)\n    }\n\n    const distinctIds = new Set(ids.values())\n    if (distinctIds.size > 1) {\n      // The same address under two identities. Bulk actions stop here rather than guessing.\n      store.identityConflict = ids\n      store.phase = CrossSystemPhase.Done\n      for (const row of found) {\n        if (!row.user) continue\n        store.setResult(row.system, {\n          axes: {\n            load: UserSystemLoad.Loaded,\n            presence: UserSystemPresence.Present,\n            access: UserSystemAccess.Ok,\n            enabled: row.user.enabled,\n          },\n          user: row.user,\n        })\n      }\n      return\n    }\n\n    const id = distinctIds.values().next().value\n    if (id === undefined) {\n      // Nobody anywhere under this address. Every row is still unknown rather than absent: an\n      // address search cannot prove absence, only an id search can.\n      store.phase = CrossSystemPhase.Done\n      return\n    }\n\n    await searchById(id)\n  }\n\n  /**\n   * Runs the fan-out, and answers whether it ran at all.\n   *\n   * A term that is neither an address nor an id has to clear the screen rather than be ignored.\n   * The rows left standing are live: their buttons and all three bulk actions write to\n   * `resolvedId`, which is still the previous person, while the box above them now holds a name\n   * that was never searched for. The plan expects this operator -- the one who knows only a\n   * surname -- so the answer has to be an empty result, not the last one.\n   */\n  const search = async (term: string): Promise<boolean> => {\n    const trimmed = term.trim()\n    if (trimmed.length === 0) return false\n    store.searchTerm = trimmed\n    if (isEmailTerm(trimmed)) {\n      await searchByEmail(trimmed)\n      return true\n    }\n    const id = Number(trimmed)\n    if (!Number.isInteger(id) || id <= 0) {\n      cancel()\n      store.resetResults()\n      store.termRejected = true\n      return false\n    }\n    await searchById(id)\n    return true\n  }\n\n  /** Re-reads one system after a write, so the row stops showing what it showed before it. */\n  const refreshSystem = async (system: string) => {\n    const descriptor = descriptors.find((item) => item.system === system)\n    const id = store.resolvedId\n    if (!descriptor || id === null) return\n    await runProbe(descriptor, id, generation)\n  }\n\n  const resultFor = (system: string): UserSystemResult | undefined => store.results.get(system)\n\n  /**\n   * Whether creating an account may be offered when nobody was found.\n   *\n   * Only when every relevant probe answered an authoritative 404. A 401, a 403 or a timeout means\n   * the record could not be read, which is not the same as not existing -- and a duplicate identity\n   * cannot be taken back.\n   */\n  const unresolvedSystems = computed(() =>\n    descriptors\n      .filter((descriptor) => descriptor.isEnabled())\n      .filter((descriptor) => {\n        const result = store.results.get(descriptor.system)\n        return result === undefined || !isAuthoritativelyAbsent(result.axes)\n      })\n      .map((descriptor) => descriptor.system)\n  )\n\n  return {\n    search,\n    searchById,\n    searchByEmail,\n    refreshSystem,\n    resultFor,\n    unresolvedSystems,\n    cancel,\n  }\n}\n"],"mappings":";;;;;;;;;AA0BA,IAAMA,IAAgB,qBAETC,KAAe,MAA0BD,EAAc,KAAKE,EAAK,KAAK,CAAC,GASvEC,KAA4B,MAAoC;CAC3E,IAAMC,IAAQC,EAAwB,GAChC,EAAE,gBAAa,mBAAgBC,GAI/BC,IAAS,IAAI,IACjBC,EAAY,KAAK,MAAe,CAACC,EAAW,QAAQC,EAAmB;EAAE;EAAY;CAAY,CAAC,CAAC,CAAC,CACtG,GAMIC,IAAa,GAEXC,UAAe;EAEnB,AADA,KACAL,EAAO,SAAS,MAAUM,EAAM,OAAO,CAAC;CAC1C,GAEMC,IAAW,OAAO,GAAqC,GAAe,MAAkB;EAC5F,IAAMD,IAAQN,EAAO,IAAIE,EAAW,MAAM;EAC1C,AAAKI,MACLT,EAAM,UAAUK,EAAW,QAAQ;GAAE,GAAGI,EAAM,KAAK;GAAO,MAAME,EAAe;EAAQ,CAAC,GACxF,MAAMF,EAAM,MAAMG,CAAE,GAChBC,MAAUN,KACdP,EAAM,UAAUK,EAAW,QAAQ;GAAE,MAAMI,EAAM,KAAK;GAAO,MAAMA,EAAM,KAAK;EAAM,CAAC;CACvF,GAGMK,IAAa,OAAO,MAAkB;EAC1C,IAAMD,IAAQ,EAAEN;EAKhB,AAJAP,EAAM,aAAa,GACnB,EAAM,aAAaY,GACnB,EAAM,QAAQG,EAAiB,eAC/B,MAAM,QAAQ,WAAWX,EAAY,KAAK,MAAeM,EAASL,GAAYO,GAAIC,CAAK,CAAC,CAAC,GACrFA,MAAUN,MACd,EAAM,QAAQQ,EAAiB;CACjC,GAGMC,IAAgB,OAAO,GAAqC,MAA4C;EAC5G,IAAI,CAACX,EAAW,UAAU,GAAG,OAAO;EACpC,IAAM,EAAE,eAAY,oBAAiBY,EAA6B;EAClE,EAAW,QAAQC;EAGnB,IAAM,EAAE,kBAAeC,EAAc,MAAMC,EAAU,MAAM,EAAE,aAAa,EAAE,CAAC,GAEvE,EAAE,eAAYC,EAA0B;GAC5C,QAAQhB,EAAW;GACnB,QAAQA,EAAW;GACnB,QAAQA,EAAW;GACnB,aAAaA,EAAW,UAAU;EACpC,CAAC;EAED,IAAI;GAEF,QAAO,MADYiB,EAAQC,GAAYC,GAAYC,CAAY,EAAA,CACnD,MAAM;EACpB,QAAQ;GAGN,OAAO;EACT;CACF,GAQMC,IAAgB,OAAO,MAAkB;EAC7C,IAAMb,IAAQ,EAAEN;EAEhB,AADAP,EAAM,aAAa,GACnB,EAAM,QAAQe,EAAiB;EAE/B,IAAMY,IAAQ,MAAM,QAAQ,IAC1BvB,EAAY,IAAI,OAAO,OAAgB;GACrC,QAAQC,EAAW;GACnB,MAAM,MAAMW,EAAcX,GAAYa,CAAK;EAC7C,EAAE,CACJ;EACA,IAAIL,MAAUN,GAAY;EAE1B,IAAMqB,oBAAM,IAAI,IAAuB;EACvC,KAAK,IAAMC,KAAOF,GAChB,AAAIE,EAAI,MAAM,MAAID,EAAI,IAAIC,EAAI,QAAQA,EAAI,KAAK,EAAE;EAGnD,IAAMC,IAAc,IAAI,IAAIF,EAAI,OAAO,CAAC;EACxC,IAAIE,EAAY,OAAO,GAAG;GAGxB,AADA,EAAM,mBAAmBF,GACzB,EAAM,QAAQb,EAAiB;GAC/B,KAAK,IAAMc,KAAOF,GAChB,AAAKE,EAAI,QACT7B,EAAM,UAAU6B,EAAI,QAAQ;IAC1B,MAAM;KACJ,MAAMlB,EAAe;KACrB,UAAUoB,EAAmB;KAC7B,QAAQC,EAAiB;KACzB,SAASH,EAAI,KAAK;IACpB;IACA,MAAMA,EAAI;GACZ,CAAC;GAEH;EACF;EAEA,IAAMjB,IAAKkB,EAAY,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC;EACvC,AAAIlB,MAAO,KAAA,IAGT,EAAM,QAAQG,EAAiB,OAIjC,MAAMD,EAAWF,CAAE;CACrB;CAyDA,OAAO;EACL,eA/CoB,MAAmC;GACvD,IAAMqB,IAAUnC,EAAK,KAAK;GAC1B,IAAImC,EAAQ,WAAW,GAAG,OAAO;GAEjC,IADA,EAAM,aAAaA,GACfpC,EAAYoC,CAAO,GAErB,OADA,MAAMP,EAAcO,CAAO,GACpB;GAET,IAAMrB,IAAK,OAAOqB,CAAO;GAQzB,OAPI,CAAC,OAAO,UAAUrB,CAAE,KAAKA,KAAM,KACjCJ,EAAO,GACPR,EAAM,aAAa,GACnB,EAAM,eAAe,IACd,OAET,MAAMc,EAAWF,CAAE,GACZ;EACT;EA+BE;EACA;EACA,sBA9B2B,MAAmB;GAC9C,IAAMP,IAAaD,EAAY,MAAM,MAAS8B,EAAK,WAAWC,CAAM,GAC9DvB,IAAKZ,EAAM;GACjB,AAAKK,KAAcO,MAAO,QAC1B,MAAMF,EAASL,GAAYO,GAAIL,CAAU;EAC3C;EA0BE,YAxBiB,MAAiDP,EAAM,QAAQ,IAAImC,CAAM;EAyB1F,mBAhBwBC,QACxBhC,EACG,QAAQ,MAAeC,EAAW,UAAU,CAAC,CAAC,CAC9C,QAAQ,MAAe;GACtB,IAAMgC,IAASrC,EAAM,QAAQ,IAAIK,EAAW,MAAM;GAClD,OAAOgC,MAAW,KAAA,KAAa,CAACC,EAAwBD,EAAO,IAAI;EACrE,CAAC,CAAC,CACD,KAAK,MAAehC,EAAW,MAAM,CASxC;EACA;CACF;AACF"}

