@anzusystems/common-admin 1.49.0 → 2.0.0-rc.10

package/dist/domains/auth/composables/defineAuth.js

@@ -0,0 +1,121 @@
+import { useAuthStore as e } from "../store/authStore.js";
+import { isArray as t, isNull as n, isUndefined as r } from "../../../shared/utils/common.js";
+import { objectGetValueByPath as i } from "../../../shared/utils/object.js";
+import { warnOnceInDevelopment as a } from "../../../shared/utils/development.js";
+import { Grant as o } from "../valueObject/Grant.js";
+import { isOwnerAware as s } from "../../../shared/types/OwnerAware.js";
+import { isCreatedByAware as c } from "../../../shared/types/CreatedByAware.js";
+import { useApiRequest as l } from "../../api/composables/useApiRequest.js";
+import { computed as u } from "vue";
+import "axios";
+// src/domains/auth/composables/defineAuth.ts
+var d = "ROLE_SUPER_ADMIN", f = { adminRole: d };
+function p(i, a = {}) {
+	let o = {
+		...f,
+		...a
+	}, s = e(), { canHelper: c, canForAllHelper: d, canOwnerHelper: p, isAdminHelper: h, canSafeHelper: g } = m(), _ = (e, t) => h(e, t), v = (e, t) => c(e, t);
+	function y(e) {
+		return p(e, i);
+	}
+	let b = (e, t) => d(e, t), x = (e, t) => g(e, t), S = (e, t) => e.length === 0 || e.some((e) => v(e, t)), C = u(() => {
+		let e = s.getCurrentUserBySystem(i), t = s.isCurrentUserLoadedBySystem(i);
+		if (!r(t) && !(r(e) || r(e.id) || n(e.id) || e.id === 0)) return e.id;
+	});
+	function w(e) {
+		let n = (t) => {
+			s.currentUsers.value.set(e, t), s.currentUsersLoaded.value.set(e, !0);
+		}, i = u(() => s.currentUsers.value.get(e)), a = u(() => s.currentUsersLoaded.value.get(e)), c = u(() => i.value ? _(i.value.roles, e) : !1), d = u(() => i.value ?? !1), f = u(() => {
+			if (!r(a.value)) return !d.value;
+		}), p = () => {
+			if (t(o.adminRole)) {
+				let t = o.adminRole.find((t) => t.system === e);
+				t && s.isAdminRoleBySystem.value.set(e, t.adminRole);
+			} else s.isAdminRoleBySystem.value.set(e, o.adminRole);
+		};
+		return {
+			currentUser: i,
+			setCurrentUser: n,
+			isCurrentUserLoaded: a,
+			isSuperAdmin: c,
+			isAnonymous: f,
+			hasCurrentUser: d,
+			fetchCurrentUser: async (t, r = "/adm/v1/users/current", a = void 0, o = "user", c = {}) => {
+				try {
+					let { execute: c } = l({
+						client: t,
+						method: "GET",
+						system: e,
+						entity: o
+					}), u = await c({
+						urlTemplate: r,
+						urlParams: a
+					});
+					return n(u), s.currentUsersLoaded.value.set(e, !0), p(), i.value;
+				} catch (t) {
+					if (s.currentUsersLoaded.value.set(e, !0), c.throwOnError) throw t;
+					return;
+				}
+			}
+		};
+	}
+	return {
+		can: v,
+		canForAll: b,
+		canForSome: S,
+		canSafe: x,
+		canOwner: y,
+		useCurrentUser: w,
+		currentUserId: C,
+		config: o
+	};
+}
+function m() {
+	let l = e(), u = (e, t) => {
+		let a = h(e), s = l.getCurrentUserBySystem(a), c = l.isCurrentUserLoadedBySystem(a);
+		if (r(c)) throw Error("Composable defineAuth must try to load currentUser first to use can function.");
+		if (r(s) || r(s.id) || n(s.id) || s.id === 0) return !1;
+		if (f(s.roles, a)) return !0;
+		let u = i(s, "resolvedPermissions." + e);
+		if (r(u)) return !1;
+		switch (u) {
+			case o.Allow: return !0;
+			case o.Deny: return !1;
+			case o.AllowOwner:
+				if (r(t)) throw Error(`Required subject for acl "${e}" to determine an ability to access the resource.`);
+				return p(t, a);
+			default: return !1;
+		}
+	}, d = (e, t) => e.length === 0 || e.every((e) => u(e, t)), f = (t, n) => {
+		let i = e().getAdminRoleBySystem(n);
+		return !r(i) && t.includes(i);
+	};
+	function p(e, t) {
+		let i = l.getCurrentUserBySystem(t), a = l.isCurrentUserLoadedBySystem(t);
+		if (r(a)) throw Error("Composable defineAuth must try to load currentUser first to use canOwner function.");
+		return r(i) || r(i.id) || n(i.id) || i.id === 0 ? !1 : s(e) ? e.owners.includes(i.id) : c(e) ? e.createdBy === i.id : !1;
+	}
+	return {
+		canHelper: u,
+		canForAllHelper: d,
+		canOwnerHelper: p,
+		isAdminHelper: f,
+		canSafeHelper: (e, n, i = "canSafe") => {
+			let o = t(e) ? e : [e];
+			if (o.length === 0) return !0;
+			for (let e of o.map((e) => h(e))) if (l.currentUsers.value.get(e), r(l.isCurrentUserLoadedBySystem(e))) return !1;
+			try {
+				return d(o, n);
+			} catch (e) {
+				let t = o.join(", ");
+				return a(`${i}:${t}`, `[${i}] the check of ${t} threw, so it is denied:`, e), !1;
+			}
+		}
+	};
+}
+function h(e) {
+	return e.split("_")[0];
+}
+export { d as ROLE_SUPER_ADMIN, p as defineAuth, h as getSystemFromAcl, m as useAuthHelpers };
+
+//# sourceMappingURL=defineAuth.js.map

