@anzusystems/common-admin 2.0.0-rc.5 → 2.0.0-rc.7

package/dist/domains/api/utils/apiErrors.d.ts

@@ -2,87 +2,60 @@ import { AnzuError } from '../../../shared/error/AnzuError';
 export type ApiErrorContext = {
     system: string;
     entity: string;
-    /** The url actually requested, parameters substituted and query included -- not the template. */
+    /** The url actually requested, with parameters substituted and query included. Not the template. */
     url?: string;
     /**
-     * The status the backend answered with, when it answered at all. Absent for a transport failure,
-     * where there is no response.
-     *
-     * It is here so an application can decide what is worth writing down without the call sites having
-     * to: a 404 that a caller probes for, for instance. Those used to be silenced per call, which made
-     * whether a failure was recorded depend on which call made it. The switch is the application's now,
-     * and this is what it needs to use it.
-     *
-     * Two statuses are not the application's to decide, and the library keeps them: 401 and 403. They
-     * are not an endpoint failing its contract, they are the session -- nobody is logged in, or this
-     * user may not -- and every admin in the fleet already branches on them and acts. Everything else
-     * reaches the logger and is filtered here, on this field.
+     * The status the backend answered with. Absent for a transport failure.
+     * The application's logger uses it to decide what to record, for example a 404 that a caller probes for.
+     * The library itself handles 401 and 403, because they concern the
+     * session and not the endpoint. Every other status reaches the logger.
      */
     status?: number;
     /**
-     * The i18n scope a field-level validation failure is reported under, when it is not the same as
-     * the backend above.
-     *
-     * `AnzuApiValidationError` turns the server's field names into `<system>.<entity>.model.<field>`
-     * translation keys. For a component shared by nine backends those two are different questions:
-     * *which* backend failed -- which is what the report needs -- and *whose labels* name its fields,
-     * which for a shared form is always the library's own `common.*`. Left unset, the two stay one
-     * value, exactly as before.
+     * The i18n scope for field-level validation errors, when it differs from the backend above.
+     * `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` translation keys. A component
+     * shared by several backends reports which backend failed but uses the library's `common.*` labels.
+     * If unset, the backend value is used.
      */
     validationSystem?: string;
     validationEntity?: string;
 };
 export type ApiErrorLogger = (error: Error, context: ApiErrorContext) => void;
 /**
- * What the user probe calls itself in the error context.
- *
- * A 404 here is an answer, not a failure -- it is how a system says "no account of yours". The
- * default logger skips it; an app's own logger still receives it, so it filters on this together
- * with the status rather than on the url, which would also silence a real detail read of the same
- * path. The validation scope stays the user's, so a field error would still name a real label.
- * Defined here, not beside the probe, so the default logger can know it without an import cycle.
+ * Entity name of the user probe in the error context.
+ * A 404 from the probe means the user has no account, so the default logger skips it. App loggers
+ * should filter on this and the status, not the url, which would also silence a real detail read.
+ * The validation scope stays the user's, so field errors still resolve real labels.
+ * Defined here to avoid an import cycle with the default logger.
  */
 export declare const USER_PROBE_ENTITY = "anzuUserProbe";
-/** What reporting does until an application says otherwise; exported so a test can put it back. */
+/** Default error reporting. Exported so tests can restore it. */
 export declare const defaultApiErrorLogger: ApiErrorLogger;
 /**
- * Replaces the logger the api helpers report unexpected failures through, or turns reporting off
- * with `null`.
- *
- * It is one switch for the whole family rather than a flag on each instance, which is what it
- * replaces: whether a failure was written down used to depend on which helper made the call and how
- * that instance happened to be constructed.
- *
- * An application that wants these where it can see them passes its own:
- * `setApiErrorLogger((e, ctx) => Sentry.captureException(e, { extra: ctx }))`.
+ * Replaces the logger the api helpers report unexpected failures through. `null` turns reporting off.
+ * One global switch for all helpers, so reporting does not depend on which helper made the call.
+ * @example setApiErrorLogger((e, ctx) => Sentry.captureException(e, { extra: ctx }))
  */
 export declare const setApiErrorLogger: (fn: ApiErrorLogger | null) => void;
 /**
- * The HTTP status the backend answered with, read off whichever class carries it: the axios response
- * of an `AnzuApiAxiosError`, or the `code` of an `AnzuApiResponseCodeError` (a response axios let
- * through). `undefined` when nothing answered -- a timeout, a network failure, a cancel.
+ * HTTP status from the axios response of `AnzuApiAxiosError` or the `code` of `AnzuApiResponseCodeError`.
+ * `undefined` when nothing answered: timeout, network failure, cancel.
  */
 export declare const apiErrorStatus: (error: unknown) => number | undefined;
 /**
- * Whether `report` hands this error, once mapped, to the logger: not a timeout, a 401 or a 403, nor
- * anything while reporting is off. For a caller that reports only the first failure of a series: a
- * failure dropped here has told nobody, and the series begins with the first one that was written.
- * What the application's own logger does with it is the application's.
+ * Whether `report` passes this error to the logger. False for a timeout, 401, 403, or while reporting is off.
+ * Lets a caller that reports only the first failure of a series start the series at the first logged one.
  */
 export declare const apiErrorIsReported: (error: unknown) => boolean;
 /**
- * Reports an error once, after it has been mapped, and hands it back so the caller can throw it.
- *
- * After, not during: an error the helper raised itself -- a body that never arrived, a status it
- * refuses -- is already an `Anzu*` class by the time it reaches the mapping, so a logger placed
- * inside the mapping would never see the two cases it exists for.
+ * Reports a mapped error once and returns it so the caller can throw it.
+ * Runs after mapping because errors the helper raises itself are
+ * already `Anzu*` classes and would bypass a logger inside the mapping.
  */
 export declare const report: <E>(error: E, context: ApiErrorContext) => E;
 /**
- * Turns whatever axios rejected with into one of the Anzu error classes.
- *
- * There used to be a copy of this inside each helper. The order of the checks is what decides which
- * class a failure becomes, so four copies were four chances for the same failure to arrive under
- * different names depending on which helper made the call.
+ * Turns whatever axios rejected with into an Anzu error class.
+ * Shared by all helpers. The order of checks decides the class,
+ * so separate copies would map the same failure differently.
  */
 export declare const mapApiError: (err: unknown, context: ApiErrorContext) => AnzuError;