package/dist/domains/anzuUser/composables/userCrossSystemWrites.d.ts

@@ -0,0 +1,35 @@
+import { AnyUserSystemDescriptor } from './userSystemDescriptor';
+import { BulkOutcomeType } from '../store/userCrossSystemStore';
+import { UserMetadataField } from '../utils/userMetadataDiff';
+import { AnzuUser, BaseUser } from '../../../shared/types/AnzuUser';
+import { IntegerId } from '../../../shared/types/common';
+export interface WriteResult {
+    outcome: BulkOutcomeType;
+    /** What the server holds afterwards, when it answered with the record. */
+    user?: AnzuUser;
+    /**
+     * Fields whose stored value had moved away from both the target and what the search saw.
+     *
+     * The write still goes through -- decision 24 says the operator's value wins -- but somebody
+     * edited the record in between, and the log line says so rather than letting it pass unnoticed.
+     */
+    concurrentFields?: UserMetadataField[];
+    detail?: string;
+}
+/**
+ * What the operator is told about a failed write.
+ *
+ * 422 and 400 are their own line and not a generic failure: a PUT validates the whole body, and an
+ * account carrying a colour or an e-mail that no longer passes validation will fail even on a plain
+ * "disable". With legacy data that is an ordinary outcome, and "could not be saved" would send
+ * somebody looking for a bug that is not there.
+ */
+export declare const classifyWriteStatus: (status: number | null) => BulkOutcomeType;
+export declare const useUserCrossSystemWrites: () => {
+    setEnabled: (descriptor: AnyUserSystemDescriptor, id: IntegerId, enabled: boolean) => Promise<WriteResult>;
+    writeMetadata: (descriptor: AnyUserSystemDescriptor, id: IntegerId, target: BaseUser, fields?: readonly UserMetadataField[], seen?: BaseUser | null) => Promise<WriteResult & {
+        changed: boolean;
+    }>;
+    createInSystem: (descriptor: AnyUserSystemDescriptor, body: AnzuUser) => Promise<WriteResult>;
+    readSourceUser: (descriptor: AnyUserSystemDescriptor, id: IntegerId) => Promise<AnzuUser | null>;
+};

package/dist/domains/anzuUser/composables/userCrossSystemWrites.js

@@ -0,0 +1,96 @@
+import { cloneDeep as e, isNull as t } from "../../../shared/utils/common.js";
+import "../../../shared/statusCodes.js";
+import { useApiRequest as n } from "../../api/composables/useApiRequest.js";
+import { descriptorMayWrite as r, resolveCreateEndpoint as i, resolveEnabledWrite as a, resolveMetadataWrite as o } from "./userSystemDescriptor.js";
+import { BulkOutcome as s } from "../store/userCrossSystemStore.js";
+import { probeStatusFromError as c } from "./userSystemProbe.js";
+import { USER_METADATA_FIELDS as l, readMetadataField as u, writeMetadataField as d } from "../utils/userMetadataDiff.js";
+//#region src/domains/anzuUser/composables/userCrossSystemWrites.ts
+var f = (e) => e === null ? s.Unavailable : e === 403 ? s.Forbidden : e === 401 ? s.Unauthenticated : e === 404 ? s.NotFound : e === 422 || e === 400 ? s.Invalid : s.Unavailable, p = (e, t, r) => n({
+	client: e.client,
+	method: t,
+	system: e.system,
+	entity: e.entity,
+	urlTemplate: r
+}), m = () => ({
+	setEnabled: async (t, n, i) => {
+		let { get: o, url: l } = a(t);
+		try {
+			let { execute: a } = p(t, "GET", o), c = await a({ urlParams: { id: n } });
+			if (c.enabled === i) return {
+				outcome: s.Done,
+				user: c
+			};
+			if (!r(t, "update")) return { outcome: s.Forbidden };
+			let u = e(c);
+			u.enabled = i;
+			let { execute: d } = p(t, "PUT", l), f = await d({
+				urlParams: { id: n },
+				body: u
+			});
+			return {
+				outcome: s.Done,
+				user: f
+			};
+		} catch (e) {
+			return { outcome: f(c(e)) };
+		}
+	},
+	writeMetadata: async (n, i, a, m = l, h = null) => {
+		let { method: g, get: _, url: v } = o(n);
+		try {
+			let { execute: o } = p(n, "GET", _), c = await o({ urlParams: { id: i } });
+			if (!m.some((e) => u(c, e) !== u(a, e))) return {
+				outcome: s.Done,
+				user: c,
+				changed: !1
+			};
+			let l = t(h) ? [] : m.filter((e) => u(c, e) !== u(h, e) && u(c, e) !== u(a, e));
+			if (!r(n, "update")) return {
+				outcome: s.Forbidden,
+				changed: !1
+			};
+			let f = e(c);
+			m.forEach((e) => d(f, e, u(a, e)));
+			let { execute: y } = p(n, g, v), b = await y({
+				urlParams: { id: i },
+				body: f
+			});
+			return {
+				outcome: s.Done,
+				user: b,
+				changed: !0,
+				concurrentFields: l
+			};
+		} catch (e) {
+			return {
+				outcome: f(c(e)),
+				changed: !1
+			};
+		}
+	},
+	createInSystem: async (e, t) => {
+		try {
+			let { execute: n } = p(e, "POST", i(e)), r = await n({ body: t });
+			return {
+				outcome: s.Done,