package/dist/domains/auth/composables/defineAuth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defineAuth.js","names":["ROLE_SUPER_ADMIN","defaultConfig","defineAuth","mergedConfig","config","authStore","useAuthStore","useAuthHelpers","isAdmin","isAdminHelper","userRoles","system","can","canHelper","acl","subject","canOwner","canOwnerHelper","mainCurrentUserSystem","canForAll","canForAllHelper","acls","canSafe","canSafeHelper","canForSome","currentUserId","computed","user","userIsLoaded","isUndefined","isNull","useCurrentUser","setCurrentUser","currentUser","isCurrentUserLoaded","isSuperAdmin","hasCurrentUser","isAnonymous","storeAdminRoleBySystem","isArray","found","role","useApiRequest","res","execute","endPoint","error","options","getSystemFromAcl","permission","objectGetValueByPath","Grant","adminRole","isOwnerAware","isCreatedByAware","value","key","warnOnceInDevelopment","label"],"sources":["../../../../src/domains/auth/composables/defineAuth.ts"],"sourcesContent":["import { computed } from 'vue'\nimport { useAuthStore } from '@/domains/auth/store/authStore'\nimport { type AxiosInstance } from 'axios'\nimport type { AclValue } from '@/domains/auth/types/Permission'\nimport { isArray, isNull, isUndefined } from '@/shared/utils/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { warnOnceInDevelopment } from '@/shared/utils/development'\nimport { Grant } from '@/domains/auth/valueObject/Grant'\nimport { isOwnerAware } from '@/shared/types/OwnerAware'\nimport { isCreatedByAware } from '@/shared/types/CreatedByAware'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\nimport type { UrlParams } from '@/domains/api/utils/apiHelper'\nimport { useApiRequest } from '@/domains/api/composables/useApiRequest'\n\nexport type DefineAuthConfig = {\n  adminRole: string | Array<{ system: string; adminRole: string }>\n}\n\nexport const ROLE_SUPER_ADMIN = 'ROLE_SUPER_ADMIN'\n\nconst defaultConfig: DefineAuthConfig = {\n  adminRole: ROLE_SUPER_ADMIN,\n}\n\n/**\n * @param mainCurrentUserSystem - By this system currentUser object is used to get user ID.\n * @param config\n */\nexport function defineAuth<TAclValue extends AclValue>(\n  mainCurrentUserSystem: string,\n  config: Partial<DefineAuthConfig> = {}\n) {\n  const mergedConfig = { ...defaultConfig, ...config }\n  const authStore = useAuthStore()\n  const { canHelper, canForAllHelper, canOwnerHelper, isAdminHelper, canSafeHelper } = useAuthHelpers()\n\n  const isAdmin = (userRoles: string[], system: string) => {\n    return isAdminHelper(userRoles, system)\n  }\n\n  const can = (acl: TAclValue, subject?: object) => {\n    return canHelper(acl, subject)\n  }\n\n  function canOwner(subject: object) {\n    return canOwnerHelper(subject, mainCurrentUserSystem)\n  }\n\n  const canForAll = (acls: TAclValue[], subject?: object) => {\n    return canForAllHelper(acls, subject)\n  }\n\n  /** `can()` and `canForAll()` that never throw -- for templates and route guards. See `canSafeHelper`. */\n  const canSafe = (acl: TAclValue | TAclValue[], subject?: object) => {\n    return canSafeHelper(acl, subject)\n  }\n\n  const canForSome = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.some((acl) => {\n      return can(acl, subject)\n    })\n  }\n\n  const currentUserId = computed(() => {\n    const user = authStore.getCurrentUserBySystem(mainCurrentUserSystem)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(mainCurrentUserSystem)\n    if (isUndefined(userIsLoaded)) {\n      return undefined\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return undefined\n    }\n    return user.id\n  })\n\n  function useCurrentUser<TCurrentUser extends AnzuUser | undefined>(system: string) {\n    const setCurrentUser = (user: TCurrentUser) => {\n      authStore.currentUsers.value.set(system, user)\n      authStore.currentUsersLoaded.value.set(system, true)\n    }\n\n    const currentUser = computed((): TCurrentUser | undefined => {\n      return authStore.currentUsers.value.get(system) as TCurrentUser | undefined\n    })\n\n    const isCurrentUserLoaded = computed((): boolean | undefined => {\n      return authStore.currentUsersLoaded.value.get(system) as boolean | undefined\n    })\n\n    const isSuperAdmin = computed(() => {\n      if (currentUser.value) {\n        return isAdmin(currentUser.value.roles, system)\n      }\n      return false\n    })\n\n    const hasCurrentUser = computed(() => {\n      return currentUser.value ?? false\n    })\n\n    const isAnonymous = computed(() => {\n      if (isUndefined(isCurrentUserLoaded.value)) return undefined\n      return !hasCurrentUser.value\n    })\n\n    const storeAdminRoleBySystem = () => {\n      if (isArray(mergedConfig.adminRole)) {\n        const found = mergedConfig.adminRole.find((role) => role.system === system)\n        if (found) {\n          authStore.isAdminRoleBySystem.value.set(system, found.adminRole)\n        }\n      } else {\n        authStore.isAdminRoleBySystem.value.set(system, mergedConfig.adminRole)\n      }\n    }\n\n    /**\n     * Returns `undefined` on any failure by default, which loses the reason.\n     * `throwOnError` rethrows the original error, so callers can tell a lost session from a dead backend.\n     * A failure leaves `currentUser` unchanged, so `can()` keeps using the previous user's permissions.\n     * The system still counts as loaded, so `can()` does not throw.\n     */\n    const fetchCurrentUser = async (\n      client: () => AxiosInstance,\n      endPoint = '/adm/v1/users/current',\n      urlParams: UrlParams | undefined = undefined,\n      entity = 'user',\n      options: { throwOnError?: boolean } = {}\n    ) => {\n      try {\n        // Uses `useApiRequest`, not `apiFetchOne`. `apiFetchOne` wraps failures in a bare `AnzuFatalError`.\n        // Callers with `throwOnError` need the real error (`AnzuApiAxiosError`\n        // or `AnzuApiTimeoutError`) to tell a dead session from a dead backend.\n        const { execute } = useApiRequest<NonNullable<TCurrentUser>>({\n          client,\n          method: 'GET',\n          system,\n          entity,\n        })\n        const res = await execute({ urlTemplate: endPoint, urlParams })\n        setCurrentUser(res)\n        authStore.currentUsersLoaded.value.set(system, true)\n        storeAdminRoleBySystem()\n        return currentUser.value\n      } catch (error) {\n        // Set before rethrowing too, or `can()` throws \"must try to load currentUser first\".\n        authStore.currentUsersLoaded.value.set(system, true)\n        if (options.throwOnError) throw error\n        return undefined\n      }\n    }\n\n    return {\n      currentUser,\n      setCurrentUser,\n      // `undefined` until something tries to load this system.\n      // `currentUser` alone cannot tell this apart from \"loaded, but no such user\".