package/dist/domains/api/utils/apiErrors.js.map

@@ -1 +1 @@
-{"version":3,"file":"apiErrors.js","names":["axios","USER_PROBE_ENTITY","defaultApiErrorLogger","context","error","logger","setApiErrorLogger","fn","LOGGED","AnzuApiAxiosError","AnzuFatalError","AnzuApiResponseCodeError","apiErrorStatus","apiErrorIsReported","status","isInCauseChain","cause","SessionExpiredError","cls","report","mapApiError","labelSystem","system","labelEntity","entity","err","axiosError","isAnzuError","axiosErrorIsCancelled","AnzuApiCancelledError","axiosErrorResponseIsForbidden","AnzuApiForbiddenError","axiosErrorResponseHasValidationData","AnzuApiValidationError","axiosErrorResponseHasDependencyExistsData","AnzuApiDependencyExistsError","axiosErrorResponseHasForbiddenOperationData","AnzuApiForbiddenOperationError","axiosErrorIsTimeout","AnzuApiTimeoutError"],"sources":["../../../../src/domains/api/utils/apiErrors.ts"],"sourcesContent":["import axios, { type AxiosError } from 'axios'\nimport { AnzuApiAxiosError } from '@/shared/error/AnzuApiAxiosError'\nimport { AnzuApiCancelledError, axiosErrorIsCancelled } from '@/shared/error/AnzuApiCancelledError'\nimport {\n  AnzuApiDependencyExistsError,\n  axiosErrorResponseHasDependencyExistsData,\n} from '@/shared/error/AnzuApiDependencyExistsError'\nimport { AnzuApiForbiddenError, axiosErrorResponseIsForbidden } from '@/shared/error/AnzuApiForbiddenError'\nimport {\n  AnzuApiForbiddenOperationError,\n  axiosErrorResponseHasForbiddenOperationData,\n} from '@/shared/error/AnzuApiForbiddenOperationError'\nimport { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { AnzuApiTimeoutError, axiosErrorIsTimeout } from '@/shared/error/AnzuApiTimeoutError'\nimport { AnzuApiValidationError, axiosErrorResponseHasValidationData } from '@/shared/error/AnzuApiValidationError'\nimport { AnzuError, isAnzuError } from '@/shared/error/AnzuError'\nimport { AnzuFatalError } from '@/shared/error/AnzuFatalError'\nimport { HTTP_STATUS_FORBIDDEN, HTTP_STATUS_UNAUTHORIZED } from '@/shared/statusCodes'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\n\nexport type ApiErrorContext = {\n  system: string\n  entity: string\n  /** The url actually requested, parameters substituted and query included -- not the template. */\n  url?: string\n  /**\n   * The status the backend answered with, when it answered at all. Absent for a transport failure,\n   * where there is no response.\n   *\n   * It is here so an application can decide what is worth writing down without the call sites having\n   * to: a 404 that a caller probes for, for instance. Those used to be silenced per call, which made\n   * whether a failure was recorded depend on which call made it. The switch is the application's now,\n   * and this is what it needs to use it.\n   *\n   * Two statuses are not the application's to decide, and the library keeps them: 401 and 403. They\n   * are not an endpoint failing its contract, they are the session -- nobody is logged in, or this\n   * user may not -- and every admin in the fleet already branches on them and acts. Everything else\n   * reaches the logger and is filtered here, on this field.\n   */\n  status?: number\n  /**\n   * The i18n scope a field-level validation failure is reported under, when it is not the same as\n   * the backend above.\n   *\n   * `AnzuApiValidationError` turns the server's field names into `<system>.<entity>.model.<field>`\n   * translation keys. For a component shared by nine backends those two are different questions:\n   * *which* backend failed -- which is what the report needs -- and *whose labels* name its fields,\n   * which for a shared form is always the library's own `common.*`. Left unset, the two stay one\n   * value, exactly as before.\n   */\n  validationSystem?: string\n  validationEntity?: string\n}\n\nexport type ApiErrorLogger = (error: Error, context: ApiErrorContext) => void\n\n/**\n * What the user probe calls itself in the error context.\n *\n * A 404 here is an answer, not a failure -- it is how a system says \"no account of yours\". The\n * default logger skips it; an app's own logger still receives it, so it filters on this together\n * with the status rather than on the url, which would also silence a real detail read of the same\n * path. The validation scope stays the user's, so a field error would still name a real label.\n * Defined here, not beside the probe, so the default logger can know it without an import cycle.\n */\nexport const USER_PROBE_ENTITY = 'anzuUserProbe'\n\n/** What reporting does until an application says otherwise; exported so a test can put it back. */\nexport const defaultApiErrorLogger: ApiErrorLogger = (error, context) => {\n  if (context.status === 404 && context.entity === USER_PROBE_ENTITY) return\n  console.error('Api error: ' + (context.url ?? ''), error)\n}\n\nlet logger: ApiErrorLogger | null = defaultApiErrorLogger\n\n/**\n * Replaces the logger the api helpers report unexpected failures through, or turns reporting off\n * with `null`.\n *\n * It is one switch for the whole family rather than a flag on each instance, which is what it\n * replaces: whether a failure was written down used to depend on which helper made the call and how\n * that instance happened to be constructed.\n *\n * An application that wants these where it can see them passes its own:\n * `setApiErrorLogger((e, ctx) => Sentry.captureException(e, { extra: ctx }))`.\n */\nexport const setApiErrorLogger = (fn: ApiErrorLogger | null): void => {\n  logger = fn\n}\n\n// Only the failures nobody planned for. A validation or forbidden answer is the backend saying\n// something the caller asked about and will show; writing those down as well would be noise that\n// teaches people to ignore the log.\nconst LOGGED = [AnzuApiAxiosError, AnzuFatalError, AnzuApiResponseCodeError]\n\n/**\n * The HTTP status the backend answered with, read off whichever class carries it: the axios response\n * of an `AnzuApiAxiosError`, or the `code` of an `AnzuApiResponseCodeError` (a response axios let\n * through). `undefined` when nothing answered -- a timeout, a network failure, a cancel.\n */\nexport const apiErrorStatus = (error: unknown): number | undefined => {\n  if (error instanceof AnzuApiResponseCodeError) return error.code\n  if (error instanceof AnzuApiAxiosError) return error.cause.response?.status\n\n  return undefined\n}\n\n/**\n * Whether `report` hands this error, once mapped, to the logger: not a timeout, a 401 or a 403, nor\n * anything while reporting is off. For a caller that reports only the first failure of a series: a\n * failure dropped here has told nobody, and the series begins with the first one that was written.\n * What the application's own logger does with it is the application's.\n */\nexport const apiErrorIsReported = (error: unknown): boolean => {\n  const status = apiErrorStatus(error)\n  // Neither of these is an unplanned failure. A 401 is \"nobody is logged in\", which every admin\n  // branches on before sending the user to the login page -- writing it down would mean an \"Api\n  // error\" for every unauthenticated start of the app. A 403 is \"this user may not\", which the\n  // caller shows. Both are the session rather than an endpoint breaking its contract.\n  //\n  // By status rather than by class, because the class only keeps it quiet on one of the two paths: a\n  // rejected 403 becomes `AnzuApiForbiddenError`, which is outside `LOGGED`, while one that arrives\n  // fulfilled -- as `options.validateStatus` allows -- becomes an `AnzuApiResponseCodeError`, which\n  // is inside it. Left to the class, the policy would hold or not depending on how the caller\n  // configured axios.\n  //\n  // It is the one thing the `status` field above does not leave to the application, and deliberately:\n  // an app that wanted its own unauthenticated starts in the log would be asking for noise it cannot\n  // act on, while an app that wants 404 or 409 filtered has the field to do it with.\n  if (status === HTTP_STATUS_UNAUTHORIZED || status === HTTP_STATUS_FORBIDDEN) return false\n  // The same as a 401, stopped before it went out: the refresh found the session gone.\n  if (isInCauseChain(error, (cause) => cause instanceof SessionExpiredError)) return false\n\n  return logger !== null && LOGGED.some((cls) => error instanceof cls)\n}\n\n/**\n * Reports an error once, after it has been mapped, and hands it back so the caller can throw it.\n *\n * After, not during: an error the helper raised itself -- a body that never arrived, a status it\n * refuses -- is already an `Anzu*` class by the time it reaches the mapping, so a logger placed\n * inside the mapping would never see the two cases it exists for.\n */\nexport const report = <E>(error: E, context: ApiErrorContext): E => {\n  if (logger !== null && apiErrorIsReported(error)) {\n    try {\n      // Filled in here rather than by the caller: the status belongs to the failure, and only the\n      // mapped error knows it -- the helper that built the context has not looked at the error yet.\n      logger(error as unknown as Error, { ...context, status: apiErrorStatus(error) })\n    } catch {\n      // A logger that throws must not replace the failure the caller is waiting for.\n    }\n  }\n\n  return error\n}\n\n/**\n * Turns whatever axios rejected with into one of the Anzu error classes.\n *\n * There used to be a copy of this inside each helper. The order of the checks is what decides which\n * class a failure becomes, so four copies were four chances for the same failure to arrive under\n * different names depending on which helper made the call.\n */\nexport const mapApiError = (err: unknown, context: ApiErrorContext): AnzuError => {\n  const { system, entity } = context\n  const labelSystem = context.validationSystem ?? system\n  const labelEntity = context.validationEntity ?? entity\n  // The predicates below are typed against `Error` / `AxiosError` and each begins by checking what\n  // it was handed, so narrowing here only satisfies their signatures.\n  const error = err as Error\n  const axiosError = err as AxiosError\n\n  // Already mapped -- including the errors a helper raised about its own contract. Wrapping it again\n  // would bury the class the caller branches on.\n  if (isAnzuError(err)) return err\n\n  // Before everything else, because it is not a failure: the caller stopped this request.\n  if (axiosErrorIsCancelled(err)) return new AnzuApiCancelledError(error)\n\n  // The rendered url, not `config.url`: that one is relative, carries no params, and would become\n  // this error's `message` -- the only url in the family that never went through `requestedUrl`.\n  if (axiosErrorResponseIsForbidden(axiosError)) return new AnzuApiForbiddenError(axiosError, context.url)\n\n  if (axiosErrorResponseHasValidationData(axiosError)) {\n    return new AnzuApiValidationError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasDependencyExistsData(axiosError)) {\n    return new AnzuApiDependencyExistsError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasForbiddenOperationData(axiosError)) {\n    return new AnzuApiForbiddenOperationError(axiosError, error)\n  }\n\n  if (axiosErrorIsTimeout(error)) return new AnzuApiTimeoutError(error)\n\n  if (axios.isAxiosError(err)) return new AnzuApiAxiosError(axiosError)\n\n  return new AnzuFatalError(error)\n}\n"],"mappings":";;;;;;;;;;;;;;;AAkEA,IAAaC,IAAoB,iBAGpBC,KAAyC,GAAO,MAAY;CACvE,CAAIC,EAAQ,WAAW,OAAOA,EAAQ,WAAA,oBACtC,QAAQ,MAAM,iBAAiBA,EAAQ,OAAO,KAAKC,CAAK;AAC1D,GAEIC,IAAgCH,GAavBI,KAAqB,MAAoC;CACpE,IAASC;AACX,GAKMC,IAAS;CAACC;CAAmBC;CAAgBC;AAAwB,GAO9DC,KAAkB,MAAuC;CACpE,IAAIR,aAAiBO,GAA0B,OAAOP,EAAM;CAC5D,IAAIA,aAAiBK,GAAmB,OAAOL,EAAM,MAAM,UAAU;AAGvE,GAQaS,KAAsB,MAA4B;CAC7D,IAAMC,IAASF,EAAeR,CAAK;CAmBnC,OAJIU,MAAA,OAAuCA,MAAA,OAEvCC,EAAeX,IAAQ,MAAUY,aAAiBC,CAAmB,IAAU,KAE5EZ,MAAW,QAAQG,EAAO,MAAM,MAAQJ,aAAiBc,CAAG;AACrE,GASaC,KAAa,GAAU,MAAgC;CAClE,IAAId,MAAW,QAAQQ,EAAmBT,CAAK,GAC7C,IAAI;EAGF,EAAOA,GAA2B;GAAE,GAAGD;GAAS,QAAQS,EAAeR,CAAK;EAAE,CAAC;CACjF,QAAQ,CAER;CAGF,OAAOA;AACT,GASagB,KAAe,GAAc,MAAwC;CAChF,IAAM,EAAE,WAAQ,cAAWjB,GACrBkB,IAAclB,EAAQ,oBAAoBmB,GAC1CC,IAAcpB,EAAQ,oBAAoBqB,GAG1CpB,IAAQqB,GACRC,IAAaD;CA6BnB,OAzBIE,EAAYF,CAAG,IAAUA,IAGzBG,EAAsBH,CAAG,IAAU,IAAII,EAAsBzB,CAAK,IAIlE0B,EAA8BJ,CAAU,IAAU,IAAIK,EAAsBL,GAAYvB,EAAQ,GAAG,IAEnG6B,EAAoCN,CAAU,IACzC,IAAIO,EAAuBP,GAAYL,GAAaE,GAAanB,CAAK,IAG3E8B,EAA0CR,CAAU,IAC/C,IAAIS,EAA6BT,GAAYL,GAAaE,GAAanB,CAAK,IAGjFgC,EAA4CV,CAAU,IACjD,IAAIW,EAA+BX,GAAYtB,CAAK,IAGzDkC,EAAoBlC,CAAK,IAAU,IAAImC,EAAoBnC,CAAK,IAEhEJ,EAAM,aAAayB,CAAG,IAAU,IAAIhB,EAAkBiB,CAAU,IAE7D,IAAIhB,EAAeN,CAAK;AACjC"}