+				user: r
+			};
+		} catch (e) {
+			return { outcome: f(c(e)) };
+		}
+	},
+	readSourceUser: async (e, t) => {
+		let { get: n } = a(e);
+		try {
+			let { execute: r } = p(e, "GET", n);
+			return await r({ urlParams: { id: t } });
+		} catch {
+			return null;
+		}
+	}
+});
+//#endregion
+export { f as classifyWriteStatus, m as useUserCrossSystemWrites };
+
+//# sourceMappingURL=userCrossSystemWrites.js.map

package/dist/domains/anzuUser/composables/userCrossSystemWrites.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userCrossSystemWrites.js","names":["classifyWriteStatus","status","BulkOutcome","request","useApiRequest","descriptor","url","useUserCrossSystemWrites","resolveEnabledWrite","read","get","current","enabled","descriptorMayWrite","body","cloneDeep","write","saved","error","probeStatusFromError","USER_METADATA_FIELDS","resolveMetadataWrite","fields","readMetadataField","field","target","concurrentFields","isNull","seen","writeMetadataField","method","resolveCreateEndpoint","created","execute"],"sources":["../../../../src/domains/anzuUser/composables/userCrossSystemWrites.ts"],"sourcesContent":["import { useApiRequest } from '@/domains/api/composables/useApiRequest'\nimport { HTTP_STATUS_BAD_REQUEST, HTTP_STATUS_UNPROCESSABLE_ENTITY } from '@/shared/statusCodes'\nimport {\n  type AnyUserSystemDescriptor,\n  descriptorMayWrite,\n  resolveCreateEndpoint,\n  resolveEnabledWrite,\n  resolveMetadataWrite,\n} from '@/domains/anzuUser/composables/userSystemDescriptor'\nimport { BulkOutcome, type BulkOutcomeType } from '@/domains/anzuUser/store/userCrossSystemStore'\nimport { probeStatusFromError } from '@/domains/anzuUser/composables/userSystemProbe'\nimport {\n  readMetadataField,\n  USER_METADATA_FIELDS,\n  writeMetadataField,\n  type UserMetadataField,\n} from '@/domains/anzuUser/utils/userMetadataDiff'\nimport type { AnzuUser, BaseUser } from '@/shared/types/AnzuUser'\nimport type { IntegerId } from '@/shared/types/common'\nimport { cloneDeep, isNull } from '@/shared/utils/common'\n\nexport interface WriteResult {\n  outcome: BulkOutcomeType\n  /** What the server holds afterwards, when it answered with the record. */\n  user?: AnzuUser\n  /**\n   * Fields whose stored value had moved away from both the target and what the search saw.\n   *\n   * The write still goes through -- decision 24 says the operator's value wins -- but somebody\n   * edited the record in between, and the log line says so rather than letting it pass unnoticed.\n   */\n  concurrentFields?: UserMetadataField[]\n  detail?: string\n}\n\n/**\n * What the operator is told about a failed write.\n *\n * 422 and 400 are their own line and not a generic failure: a PUT validates the whole body, and an\n * account carrying a colour or an e-mail that no longer passes validation will fail even on a plain\n * \"disable\". With legacy data that is an ordinary outcome, and \"could not be saved\" would send\n * somebody looking for a bug that is not there.\n */\nexport const classifyWriteStatus = (status: number | null): BulkOutcomeType => {\n  if (status === null) return BulkOutcome.Unavailable\n  if (status === 403) return BulkOutcome.Forbidden\n  if (status === 401) return BulkOutcome.Unauthenticated\n  if (status === 404) return BulkOutcome.NotFound\n  if (status === HTTP_STATUS_UNPROCESSABLE_ENTITY || status === HTTP_STATUS_BAD_REQUEST) return BulkOutcome.Invalid\n  return BulkOutcome.Unavailable\n}\n\nconst request = <R extends object, B>(\n  descriptor: AnyUserSystemDescriptor,\n  method: 'GET' | 'PUT' | 'PATCH' | 'POST',\n  url: string\n) =>\n  useApiRequest<R, B>({\n    client: descriptor.client,\n    method,\n    system: descriptor.system,\n    entity: descriptor.entity,\n    urlTemplate: url,\n  })\n\nexport const useUserCrossSystemWrites = () => {\n  /**\n   * Switching an account on or off.\n   *\n   * There is no PATCH for this anywhere -- the only method that calls `setEnabled` is the full\n   * update -- so it is a read followed by a write on the same path, with the whole record the read\n   * returned. That is not caution, it is the contract: the DTO defaults roles to `[ROLE_USER]`,\n   * `enabled` to true and both permission collections to empty, and the manager writes all four\n   * unconditionally. A body of \"just the enabled flag\" resets the roles, wipes the grants, detaches\n   * the groups and switches a disabled account back on.\n   *\n   * On `/adm/users` in cms it goes further still: that PUT runs `updateRelations()` over seven\n   * scalars and twelve collections, so an omitted `desks` does not mean \"unchanged\", it means\n   * \"remove from every desk\".\n   */\n  const setEnabled = async (\n    descriptor: AnyUserSystemDescriptor,\n    id: IntegerId,\n    enabled: boolean\n  ): Promise<WriteResult> => {\n    const { get, url } = resolveEnabledWrite(descriptor)\n    try {\n      const { execute: read } = request<AnzuUser, null>(descriptor, 'GET', get)\n      const current = await read({ urlParams: { id } })\n      if (current.enabled === enabled) {\n        // Already there. A no-op PUT would still run `updateRelations()` in cms -- risk for nothing.\n        return { outcome: BulkOutcome.Done, user: current }\n      }\n      // The right may have gone while the record was read: reported as the server would refuse it.