\n      isCurrentUserLoaded,\n      isSuperAdmin,\n      isAnonymous,\n      hasCurrentUser,\n      fetchCurrentUser,\n    }\n  }\n\n  return {\n    can,\n    canForAll,\n    canForSome,\n    canSafe,\n    canOwner,\n    useCurrentUser,\n    currentUserId,\n    config: mergedConfig,\n  }\n}\n\nexport function useAuthHelpers<TAclValue extends AclValue>() {\n  const authStore = useAuthStore()\n\n  const canHelper = (acl: TAclValue, subject: object | undefined) => {\n    const system = getSystemFromAcl(acl)\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use can function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isAdminHelper(user.roles, system)) return true\n    const permission = objectGetValueByPath(user, 'resolvedPermissions.' + acl)\n    if (isUndefined(permission)) return false\n    switch (permission) {\n      case Grant.Allow:\n        return true\n      case Grant.Deny:\n        return false\n      case Grant.AllowOwner:\n        if (isUndefined(subject))\n          throw new Error(`Required subject for acl \"${acl}\" to determine an ability to access the resource.`)\n        return canOwnerHelper(subject, system)\n      default:\n        return false\n    }\n  }\n\n  const canForAllHelper = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.every((acl) => {\n      return canHelper(acl, subject)\n    })\n  }\n\n  const isAdminHelper = (userRoles: string[], system: string) => {\n    const authStore = useAuthStore()\n    const adminRole = authStore.getAdminRoleBySystem(system)\n    if (isUndefined(adminRole)) return false\n\n    return userRoles.includes(adminRole)\n  }\n\n  function canOwnerHelper(subject: object, system: string) {\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use canOwner function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isOwnerAware(subject)) {\n      return subject.owners.includes(user.id)\n    }\n    if (isCreatedByAware(subject)) {\n      return subject.createdBy === user.id\n    }\n    return false\n  }\n\n  /**\n   * `canForAll` that returns false instead of throwing.\n   * Covers a system not loaded yet (templates and route guards may get there\n   * first) and checks that throw, such as an `allowOwner` grant with no subject.\n   * An array is evaluated with AND. Reading each system's current user\n   * makes a render or computed re-evaluate when that system loads.\n   */\n  const canSafeHelper = (acl: TAclValue | TAclValue[], subject?: object, label = 'canSafe'): boolean => {\n    const acls = isArray(acl) ? acl : [acl]\n    if (acls.length === 0) {\n      return true\n    }\n    for (const system of acls.map((value) => getSystemFromAcl(value))) {\n      authStore.currentUsers.value.get(system)\n      if (isUndefined(authStore.isCurrentUserLoadedBySystem(system))) {\n        return false\n      }\n    }\n    try {\n      return canForAllHelper(acls, subject)\n    } catch (error) {\n      // Denied either way. Without the warning it looks like a missing permission.\n      const key = acls.join(', ')\n      warnOnceInDevelopment(`${label}:${key}`, `[${label}] the check of ${key} threw, so it is denied:`, error)\n      return false\n    }\n  }\n\n  return {\n    canHelper,\n    canForAllHelper,\n    canOwnerHelper,\n    isAdminHelper,\n    canSafeHelper,\n  }\n}\n\n/** An ACL value carries its system in front of the first underscore: `weather_location_ui`. */\nexport function getSystemFromAcl(acl: any) {\n  const parts = acl.split('_')\n\n  return parts[0]\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaA,IAAmB,oBAE1BC,IAAkC,EACtC,WAAWD,EACb;AAMA,SAAgBE,EACd,GACA,IAAoC,CAAC,GACrC;CACA,IAAMC,IAAe;EAAE,GAAGF;EAAe,GAAGG;CAAO,GAC7CC,IAAYC,EAAa,GACzB,EAAE,cAAW,oBAAiB,mBAAgB,kBAAe,qBAAkBC,EAAe,GAE9FC,KAAW,GAAqB,MAC7BC,EAAcC,GAAWC,CAAM,GAGlCC,KAAO,GAAgB,MACpBC,EAAUC,GAAKC,CAAO;CAG/B,SAASC,EAAS,GAAiB;EACjC,OAAOC,EAAeF,GAASG,CAAqB;CACtD;CAEA,IAAMC,KAAa,GAAmB,MAC7BC,EAAgBC,GAAMN,CAAO,GAIhCO,KAAW,GAA8B,MACtCC,EAAcT,GAAKC,CAAO,GAG7BS,KAAc,GAAmB,MACjCH,EAAK,WAAW,KAGbA,EAAK,MAAM,MACTT,EAAIE,GAAKC,CAAO,CACxB,GAGGU,IAAgBC,QAAe;EACnC,IAAMC,IAAOtB,EAAU,uBAAuBa,CAAqB,GAC7DU,IAAevB,EAAU,4BAA4Ba,CAAqB;EAChF,IAAI,GAAYU,CAAY,KAGxB,IAAYD,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IAGhF,OAAOA,EAAK;CACd,CAAC;CAED,SAASI,EAA0D,GAAgB;EACjF,IAAMC,KAAkB,MAAuB;GAE7C,AADA3B,EAAU,aAAa,MAAM,IAAIM,GAAQgB,CAAI,GAC7CtB,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI;EACrD,GAEMsB,IAAcP,QACXrB,EAAU,aAAa,MAAM,IAAIM,CAAM,CAC/C,GAEKuB,IAAsBR,QACnBrB,EAAU,mBAAmB,MAAM,IAAIM,CAAM,CACrD,GAEKwB,IAAeT,QACfO,EAAY,QACPzB,EAAQyB,EAAY,MAAM,OAAOtB,CAAM,IAEzC,EACR,GAEKyB,IAAiBV,QACdO,EAAY,SAAS,EAC7B,GAEKI,IAAcX,QAAe;GACjC,IAAI,GAAYQ,EAAoB,KAAK,GACzC,OAAO,CAACE,EAAe;EACzB,CAAC,GAEKE,UAA+B;GACnC,IAAIC,EAAQpC,EAAa,SAAS,GAAG;IACnC,IAAMqC,IAAQrC,EAAa,UAAU,MAAM,MAASsC,EAAK,WAAW9B,CAAM;IAC1E,AAAI6B,KACFnC,EAAU,oBAAoB,MAAM,IAAIM,GAAQ6B,EAAM,SAAS;GAEnE,OACE,EAAU,oBAAoB,MAAM,IAAI7B,GAAQR,EAAa,SAAS;EAE1E;EAsCA,OAAO;GACL;GACA;GAGA;GACA;GACA;GACA;GACA,yBAtCA,GACA,IAAW,yBACX,IAAmC,KAAA,GACnC,IAAS,QACT,IAAsC,CAAC,MACpC;IACH,IAAI;KAIF,IAAM,EAAE,eAAYuC,EAAyC;MAC3D;MACA,QAAQ;MACR;MACA;KACF,CAAC,GACKC,IAAM,MAAMC,EAAQ;MAAE,aAAaC;MAAU;KAAU,CAAC;KAI9D,OAHAb,EAAeW,CAAG,GAClBtC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GACnD2B,EAAuB,GAChBL,EAAY;IACrB,SAASa,GAAO;KAGd,IADAzC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GAC/CoC,EAAQ,cAAc,MAAMD;KAChC;IACF;GACF;EAYA;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ3C;CACV;AACF;AAEA,SAAgBI,IAA6C;CAC3D,IAAMF,IAAYC,EAAa,GAEzBO,KAAa,GAAgB,MAAgC;EACjE,IAAMF,IAASqC,EAAiBlC,CAAG,GAC7Ba,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,+EAA+E;EAEjG,IAAIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,GAC9E,OAAO;EAET,IAAIlB,EAAckB,EAAK,OAAOhB,CAAM,GAAG,OAAO;EAC9C,IAAMsC,IAAaC,EAAqBvB,GAAM,yBAAyBb,CAAG;EAC1E,IAAIe,EAAYoB,CAAU,GAAG,OAAO;EACpC,QAAQA,GAAR;GACE,KAAKE,EAAM,OACT,OAAO;GACT,KAAKA,EAAM,MACT,OAAO;GACT,KAAKA,EAAM;IACT,IAAItB,EAAYd,CAAO,GACrB,MAAU,MAAM,6BAA6BD,EAAI,kDAAkD;IACrG,OAAOG,EAAeF,GAASJ,CAAM;GACvC,SACE,OAAO;EACX;CACF,GAEMS,KAAmB,GAAmB,MACtCC,EAAK,WAAW,KAGbA,EAAK,OAAO,MACVR,EAAUC,GAAKC,CAAO,CAC9B,GAGGN,KAAiB,GAAqB,MAAmB;EAE7D,IAAM2C,IADY9C,EACA,CAAA,CAAU,qBAAqBK,CAAM;EAGvD,OAFA,CAAIkB,EAAYuB,CAAS,KAElB1C,EAAU,SAAS0C,CAAS;CACrC;CAEA,SAASnC,EAAe,GAAiB,GAAgB;EACvD,IAAMU,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,oFAAoF;EAWtG,OATIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IACvE,KAEL0B,EAAatC,CAAO,IACfA,EAAQ,OAAO,SAASY,EAAK,EAAE,IAEpC2B,EAAiBvC,CAAO,IACnBA,EAAQ,cAAcY,EAAK,KAE7B;CACT;CA8BA,OAAO;EACL;EACA;EACA;EACA;EACA,gBA1BqB,GAA8B,GAAkB,IAAQ,cAAuB;GACpG,IAAMN,IAAOkB,EAAQzB,CAAG,IAAIA,IAAM,CAACA,CAAG;GACtC,IAAIO,EAAK,WAAW,GAClB,OAAO;GAET,KAAK,IAAMV,KAAUU,EAAK,KAAK,MAAU2B,EAAiBO,CAAK,CAAC,GAE9D,IADAlD,EAAU,aAAa,MAAM,IAAIM,CAAM,GACnCkB,EAAYxB,EAAU,4BAA4BM,CAAM,CAAC,GAC3D,OAAO;GAGX,IAAI;IACF,OAAOS,EAAgBC,GAAMN,CAAO;GACtC,SAAS+B,GAAO;IAEd,IAAMU,IAAMnC,EAAK,KAAK,IAAI;IAE1B,OADAoC,EAAsB,GAAGC,EAAM,GAAGF,KAAO,IAAIE,EAAM,iBAAiBF,EAAI,2BAA2BV,CAAK,GACjG;GACT;EACF;CAQA;AACF;AAGA,SAAgBE,EAAiB,GAAU;CAGzC,OAFclC,EAAI,MAAM,GAEjB,CAAA,CAAM;AACf"}