+{"version":3,"file":"apiErrors.js","names":["axios","USER_PROBE_ENTITY","defaultApiErrorLogger","context","error","logger","setApiErrorLogger","fn","LOGGED","AnzuApiAxiosError","AnzuFatalError","AnzuApiResponseCodeError","apiErrorStatus","apiErrorIsReported","status","isInCauseChain","cause","SessionExpiredError","cls","report","mapApiError","labelSystem","system","labelEntity","entity","err","axiosError","isAnzuError","axiosErrorIsCancelled","AnzuApiCancelledError","axiosErrorResponseIsForbidden","AnzuApiForbiddenError","axiosErrorResponseHasValidationData","AnzuApiValidationError","axiosErrorResponseHasDependencyExistsData","AnzuApiDependencyExistsError","axiosErrorResponseHasForbiddenOperationData","AnzuApiForbiddenOperationError","axiosErrorIsTimeout","AnzuApiTimeoutError"],"sources":["../../../../src/domains/api/utils/apiErrors.ts"],"sourcesContent":["import axios, { type AxiosError } from 'axios'\nimport { AnzuApiAxiosError } from '@/shared/error/AnzuApiAxiosError'\nimport { AnzuApiCancelledError, axiosErrorIsCancelled } from '@/shared/error/AnzuApiCancelledError'\nimport {\n  AnzuApiDependencyExistsError,\n  axiosErrorResponseHasDependencyExistsData,\n} from '@/shared/error/AnzuApiDependencyExistsError'\nimport { AnzuApiForbiddenError, axiosErrorResponseIsForbidden } from '@/shared/error/AnzuApiForbiddenError'\nimport {\n  AnzuApiForbiddenOperationError,\n  axiosErrorResponseHasForbiddenOperationData,\n} from '@/shared/error/AnzuApiForbiddenOperationError'\nimport { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { AnzuApiTimeoutError, axiosErrorIsTimeout } from '@/shared/error/AnzuApiTimeoutError'\nimport { AnzuApiValidationError, axiosErrorResponseHasValidationData } from '@/shared/error/AnzuApiValidationError'\nimport { AnzuError, isAnzuError } from '@/shared/error/AnzuError'\nimport { AnzuFatalError } from '@/shared/error/AnzuFatalError'\nimport { HTTP_STATUS_FORBIDDEN, HTTP_STATUS_UNAUTHORIZED } from '@/shared/statusCodes'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\n\nexport type ApiErrorContext = {\n  system: string\n  entity: string\n  /** The url actually requested, with parameters substituted and query included. Not the template. */\n  url?: string\n  /**\n   * The status the backend answered with. Absent for a transport failure.\n   * The application's logger uses it to decide what to record, for example a 404 that a caller probes for.\n   * The library itself handles 401 and 403, because they concern the\n   * session and not the endpoint. Every other status reaches the logger.\n   */\n  status?: number\n  /**\n   * The i18n scope for field-level validation errors, when it differs from the backend above.\n   * `AnzuApiValidationError` builds `<system>.<entity>.model.<field>` translation keys. A component\n   * shared by several backends reports which backend failed but uses the library's `common.*` labels.\n   * If unset, the backend value is used.\n   */\n  validationSystem?: string\n  validationEntity?: string\n}\n\nexport type ApiErrorLogger = (error: Error, context: ApiErrorContext) => void\n\n/**\n * Entity name of the user probe in the error context.\n * A 404 from the probe means the user has no account, so the default logger skips it. App loggers\n * should filter on this and the status, not the url, which would also silence a real detail read.\n * The validation scope stays the user's, so field errors still resolve real labels.\n * Defined here to avoid an import cycle with the default logger.\n */\nexport const USER_PROBE_ENTITY = 'anzuUserProbe'\n\n/** Default error reporting. Exported so tests can restore it. */\nexport const defaultApiErrorLogger: ApiErrorLogger = (error, context) => {\n  if (context.status === 404 && context.entity === USER_PROBE_ENTITY) return\n  console.error('Api error: ' + (context.url ?? ''), error)\n}\n\nlet logger: ApiErrorLogger | null = defaultApiErrorLogger\n\n/**\n * Replaces the logger the api helpers report unexpected failures through. `null` turns reporting off.\n * One global switch for all helpers, so reporting does not depend on which helper made the call.\n * @example setApiErrorLogger((e, ctx) => Sentry.captureException(e, { extra: ctx }))\n */\nexport const setApiErrorLogger = (fn: ApiErrorLogger | null): void => {\n  logger = fn\n}\n\n// Only unplanned failures. Validation and forbidden errors are shown to the user by the caller.\n// Logging them too would be noise.\nconst LOGGED = [AnzuApiAxiosError, AnzuFatalError, AnzuApiResponseCodeError]\n\n/**\n * HTTP status from the axios response of `AnzuApiAxiosError` or the `code` of `AnzuApiResponseCodeError`.\n * `undefined` when nothing answered: timeout, network failure, cancel.\n */\nexport const apiErrorStatus = (error: unknown): number | undefined => {\n  if (error instanceof AnzuApiResponseCodeError) return error.code\n  if (error instanceof AnzuApiAxiosError) return error.cause.response?.status\n\n  return undefined\n}\n\n/**\n * Whether `report` passes this error to the logger. False for a timeout, 401, 403, or while reporting is off.\n * Lets a caller that reports only the first failure of a series start the series at the first logged one.\n */\nexport const apiErrorIsReported = (error: unknown): boolean => {\n  const status = apiErrorStatus(error)\n  // 401 and 403 are session states, not endpoint failures. Every\n  // admin checks for 401 on startup, so logging it adds noise.\n  // Checked by status, not by class. A rejected 403 becomes `AnzuApiForbiddenError` (not in `LOGGED`).\n  // A fulfilled 403 allowed by `options.validateStatus` becomes `AnzuApiResponseCodeError` (in `LOGGED`).\n  // This is not configurable on purpose. Apps can filter other statuses like 404 or 409 via the `status` field.\n  if (status === HTTP_STATUS_UNAUTHORIZED || status === HTTP_STATUS_FORBIDDEN) return false\n  // Same as a 401, caught before the request: the refresh found the session gone.\n  if (isInCauseChain(error, (cause) => cause instanceof SessionExpiredError)) return false\n\n  return logger !== null && LOGGED.some((cls) => error instanceof cls)\n}\n\n/**\n * Reports a mapped error once and returns it so the caller can throw it.\n * Runs after mapping because errors the helper raises itself are\n * already `Anzu*` classes and would bypass a logger inside the mapping.\n */\nexport const report = <E>(error: E, context: ApiErrorContext): E => {\n  if (logger !== null && apiErrorIsReported(error)) {\n    try {\n      // Status is added here because only the mapped error knows it.\n      // The caller built the context before looking at the error.\n      logger(error as unknown as Error, { ...context, status: apiErrorStatus(error) })\n    } catch {\n      // A logger that throws must not replace the failure the caller is waiting for.\n    }\n  }\n\n  return error\n}\n\n/**\n * Turns whatever axios rejected with into an Anzu error class.\n * Shared by all helpers. The order of checks decides the class,\n * so separate copies would map the same failure differently.\n */\nexport const mapApiError = (err: unknown, context: ApiErrorContext): AnzuError => {\n  const { system, entity } = context\n  const labelSystem = context.validationSystem ?? system\n  const labelEntity = context.validationEntity ?? entity\n  // Casts only satisfy the predicate signatures. Each predicate checks its input itself.\n  const error = err as Error\n  const axiosError = err as AxiosError\n\n  // Already mapped, including contract errors raised by a helper.\n  // Wrapping again would hide the class the caller branches on.\n  if (isAnzuError(err)) return err\n\n  // Checked first because a cancelled request is not a failure. The caller stopped it.\n  if (axiosErrorIsCancelled(err)) return new AnzuApiCancelledError(error)\n\n  // Use the rendered url, not `config.url`. `config.url` is relative and has no params.\n  // It would become this error's `message`, unlike every other error that uses `requestedUrl`.\n  if (axiosErrorResponseIsForbidden(axiosError)) return new AnzuApiForbiddenError(axiosError, context.url)\n\n  if (axiosErrorResponseHasValidationData(axiosError)) {\n    return new AnzuApiValidationError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasDependencyExistsData(axiosError)) {\n    return new AnzuApiDependencyExistsError(axiosError, labelSystem, labelEntity, error)\n  }\n\n  if (axiosErrorResponseHasForbiddenOperationData(axiosError)) {\n    return new AnzuApiForbiddenOperationError(axiosError, error)\n  }\n\n  if (axiosErrorIsTimeout(error)) return new AnzuApiTimeoutError(error)\n\n  if (axios.isAxiosError(err)) return new AnzuApiAxiosError(axiosError)\n\n  return new AnzuFatalError(error)\n}\n"],"mappings":";;;;;;;;;;;;;;;AAoDA,IAAaC,IAAoB,iBAGpBC,KAAyC,GAAO,MAAY;CACvE,CAAIC,EAAQ,WAAW,OAAOA,EAAQ,WAAA,oBACtC,QAAQ,MAAM,iBAAiBA,EAAQ,OAAO,KAAKC,CAAK;AAC1D,GAEIC,IAAgCH,GAOvBI,KAAqB,MAAoC;CACpE,IAASC;AACX,GAIMC,IAAS;CAACC;CAAmBC;CAAgBC;AAAwB,GAM9DC,KAAkB,MAAuC;CACpE,IAAIR,aAAiBO,GAA0B,OAAOP,EAAM;CAC5D,IAAIA,aAAiBK,GAAmB,OAAOL,EAAM,MAAM,UAAU;AAGvE,GAMaS,KAAsB,MAA4B;CAC7D,IAAMC,IAASF,EAAeR,CAAK;CAUnC,OAJIU,MAAA,OAAuCA,MAAA,OAEvCC,EAAeX,IAAQ,MAAUY,aAAiBC,CAAmB,IAAU,KAE5EZ,MAAW,QAAQG,EAAO,MAAM,MAAQJ,aAAiBc,CAAG;AACrE,GAOaC,KAAa,GAAU,MAAgC;CAClE,IAAId,MAAW,QAAQQ,EAAmBT,CAAK,GAC7C,IAAI;EAGF,EAAOA,GAA2B;GAAE,GAAGD;GAAS,QAAQS,EAAeR,CAAK;EAAE,CAAC;CACjF,QAAQ,CAER;CAGF,OAAOA;AACT,GAOagB,KAAe,GAAc,MAAwC;CAChF,IAAM,EAAE,WAAQ,cAAWjB,GACrBkB,IAAclB,EAAQ,oBAAoBmB,GAC1CC,IAAcpB,EAAQ,oBAAoBqB,GAE1CpB,IAAQqB,GACRC,IAAaD;CA6BnB,OAzBIE,EAAYF,CAAG,IAAUA,IAGzBG,EAAsBH,CAAG,IAAU,IAAII,EAAsBzB,CAAK,IAIlE0B,EAA8BJ,CAAU,IAAU,IAAIK,EAAsBL,GAAYvB,EAAQ,GAAG,IAEnG6B,EAAoCN,CAAU,IACzC,IAAIO,EAAuBP,GAAYL,GAAaE,GAAanB,CAAK,IAG3E8B,EAA0CR,CAAU,IAC/C,IAAIS,EAA6BT,GAAYL,GAAaE,GAAanB,CAAK,IAGjFgC,EAA4CV,CAAU,IACjD,IAAIW,EAA+BX,GAAYtB,CAAK,IAGzDkC,EAAoBlC,CAAK,IAAU,IAAImC,EAAoBnC,CAAK,IAEhEJ,EAAM,aAAayB,CAAG,IAAU,IAAIhB,EAAkBiB,CAAU,IAE7D,IAAIhB,EAAeN,CAAK;AACjC"}