\n      if (!descriptorMayWrite(descriptor, 'update')) return { outcome: BulkOutcome.Forbidden }\n      const body = cloneDeep(current)\n      body.enabled = enabled\n      const { execute: write } = request<AnzuUser, AnzuUser>(descriptor, 'PUT', url)\n      const saved = await write({ urlParams: { id }, body })\n      return { outcome: BulkOutcome.Done, user: saved }\n    } catch (error) {\n      return { outcome: classifyWriteStatus(probeStatusFromError(error)) }\n    }\n  }\n\n  /**\n   * Writing the shared metadata.\n   *\n   * Through `PATCH /adm/users/{id}` wherever that path exists, because the method behind it\n   * physically cannot write roles, permissions, groups or `enabled` -- it has no setters for them.\n   * That is a stronger guarantee than assembling a careful body, and it is why the plan sends\n   * metadata this way rather than through the full update.\n   *\n   * The body is still the whole record the read returned. `id` in particular has to be in it: the\n   * uniqueness validator only excludes the record itself when the DTO carries a non-empty id, and\n   * without it the server reports the user's own e-mail as already taken -- on every account.\n   */\n  const writeMetadata = async (\n    descriptor: AnyUserSystemDescriptor,\n    id: IntegerId,\n    target: BaseUser,\n    fields: readonly UserMetadataField[] = USER_METADATA_FIELDS,\n    /** What the search showed for this system, so a change made in between can be recognised. */\n    seen: BaseUser | null = null\n  ): Promise<WriteResult & { changed: boolean }> => {\n    const { method, get, url } = resolveMetadataWrite(descriptor)\n    try {\n      const { execute: read } = request<AnzuUser, null>(descriptor, 'GET', get)\n      // Read again immediately before writing, not reused from the search: those results can be\n      // hours old, and a system whose value already matches must not be written to at all.\n      const current = await read({ urlParams: { id } })\n\n      const differs = fields.some((field) => readMetadataField(current, field) !== readMetadataField(target, field))\n      if (!differs) return { outcome: BulkOutcome.Done, user: current, changed: false }\n\n      // Different from what the operator chose *and* from what they were shown when they chose it:\n      // somebody else wrote to this record in between. The value still goes in -- that is what was\n      // asked for -- and the log names the fields.\n      const concurrentFields = isNull(seen)\n        ? []\n        : fields.filter(\n            (field) =>\n              readMetadataField(current, field) !== readMetadataField(seen, field) &&\n              readMetadataField(current, field) !== readMetadataField(target, field)\n          )\n\n      // The right may have gone while the record was read: reported as the server would refuse it.\n      if (!descriptorMayWrite(descriptor, 'update')) return { outcome: BulkOutcome.Forbidden, changed: false }\n      const body = cloneDeep(current)\n      fields.forEach((field) => writeMetadataField(body, field, readMetadataField(target, field)))\n\n      const { execute: write } = request<AnzuUser, AnzuUser>(descriptor, method, url)\n      const saved = await write({ urlParams: { id }, body })\n      return { outcome: BulkOutcome.Done, user: saved, changed: true, concurrentFields }\n    } catch (error) {\n      return { outcome: classifyWriteStatus(probeStatusFromError(error)), changed: false }\n    }\n  }\n\n  /**\n   * Creating an account in another system.\n   *\n   * The body comes from the library factory -- `roles: []`, `enabled: false` -- with the metadata\n   * copied over. Assembling it by hand from base fields is what would have the backend fill in\n   * `ROLE_USER`, leaving an account with a role nobody granted.\n   */\n  const createInSystem = async (descriptor: AnyUserSystemDescriptor, body: AnzuUser): Promise<WriteResult> => {\n    try {\n      const { execute } = request<AnzuUser, AnzuUser>(descriptor, 'POST', resolveCreateEndpoint(descriptor))\n      const created = await execute({ body })\n      return { outcome: BulkOutcome.Done, user: created }\n    } catch (error) {\n      return { outcome: classifyWriteStatus(probeStatusFromError(error)) }\n    }\n  }\n\n  /** The source account, read fresh from the server rather than taken from a store or a form. */\n  const readSourceUser = async (descriptor: AnyUserSystemDescriptor, id: IntegerId): Promise<AnzuUser | null> => {\n    const { get } = resolveEnabledWrite(descriptor)\n    try {\n      const { execute } = request<AnzuUser, null>(descriptor, 'GET', get)\n      return await execute({ urlParams: { id } })\n    } catch {\n      return null\n    }\n  }\n\n  return {\n    setEnabled,\n    writeMetadata,\n    createInSystem,\n    readSourceUser,\n  }\n}\n"],"mappings":";;;;;;;;AA2CA,IAAaA,KAAuB,MAC9BC,MAAW,OAAaC,EAAY,cACpCD,MAAW,MAAYC,EAAY,YACnCD,MAAW,MAAYC,EAAY,kBACnCD,MAAW,MAAYC,EAAY,WACnCD,MAAA,OAA+CA,MAAA,MAA2CC,EAAY,UACnGA,EAAY,aAGfC,KACJ,GACA,GACA,MAEAC,EAAoB;CAClB,QAAQC,EAAW;CACnB;CACA,QAAQA,EAAW;CACnB,QAAQA,EAAW;CACnB,aAAaC;AACf,CAAC,GAEUC,WA0HJ;CACL,mBA3GA,GACA,GACA,MACyB;EACzB,IAAM,EAAE,QAAK,WAAQC,EAAoBH,CAAU;EACnD,IAAI;GACF,IAAM,EAAE,SAASI,MAASN,EAAwBE,GAAY,OAAOK,CAAG,GAClEC,IAAU,MAAMF,EAAK,EAAE,WAAW,EAAE,MAAG,EAAE,CAAC;GAChD,IAAIE,EAAQ,YAAYC,GAEtB,OAAO;IAAE,SAASV,EAAY;IAAM,MAAMS;GAAQ;GAGpD,IAAI,CAACE,EAAmBR,GAAY,QAAQ,GAAG,OAAO,EAAE,SAASH,EAAY,UAAU;GACvF,IAAMY,IAAOC,EAAUJ,CAAO;GAC9B,EAAK,UAAUC;GACf,IAAM,EAAE,SAASI,MAAUb,EAA4BE,GAAY,OAAOC,CAAG,GACvEW,IAAQ,MAAMD,EAAM;IAAE,WAAW,EAAE,MAAG;IAAG;GAAK,CAAC;GACrD,OAAO;IAAE,SAASd,EAAY;IAAM,MAAMe;GAAM;EAClD,SAASC,GAAO;GACd,OAAO,EAAE,SAASlB,EAAoBmB,EAAqBD,CAAK,CAAC,EAAE;EACrE;CACF;CAsFE,sBAvEA,GACA,GACA,GACA,IAAuCE,GAEvC,IAAwB,SACwB;EAChD,IAAM,EAAE,WAAQ,QAAK,WAAQC,EAAqBhB,CAAU;EAC5D,IAAI;GACF,IAAM,EAAE,SAASI,MAASN,EAAwBE,GAAY,OAAOK,CAAG,GAGlEC,IAAU,MAAMF,EAAK,EAAE,WAAW,EAAE,MAAG,EAAE,CAAC;GAGhD,IAAI,CADYa,EAAO,MAAM,MAAUC,EAAkBZ,GAASa,CAAK,MAAMD,EAAkBE,GAAQD,CAAK,CACvG,GAAS,OAAO;IAAE,SAAStB,EAAY;IAAM,MAAMS;IAAS,SAAS;GAAM;GAKhF,IAAMe,IAAmBC,EAAOC,CAAI,IAChC,CAAC,IACDN,EAAO,QACJ,MACCC,EAAkBZ,GAASa,CAAK,MAAMD,EAAkBK,GAAMJ,CAAK,KACnED,EAAkBZ,GAASa,CAAK,MAAMD,EAAkBE,GAAQD,CAAK,CACzE;GAGJ,IAAI,CAACX,EAAmBR,GAAY,QAAQ,GAAG,OAAO;IAAE,SAASH,EAAY;IAAW,SAAS;GAAM;GACvG,IAAMY,IAAOC,EAAUJ,CAAO;GAC9B,EAAO,SAAS,MAAUkB,EAAmBf,GAAMU,GAAOD,EAAkBE,GAAQD,CAAK,CAAC,CAAC;GAE3F,IAAM,EAAE,SAASR,MAAUb,EAA4BE,GAAYyB,GAAQxB,CAAG,GACxEW,IAAQ,MAAMD,EAAM;IAAE,WAAW,EAAE,MAAG;IAAG;GAAK,CAAC;GACrD,OAAO;IAAE,SAASd,EAAY;IAAM,MAAMe;IAAO,SAAS;IAAM;GAAiB;EACnF,SAASC,GAAO;GACd,OAAO;IAAE,SAASlB,EAAoBmB,EAAqBD,CAAK,CAAC;IAAG,SAAS;GAAM;EACrF;CACF;CAiCE,uBAxB4B,GAAqC,MAAyC;EAC1G,IAAI;GACF,IAAM,EAAE,eAAYf,EAA4BE,GAAY,QAAQ0B,EAAsB1B,CAAU,CAAC,GAC/F2B,IAAU,MAAMC,EAAQ,EAAE,QAAK,CAAC;GACtC,OAAO;IAAE,SAAS/B,EAAY;IAAM,MAAM8B;GAAQ;EACpD,SAASd,GAAO;GACd,OAAO,EAAE,SAASlB,EAAoBmB,EAAqBD,CAAK,CAAC,EAAE;EACrE;CACF;CAiBE,uBAd4B,GAAqC,MAA4C;EAC7G,IAAM,EAAE,WAAQV,EAAoBH,CAAU;EAC9C,IAAI;GACF,IAAM,EAAE,eAAYF,EAAwBE,GAAY,OAAOK,CAAG;GAClE,OAAO,MAAMuB,EAAQ,EAAE,WAAW,EAAE,MAAG,EAAE,CAAC;EAC5C,QAAQ;GACN,OAAO;EACT;CACF;AAOA"}

package/dist/domains/anzuUser/composables/userSystemDescriptor.d.ts

@@ -0,0 +1,156 @@
+import { RouteLocationRaw } from 'vue-router';
+import { AxiosClientFn } from '../../api/utils/client';
+import { AnzuUser } from '../../../shared/types/AnzuUser';
+/**
+ * A state a system has on top of `enabled`, shown next to it. Today only two systems have one:
+ * blog's `status` (guest / waiting_approval / active / ban / gdpr_deleted) and forum's
+ * `settings.banned`. Both arrive with the record -- they are `#[Serialize]` on the entity -- so
+ * rendering one costs no extra call.
+ */
+export interface UserSystemExtraState {
+    /** "blogger", "commenter" -- the app translates it; the library only prints it. */
+    label: string;
+    /** "active", "banned". */
+    value: string;
+    tone: 'ok' | 'warn' | 'error';
+}
+/** `/adm/v1/anzu-user`. Absent in contentHub, which has only `/adm/users`. */
+export interface AnzuUserEndpointPair {
+    get: string;
+    put: string;
+    post: string;
+}
+/** `/adm/users`. Only cms, dam and contentHub have it; it is the only path with a `PATCH`. */
+export interface BaseUserEndpointPair extends AnzuUserEndpointPair {
+    patch: string;
+}
+/**
+ * Paired GET + write paths, never loose urls.
+ *
+ * This is what makes the write invariant expressible: a write body is always the whole object the
+ * preceding GET on the *same path* returned. The two paths return different DTOs -- `/adm/users`
+ * in cms answers `CmsUserDto` and its PUT runs `updateRelations()` over seven scalars and twelve
+ * collections -- so a GET from one path and a PUT to the other silently drops whatever the other
+ * DTO carries.
+ */
+export interface UserSystemEndpoints {
+    anzuUser: AnzuUserEndpointPair | null;
+    base: BaseUserEndpointPair | null;
+    permissionGroup: string;
+    /**
+     * Per system, not one constant. contentHub's is `/adm/users/current`, and the admins had this
+     * hard-coded as a single path shared by every backend.
+     */
+    currentUser: string;
+    list: string;
+    /**
+     * Which pair the probe reads through. A field rather than something derived, because in dam the
+     * choice is visible to the operator: `GET /adm/v1/anzu-user/{id}` has no gating at all while
+     * `GET /adm/users/{id}` sits behind `DAM_USER_READ`, so only the second can ever render "you
+     * have no access". The rule is "the probe goes the way the write goes".
+     */
+    probe: 'anzuUser' | 'base';
+}
+/**
+ * Where "manage in X" leads. A callback over the user rather than a static value: a global
+ * descriptor does not know which row is being drawn.
+ *
+ * The return type is a discriminated union so the two cannot be confused in code either -- an
+ * internal target is pushed through the router, an external one is an `<a href>` opened in a new
+ * tab, and `href: null` is a configured-but-missing url, which renders disabled with a reason
+ * rather than as a dead button.
+ */
+export type UserSystemManageTarget = {
+    kind: 'internal';
+    to: RouteLocationRaw;
+} | {
+    kind: 'external';
+    href: string | null;
+};
+export interface UserSystemDescriptor<TSystem extends string = string, TUser extends AnzuUser = AnzuUser> {
+    system: TSystem;
+    client: AxiosClientFn;
+    /** Reaches every `useApiRequest` built for this system; see `permissionGroupApi`. */
+    entity: string;
+    /**
+     * Whether the system is switched on in this admin's configuration. Mandatory, not optional: the
+     * "disabled in configuration" state has to be *shown*, so leaving the system out of the array is
+     * not the same thing. The value is app-specific (`envConfig[system].enabled`) and the library has
+     * no way to read it.