package/dist/domains/auth/composables/refreshSession.d.ts

@@ -0,0 +1,46 @@
+import { InternalAxiosRequestConfig } from 'axios';
+export type RefreshResult = {
+    type: 'refreshed';
+} | {
+    type: 'session-expired';
+} | {
+    type: 'auth-unavailable';
+    error: unknown;
+};
+export interface AuthCookieState {
+    refreshTokenExists: unknown;
+    jwtPayload: string | null | undefined;
+}
+/**
+ * Single-flight session refresh. A running refresh is joined,
+ * otherwise a new one starts. A finished result is never reused.
+ * Only a 401 means the session is gone.
+ * A 400 (`unable_to_refresh`) can also mean another tab rotated the token first, because
+ * backend rotation is not atomic. A changed JWT cookie shows this, up to a second later.
+ * Any other error means the auth backend is unavailable and never causes a logout.
+ */
+export declare function createRefreshSession(options: {
+    /** Calls the refresh endpoint; rejects with whatever the api helper throws. */
+    refresh: () => Promise<unknown>;
+    /** The JWT payload cookie as it is now. */
+    jwtPayload: () => string | null | undefined;
+}): () => Promise<RefreshResult>;
+/**
+ * Request interceptor that refreshes an expired JWT before a request goes out. Its `runWhen` skips the auth endpoints.
+ * Concurrent requests share one refresh (`refreshSession`). A request is rejected with
+ * `SessionExpiredError` (after `logout`) or `AuthUnavailableError` (the user stays logged in).
+ */
+export declare function createRefreshRequestInterceptor(options: {
+    cookies: () => AuthCookieState;
+    refreshSession: () => Promise<RefreshResult>;
+    logout: () => void;
+    /** Requests to these urls (the auth endpoints) are never held for a refresh. */
+    skipUrlPrefix: string;
+    /** Also refresh a JWT that exists but is expired. By default only a missing JWT is refreshed. */
+    jwtExpired?: () => boolean;
+}): {
+    interceptor: (requestConfig: InternalAxiosRequestConfig) => Promise<InternalAxiosRequestConfig>;
+    options: {
+        runWhen: (config: import('axios').AxiosRequestConfig) => boolean;
+    };
+};

package/dist/domains/auth/composables/refreshSession.js

@@ -0,0 +1,55 @@
+import { isDefined as e, isNull as t } from "../../../shared/utils/common.js";
+import { skipUrlPrefixes as n } from "../../api/composables/defineApiClient.js";
+import { AuthUnavailableError as r } from "../../../shared/error/AuthUnavailableError.js";
+import { isInCauseChain as i } from "../../../shared/error/isInCauseChain.js";
+import { SessionExpiredError as a } from "../../../shared/error/SessionExpiredError.js";
+import o from "axios";
+// src/domains/auth/composables/refreshSession.ts
+var s = 400, c = 401, l = 1e3, u = 100, d = (t) => {
+	let n;
+	return i(t, (t) => !o.isAxiosError(t) || !e(t.response) ? !1 : (n = t.response.status, !0)), n;
+};
+function f(n) {
+	let r = null, i = async (r) => {
+		for (let i = 0;; i += u) {
+			let a = n.jwtPayload();
+			if (e(a) && !t(a) && a !== r) return !0;
+			if (i >= l) return !1;
+			await new Promise((e) => setTimeout(e, u));
+		}
+	}, a = async () => {
+		let e = n.jwtPayload();
+		try {
+			return await n.refresh(), { type: "refreshed" };
+		} catch (t) {
+			let n = d(t);
+			return n === c ? { type: "session-expired" } : n === s ? await i(e) ? { type: "refreshed" } : { type: "session-expired" } : {
+				type: "auth-unavailable",
+				error: t
+			};
+		}
+	};
+	return () => (t(r) && (r = a().finally(() => {
+		r = null;
+	})), r);
+}
+function p(e) {
+	let t = /* @__PURE__ */ new WeakSet();
+	return {
+		interceptor: async (n) => {
+			let { refreshTokenExists: i, jwtPayload: s } = e.cookies();
+			if (!i && !s) throw e.logout(), new a();
+			if (i && (!s || e.jwtExpired?.())) {
+				let i = await e.refreshSession();
+				if (i.type === "session-expired") throw t.has(i) || (t.add(i), e.logout()), new a();
+				if (n.signal?.aborted) throw new o.CanceledError();
+				if (i.type === "auth-unavailable") throw new r(i.error);
+			}
+			return n;
+		},
+		options: { runWhen: n(e.skipUrlPrefix) }
+	};
+}
+export { p as createRefreshRequestInterceptor, f as createRefreshSession };
+
+//# sourceMappingURL=refreshSession.js.map