package/dist/domains/api/utils/listBody.d.ts

@@ -2,64 +2,43 @@ import { Pagination } from '../composables/pagination';
 export type ListBody<T> = {
     items: T[];
     /**
-     * Which kind of list answered, read from the response rather than inferred from `pagination`.
-     *
-     * They are two different things and conflating them cost a bug: `pagination` is what to write, and
-     * for an infinite list that includes `totalCount: 0` to clear the counted mode's leftovers -- so a
-     * reader using `totalCount` to recognise the mode sees a counted list of zero items.
+     * Which kind of list answered, read from the response, not inferred from `pagination`.
+     * `pagination` is what to write. For an infinite list it includes `totalCount: 0` to clear counted-mode leftovers.
+     * So reading the mode from `totalCount` sees a counted list of zero items. This caused a bug.
      */
     mode: 'counted' | 'infinite' | 'unknown';
     /**
-     * What the response said about the mode it is in, plus the other mode's field cleared: a counted
-     * body carries `hasNextPage: null` and an infinite one `totalCount: 0`, so a value left over from
-     * the previous query cannot go on describing this one. A missing or malformed field of the mode's
-     * own kind is not written at all.
+     * The fields the response gave for its mode, plus the other mode's field cleared.
+     * A counted body gets `hasNextPage: null`, an infinite one
+     * `totalCount: 0`, so values from the previous query do not linger.
+     * A missing or malformed field of the mode's own kind is not written.
      */
     pagination: Partial<Pagination>;
     /**
      * Whether `totalCount` is a bound rather than a count.
-     *
-     * The backend's counted envelope carries `bigTable`, and with it on -- which is the default -- the
-     * count it sends is `offset + limit + 1`: a look-ahead that says "there is at least one more page",
-     * not how many rows exist. It is corrected to the real total only when the page came back short,
-     * which is to say only when there was nothing more to look ahead to.
-     *
-     * Page-by-page navigation does not care: the sentinel is exactly what it needs to enable Next.
-     * Anything that treats the number as a total does -- dividing by a page size to learn how many
-     * pages exist yields 2, whatever the real answer is.
+     * With the backend's `bigTable` on (the default), the count is `offset
+     * + limit + 1`, a look-ahead meaning "at least one more page".
+     * It is the real total only when the page came back short.
+     * Fine for Next/Previous navigation. Wrong for anything that computes a page count from it.
      */
     countIsBound: boolean;
 };
 /**
  * Reads a list response.
- *
- * The array is the only thing that decides whether this is a list at all. The existing shape guards
- * test for a metadata key and nothing else, so `{ totalCount: 1 }` passed as a list and the caller
- * got `undefined` typed as an array.
- *
- * Metadata only picks the mode, and is optional: a well-formed array is not worth discarding because
- * the count beside it is missing or of the wrong type.
- *
- * `hasNextPage` decides, and only its absence falls through to `totalCount`. It has to be that way
- * round, because the backend's infinite envelope carries BOTH: `ApiInfiniteResponseList` serialises
- * `hasNextPage`, `data` and `totalCount` (the last marked `@deprecated`, which is a docblock and
- * suppresses nothing), while the counted one carries `totalCount`, `data` and `bigTable` and never
- * `hasNextPage`. So the presence of `hasNextPage` is the only unambiguous signal, and reading
- * `totalCount` first would turn every infinite list in the fleet into a counted one -- with a total
- * that is not a total: with `bigTable` on, which is the default, the counted number is a look-ahead
- * sentinel, `offset + limit + 1`, and the infinite envelope reports that same sentinel unconditionally.
+ * Only the `data` array decides whether this is a list. Older guards checked a metadata
+ * key only, so `{ totalCount: 1 }` passed and callers got `undefined` as an array.
+ * Metadata only picks the mode and is optional. A valid array is kept even if the count is missing or malformed.
+ * `hasNextPage` decides the mode. The infinite envelope also carries a
+ * deprecated `totalCount`, and the counted one never has `hasNextPage`.
+ * Reading `totalCount` first would make every infinite list counted,
+ * with a look-ahead sentinel `offset + limit + 1` as its total.
  */
 export declare const readListBody: <T>(body: unknown, status: number, url: string | undefined) => ListBody<T>;
 /**
  * Reads a list that arrived as a bare array.
- *
- * The second of the two shapes a list comes in, and a separate reader rather than one that takes
- * either: the caller declares which one this endpoint answers with and the reader refuses the
- * other, the way `optionalBody` makes the caller declare a body. One reader accepting both shapes
- * is a permissive reader, and a permissive reader is what let a malformed answer through in the
- * first place.
- *
- * Returns `T[]` rather than `ListBody<T>`: `mode: 'unknown'` means the envelope named no mode, and
- * here there was no envelope to name one.
+ * Separate from `readListBody` on purpose. The caller declares the shape
+ * its endpoint returns and the other shape is refused, like `optionalBody`.
+ * A reader accepting both shapes would let malformed answers through.
+ * Returns `T[]`, not `ListBody<T>`, because there is no envelope to name a mode.
  */
 export declare const readArrayBody: <T>(body: unknown, status: number, url: string | undefined) => T[];