+     */
+    isEnabled: () => boolean;
+    /**
+     * Which validation profile this system's form uses. `false` means only the e-mail is required;
+     * `true` adds first name, last name, full name, avatar text and avatar colour. It is a property
+     * of the system, and it is the same for creating and for editing.
+     */
+    requiredMetadata: boolean;
+    /**
+     * Whether the id is typed in. False only in cms, where the backend looks it up in SSO from the
+     * e-mail. On an edit the field is read-only regardless.
+     */
+    idInput: boolean;
+    extraState?: (user: TUser) => UserSystemExtraState | null;
+    /** Above the `enabled` switch and in the row of a bulk action. */
+    enabledNote?: string;
+    /** In the metadata repair dialog and in the owning form. */
+    metadataNote?: string;
+    /** In the confirmation dialog when an account is created here. */
+    createNote?: string;
+    endpoints: UserSystemEndpoints;
+    /** Added in task 2: the system's name as the app translates it. */
+    label?: string;
+    /** Added in task 2. */
+    manage?: (user: TUser) => UserSystemManageTarget;
+    /**
+     * Whether the current user may write this system's accounts. `false` takes away create, enable or
+     * disable, manage and the system's part of a bulk action; `undefined`, or no function, leaves it to the
+     * probe and the backend's answer, as before. Only the admin can say: the library has no current user of
+     * another system, and only the admin knows which ones it has loaded.
+     */
+    canWrite?: (action: UserSystemWriteAction) => boolean | undefined;
+}
+export type UserSystemWriteAction = 'create' | 'update';
+/**
+ * The erasure boundary for a heterogeneous array.
+ *
+ * Descriptors differ in `TUser` -- blog's `extraState` reaches for `status`, forum's for
+ * `settings.banned` -- so an array of them cannot keep each one's type. Without a single place to
+ * erase it, `strict: true` would demand a cast in every admin, at every call site. This does it
+ * once, where the array is built.
+ */
+export type AnyUserSystemDescriptor = UserSystemDescriptor<string, AnzuUser>;
+export declare const defineUserSystemDescriptor: <TSystem extends string, TUser extends AnzuUser>(descriptor: UserSystemDescriptor<TSystem, TUser>) => AnyUserSystemDescriptor;
+/** False only when the descriptor says no. Not knowing is not a no. */
+export declare const descriptorMayWrite: (descriptor: AnyUserSystemDescriptor, action: UserSystemWriteAction) => boolean;
+/**
+ * The pair the probe reads through, with the one invariant the type cannot state: both branches of
+ * `endpoints` are nullable, so nothing stops a descriptor naming `probe: 'base'` on a system that
+ * has no `/adm/users`. Every admin's descriptor test asserts this resolves for each of its
+ * systems.
+ */
+export declare const resolveProbeEndpoint: (descriptor: AnyUserSystemDescriptor) => AnzuUserEndpointPair;
+/**
+ * Metadata is written through `PATCH /adm/users/{id}` wherever that path exists: the method behind
+ * it can only write e-mail, locale, avatar and person -- it has no setter for roles, permissions,
+ * groups or `enabled`. That is a stronger guarantee than being careful about what goes in the body.
+ */
+export declare const resolveMetadataWrite: (descriptor: AnyUserSystemDescriptor) => {
+    method: "PATCH";
+    get: string;
+    url: string;
+} | {
+    method: "PUT";
+    get: string;
+    url: string;
+};
+/**
+ * `enabled` has no `PATCH` anywhere: the only method that calls `setEnabled` is the full update.
+ * So it goes GET + PUT, on the same path, with the whole DTO the GET returned.
+ */
+export declare const resolveEnabledWrite: (descriptor: AnyUserSystemDescriptor) => {
+    get: string;
+    url: string;
+};
+/** Creating an account goes the same way a write does. */
+export declare const resolveCreateEndpoint: (descriptor: AnyUserSystemDescriptor) => string;

package/dist/domains/anzuUser/composables/userSystemDescriptor.js

@@ -0,0 +1,42 @@
+//#region src/domains/anzuUser/composables/userSystemDescriptor.ts
+var e = (e) => e, t = (e, t) => e.canWrite?.(t) !== !1, n = (e) => {
+	let t = e.endpoints[e.endpoints.probe];
+	if (t === null) throw Error(`[userSystemDescriptor] '${e.system}' names probe '${e.endpoints.probe}', which it does not have.`);
+	return t;
+}, r = (e) => {
+	let t = e.endpoints.base;
+	if (t !== null) return {
+		method: "PATCH",
+		get: t.get,
+		url: t.patch
+	};
+	let n = e.endpoints.anzuUser;
+	if (n === null) throw Error(`[userSystemDescriptor] '${e.system}' has neither write path.`);
+	return {
+		method: "PUT",
+		get: n.get,
+		url: n.put
+	};
+}, i = (e) => {
+	let t = e.endpoints.base;
+	if (t !== null) return {
+		get: t.get,
+		url: t.put
+	};
+	let n = e.endpoints.anzuUser;
+	if (n === null) throw Error(`[userSystemDescriptor] '${e.system}' has neither write path.`);
+	return {
+		get: n.get,
+		url: n.put
+	};
+}, a = (e) => {
+	let t = e.endpoints.base;
+	if (t !== null) return t.post;
+	let n = e.endpoints.anzuUser;
+	if (n === null) throw Error(`[userSystemDescriptor] '${e.system}' has no create path.`);
+	return n.post;
+};
+//#endregion
+export { e as defineUserSystemDescriptor, t as descriptorMayWrite, a as resolveCreateEndpoint, i as resolveEnabledWrite, r as resolveMetadataWrite, n as resolveProbeEndpoint };
+
+//# sourceMappingURL=userSystemDescriptor.js.map