package/dist/domains/auth/composables/refreshSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refreshSession.js","names":["axios","HTTP_BAD_REQUEST","HTTP_UNAUTHORIZED","ROTATION_GRACE_MS","ROTATION_POLL_MS","httpStatusInCauseChain","status","isInCauseChain","error","value","isDefined","createRefreshSession","inFlight","rotatedMeanwhile","waited","now","options","isNull","before","resolve","run","jwtPayloadBefore","createRefreshRequestInterceptor","loggedOut","refreshTokenExists","jwtPayload","SessionExpiredError","result","requestConfig","AuthUnavailableError","skipUrlPrefixes"],"sources":["../../../../src/domains/auth/composables/refreshSession.ts"],"sourcesContent":["import axios, { type InternalAxiosRequestConfig } from 'axios'\nimport { isDefined, isNull } from '@/shared/utils/common'\nimport { skipUrlPrefixes } from '@/domains/api/composables/defineApiClient'\nimport { AuthUnavailableError } from '@/shared/error/AuthUnavailableError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\n\nconst HTTP_BAD_REQUEST = 400\nconst HTTP_UNAUTHORIZED = 401\n// How long a 400 waits for the cookie from the tab whose refresh won. That tab's response can arrive after this one.\nconst ROTATION_GRACE_MS = 1000\nconst ROTATION_POLL_MS = 100\n\nexport type RefreshResult =\n  | { type: 'refreshed' }\n  | { type: 'session-expired' }\n  | { type: 'auth-unavailable'; error: unknown }\n\nexport interface AuthCookieState {\n  refreshTokenExists: unknown\n  jwtPayload: string | null | undefined\n}\n\n// `undefined` means no response in the chain: a timeout or a network failure.\nconst httpStatusInCauseChain = (error: unknown): number | undefined => {\n  let status: number | undefined\n  isInCauseChain(error, (value) => {\n    if (!axios.isAxiosError(value) || !isDefined(value.response)) return false\n    status = value.response.status\n    return true\n  })\n  return status\n}\n\n/**\n * Single-flight session refresh. A running refresh is joined,\n * otherwise a new one starts. A finished result is never reused.\n * Only a 401 means the session is gone.\n * A 400 (`unable_to_refresh`) can also mean another tab rotated the token first, because\n * backend rotation is not atomic. A changed JWT cookie shows this, up to a second later.\n * Any other error means the auth backend is unavailable and never causes a logout.\n */\nexport function createRefreshSession(options: {\n  /** Calls the refresh endpoint; rejects with whatever the api helper throws. */\n  refresh: () => Promise<unknown>\n  /** The JWT payload cookie as it is now. */\n  jwtPayload: () => string | null | undefined\n}): () => Promise<RefreshResult> {\n  let inFlight: Promise<RefreshResult> | null = null\n\n  const rotatedMeanwhile = async (before: string | null | undefined): Promise<boolean> => {\n    for (let waited = 0; ; waited += ROTATION_POLL_MS) {\n      const now = options.jwtPayload()\n      if (isDefined(now) && !isNull(now) && now !== before) return true\n      if (waited >= ROTATION_GRACE_MS) return false\n      await new Promise((resolve) => setTimeout(resolve, ROTATION_POLL_MS))\n    }\n  }\n\n  const run = async (): Promise<RefreshResult> => {\n    // Read before the request. During an in-flight refresh the\n    // cookie already exists, so only a changed value is meaningful.\n    const jwtPayloadBefore = options.jwtPayload()\n    try {\n      await options.refresh()\n      return { type: 'refreshed' }\n    } catch (error) {\n      const status = httpStatusInCauseChain(error)\n      if (status === HTTP_UNAUTHORIZED) return { type: 'session-expired' }\n      if (status === HTTP_BAD_REQUEST) {\n        return (await rotatedMeanwhile(jwtPayloadBefore)) ? { type: 'refreshed' } : { type: 'session-expired' }\n      }\n      return { type: 'auth-unavailable', error }\n    }\n  }\n\n  return () => {\n    if (isNull(inFlight)) {\n      inFlight = run().finally(() => {\n        inFlight = null\n      })\n    }\n    return inFlight\n  }\n}\n\n/**\n * Request interceptor that refreshes an expired JWT before a request goes out. Its `runWhen` skips the auth endpoints.\n * Concurrent requests share one refresh (`refreshSession`). A request is rejected with\n * `SessionExpiredError` (after `logout`) or `AuthUnavailableError` (the user stays logged in).\n */\nexport function createRefreshRequestInterceptor(options: {\n  cookies: () => AuthCookieState\n  refreshSession: () => Promise<RefreshResult>\n  logout: () => void\n  /** Requests to these urls (the auth endpoints) are never held for a refresh. */\n  skipUrlPrefix: string\n  /** Also refresh a JWT that exists but is expired. By default only a missing JWT is refreshed. */\n  jwtExpired?: () => boolean\n}) {\n  // Requests waiting on one refresh share its result. Log out once per refresh, not once per request.\n  const loggedOut = new WeakSet<RefreshResult>()\n\n  const interceptor = async (requestConfig: InternalAxiosRequestConfig): Promise<InternalAxiosRequestConfig> => {\n    const { refreshTokenExists, jwtPayload } = options.cookies()\n    if (!refreshTokenExists && !jwtPayload) {\n      options.logout()\n      throw new SessionExpiredError()\n    }\n    if (refreshTokenExists && (!jwtPayload || options.jwtExpired?.())) {\n      const result = await options.refreshSession()\n      if (result.type === 'session-expired') {\n        if (!loggedOut.has(result)) {\n          loggedOut.add(result)\n          options.logout()\n        }\n        throw new SessionExpiredError()\n      }\n      // Aborted while waiting (its page is gone): treat as cancelled, not as a failure to show on the new page.\n      // Axios checks the signal only after the interceptors finish.\n      if (requestConfig.signal?.aborted) throw new axios.CanceledError()\n      if (result.type === 'auth-unavailable') throw new AuthUnavailableError(result.error)\n    }\n    return requestConfig\n  }\n\n  return {\n    interceptor,\n    options: { runWhen: skipUrlPrefixes(options.skipUrlPrefix) },\n  }\n}\n"],"mappings":";;;;;;;AAOA,IAAMC,IAAmB,KACnBC,IAAoB,KAEpBC,IAAoB,KACpBC,IAAmB,KAanBC,KAA0B,MAAuC;CACrE,IAAIC;CAMJ,OALAC,EAAeC,IAAQ,MACjB,CAACR,EAAM,aAAaS,CAAK,KAAK,CAACC,EAAUD,EAAM,QAAQ,IAAU,MACrE,IAASA,EAAM,SAAS,QACjB,GACR,GACMH;AACT;AAUA,SAAgBK,EAAqB,GAKJ;CAC/B,IAAIC,IAA0C,MAExCC,IAAmB,OAAO,MAAwD;EACtF,KAAK,IAAIC,IAAS,IAAK,KAAUV,GAAkB;GACjD,IAAMW,IAAMC,EAAQ,WAAW;GAC/B,IAAIN,EAAUK,CAAG,KAAK,CAACE,EAAOF,CAAG,KAAKA,MAAQG,GAAQ,OAAO;GAC7D,IAAIJ,KAAUX,GAAmB,OAAO;GACxC,MAAM,IAAI,SAAS,MAAY,WAAWgB,GAASf,CAAgB,CAAC;EACtE;CACF,GAEMgB,IAAM,YAAoC;EAG9C,IAAMC,IAAmBL,EAAQ,WAAW;EAC5C,IAAI;GAEF,OADA,MAAMA,EAAQ,QAAQ,GACf,EAAE,MAAM,YAAY;EAC7B,SAASR,GAAO;GACd,IAAMF,IAASD,EAAuBG,CAAK;GAK3C,OAJIF,MAAWJ,IAA0B,EAAE,MAAM,kBAAkB,IAC/DI,MAAWL,IACL,MAAMY,EAAiBQ,CAAgB,IAAK,EAAE,MAAM,YAAY,IAAI,EAAE,MAAM,kBAAkB,IAEjG;IAAE,MAAM;IAAoB;GAAM;EAC3C;CACF;CAEA,cACMJ,EAAOL,CAAQ,MACjB,IAAWQ,EAAI,CAAC,CAAC,cAAc;EAC7B,IAAW;CACb,CAAC,IAEIR;AAEX;AAOA,SAAgBU,EAAgC,GAQ7C;CAED,IAAMC,oBAAY,IAAI,QAAuB;CAyB7C,OAAO;EACL,oBAxByB,MAAmF;GAC5G,IAAM,EAAE,uBAAoB,kBAAeP,EAAQ,QAAQ;GAC3D,IAAI,CAACQ,KAAsB,CAACC,GAE1B,MADAT,EAAQ,OAAO,GACT,IAAIU,EAAoB;GAEhC,IAAIF,MAAuB,CAACC,KAAcT,EAAQ,aAAa,IAAI;IACjE,IAAMW,IAAS,MAAMX,EAAQ,eAAe;IAC5C,IAAIW,EAAO,SAAS,mBAKlB,MAJKJ,EAAU,IAAII,CAAM,MACvBJ,EAAU,IAAII,CAAM,GACpBX,EAAQ,OAAO,IAEX,IAAIU,EAAoB;IAIhC,IAAIE,EAAc,QAAQ,SAAS,MAAM,IAAI5B,EAAM,cAAc;IACjE,IAAI2B,EAAO,SAAS,oBAAoB,MAAM,IAAIE,EAAqBF,EAAO,KAAK;GACrF;GACA,OAAOC;EACT;EAIE,SAAS,EAAE,SAASE,EAAgBd,EAAQ,aAAa,EAAE;CAC7D;AACF"}