package/dist/domains/api/utils/listBody.js.map

@@ -1 +1 @@
-{"version":3,"file":"listBody.js","names":["readListBody","isObject","body","AnzuApiResponseCodeError","status","url","isBoolean","hasNextPage","data","isNumber","totalCount","bigTable","readArrayBody"],"sources":["../../../../src/domains/api/utils/listBody.ts"],"sourcesContent":["import { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { isBoolean, isNumber, isObject } from '@/shared/utils/common'\nimport type { Pagination } from '@/domains/api/composables/pagination'\n\nexport type ListBody<T> = {\n  items: T[]\n  /**\n   * Which kind of list answered, read from the response rather than inferred from `pagination`.\n   *\n   * They are two different things and conflating them cost a bug: `pagination` is what to write, and\n   * for an infinite list that includes `totalCount: 0` to clear the counted mode's leftovers -- so a\n   * reader using `totalCount` to recognise the mode sees a counted list of zero items.\n   */\n  mode: 'counted' | 'infinite' | 'unknown'\n  /**\n   * What the response said about the mode it is in, plus the other mode's field cleared: a counted\n   * body carries `hasNextPage: null` and an infinite one `totalCount: 0`, so a value left over from\n   * the previous query cannot go on describing this one. A missing or malformed field of the mode's\n   * own kind is not written at all.\n   */\n  pagination: Partial<Pagination>\n  /**\n   * Whether `totalCount` is a bound rather than a count.\n   *\n   * The backend's counted envelope carries `bigTable`, and with it on -- which is the default -- the\n   * count it sends is `offset + limit + 1`: a look-ahead that says \"there is at least one more page\",\n   * not how many rows exist. It is corrected to the real total only when the page came back short,\n   * which is to say only when there was nothing more to look ahead to.\n   *\n   * Page-by-page navigation does not care: the sentinel is exactly what it needs to enable Next.\n   * Anything that treats the number as a total does -- dividing by a page size to learn how many\n   * pages exist yields 2, whatever the real answer is.\n   */\n  countIsBound: boolean\n}\n\n/**\n * Reads a list response.\n *\n * The array is the only thing that decides whether this is a list at all. The existing shape guards\n * test for a metadata key and nothing else, so `{ totalCount: 1 }` passed as a list and the caller\n * got `undefined` typed as an array.\n *\n * Metadata only picks the mode, and is optional: a well-formed array is not worth discarding because\n * the count beside it is missing or of the wrong type.\n *\n * `hasNextPage` decides, and only its absence falls through to `totalCount`. It has to be that way\n * round, because the backend's infinite envelope carries BOTH: `ApiInfiniteResponseList` serialises\n * `hasNextPage`, `data` and `totalCount` (the last marked `@deprecated`, which is a docblock and\n * suppresses nothing), while the counted one carries `totalCount`, `data` and `bigTable` and never\n * `hasNextPage`. So the presence of `hasNextPage` is the only unambiguous signal, and reading\n * `totalCount` first would turn every infinite list in the fleet into a counted one -- with a total\n * that is not a total: with `bigTable` on, which is the default, the counted number is a look-ahead\n * sentinel, `offset + limit + 1`, and the infinite envelope reports that same sentinel unconditionally.\n */\nexport const readListBody = <T>(body: unknown, status: number, url: string | undefined): ListBody<T> => {\n  if (!isObject(body) || !Array.isArray((body as { data?: unknown }).data)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected a list body, url: ' + url)\n  }\n\n  const { data, totalCount, hasNextPage, bigTable } = body as {\n    data: T[]\n    totalCount?: unknown\n    hasNextPage?: unknown\n    bigTable?: unknown\n  }\n\n  if (isBoolean(hasNextPage)) {\n    return { items: data, mode: 'infinite', pagination: { hasNextPage, totalCount: 0 }, countIsBound: false }\n  }\n\n  if (isNumber(totalCount)) {\n    // `null`, not `false`: the field is three-valued and the paginators read it that way. `isNull`\n    // is what picks the mode -- `ADatatablePagination.vue:62,67,73` and both `ASubjectSelect.vue`\n    // take a non-null value to mean an infinite list, so `false` here says \"infinite, and there is\n    // no next page\": Next and Last go dead on every page and the total renders as the number of\n    // rows on screen. `null` is the counted list saying the infinite mode's field does not apply.\n    return {\n      items: data,\n      mode: 'counted',\n      pagination: { totalCount, hasNextPage: null },\n      countIsBound: bigTable === true,\n    }\n  }\n\n  return { items: data, mode: 'unknown', pagination: {}, countIsBound: false }\n}\n\n/**\n * Reads a list that arrived as a bare array.\n *\n * The second of the two shapes a list comes in, and a separate reader rather than one that takes\n * either: the caller declares which one this endpoint answers with and the reader refuses the\n * other, the way `optionalBody` makes the caller declare a body. One reader accepting both shapes\n * is a permissive reader, and a permissive reader is what let a malformed answer through in the\n * first place.\n *\n * Returns `T[]` rather than `ListBody<T>`: `mode: 'unknown'` means the envelope named no mode, and\n * here there was no envelope to name one.\n */\nexport const readArrayBody = <T>(body: unknown, status: number, url: string | undefined): T[] => {\n  if (!Array.isArray(body)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected an array body, url: ' + url)\n  }\n\n  return body as T[]\n}\n"],"mappings":";;;AAuDA,IAAaA,KAAmB,GAAe,GAAgB,MAAyC;CACtG,IAAI,CAACC,EAASC,CAAI,KAAK,CAAC,MAAM,QAASA,EAA4B,IAAI,GACrE,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,gCAAgCC,CAAG;CAG3F,IAAM,EAAE,SAAM,eAAY,gBAAa,gBAAaH;CAyBpD,OAlBII,EAAUC,CAAW,IAChB;EAAE,OAAOC;EAAM,MAAM;EAAY,YAAY;GAAE;GAAa,YAAY;EAAE;EAAG,cAAc;CAAM,IAGtGC,EAASC,CAAU,IAMd;EACL,OAAOF;EACP,MAAM;EACN,YAAY;GAAE;GAAY,aAAa;EAAK;EAC5C,cAAcG,MAAa;CAC7B,IAGK;EAAE,OAAOH;EAAM,MAAM;EAAW,YAAY,CAAC;EAAG,cAAc;CAAM;AAC7E,GAcaI,KAAoB,GAAe,GAAgB,MAAiC;CAC/F,IAAI,CAAC,MAAM,QAAQV,CAAI,GACrB,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,kCAAkCC,CAAG;CAG7F,OAAOH;AACT"}
+{"version":3,"file":"listBody.js","names":["readListBody","isObject","body","AnzuApiResponseCodeError","status","url","isBoolean","hasNextPage","data","isNumber","totalCount","bigTable","readArrayBody"],"sources":["../../../../src/domains/api/utils/listBody.ts"],"sourcesContent":["import { AnzuApiResponseCodeError } from '@/shared/error/AnzuApiResponseCodeError'\nimport { isBoolean, isNumber, isObject } from '@/shared/utils/common'\nimport type { Pagination } from '@/domains/api/composables/pagination'\n\nexport type ListBody<T> = {\n  items: T[]\n  /**\n   * Which kind of list answered, read from the response, not inferred from `pagination`.\n   * `pagination` is what to write. For an infinite list it includes `totalCount: 0` to clear counted-mode leftovers.\n   * So reading the mode from `totalCount` sees a counted list of zero items. This caused a bug.\n   */\n  mode: 'counted' | 'infinite' | 'unknown'\n  /**\n   * The fields the response gave for its mode, plus the other mode's field cleared.\n   * A counted body gets `hasNextPage: null`, an infinite one\n   * `totalCount: 0`, so values from the previous query do not linger.\n   * A missing or malformed field of the mode's own kind is not written.\n   */\n  pagination: Partial<Pagination>\n  /**\n   * Whether `totalCount` is a bound rather than a count.\n   * With the backend's `bigTable` on (the default), the count is `offset\n   * + limit + 1`, a look-ahead meaning \"at least one more page\".\n   * It is the real total only when the page came back short.\n   * Fine for Next/Previous navigation. Wrong for anything that computes a page count from it.\n   */\n  countIsBound: boolean\n}\n\n/**\n * Reads a list response.\n * Only the `data` array decides whether this is a list. Older guards checked a metadata\n * key only, so `{ totalCount: 1 }` passed and callers got `undefined` as an array.\n * Metadata only picks the mode and is optional. A valid array is kept even if the count is missing or malformed.\n * `hasNextPage` decides the mode. The infinite envelope also carries a\n * deprecated `totalCount`, and the counted one never has `hasNextPage`.\n * Reading `totalCount` first would make every infinite list counted,\n * with a look-ahead sentinel `offset + limit + 1` as its total.\n */\nexport const readListBody = <T>(body: unknown, status: number, url: string | undefined): ListBody<T> => {\n  if (!isObject(body) || !Array.isArray((body as { data?: unknown }).data)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected a list body, url: ' + url)\n  }\n\n  const { data, totalCount, hasNextPage, bigTable } = body as {\n    data: T[]\n    totalCount?: unknown\n    hasNextPage?: unknown\n    bigTable?: unknown\n  }\n\n  if (isBoolean(hasNextPage)) {\n    return { items: data, mode: 'infinite', pagination: { hasNextPage, totalCount: 0 }, countIsBound: false }\n  }\n\n  if (isNumber(totalCount)) {\n    // `null`, not `false`. Paginators (`ADatatablePagination.vue`,\n    // `ASubjectSelect.vue`) treat any non-null value as an infinite list.\n    // `false` would mean \"infinite, no next page\": Next and Last go dead and the total shows the rows on screen.\n    // `null` means the counted list has no `hasNextPage`.\n    return {\n      items: data,\n      mode: 'counted',\n      pagination: { totalCount, hasNextPage: null },\n      countIsBound: bigTable === true,\n    }\n  }\n\n  return { items: data, mode: 'unknown', pagination: {}, countIsBound: false }\n}\n\n/**\n * Reads a list that arrived as a bare array.\n * Separate from `readListBody` on purpose. The caller declares the shape\n * its endpoint returns and the other shape is refused, like `optionalBody`.\n * A reader accepting both shapes would let malformed answers through.\n * Returns `T[]`, not `ListBody<T>`, because there is no envelope to name a mode.\n */\nexport const readArrayBody = <T>(body: unknown, status: number, url: string | undefined): T[] => {\n  if (!Array.isArray(body)) {\n    throw new AnzuApiResponseCodeError(status, undefined, 'Expected an array body, url: ' + url)\n  }\n\n  return body as T[]\n}\n"],"mappings":";;;AAuCA,IAAaA,KAAmB,GAAe,GAAgB,MAAyC;CACtG,IAAI,CAACC,EAASC,CAAI,KAAK,CAAC,MAAM,QAASA,EAA4B,IAAI,GACrE,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,gCAAgCC,CAAG;CAG3F,IAAM,EAAE,SAAM,eAAY,gBAAa,gBAAaH;CAwBpD,OAjBII,EAAUC,CAAW,IAChB;EAAE,OAAOC;EAAM,MAAM;EAAY,YAAY;GAAE;GAAa,YAAY;EAAE;EAAG,cAAc;CAAM,IAGtGC,EAASC,CAAU,IAKd;EACL,OAAOF;EACP,MAAM;EACN,YAAY;GAAE;GAAY,aAAa;EAAK;EAC5C,cAAcG,MAAa;CAC7B,IAGK;EAAE,OAAOH;EAAM,MAAM;EAAW,YAAY,CAAC;EAAG,cAAc;CAAM;AAC7E,GASaI,KAAoB,GAAe,GAAgB,MAAiC;CAC/F,IAAI,CAAC,MAAM,QAAQV,CAAI,GACrB,MAAM,IAAIC,EAAyBC,GAAQ,KAAA,GAAW,kCAAkCC,CAAG;CAG7F,OAAOH;AACT"}