package/dist/domains/anzuUser/composables/userSystemDescriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userSystemDescriptor.js","names":["defineUserSystemDescriptor","descriptor","descriptorMayWrite","action","resolveProbeEndpoint","pair","resolveMetadataWrite","base","anzuUser","resolveEnabledWrite","resolveCreateEndpoint"],"sources":["../../../../src/domains/anzuUser/composables/userSystemDescriptor.ts"],"sourcesContent":["import type { RouteLocationRaw } from 'vue-router'\nimport type { AxiosClientFn } from '@/domains/api/utils/client'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\n\n/**\n * A state a system has on top of `enabled`, shown next to it. Today only two systems have one:\n * blog's `status` (guest / waiting_approval / active / ban / gdpr_deleted) and forum's\n * `settings.banned`. Both arrive with the record -- they are `#[Serialize]` on the entity -- so\n * rendering one costs no extra call.\n */\nexport interface UserSystemExtraState {\n  /** \"blogger\", \"commenter\" -- the app translates it; the library only prints it. */\n  label: string\n  /** \"active\", \"banned\". */\n  value: string\n  tone: 'ok' | 'warn' | 'error'\n}\n\n/** `/adm/v1/anzu-user`. Absent in contentHub, which has only `/adm/users`. */\nexport interface AnzuUserEndpointPair {\n  get: string\n  put: string\n  post: string\n}\n\n/** `/adm/users`. Only cms, dam and contentHub have it; it is the only path with a `PATCH`. */\nexport interface BaseUserEndpointPair extends AnzuUserEndpointPair {\n  patch: string\n}\n\n/**\n * Paired GET + write paths, never loose urls.\n *\n * This is what makes the write invariant expressible: a write body is always the whole object the\n * preceding GET on the *same path* returned. The two paths return different DTOs -- `/adm/users`\n * in cms answers `CmsUserDto` and its PUT runs `updateRelations()` over seven scalars and twelve\n * collections -- so a GET from one path and a PUT to the other silently drops whatever the other\n * DTO carries.\n */\nexport interface UserSystemEndpoints {\n  anzuUser: AnzuUserEndpointPair | null\n  base: BaseUserEndpointPair | null\n  permissionGroup: string\n  /**\n   * Per system, not one constant. contentHub's is `/adm/users/current`, and the admins had this\n   * hard-coded as a single path shared by every backend.\n   */\n  currentUser: string\n  list: string\n  /**\n   * Which pair the probe reads through. A field rather than something derived, because in dam the\n   * choice is visible to the operator: `GET /adm/v1/anzu-user/{id}` has no gating at all while\n   * `GET /adm/users/{id}` sits behind `DAM_USER_READ`, so only the second can ever render \"you\n   * have no access\". The rule is \"the probe goes the way the write goes\".\n   */\n  probe: 'anzuUser' | 'base'\n}\n\n/**\n * Where \"manage in X\" leads. A callback over the user rather than a static value: a global\n * descriptor does not know which row is being drawn.\n *\n * The return type is a discriminated union so the two cannot be confused in code either -- an\n * internal target is pushed through the router, an external one is an `<a href>` opened in a new\n * tab, and `href: null` is a configured-but-missing url, which renders disabled with a reason\n * rather than as a dead button.\n */\nexport type UserSystemManageTarget =\n  | { kind: 'internal'; to: RouteLocationRaw }\n  | { kind: 'external'; href: string | null }\n\nexport interface UserSystemDescriptor<TSystem extends string = string, TUser extends AnzuUser = AnzuUser> {\n  system: TSystem\n  client: AxiosClientFn\n  /** Reaches every `useApiRequest` built for this system; see `permissionGroupApi`. */\n  entity: string\n  /**\n   * Whether the system is switched on in this admin's configuration. Mandatory, not optional: the\n   * \"disabled in configuration\" state has to be *shown*, so leaving the system out of the array is\n   * not the same thing. The value is app-specific (`envConfig[system].enabled`) and the library has\n   * no way to read it.\n   */\n  isEnabled: () => boolean\n  /**\n   * Which validation profile this system's form uses. `false` means only the e-mail is required;\n   * `true` adds first name, last name, full name, avatar text and avatar colour. It is a property\n   * of the system, and it is the same for creating and for editing.\n   */\n  requiredMetadata: boolean\n  /**\n   * Whether the id is typed in. False only in cms, where the backend looks it up in SSO from the\n   * e-mail. On an edit the field is read-only regardless.\n   */\n  idInput: boolean\n  extraState?: (user: TUser) => UserSystemExtraState | null\n  /** Above the `enabled` switch and in the row of a bulk action. */\n  enabledNote?: string\n  /** In the metadata repair dialog and in the owning form. */\n  metadataNote?: string\n  /** In the confirmation dialog when an account is created here. */\n  createNote?: string\n  endpoints: UserSystemEndpoints\n  /** Added in task 2: the system's name as the app translates it. */\n  label?: string\n  /** Added in task 2. */\n  manage?: (user: TUser) => UserSystemManageTarget\n  /**\n   * Whether the current user may write this system's accounts. `false` takes away create, enable or\n   * disable, manage and the system's part of a bulk action; `undefined`, or no function, leaves it to the\n   * probe and the backend's answer, as before. Only the admin can say: the library has no current user of\n   * another system, and only the admin knows which ones it has loaded.\n   */\n  canWrite?: (action: UserSystemWriteAction) => boolean | undefined\n}\n\nexport type UserSystemWriteAction = 'create' | 'update'\n\n/**\n * The erasure boundary for a heterogeneous array.\n *\n * Descriptors differ in `TUser` -- blog's `extraState` reaches for `status`, forum's for\n * `settings.banned` -- so an array of them cannot keep each one's type. Without a single place to\n * erase it, `strict: true` would demand a cast in every admin, at every call site. This does it\n * once, where the array is built.\n */\nexport type AnyUserSystemDescriptor = UserSystemDescriptor<string, AnzuUser>\n\nexport const defineUserSystemDescriptor = <TSystem extends string, TUser extends AnzuUser>(\n  descriptor: UserSystemDescriptor<TSystem, TUser>\n): AnyUserSystemDescriptor => descriptor as unknown as AnyUserSystemDescriptor\n\n/** False only when the descriptor says no. Not knowing is not a no. */\nexport const descriptorMayWrite = (descriptor: AnyUserSystemDescriptor, action: UserSystemWriteAction): boolean =>\n  descriptor.canWrite?.(action) !== false\n\n/**\n * The pair the probe reads through, with the one invariant the type cannot state: both branches of\n * `endpoints` are nullable, so nothing stops a descriptor naming `probe: 'base'` on a system that\n * has no `/adm/users`. Every admin's descriptor test asserts this resolves for each of its\n * systems.