package/dist/domains/auth/store/authStore.d.ts

@@ -0,0 +1,82 @@
+import { AnzuUser } from '../../../shared/types/AnzuUser';
+export declare const useAuthStore: () => {
+    currentUsers: import('vue').Ref<Map<string, {
+        enabled: boolean;
+        locale: import('../../../lib').LanguageCode | null;
+        roles: string[];
+        permissionGroups: import('../../../lib').IntegerId[];
+        permissions: import('../types/Permission').Permissions;
+        resolvedPermissions: import('../types/Permission').Permissions;
+        _resourceName: string;
+        _system: string;
+        createdAt: import('../../../lib').DatetimeUTC;
+        modifiedAt: import('../../../lib').DatetimeUTC;
+        modifiedBy: import('../../../lib').IntegerIdNullable;
+        createdBy: import('../../../lib').IntegerIdNullable;
+        id?: import('../../../lib').IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    } | undefined> & Omit<Map<string, AnzuUser | undefined>, keyof Map<any, any>>, Map<string, AnzuUser | undefined> | (Map<string, {
+        enabled: boolean;
+        locale: import('../../../lib').LanguageCode | null;
+        roles: string[];
+        permissionGroups: import('../../../lib').IntegerId[];
+        permissions: import('../types/Permission').Permissions;
+        resolvedPermissions: import('../types/Permission').Permissions;
+        _resourceName: string;
+        _system: string;
+        createdAt: import('../../../lib').DatetimeUTC;
+        modifiedAt: import('../../../lib').DatetimeUTC;
+        modifiedBy: import('../../../lib').IntegerIdNullable;
+        createdBy: import('../../../lib').IntegerIdNullable;
+        id?: import('../../../lib').IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    } | undefined> & Omit<Map<string, AnzuUser | undefined>, keyof Map<any, any>>)>;
+    currentUsersLoaded: import('vue').Ref<Map<string, true | undefined> & Omit<Map<string, true | undefined>, keyof Map<any, any>>, Map<string, true | undefined> | (Map<string, true | undefined> & Omit<Map<string, true | undefined>, keyof Map<any, any>>)>;
+    isAdminRoleBySystem: import('vue').Ref<Map<string, string> & Omit<Map<string, string>, keyof Map<any, any>>, Map<string, string> | (Map<string, string> & Omit<Map<string, string>, keyof Map<any, any>>)>;
+    getCurrentUserBySystem: (system: string) => {
+        enabled: boolean;
+        locale: import('../../../lib').LanguageCode | null;
+        roles: string[];
+        permissionGroups: import('../../../lib').IntegerId[];
+        permissions: import('../types/Permission').Permissions;
+        resolvedPermissions: import('../types/Permission').Permissions;
+        _resourceName: string;
+        _system: string;
+        createdAt: import('../../../lib').DatetimeUTC;
+        modifiedAt: import('../../../lib').DatetimeUTC;
+        modifiedBy: import('../../../lib').IntegerIdNullable;
+        createdBy: import('../../../lib').IntegerIdNullable;
+        id?: import('../../../lib').IntegerIdNullable | undefined;
+        email: string;
+        person: {
+            firstName: string;
+            lastName: string;
+            fullName: string;
+        };
+        avatar: {
+            color: string;
+            text: string;
+        };
+    } | undefined;
+    getAdminRoleBySystem: (system: string) => string | undefined;
+    isCurrentUserLoadedBySystem: (system: string) => true | undefined;
+    reset: () => void;
+};

package/dist/domains/auth/store/authStore.js

@@ -0,0 +1,28 @@
+import { ref as e } from "vue";
+// src/domains/auth/store/authStore.ts
+var t = e(/* @__PURE__ */ new Map()), n = e(/* @__PURE__ */ new Map()), r = e(/* @__PURE__ */ new Map()), i = () => {
+	function e(e) {
+		return t.value.get(e);
+	}
+	function i(e) {
+		return n.value.get(e);
+	}
+	function a(e) {
+		return r.value.get(e);
+	}
+	function o() {
+		t.value.clear(), n.value.clear(), r.value.clear();
+	}
+	return {
+		currentUsers: t,
+		currentUsersLoaded: n,
+		isAdminRoleBySystem: r,
+		getCurrentUserBySystem: e,
+		getAdminRoleBySystem: a,
+		isCurrentUserLoadedBySystem: i,
+		reset: o
+	};
+};
+export { i as useAuthStore };
+
+//# sourceMappingURL=authStore.js.map