package/dist/domains/auth/components/Acl.js.map

@@ -1 +1 @@
-{"version":3,"file":"Acl.js","names":["_sfc_main","Acl_vue_vue_type_script_setup_true_lang_default","Acl_default"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems are handled correctly --\n    // every system involved must be loaded, or the slot stays hidden -- but keeping them from one\n    // system is still the clearer thing to write.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher that latches on the first `true`: it re-evaluates when its own system's\n * current user arrives, and a permission taken away is taken away without a reload.\n *\n * This is the non-throwing variant of `can()`, for templates that may render before their system is\n * there -- `canSafeHelper` answers false where `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":""}
+{"version":3,"file":"Acl.js","names":["_sfc_main","Acl_vue_vue_type_script_setup_true_lang_default","Acl_default"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems work:\n    // every involved system must be loaded, or the slot stays hidden.\n    // Prefer values from one system for clarity.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher latching on the first `true`. It re-evaluates when its\n * system's current user arrives, and a revoked permission applies without a reload.\n * Uses `canSafeHelper` because the template may render before its system is loaded. `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":""}

package/dist/domains/auth/components/Acl.vue_vue_type_script_setup_true_lang.js.map

@@ -1 +1 @@
-{"version":3,"file":"Acl.vue_vue_type_script_setup_true_lang.js","names":["_renderSlot","_createCommentVNode","Acl_vue_vue_type_script_setup_true_lang_default","props","__props","useAuthHelpers","allowed","computed","canSafeHelper","renderSlot","_ctx","createCommentVNode"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems are handled correctly --\n    // every system involved must be loaded, or the slot stays hidden -- but keeping them from one\n    // system is still the clearer thing to write.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher that latches on the first `true`: it re-evaluates when its own system's\n * current user arrives, and a permission taken away is taken away without a reload.\n *\n * This is the non-throwing variant of `can()`, for templates that may render before their system is\n * there -- `canSafeHelper` answers false where `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":";;;;;;;;;;EAKA,IAAMG,IAAQC,GAaR,EAAE,qBAAkBC,EAA0B,GAS9CC,IAAUC,QAAwBC,EAAcL,EAAM,YAAYA,EAAM,SAAS,KAAK,CAAC;E,iBAI/EG,EAAA,QAAZN,EAAuBU,EAAA,QAAA,WAAA,CAAA,GAAA,KAAA,GAAA,KAAA,GAAA,CAAA,I"}
+{"version":3,"file":"Acl.vue_vue_type_script_setup_true_lang.js","names":["_renderSlot","_createCommentVNode","Acl_vue_vue_type_script_setup_true_lang_default","props","__props","useAuthHelpers","allowed","computed","canSafeHelper","renderSlot","_ctx","createCommentVNode"],"sources":["../../../../src/domains/auth/components/Acl.vue"],"sourcesContent":["<script lang=\"ts\" setup generic=\"TAclValue extends RegisteredAclValue\">\nimport { computed } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\n\nconst props = withDefaults(\n  defineProps<{\n    // An array is evaluated with AND. Values from different systems work:\n    // every involved system must be loaded, or the slot stays hidden.\n    // Prefer values from one system for clarity.\n    permission: TAclValue | TAclValue[]\n    subject?: object\n  }>(),\n  {\n    subject: undefined,\n  }\n)\n\nconst { canSafeHelper } = useAuthHelpers<TAclValue>()\n\n/**\n * A computed, not a watcher latching on the first `true`. It re-evaluates when its\n * system's current user arrives, and a revoked permission applies without a reload.\n * Uses `canSafeHelper` because the template may render before its system is loaded. `canHelper` would throw.\n */\nconst allowed = computed<boolean>(() => canSafeHelper(props.permission, props.subject, 'Acl'))\n</script>\n\n<template>\n  <slot v-if=\"allowed\" />\n</template>\n"],"mappings":";;;;;;;;;;EAKA,IAAMG,IAAQC,GAaR,EAAE,qBAAkBC,EAA0B,GAO9CC,IAAUC,QAAwBC,EAAcL,EAAM,YAAYA,EAAM,SAAS,KAAK,CAAC;E,iBAI/EG,EAAA,QAAZN,EAAuBU,EAAA,QAAA,WAAA,CAAA,GAAA,KAAA,GAAA,KAAA,GAAA,CAAA,I"}

package/dist/domains/auth/composables/aclAllowed.d.ts

@@ -1,8 +1,7 @@
 import { ComputedRef, MaybeRefOrGetter } from 'vue';
 import { RegisteredAclValue } from '../types/Permission';
 /**
- * Whether a component guarded by an optional ACL may show itself. No ACL means no guard, so a component
- * that takes one keeps its old behaviour for callers that pass none. The check never throws (see
- * `canSafeHelper`).
+ * Whether a component guarded by an optional ACL may show itself.
+ * No ACL means no guard, so callers that pass none keep the old behaviour. Never throws (see `canSafeHelper`).
  */
 export declare function useAclAllowed(acl: MaybeRefOrGetter<RegisteredAclValue | RegisteredAclValue[] | undefined>, subject?: MaybeRefOrGetter<object | undefined>): ComputedRef<boolean>;

package/dist/domains/auth/composables/aclAllowed.js.map

@@ -1 +1 @@
-{"version":3,"file":"aclAllowed.js","names":["useAclAllowed","useAuthHelpers","computed","value","toValue","acl","isUndefined","canSafeHelper","subject"],"sources":["../../../../src/domains/auth/composables/aclAllowed.ts"],"sourcesContent":["import { computed, type ComputedRef, type MaybeRefOrGetter, toValue } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\nimport { isUndefined } from '@/shared/utils/common'\n\n/**\n * Whether a component guarded by an optional ACL may show itself. No ACL means no guard, so a component\n * that takes one keeps its old behaviour for callers that pass none. The check never throws (see\n * `canSafeHelper`).\n */\nexport function useAclAllowed(\n  acl: MaybeRefOrGetter<RegisteredAclValue | RegisteredAclValue[] | undefined>,\n  subject: MaybeRefOrGetter<object | undefined> = undefined\n): ComputedRef<boolean> {\n  const { canSafeHelper } = useAuthHelpers<RegisteredAclValue>()\n\n  return computed(() => {\n    const value = toValue(acl)\n    if (isUndefined(value)) return true\n\n    return canSafeHelper(value, toValue(subject))\n  })\n}\n"],"mappings":";;;;AAUA,SAAgBA,EACd,GACA,IAAgD,KAAA,GAC1B;CACtB,IAAM,EAAE,qBAAkBC,EAAmC;CAE7D,OAAOC,QAAe;EACpB,IAAMC,IAAQC,EAAQC,CAAG;EAGzB,OAFIC,EAAYH,CAAK,IAAU,KAExBI,EAAcJ,GAAOC,EAAQI,CAAO,CAAC;CAC9C,CAAC;AACH"}
+{"version":3,"file":"aclAllowed.js","names":["useAclAllowed","useAuthHelpers","computed","value","toValue","acl","isUndefined","canSafeHelper","subject"],"sources":["../../../../src/domains/auth/composables/aclAllowed.ts"],"sourcesContent":["import { computed, type ComputedRef, type MaybeRefOrGetter, toValue } from 'vue'\nimport type { RegisteredAclValue } from '@/domains/auth/types/Permission'\nimport { useAuthHelpers } from '@/domains/auth/composables/defineAuth'\nimport { isUndefined } from '@/shared/utils/common'\n\n/**\n * Whether a component guarded by an optional ACL may show itself.\n * No ACL means no guard, so callers that pass none keep the old behaviour. Never throws (see `canSafeHelper`).\n */\nexport function useAclAllowed(\n  acl: MaybeRefOrGetter<RegisteredAclValue | RegisteredAclValue[] | undefined>,\n  subject: MaybeRefOrGetter<object | undefined> = undefined\n): ComputedRef<boolean> {\n  const { canSafeHelper } = useAuthHelpers<RegisteredAclValue>()\n\n  return computed(() => {\n    const value = toValue(acl)\n    if (isUndefined(value)) return true\n\n    return canSafeHelper(value, toValue(subject))\n  })\n}\n"],"mappings":";;;;AASA,SAAgBA,EACd,GACA,IAAgD,KAAA,GAC1B;CACtB,IAAM,EAAE,qBAAkBC,EAAmC;CAE7D,OAAOC,QAAe;EACpB,IAAMC,IAAQC,EAAQC,CAAG;EAGzB,OAFIC,EAAYH,CAAK,IAAU,KAExBI,EAAcJ,GAAOC,EAAQI,CAAO,CAAC;CAC9C,CAAC;AACH"}