\n */\nexport const resolveProbeEndpoint = (descriptor: AnyUserSystemDescriptor): AnzuUserEndpointPair => {\n  const pair = descriptor.endpoints[descriptor.endpoints.probe]\n  if (pair === null) {\n    throw new Error(\n      `[userSystemDescriptor] '${descriptor.system}' names probe '${descriptor.endpoints.probe}', which it does not have.`\n    )\n  }\n  return pair\n}\n\n/**\n * Metadata is written through `PATCH /adm/users/{id}` wherever that path exists: the method behind\n * it can only write e-mail, locale, avatar and person -- it has no setter for roles, permissions,\n * groups or `enabled`. That is a stronger guarantee than being careful about what goes in the body.\n */\nexport const resolveMetadataWrite = (\n  descriptor: AnyUserSystemDescriptor\n): { method: 'PATCH'; get: string; url: string } | { method: 'PUT'; get: string; url: string } => {\n  const base = descriptor.endpoints.base\n  if (base !== null) return { method: 'PATCH', get: base.get, url: base.patch }\n  const anzuUser = descriptor.endpoints.anzuUser\n  if (anzuUser === null) {\n    throw new Error(`[userSystemDescriptor] '${descriptor.system}' has neither write path.`)\n  }\n  return { method: 'PUT', get: anzuUser.get, url: anzuUser.put }\n}\n\n/**\n * `enabled` has no `PATCH` anywhere: the only method that calls `setEnabled` is the full update.\n * So it goes GET + PUT, on the same path, with the whole DTO the GET returned.\n */\nexport const resolveEnabledWrite = (descriptor: AnyUserSystemDescriptor): { get: string; url: string } => {\n  const base = descriptor.endpoints.base\n  if (base !== null) return { get: base.get, url: base.put }\n  const anzuUser = descriptor.endpoints.anzuUser\n  if (anzuUser === null) {\n    throw new Error(`[userSystemDescriptor] '${descriptor.system}' has neither write path.`)\n  }\n  return { get: anzuUser.get, url: anzuUser.put }\n}\n\n/** Creating an account goes the same way a write does. */\nexport const resolveCreateEndpoint = (descriptor: AnyUserSystemDescriptor): string => {\n  const base = descriptor.endpoints.base\n  if (base !== null) return base.post\n  const anzuUser = descriptor.endpoints.anzuUser\n  if (anzuUser === null) {\n    throw new Error(`[userSystemDescriptor] '${descriptor.system}' has no create path.`)\n  }\n  return anzuUser.post\n}\n"],"mappings":";AA+HA,IAAaA,KACX,MAC4BC,GAGjBC,KAAsB,GAAqC,MACtED,EAAW,WAAWE,CAAM,MAAM,IAQvBC,KAAwB,MAA8D;CACjG,IAAMC,IAAOJ,EAAW,UAAUA,EAAW,UAAU;CACvD,IAAII,MAAS,MACX,MAAU,MACR,2BAA2BJ,EAAW,OAAO,iBAAiBA,EAAW,UAAU,MAAM,2BAC3F;CAEF,OAAOI;AACT,GAOaC,KACX,MACgG;CAChG,IAAMC,IAAON,EAAW,UAAU;CAClC,IAAIM,MAAS,MAAM,OAAO;EAAE,QAAQ;EAAS,KAAKA,EAAK;EAAK,KAAKA,EAAK;CAAM;CAC5E,IAAMC,IAAWP,EAAW,UAAU;CACtC,IAAIO,MAAa,MACf,MAAU,MAAM,2BAA2BP,EAAW,OAAO,0BAA0B;CAEzF,OAAO;EAAE,QAAQ;EAAO,KAAKO,EAAS;EAAK,KAAKA,EAAS;CAAI;AAC/D,GAMaC,KAAuB,MAAsE;CACxG,IAAMF,IAAON,EAAW,UAAU;CAClC,IAAIM,MAAS,MAAM,OAAO;EAAE,KAAKA,EAAK;EAAK,KAAKA,EAAK;CAAI;CACzD,IAAMC,IAAWP,EAAW,UAAU;CACtC,IAAIO,MAAa,MACf,MAAU,MAAM,2BAA2BP,EAAW,OAAO,0BAA0B;CAEzF,OAAO;EAAE,KAAKO,EAAS;EAAK,KAAKA,EAAS;CAAI;AAChD,GAGaE,KAAyB,MAAgD;CACpF,IAAMH,IAAON,EAAW,UAAU;CAClC,IAAIM,MAAS,MAAM,OAAOA,EAAK;CAC/B,IAAMC,IAAWP,EAAW,UAAU;CACtC,IAAIO,MAAa,MACf,MAAU,MAAM,2BAA2BP,EAAW,OAAO,sBAAsB;CAErF,OAAOO,EAAS;AAClB"}

package/dist/domains/anzuUser/composables/userSystemProbe.d.ts

@@ -0,0 +1,56 @@
+import { InjectionKey, Ref } from 'vue';
+import { USER_PROBE_ENTITY } from '../../api/utils/apiErrors';
+import { AnyUserSystemDescriptor } from './userSystemDescriptor';
+import { UserSystemAxes } from '../utils/userSystemState';
+import { AnzuUser } from '../../../shared/types/AnzuUser';
+import { IntegerId } from '../../../shared/types/common';
+/**
+ * How an app refreshes a session for one system, and retries.
+ *
+ * The probe cannot do this itself: a first 401 is ambiguous -- expired session or no account --
+ * and the only way to tell them apart is to refresh and ask again, with the session this admin
+ * refreshes (its `createRefreshSession`, shared with its refresh interceptor). Without this hook a
+ * panel would show an expired token as "no account here", which is exactly the confusion decision
+ * 16 forbids.
+ *
+ * Returns true when the refresh succeeded and the call is worth repeating.
+ */
+export type UserSystemRefreshHook = (system: string) => Promise<boolean>;
+export { USER_PROBE_ENTITY };
+export declare const UserSystemRefreshHookKey: InjectionKey<UserSystemRefreshHook>;
+/**
+ * The status the backend answered with, or null when nothing ever answered.
+ *
+ * Read off the axios failure the mapped error kept as its cause, not off the class. Going by class
+ * alone misses exactly the answers that exist *because* the backend replied with a body: a
+ * validation failure is `AnzuApiValidationError`, a dependency conflict is
+ * `AnzuApiDependencyExistsError`, and both are 422s that have to be reported as such. Reported as
+ * "the system did not answer" they would send the operator looking for an outage instead of at the
+ * account whose stored data no longer validates -- which, with legacy rows, is the failure that
+ * happens most.
+ */
+export declare const probeStatusFromError: (error: unknown) => number | null;
+export interface UserSystemProbeResult {
+    axes: Ref<UserSystemAxes>;
+    user: Ref<AnzuUser | null>;
+    probe: (id: IntegerId) => Promise<void>;
+    reset: () => void;
+    cancel: () => void;
+}
+export interface UserSystemProbeParams {
+    descriptor: AnyUserSystemDescriptor;
+    /** Usually injected once per page; passing it explicitly is for tests and one-off panels. */
+    refreshHook?: UserSystemRefreshHook | undefined;
+}
+/**
+ * One system's answer about one user.
+ *
+ * Reads through `endpoints[probe].get`, never a hard-coded path: in dam the choice is visible to
+ * the operator, because `/adm/v1/anzu-user/{id}` has no gating there while `/adm/users/{id}` sits
+ * behind `DAM_USER_READ` -- only the second can ever render "you have no access".
+ *
+ * Note for the app: a probe answering 404 is an expected result here, not a failure. The default
+ * api error logger skips it; a logger of the app's own still receives it and should filter on
+ * `status === 404 && entity === USER_PROBE_ENTITY`, or every absent account writes a line into the log.
+ */
+export declare const useUserSystemProbe: (params: UserSystemProbeParams) => UserSystemProbeResult;