package/dist/domains/auth/store/authStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStore.js","names":["currentUsers","ref","currentUsersLoaded","isAdminRoleBySystem","useAuthStore","getCurrentUserBySystem","system","isCurrentUserLoadedBySystem","getAdminRoleBySystem","reset"],"sources":["../../../../src/domains/auth/store/authStore.ts"],"sourcesContent":["import { ref } from 'vue'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\n\nconst currentUsers = ref<Map<string, AnzuUser | undefined>>(new Map())\nconst currentUsersLoaded = ref<Map<string, undefined | true>>(new Map())\nconst isAdminRoleBySystem = ref<Map<string, string>>(new Map())\n\nexport const useAuthStore = () => {\n  function getCurrentUserBySystem(system: string) {\n    return currentUsers.value.get(system)\n  }\n\n  function isCurrentUserLoadedBySystem(system: string) {\n    return currentUsersLoaded.value.get(system)\n  }\n\n  function getAdminRoleBySystem(system: string) {\n    return isAdminRoleBySystem.value.get(system)\n  }\n\n  function reset() {\n    currentUsers.value.clear()\n    currentUsersLoaded.value.clear()\n    isAdminRoleBySystem.value.clear()\n  }\n\n  return {\n    currentUsers,\n    currentUsersLoaded,\n    isAdminRoleBySystem,\n    getCurrentUserBySystem,\n    getAdminRoleBySystem,\n    isCurrentUserLoadedBySystem,\n    reset,\n  }\n}\n"],"mappings":";;AAGA,IAAMA,IAAeC,kBAAuC,IAAI,IAAI,CAAC,GAC/DC,IAAqBD,kBAAmC,IAAI,IAAI,CAAC,GACjEE,IAAsBF,kBAAyB,IAAI,IAAI,CAAC,GAEjDG,UAAqB;CAChC,SAASC,EAAuB,GAAgB;EAC9C,OAAOL,EAAa,MAAM,IAAIM,CAAM;CACtC;CAEA,SAASC,EAA4B,GAAgB;EACnD,OAAOL,EAAmB,MAAM,IAAII,CAAM;CAC5C;CAEA,SAASE,EAAqB,GAAgB;EAC5C,OAAOL,EAAoB,MAAM,IAAIG,CAAM;CAC7C;CAEA,SAASG,IAAQ;EAGf,AAFAT,EAAa,MAAM,MAAM,GACzBE,EAAmB,MAAM,MAAM,GAC/BC,EAAoB,MAAM,MAAM;CAClC;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;CACF;AACF"}

package/dist/domains/auth/types/Permission.d.ts

@@ -0,0 +1,19 @@
+import { GrantType } from '../valueObject/Grant';
+export type AclValue = `${string}_${string}_${string}`;
+/**
+ * Where an admin registers its ACL values, once:
+ * `declare module '@anzusystems/common-admin' { interface AclRegistry { acl: AclValue } }`.
+ * `<Acl :permission>` then accepts only those.
+ */
+export interface AclRegistry {
+}
+/** The ACL values of a registry: its `acl` union, or any `system_subject_action` when there is none. */
+export type AclValueOf<TRegistry> = TRegistry extends {
+    acl: infer TAcl extends string;
+} ? TAcl : AclValue;
+/** What `<Acl :permission>` accepts: the admin's registered ACL values. */
+export type RegisteredAclValue = AclValueOf<AclRegistry>;
+/** An admin with typed ACL values passes their union; the default accepts any `system_subject_action`. */
+export type Permissions<TAcl extends string = AclValue> = {
+    [key in TAcl]?: GrantType;
+};

package/dist/domains/auth/valueObject/Grant.d.ts

@@ -0,0 +1,23 @@
+import { ValueObjectOption } from '../../../shared/types/ValueObject';
+export declare const Grant: {
+    readonly Deny: 0;
+    readonly AllowOwner: 1;
+    readonly Allow: 2;
+};
+export type GrantType = (typeof Grant)[keyof typeof Grant];
+export declare function useGrant(): {
+    grantOptions: import('vue').Ref<{
+        value: GrantType;
+        title: string;
+        color?: string | undefined;
+        active?: false | undefined;
+        subtitle?: string | undefined;
+    }[], ValueObjectOption<GrantType>[] | {
+        value: GrantType;
+        title: string;
+        color?: string | undefined;
+        active?: false | undefined;
+        subtitle?: string | undefined;
+    }[]>;
+    getGrantOption: (value: GrantType) => ValueObjectOption<GrantType>;
+};

package/dist/domains/auth/valueObject/Grant.js

@@ -0,0 +1,34 @@
+import { ref as e } from "vue";
+import { useI18n as t } from "vue-i18n";
+// src/domains/auth/valueObject/Grant.ts
+var n = {
+	Deny: 0,
+	AllowOwner: 1,
+	Allow: 2
+};
+function r() {
+	let { t: r } = t(), i = e([
+		{
+			value: n.Deny,
+			title: r("common.permission.grant.deny"),
+			color: "error"
+		},
+		{
+			value: n.AllowOwner,
+			title: r("common.permission.grant.allowOwner"),
+			color: "warning"
+		},
+		{
+			value: n.Allow,
+			title: r("common.permission.grant.allow"),
+			color: "success"
+		}
+	]);
+	return {
+		grantOptions: i,
+		getGrantOption: (e) => i.value.find((t) => t.value === e)
+	};
+}
+export { n as Grant, r as useGrant };
+
+//# sourceMappingURL=Grant.js.map

package/dist/domains/auth/valueObject/Grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Grant.js","names":["Grant","useGrant","useI18n","grantOptions","ref","t","item","value"],"sources":["../../../../src/domains/auth/valueObject/Grant.ts"],"sourcesContent":["import { ref } from 'vue'\nimport type { ValueObjectOption } from '@/shared/types/ValueObject'\nimport { useI18n } from 'vue-i18n'\n\nexport const Grant = {\n  Deny: 0,\n  AllowOwner: 1,\n  Allow: 2,\n} as const\nexport type GrantType = (typeof Grant)[keyof typeof Grant]\n\nexport function useGrant() {\n  const { t } = useI18n()\n\n  const grantOptions = ref<ValueObjectOption<GrantType>[]>([\n    {\n      value: Grant.Deny,\n      title: t('common.permission.grant.deny'),\n      color: 'error',\n    },\n    {\n      value: Grant.AllowOwner,\n      title: t('common.permission.grant.allowOwner'),\n      color: 'warning',\n    },\n    {\n      value: Grant.Allow,\n      title: t('common.permission.grant.allow'),\n      color: 'success',\n    },\n  ])\n\n  const getGrantOption = (value: GrantType): ValueObjectOption<GrantType> => {\n    return grantOptions.value.find((item) => item.value === value) as ValueObjectOption<GrantType>\n  }\n\n  return {\n    grantOptions,\n    getGrantOption,\n  }\n}\n"],"mappings":";;;AAIA,IAAaA,IAAQ;CACnB,MAAM;CACN,YAAY;CACZ,OAAO;AACT;AAGA,SAAgBC,IAAW;CACzB,IAAM,EAAE,SAAMC,EAAQ,GAEhBC,IAAeC,EAAoC;EACvD;GACE,OAAOJ,EAAM;GACb,OAAOK,EAAE,8BAA8B;GACvC,OAAO;EACT;EACA;GACE,OAAOL,EAAM;GACb,OAAOK,EAAE,oCAAoC;GAC7C,OAAO;EACT;EACA;GACE,OAAOL,EAAM;GACb,OAAOK,EAAE,+BAA+B;GACxC,OAAO;EACT;CACF,CAAC;CAMD,OAAO;EACL;EACA,iBANsB,MACfF,EAAa,MAAM,MAAM,MAASG,EAAK,UAAUC,CAAK;CAM/D;AACF"}