package/dist/domains/auth/composables/defineAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"defineAuth.js","names":["ROLE_SUPER_ADMIN","defaultConfig","defineAuth","mergedConfig","config","authStore","useAuthStore","useAuthHelpers","isAdmin","isAdminHelper","userRoles","system","can","canHelper","acl","subject","canOwner","canOwnerHelper","mainCurrentUserSystem","canForAll","canForAllHelper","acls","canSafe","canSafeHelper","canForSome","currentUserId","computed","user","userIsLoaded","isUndefined","isNull","useCurrentUser","setCurrentUser","currentUser","isCurrentUserLoaded","isSuperAdmin","hasCurrentUser","isAnonymous","storeAdminRoleBySystem","isArray","found","role","useApiRequest","res","execute","endPoint","error","options","getSystemFromAcl","permission","objectGetValueByPath","Grant","adminRole","isOwnerAware","isCreatedByAware","value","key","warnOnceInDevelopment","label"],"sources":["../../../../src/domains/auth/composables/defineAuth.ts"],"sourcesContent":["import { computed } from 'vue'\nimport { useAuthStore } from '@/domains/auth/store/authStore'\nimport { type AxiosInstance } from 'axios'\nimport type { AclValue } from '@/domains/auth/types/Permission'\nimport { isArray, isNull, isUndefined } from '@/shared/utils/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { warnOnceInDevelopment } from '@/shared/utils/development'\nimport { Grant } from '@/domains/auth/valueObject/Grant'\nimport { isOwnerAware } from '@/shared/types/OwnerAware'\nimport { isCreatedByAware } from '@/shared/types/CreatedByAware'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\nimport type { UrlParams } from '@/domains/api/utils/apiHelper'\nimport { useApiRequest } from '@/domains/api/composables/useApiRequest'\n\nexport type DefineAuthConfig = {\n  adminRole: string | Array<{ system: string; adminRole: string }>\n}\n\nexport const ROLE_SUPER_ADMIN = 'ROLE_SUPER_ADMIN'\n\nconst defaultConfig: DefineAuthConfig = {\n  adminRole: ROLE_SUPER_ADMIN,\n}\n\n/**\n * @param mainCurrentUserSystem - By this system currentUser object is used to get user ID.\n * @param config\n */\nexport function defineAuth<TAclValue extends AclValue>(\n  mainCurrentUserSystem: string,\n  config: Partial<DefineAuthConfig> = {}\n) {\n  const mergedConfig = { ...defaultConfig, ...config }\n  const authStore = useAuthStore()\n  const { canHelper, canForAllHelper, canOwnerHelper, isAdminHelper, canSafeHelper } = useAuthHelpers()\n\n  const isAdmin = (userRoles: string[], system: string) => {\n    return isAdminHelper(userRoles, system)\n  }\n\n  const can = (acl: TAclValue, subject?: object) => {\n    return canHelper(acl, subject)\n  }\n\n  function canOwner(subject: object) {\n    return canOwnerHelper(subject, mainCurrentUserSystem)\n  }\n\n  const canForAll = (acls: TAclValue[], subject?: object) => {\n    return canForAllHelper(acls, subject)\n  }\n\n  /** `can()` and `canForAll()` that never throw -- for templates and route guards. See `canSafeHelper`. */\n  const canSafe = (acl: TAclValue | TAclValue[], subject?: object) => {\n    return canSafeHelper(acl, subject)\n  }\n\n  const canForSome = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.some((acl) => {\n      return can(acl, subject)\n    })\n  }\n\n  const currentUserId = computed(() => {\n    const user = authStore.getCurrentUserBySystem(mainCurrentUserSystem)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(mainCurrentUserSystem)\n    if (isUndefined(userIsLoaded)) {\n      return undefined\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return undefined\n    }\n    return user.id\n  })\n\n  function useCurrentUser<TCurrentUser extends AnzuUser | undefined>(system: string) {\n    const setCurrentUser = (user: TCurrentUser) => {\n      authStore.currentUsers.value.set(system, user)\n      authStore.currentUsersLoaded.value.set(system, true)\n    }\n\n    const currentUser = computed((): TCurrentUser | undefined => {\n      return authStore.currentUsers.value.get(system) as TCurrentUser | undefined\n    })\n\n    const isCurrentUserLoaded = computed((): boolean | undefined => {\n      return authStore.currentUsersLoaded.value.get(system) as boolean | undefined\n    })\n\n    const isSuperAdmin = computed(() => {\n      if (currentUser.value) {\n        return isAdmin(currentUser.value.roles, system)\n      }\n      return false\n    })\n\n    const hasCurrentUser = computed(() => {\n      return currentUser.value ?? false\n    })\n\n    const isAnonymous = computed(() => {\n      if (isUndefined(isCurrentUserLoaded.value)) return undefined\n      return !hasCurrentUser.value\n    })\n\n    const storeAdminRoleBySystem = () => {\n      if (isArray(mergedConfig.adminRole)) {\n        const found = mergedConfig.adminRole.find((role) => role.system === system)\n        if (found) {\n          authStore.isAdminRoleBySystem.value.set(system, found.adminRole)\n        }\n      } else {\n        authStore.isAdminRoleBySystem.value.set(system, mergedConfig.adminRole)\n      }\n    }\n\n    /**\n     * Answers `undefined` for every failure by default, which loses the reason. `throwOnError`\n     * hands the original error back, for callers that must tell a lost session from a dead backend.\n     *\n     * A failure leaves `currentUser` as it was: unset before the first successful load, the previous\n     * user on a later call, whose permissions `can()` then keeps answering from. The system still\n     * counts as loaded either way, so `can()` does not throw for a system that was never loaded.\n     */\n    const fetchCurrentUser = async (\n      client: () => AxiosInstance,\n      endPoint = '/adm/v1/users/current',\n      urlParams: UrlParams | undefined = undefined,\n      entity = 'user',\n      options: { throwOnError?: boolean } = {}\n    ) => {\n      try {\n        // `useApiRequest`, not the older `apiFetchOne`: it is where the fleet is going, and it is\n        // the difference between a failure arriving as a bare `AnzuFatalError` and arriving as the\n        // error it actually was -- `AnzuApiAxiosError` with the response on its cause, or\n        // `AnzuApiTimeoutError`. A caller passing `throwOnError` can only tell a dead session from\n        // a dead backend if the error says which it was.\n        const { execute } = useApiRequest<NonNullable<TCurrentUser>>({\n          client,\n          method: 'GET',\n          system,\n          entity,\n        })\n        const res = await execute({ urlTemplate: endPoint, urlParams })\n        setCurrentUser(res)\n        authStore.currentUsersLoaded.value.set(system, true)\n        storeAdminRoleBySystem()\n        return currentUser.value\n      } catch (error) {\n        // Set before rethrowing too, or `can()` throws \"must try to load currentUser first\".\n        authStore.currentUsersLoaded.value.set(system, true)\n        if (options.throwOnError) throw error\n        return undefined\n      }\n    }\n\n    return {\n      currentUser,\n      setCurrentUser,\n      // `undefined` until something has tried to load this system, which is the one state\n      // `currentUser` alone cannot tell apart from \"loaded, but there is no such user\".\n      isCurrentUserLoaded,\n      isSuperAdmin,\n      isAnonymous,\n      hasCurrentUser,\n      fetchCurrentUser,\n    }\n  }\n\n  return {\n    can,\n    canForAll,\n    canForSome,\n    canSafe,\n    canOwner,\n    useCurrentUser,\n    currentUserId,\n    config: mergedConfig,\n  }\n}\n\nexport function useAuthHelpers<TAclValue extends AclValue>() {\n  const authStore = useAuthStore()\n\n  const canHelper = (acl: TAclValue, subject: object | undefined) => {\n    const system = getSystemFromAcl(acl)\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use can function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isAdminHelper(user.roles, system)) return true\n    const permission = objectGetValueByPath(user, 'resolvedPermissions.' + acl)\n    if (isUndefined(permission)) return false\n    switch (permission) {\n      case Grant.Allow:\n        return true\n      case Grant.Deny:\n        return false\n      case Grant.AllowOwner:\n        if (isUndefined(subject))\n          throw new Error(`Required subject for acl \"${acl}\" to determine an ability to access the resource.`)\n        return canOwnerHelper(subject, system)\n      default:\n        return false\n    }\n  }\n\n  const canForAllHelper = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.every((acl) => {\n      return canHelper(acl, subject)\n    })\n  }\n\n  const isAdminHelper = (userRoles: string[], system: string) => {\n    const authStore = useAuthStore()\n    const adminRole = authStore.getAdminRoleBySystem(system)\n    if (isUndefined(adminRole)) return false\n\n    return userRoles.includes(adminRole)\n  }\n\n  function canOwnerHelper(subject: object, system: string) {\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use canOwner function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isOwnerAware(subject)) {\n      return subject.owners.includes(user.id)\n    }\n    if (isCreatedByAware(subject)) {\n      return subject.createdBy === user.id\n    }\n    return false\n  }\n\n  /**\n   * `canForAll` that answers false instead of throwing: for a system nothing has tried to load yet, which a\n   * template or a route guard may reach first, and for a check that throws, such as an `allowOwner` grant\n   * with no subject. An array is evaluated with AND.\n   *\n   * Reading each system's current user tracks that key, so a render or a computed re-evaluates when its\n   * own system arrives.\n   */\n  const canSafeHelper = (acl: TAclValue | TAclValue[], subject?: object, label = 'canSafe'): boolean => {\n    const acls = isArray(acl) ? acl : [acl]\n    if (acls.length === 0) {\n      return true\n    }\n    for (const system of acls.map((value) => getSystemFromAcl(value))) {\n      authStore.currentUsers.value.get(system)\n      if (isUndefined(authStore.isCurrentUserLoadedBySystem(system))) {\n        return false\n      }\n    }\n    try {\n      return canForAllHelper(acls, subject)\n    } catch (error) {\n      // Denied either way; without a word it looks exactly like a missing permission.\n      const key = acls.join(', ')\n      warnOnceInDevelopment(`${label}:${key}`, `[${label}] the check of ${key} threw, so it is denied:`, error)\n      return false\n    }\n  }\n\n  return {\n    canHelper,\n    canForAllHelper,\n    canOwnerHelper,\n    isAdminHelper,\n    canSafeHelper,\n  }\n}\n\n/** An ACL value carries its system in front of the first underscore: `weather_location_ui`. */\nexport function getSystemFromAcl(acl: any) {\n  const parts = acl.split('_')\n\n  return parts[0]\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaA,IAAmB,oBAE1BC,IAAkC,EACtC,WAAWD,EACb;AAMA,SAAgBE,EACd,GACA,IAAoC,CAAC,GACrC;CACA,IAAMC,IAAe;EAAE,GAAGF;EAAe,GAAGG;CAAO,GAC7CC,IAAYC,EAAa,GACzB,EAAE,cAAW,oBAAiB,mBAAgB,kBAAe,qBAAkBC,EAAe,GAE9FC,KAAW,GAAqB,MAC7BC,EAAcC,GAAWC,CAAM,GAGlCC,KAAO,GAAgB,MACpBC,EAAUC,GAAKC,CAAO;CAG/B,SAASC,EAAS,GAAiB;EACjC,OAAOC,EAAeF,GAASG,CAAqB;CACtD;CAEA,IAAMC,KAAa,GAAmB,MAC7BC,EAAgBC,GAAMN,CAAO,GAIhCO,KAAW,GAA8B,MACtCC,EAAcT,GAAKC,CAAO,GAG7BS,KAAc,GAAmB,MACjCH,EAAK,WAAW,KAGbA,EAAK,MAAM,MACTT,EAAIE,GAAKC,CAAO,CACxB,GAGGU,IAAgBC,QAAe;EACnC,IAAMC,IAAOtB,EAAU,uBAAuBa,CAAqB,GAC7DU,IAAevB,EAAU,4BAA4Ba,CAAqB;EAChF,IAAI,GAAYU,CAAY,KAGxB,IAAYD,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IAGhF,OAAOA,EAAK;CACd,CAAC;CAED,SAASI,EAA0D,GAAgB;EACjF,IAAMC,KAAkB,MAAuB;GAE7C,AADA3B,EAAU,aAAa,MAAM,IAAIM,GAAQgB,CAAI,GAC7CtB,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI;EACrD,GAEMsB,IAAcP,QACXrB,EAAU,aAAa,MAAM,IAAIM,CAAM,CAC/C,GAEKuB,IAAsBR,QACnBrB,EAAU,mBAAmB,MAAM,IAAIM,CAAM,CACrD,GAEKwB,IAAeT,QACfO,EAAY,QACPzB,EAAQyB,EAAY,MAAM,OAAOtB,CAAM,IAEzC,EACR,GAEKyB,IAAiBV,QACdO,EAAY,SAAS,EAC7B,GAEKI,IAAcX,QAAe;GACjC,IAAI,GAAYQ,EAAoB,KAAK,GACzC,OAAO,CAACE,EAAe;EACzB,CAAC,GAEKE,UAA+B;GACnC,IAAIC,EAAQpC,EAAa,SAAS,GAAG;IACnC,IAAMqC,IAAQrC,EAAa,UAAU,MAAM,MAASsC,EAAK,WAAW9B,CAAM;IAC1E,AAAI6B,KACFnC,EAAU,oBAAoB,MAAM,IAAIM,GAAQ6B,EAAM,SAAS;GAEnE,OACE,EAAU,oBAAoB,MAAM,IAAI7B,GAAQR,EAAa,SAAS;EAE1E;EA0CA,OAAO;GACL;GACA;GAGA;GACA;GACA;GACA;GACA,yBAxCA,GACA,IAAW,yBACX,IAAmC,KAAA,GACnC,IAAS,QACT,IAAsC,CAAC,MACpC;IACH,IAAI;KAMF,IAAM,EAAE,eAAYuC,EAAyC;MAC3D;MACA,QAAQ;MACR;MACA;KACF,CAAC,GACKC,IAAM,MAAMC,EAAQ;MAAE,aAAaC;MAAU;KAAU,CAAC;KAI9D,OAHAb,EAAeW,CAAG,GAClBtC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GACnD2B,EAAuB,GAChBL,EAAY;IACrB,SAASa,GAAO;KAGd,IADAzC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GAC/CoC,EAAQ,cAAc,MAAMD;KAChC;IACF;GACF;EAYA;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ3C;CACV;AACF;AAEA,SAAgBI,IAA6C;CAC3D,IAAMF,IAAYC,EAAa,GAEzBO,KAAa,GAAgB,MAAgC;EACjE,IAAMF,IAASqC,EAAiBlC,CAAG,GAC7Ba,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,+EAA+E;EAEjG,IAAIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,GAC9E,OAAO;EAET,IAAIlB,EAAckB,EAAK,OAAOhB,CAAM,GAAG,OAAO;EAC9C,IAAMsC,IAAaC,EAAqBvB,GAAM,yBAAyBb,CAAG;EAC1E,IAAIe,EAAYoB,CAAU,GAAG,OAAO;EACpC,QAAQA,GAAR;GACE,KAAKE,EAAM,OACT,OAAO;GACT,KAAKA,EAAM,MACT,OAAO;GACT,KAAKA,EAAM;IACT,IAAItB,EAAYd,CAAO,GACrB,MAAU,MAAM,6BAA6BD,EAAI,kDAAkD;IACrG,OAAOG,EAAeF,GAASJ,CAAM;GACvC,SACE,OAAO;EACX;CACF,GAEMS,KAAmB,GAAmB,MACtCC,EAAK,WAAW,KAGbA,EAAK,OAAO,MACVR,EAAUC,GAAKC,CAAO,CAC9B,GAGGN,KAAiB,GAAqB,MAAmB;EAE7D,IAAM2C,IADY9C,EACA,CAAA,CAAU,qBAAqBK,CAAM;EAGvD,OAFA,CAAIkB,EAAYuB,CAAS,KAElB1C,EAAU,SAAS0C,CAAS;CACrC;CAEA,SAASnC,EAAe,GAAiB,GAAgB;EACvD,IAAMU,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,oFAAoF;EAWtG,OATIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IACvE,KAEL0B,EAAatC,CAAO,IACfA,EAAQ,OAAO,SAASY,EAAK,EAAE,IAEpC2B,EAAiBvC,CAAO,IACnBA,EAAQ,cAAcY,EAAK,KAE7B;CACT;CA+BA,OAAO;EACL;EACA;EACA;EACA;EACA,gBA1BqB,GAA8B,GAAkB,IAAQ,cAAuB;GACpG,IAAMN,IAAOkB,EAAQzB,CAAG,IAAIA,IAAM,CAACA,CAAG;GACtC,IAAIO,EAAK,WAAW,GAClB,OAAO;GAET,KAAK,IAAMV,KAAUU,EAAK,KAAK,MAAU2B,EAAiBO,CAAK,CAAC,GAE9D,IADAlD,EAAU,aAAa,MAAM,IAAIM,CAAM,GACnCkB,EAAYxB,EAAU,4BAA4BM,CAAM,CAAC,GAC3D,OAAO;GAGX,IAAI;IACF,OAAOS,EAAgBC,GAAMN,CAAO;GACtC,SAAS+B,GAAO;IAEd,IAAMU,IAAMnC,EAAK,KAAK,IAAI;IAE1B,OADAoC,EAAsB,GAAGC,EAAM,GAAGF,KAAO,IAAIE,EAAM,iBAAiBF,EAAI,2BAA2BV,CAAK,GACjG;GACT;EACF;CAQA;AACF;AAGA,SAAgBE,EAAiB,GAAU;CAGzC,OAFclC,EAAI,MAAM,GAEjB,CAAA,CAAM;AACf"}