package/dist/domains/cached/components/ACachedChip.js

@@ -0,0 +1,7 @@
+import e from "./ACachedChip.vue_vue_type_script_setup_true_lang.js";
+/* empty css                                            */
+// src/domains/cached/components/ACachedChip.vue
+var t = e;
+export { t as default };
+
+//# sourceMappingURL=ACachedChip.js.map

package/dist/domains/cached/components/ACachedChip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ACachedChip.js","names":["_sfc_main","ACachedChip_vue_vue_type_script_setup_true_lang_default","ACachedChip_default"],"sources":["../../../../src/domains/cached/components/ACachedChip.vue"],"sourcesContent":["<script lang=\"ts\" setup>\nimport { computed } from 'vue'\nimport { useI18n } from 'vue-i18n'\nimport { useRouter } from 'vue-router'\nimport type { DocId, IntegerId } from '@/shared/types/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { isNull, isUndefined } from '@/shared/utils/common'\nimport { COMMON_CONFIG } from '@/shared/commonConfig'\nimport { useCachedItem } from '@/domains/cached/composables/useCachedItem'\n\nconst props = withDefaults(\n  defineProps<{\n    id?: null | undefined | IntegerId | DocId\n    title?: string\n    containerClass?: undefined | string\n    getCachedFn: (id: any) => any\n    displayTextPath: string\n    route: string\n    disableClick?: boolean\n    openInNew?: boolean\n    size?: string\n    forceRounded?: boolean\n    textOnly?: boolean\n    fallbackIdText?: boolean\n    wrapText?: boolean\n    closable?: boolean\n    customTitleFn?: (\n      cachedItem: any,\n      defaultTitle: string,\n      displayTextPath: string,\n      fallbackIdText: boolean\n    ) => string | undefined\n  }>(),\n  {\n    id: null,\n    title: '',\n    containerClass: 'd-inline-flex',\n    disableClick: false,\n    openInNew: false,\n    size: 'small',\n    forceRounded: false,\n    textOnly: false,\n    fallbackIdText: false,\n    wrapText: false,\n    closable: false,\n    customTitleFn: undefined,\n  }\n)\n\nconst emit = defineEmits<{\n  (e: 'close', id: null | undefined | IntegerId | DocId): void\n}>()\n\nconst { t } = useI18n()\nconst router = useRouter()\nconst { cached, loaded, unresolved } = useCachedItem(() => props.getCachedFn(props.id as any))\n\n// An item the fetch could not resolve shows only its id placeholder.\n// It gets no link, because its detail would not load either.\nconst linkDisabled = computed(() => props.disableClick || unresolved.value)\n\nconst containerClassComputed = computed(() => {\n  return props.wrapText ? props.containerClass + ' a-chip--wrap' : props.containerClass\n})\n\n// A title given by the caller still wins over the placeholder.\nconst showUnresolved = computed(() => unresolved.value && props.title.length === 0)\n\nconst displayTitle = computed(() => {\n  if (showUnresolved.value) return '#' + props.id\n  if (props.customTitleFn && cached.value) {\n    const customTitle = props.customTitleFn(cached.value, props.title, props.displayTextPath, props.fallbackIdText)\n    if (customTitle !== undefined) {\n      return customTitle\n    }\n  }\n  if (props.title.length > 0) return props.title\n  if (cached.value) {\n    return objectGetValueByPath(cached.value, props.displayTextPath)\n  }\n  return props.fallbackIdText ? props.id : ''\n})\n\nconst onClick = () => {\n  router.push({ name: props.route, params: { id: props.id } })\n}\n</script>\n\n<template>\n  <div :class=\"containerClassComputed\">\n    <template v-if=\"isNull(id) || isUndefined(id)\">\n      <slot name=\"empty\">-</slot>\n    </template>\n    <div\n      v-else-if=\"textOnly\"\n      :title=\"unresolved ? t('common.model.cachedUnavailable') : undefined\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </div>\n    <VChip\n      v-else-if=\"linkDisabled\"\n      :size=\"size\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VTooltip\n        v-if=\"unresolved\"\n        activator=\"parent\"\n        location=\"bottom\"\n      >\n        {{ t('common.model.cachedUnavailable') }}\n      </VTooltip>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n    <VChip\n      v-else\n      :size=\"size\"\n      :append-icon=\"openInNew ? COMMON_CONFIG.CHIP.ICON.LINK_EXTERNAL : COMMON_CONFIG.CHIP.ICON.LINK\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click.stop=\"onClick\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      {{ displayTitle }}\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n  </div>\n</template>\n\n<style lang=\"scss\">\n.a-chip--wrap {\n  .v-chip {\n    height: auto !important;\n  }\n\n  .v-chip .v-chip__content {\n    max-width: 100%;\n    height: auto;\n    min-height: 26px;\n    white-space: pre-wrap;\n  }\n}\n</style>\n"],"mappings":""}

package/dist/domains/cached/components/ACachedChip.vue.d.ts

@@ -0,0 +1,58 @@
+import { DocId, IntegerId } from '../../../shared/types/common';
+type __VLS_Props = {
+    id?: null | undefined | IntegerId | DocId;
+    title?: string;
+    containerClass?: undefined | string;
+    getCachedFn: (id: any) => any;
+    displayTextPath: string;
+    route: string;
+    disableClick?: boolean;
+    openInNew?: boolean;
+    size?: string;
+    forceRounded?: boolean;
+    textOnly?: boolean;
+    fallbackIdText?: boolean;
+    wrapText?: boolean;
+    closable?: boolean;
+    customTitleFn?: (cachedItem: any, defaultTitle: string, displayTextPath: string, fallbackIdText: boolean) => string | undefined;
+};
+declare const __VLS_template: () => {
+    __VLS_Slots: {
+        empty?: (props: {}) => any;
+    } & {
+        unresolved?: (props: {
+            id: string | number;
+        }) => any;
+    } & {
+        unresolved?: (props: {
+            id: string | number;
+        }) => any;
+    };
+};
+type __VLS_Slots = ReturnType<typeof __VLS_template>['__VLS_Slots'];
+declare const __VLS_base: import('vue').DefineComponent<__VLS_Props, {}, {}, {}, {}, import('vue').ComponentOptionsMixin, import('vue').ComponentOptionsMixin, {} & {
+    close: (id: string | number | null | undefined) => any;
+}, string, import('vue').PublicProps, Readonly<__VLS_Props> & Readonly<{
+    onClose?: ((id: string | number | null | undefined) => any) | undefined;
+}>, {
+    id: string | number | null;
+    title: string;
+    size: string;
+    closable: boolean;
+    containerClass: string;
+    disableClick: boolean;
+    openInNew: boolean;
+    forceRounded: boolean;
+    textOnly: boolean;
+    fallbackIdText: boolean;
+    wrapText: boolean;
+    customTitleFn: (cachedItem: any, defaultTitle: string, displayTextPath: string, fallbackIdText: boolean) => string | undefined;
+}, {}, {}, {}, string, import('vue').ComponentProvideOptions, false, {}, any>;
+declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
+declare const _default: typeof __VLS_export;
+export default _default;
+type __VLS_WithSlots<T, S> = T & {
+    new (): {
+        $slots: S;
+    };
+};