+{"version":3,"file":"defineAuth.js","names":["ROLE_SUPER_ADMIN","defaultConfig","defineAuth","mergedConfig","config","authStore","useAuthStore","useAuthHelpers","isAdmin","isAdminHelper","userRoles","system","can","canHelper","acl","subject","canOwner","canOwnerHelper","mainCurrentUserSystem","canForAll","canForAllHelper","acls","canSafe","canSafeHelper","canForSome","currentUserId","computed","user","userIsLoaded","isUndefined","isNull","useCurrentUser","setCurrentUser","currentUser","isCurrentUserLoaded","isSuperAdmin","hasCurrentUser","isAnonymous","storeAdminRoleBySystem","isArray","found","role","useApiRequest","res","execute","endPoint","error","options","getSystemFromAcl","permission","objectGetValueByPath","Grant","adminRole","isOwnerAware","isCreatedByAware","value","key","warnOnceInDevelopment","label"],"sources":["../../../../src/domains/auth/composables/defineAuth.ts"],"sourcesContent":["import { computed } from 'vue'\nimport { useAuthStore } from '@/domains/auth/store/authStore'\nimport { type AxiosInstance } from 'axios'\nimport type { AclValue } from '@/domains/auth/types/Permission'\nimport { isArray, isNull, isUndefined } from '@/shared/utils/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { warnOnceInDevelopment } from '@/shared/utils/development'\nimport { Grant } from '@/domains/auth/valueObject/Grant'\nimport { isOwnerAware } from '@/shared/types/OwnerAware'\nimport { isCreatedByAware } from '@/shared/types/CreatedByAware'\nimport type { AnzuUser } from '@/shared/types/AnzuUser'\nimport type { UrlParams } from '@/domains/api/utils/apiHelper'\nimport { useApiRequest } from '@/domains/api/composables/useApiRequest'\n\nexport type DefineAuthConfig = {\n  adminRole: string | Array<{ system: string; adminRole: string }>\n}\n\nexport const ROLE_SUPER_ADMIN = 'ROLE_SUPER_ADMIN'\n\nconst defaultConfig: DefineAuthConfig = {\n  adminRole: ROLE_SUPER_ADMIN,\n}\n\n/**\n * @param mainCurrentUserSystem - By this system currentUser object is used to get user ID.\n * @param config\n */\nexport function defineAuth<TAclValue extends AclValue>(\n  mainCurrentUserSystem: string,\n  config: Partial<DefineAuthConfig> = {}\n) {\n  const mergedConfig = { ...defaultConfig, ...config }\n  const authStore = useAuthStore()\n  const { canHelper, canForAllHelper, canOwnerHelper, isAdminHelper, canSafeHelper } = useAuthHelpers()\n\n  const isAdmin = (userRoles: string[], system: string) => {\n    return isAdminHelper(userRoles, system)\n  }\n\n  const can = (acl: TAclValue, subject?: object) => {\n    return canHelper(acl, subject)\n  }\n\n  function canOwner(subject: object) {\n    return canOwnerHelper(subject, mainCurrentUserSystem)\n  }\n\n  const canForAll = (acls: TAclValue[], subject?: object) => {\n    return canForAllHelper(acls, subject)\n  }\n\n  /** `can()` and `canForAll()` that never throw -- for templates and route guards. See `canSafeHelper`. */\n  const canSafe = (acl: TAclValue | TAclValue[], subject?: object) => {\n    return canSafeHelper(acl, subject)\n  }\n\n  const canForSome = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.some((acl) => {\n      return can(acl, subject)\n    })\n  }\n\n  const currentUserId = computed(() => {\n    const user = authStore.getCurrentUserBySystem(mainCurrentUserSystem)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(mainCurrentUserSystem)\n    if (isUndefined(userIsLoaded)) {\n      return undefined\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return undefined\n    }\n    return user.id\n  })\n\n  function useCurrentUser<TCurrentUser extends AnzuUser | undefined>(system: string) {\n    const setCurrentUser = (user: TCurrentUser) => {\n      authStore.currentUsers.value.set(system, user)\n      authStore.currentUsersLoaded.value.set(system, true)\n    }\n\n    const currentUser = computed((): TCurrentUser | undefined => {\n      return authStore.currentUsers.value.get(system) as TCurrentUser | undefined\n    })\n\n    const isCurrentUserLoaded = computed((): boolean | undefined => {\n      return authStore.currentUsersLoaded.value.get(system) as boolean | undefined\n    })\n\n    const isSuperAdmin = computed(() => {\n      if (currentUser.value) {\n        return isAdmin(currentUser.value.roles, system)\n      }\n      return false\n    })\n\n    const hasCurrentUser = computed(() => {\n      return currentUser.value ?? false\n    })\n\n    const isAnonymous = computed(() => {\n      if (isUndefined(isCurrentUserLoaded.value)) return undefined\n      return !hasCurrentUser.value\n    })\n\n    const storeAdminRoleBySystem = () => {\n      if (isArray(mergedConfig.adminRole)) {\n        const found = mergedConfig.adminRole.find((role) => role.system === system)\n        if (found) {\n          authStore.isAdminRoleBySystem.value.set(system, found.adminRole)\n        }\n      } else {\n        authStore.isAdminRoleBySystem.value.set(system, mergedConfig.adminRole)\n      }\n    }\n\n    /**\n     * Returns `undefined` on any failure by default, which loses the reason.\n     * `throwOnError` rethrows the original error, so callers can tell a lost session from a dead backend.\n     * A failure leaves `currentUser` unchanged, so `can()` keeps using the previous user's permissions.\n     * The system still counts as loaded, so `can()` does not throw.\n     */\n    const fetchCurrentUser = async (\n      client: () => AxiosInstance,\n      endPoint = '/adm/v1/users/current',\n      urlParams: UrlParams | undefined = undefined,\n      entity = 'user',\n      options: { throwOnError?: boolean } = {}\n    ) => {\n      try {\n        // Uses `useApiRequest`, not `apiFetchOne`. `apiFetchOne` wraps failures in a bare `AnzuFatalError`.\n        // Callers with `throwOnError` need the real error (`AnzuApiAxiosError`\n        // or `AnzuApiTimeoutError`) to tell a dead session from a dead backend.\n        const { execute } = useApiRequest<NonNullable<TCurrentUser>>({\n          client,\n          method: 'GET',\n          system,\n          entity,\n        })\n        const res = await execute({ urlTemplate: endPoint, urlParams })\n        setCurrentUser(res)\n        authStore.currentUsersLoaded.value.set(system, true)\n        storeAdminRoleBySystem()\n        return currentUser.value\n      } catch (error) {\n        // Set before rethrowing too, or `can()` throws \"must try to load currentUser first\".\n        authStore.currentUsersLoaded.value.set(system, true)\n        if (options.throwOnError) throw error\n        return undefined\n      }\n    }\n\n    return {\n      currentUser,\n      setCurrentUser,\n      // `undefined` until something tries to load this system.\n      // `currentUser` alone cannot tell this apart from \"loaded, but no such user\".\n      isCurrentUserLoaded,\n      isSuperAdmin,\n      isAnonymous,\n      hasCurrentUser,\n      fetchCurrentUser,\n    }\n  }\n\n  return {\n    can,\n    canForAll,\n    canForSome,\n    canSafe,\n    canOwner,\n    useCurrentUser,\n    currentUserId,\n    config: mergedConfig,\n  }\n}\n\nexport function useAuthHelpers<TAclValue extends AclValue>() {\n  const authStore = useAuthStore()\n\n  const canHelper = (acl: TAclValue, subject: object | undefined) => {\n    const system = getSystemFromAcl(acl)\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use can function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isAdminHelper(user.roles, system)) return true\n    const permission = objectGetValueByPath(user, 'resolvedPermissions.' + acl)\n    if (isUndefined(permission)) return false\n    switch (permission) {\n      case Grant.Allow:\n        return true\n      case Grant.Deny:\n        return false\n      case Grant.AllowOwner:\n        if (isUndefined(subject))\n          throw new Error(`Required subject for acl \"${acl}\" to determine an ability to access the resource.`)\n        return canOwnerHelper(subject, system)\n      default:\n        return false\n    }\n  }\n\n  const canForAllHelper = (acls: TAclValue[], subject?: object) => {\n    if (acls.length === 0) {\n      return true\n    }\n    return acls.every((acl) => {\n      return canHelper(acl, subject)\n    })\n  }\n\n  const isAdminHelper = (userRoles: string[], system: string) => {\n    const authStore = useAuthStore()\n    const adminRole = authStore.getAdminRoleBySystem(system)\n    if (isUndefined(adminRole)) return false\n\n    return userRoles.includes(adminRole)\n  }\n\n  function canOwnerHelper(subject: object, system: string) {\n    const user = authStore.getCurrentUserBySystem(system)\n    const userIsLoaded = authStore.isCurrentUserLoadedBySystem(system)\n    if (isUndefined(userIsLoaded)) {\n      throw new Error('Composable defineAuth must try to load currentUser first to use canOwner function.')\n    }\n    if (isUndefined(user) || isUndefined(user.id) || isNull(user.id) || user.id === 0) {\n      return false\n    }\n    if (isOwnerAware(subject)) {\n      return subject.owners.includes(user.id)\n    }\n    if (isCreatedByAware(subject)) {\n      return subject.createdBy === user.id\n    }\n    return false\n  }\n\n  /**\n   * `canForAll` that returns false instead of throwing.\n   * Covers a system not loaded yet (templates and route guards may get there\n   * first) and checks that throw, such as an `allowOwner` grant with no subject.\n   * An array is evaluated with AND. Reading each system's current user\n   * makes a render or computed re-evaluate when that system loads.\n   */\n  const canSafeHelper = (acl: TAclValue | TAclValue[], subject?: object, label = 'canSafe'): boolean => {\n    const acls = isArray(acl) ? acl : [acl]\n    if (acls.length === 0) {\n      return true\n    }\n    for (const system of acls.map((value) => getSystemFromAcl(value))) {\n      authStore.currentUsers.value.get(system)\n      if (isUndefined(authStore.isCurrentUserLoadedBySystem(system))) {\n        return false\n      }\n    }\n    try {\n      return canForAllHelper(acls, subject)\n    } catch (error) {\n      // Denied either way. Without the warning it looks like a missing permission.\n      const key = acls.join(', ')\n      warnOnceInDevelopment(`${label}:${key}`, `[${label}] the check of ${key} threw, so it is denied:`, error)\n      return false\n    }\n  }\n\n  return {\n    canHelper,\n    canForAllHelper,\n    canOwnerHelper,\n    isAdminHelper,\n    canSafeHelper,\n  }\n}\n\n/** An ACL value carries its system in front of the first underscore: `weather_location_ui`. */\nexport function getSystemFromAcl(acl: any) {\n  const parts = acl.split('_')\n\n  return parts[0]\n}\n"],"mappings":";;;;;;;;;;;AAkBA,IAAaA,IAAmB,oBAE1BC,IAAkC,EACtC,WAAWD,EACb;AAMA,SAAgBE,EACd,GACA,IAAoC,CAAC,GACrC;CACA,IAAMC,IAAe;EAAE,GAAGF;EAAe,GAAGG;CAAO,GAC7CC,IAAYC,EAAa,GACzB,EAAE,cAAW,oBAAiB,mBAAgB,kBAAe,qBAAkBC,EAAe,GAE9FC,KAAW,GAAqB,MAC7BC,EAAcC,GAAWC,CAAM,GAGlCC,KAAO,GAAgB,MACpBC,EAAUC,GAAKC,CAAO;CAG/B,SAASC,EAAS,GAAiB;EACjC,OAAOC,EAAeF,GAASG,CAAqB;CACtD;CAEA,IAAMC,KAAa,GAAmB,MAC7BC,EAAgBC,GAAMN,CAAO,GAIhCO,KAAW,GAA8B,MACtCC,EAAcT,GAAKC,CAAO,GAG7BS,KAAc,GAAmB,MACjCH,EAAK,WAAW,KAGbA,EAAK,MAAM,MACTT,EAAIE,GAAKC,CAAO,CACxB,GAGGU,IAAgBC,QAAe;EACnC,IAAMC,IAAOtB,EAAU,uBAAuBa,CAAqB,GAC7DU,IAAevB,EAAU,4BAA4Ba,CAAqB;EAChF,IAAI,GAAYU,CAAY,KAGxB,IAAYD,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IAGhF,OAAOA,EAAK;CACd,CAAC;CAED,SAASI,EAA0D,GAAgB;EACjF,IAAMC,KAAkB,MAAuB;GAE7C,AADA3B,EAAU,aAAa,MAAM,IAAIM,GAAQgB,CAAI,GAC7CtB,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI;EACrD,GAEMsB,IAAcP,QACXrB,EAAU,aAAa,MAAM,IAAIM,CAAM,CAC/C,GAEKuB,IAAsBR,QACnBrB,EAAU,mBAAmB,MAAM,IAAIM,CAAM,CACrD,GAEKwB,IAAeT,QACfO,EAAY,QACPzB,EAAQyB,EAAY,MAAM,OAAOtB,CAAM,IAEzC,EACR,GAEKyB,IAAiBV,QACdO,EAAY,SAAS,EAC7B,GAEKI,IAAcX,QAAe;GACjC,IAAI,GAAYQ,EAAoB,KAAK,GACzC,OAAO,CAACE,EAAe;EACzB,CAAC,GAEKE,UAA+B;GACnC,IAAIC,EAAQpC,EAAa,SAAS,GAAG;IACnC,IAAMqC,IAAQrC,EAAa,UAAU,MAAM,MAASsC,EAAK,WAAW9B,CAAM;IAC1E,AAAI6B,KACFnC,EAAU,oBAAoB,MAAM,IAAIM,GAAQ6B,EAAM,SAAS;GAEnE,OACE,EAAU,oBAAoB,MAAM,IAAI7B,GAAQR,EAAa,SAAS;EAE1E;EAsCA,OAAO;GACL;GACA;GAGA;GACA;GACA;GACA;GACA,yBAtCA,GACA,IAAW,yBACX,IAAmC,KAAA,GACnC,IAAS,QACT,IAAsC,CAAC,MACpC;IACH,IAAI;KAIF,IAAM,EAAE,eAAYuC,EAAyC;MAC3D;MACA,QAAQ;MACR;MACA;KACF,CAAC,GACKC,IAAM,MAAMC,EAAQ;MAAE,aAAaC;MAAU;KAAU,CAAC;KAI9D,OAHAb,EAAeW,CAAG,GAClBtC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GACnD2B,EAAuB,GAChBL,EAAY;IACrB,SAASa,GAAO;KAGd,IADAzC,EAAU,mBAAmB,MAAM,IAAIM,GAAQ,EAAI,GAC/CoC,EAAQ,cAAc,MAAMD;KAChC;IACF;GACF;EAYA;CACF;CAEA,OAAO;EACL;EACA;EACA;EACA;EACA;EACA;EACA;EACA,QAAQ3C;CACV;AACF;AAEA,SAAgBI,IAA6C;CAC3D,IAAMF,IAAYC,EAAa,GAEzBO,KAAa,GAAgB,MAAgC;EACjE,IAAMF,IAASqC,EAAiBlC,CAAG,GAC7Ba,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,+EAA+E;EAEjG,IAAIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,GAC9E,OAAO;EAET,IAAIlB,EAAckB,EAAK,OAAOhB,CAAM,GAAG,OAAO;EAC9C,IAAMsC,IAAaC,EAAqBvB,GAAM,yBAAyBb,CAAG;EAC1E,IAAIe,EAAYoB,CAAU,GAAG,OAAO;EACpC,QAAQA,GAAR;GACE,KAAKE,EAAM,OACT,OAAO;GACT,KAAKA,EAAM,MACT,OAAO;GACT,KAAKA,EAAM;IACT,IAAItB,EAAYd,CAAO,GACrB,MAAU,MAAM,6BAA6BD,EAAI,kDAAkD;IACrG,OAAOG,EAAeF,GAASJ,CAAM;GACvC,SACE,OAAO;EACX;CACF,GAEMS,KAAmB,GAAmB,MACtCC,EAAK,WAAW,KAGbA,EAAK,OAAO,MACVR,EAAUC,GAAKC,CAAO,CAC9B,GAGGN,KAAiB,GAAqB,MAAmB;EAE7D,IAAM2C,IADY9C,EACA,CAAA,CAAU,qBAAqBK,CAAM;EAGvD,OAFA,CAAIkB,EAAYuB,CAAS,KAElB1C,EAAU,SAAS0C,CAAS;CACrC;CAEA,SAASnC,EAAe,GAAiB,GAAgB;EACvD,IAAMU,IAAOtB,EAAU,uBAAuBM,CAAM,GAC9CiB,IAAevB,EAAU,4BAA4BM,CAAM;EACjE,IAAIkB,EAAYD,CAAY,GAC1B,MAAU,MAAM,oFAAoF;EAWtG,OATIC,EAAYF,CAAI,KAAKE,EAAYF,EAAK,EAAE,KAAKG,EAAOH,EAAK,EAAE,KAAKA,EAAK,OAAO,IACvE,KAEL0B,EAAatC,CAAO,IACfA,EAAQ,OAAO,SAASY,EAAK,EAAE,IAEpC2B,EAAiBvC,CAAO,IACnBA,EAAQ,cAAcY,EAAK,KAE7B;CACT;CA8BA,OAAO;EACL;EACA;EACA;EACA;EACA,gBA1BqB,GAA8B,GAAkB,IAAQ,cAAuB;GACpG,IAAMN,IAAOkB,EAAQzB,CAAG,IAAIA,IAAM,CAACA,CAAG;GACtC,IAAIO,EAAK,WAAW,GAClB,OAAO;GAET,KAAK,IAAMV,KAAUU,EAAK,KAAK,MAAU2B,EAAiBO,CAAK,CAAC,GAE9D,IADAlD,EAAU,aAAa,MAAM,IAAIM,CAAM,GACnCkB,EAAYxB,EAAU,4BAA4BM,CAAM,CAAC,GAC3D,OAAO;GAGX,IAAI;IACF,OAAOS,EAAgBC,GAAMN,CAAO;GACtC,SAAS+B,GAAO;IAEd,IAAMU,IAAMnC,EAAK,KAAK,IAAI;IAE1B,OADAoC,EAAsB,GAAGC,EAAM,GAAGF,KAAO,IAAIE,EAAM,iBAAiBF,EAAI,2BAA2BV,CAAK,GACjG;GACT;EACF;CAQA;AACF;AAGA,SAAgBE,EAAiB,GAAU;CAGzC,OAFclC,EAAI,MAAM,GAEjB,CAAA,CAAM;AACf"}

package/dist/domains/auth/composables/refreshSession.d.ts

@@ -7,19 +7,17 @@ export type RefreshResult = {
     type: 'auth-unavailable';
     error: unknown;
 };
-/** What the refresh needs to know about the auth cookies. */
 export interface AuthCookieState {
     refreshTokenExists: unknown;
     jwtPayload: string | null | undefined;
 }
 /**
- * The session refresh, single flight: a refresh already running is joined, otherwise a new one
- * starts; a finished result is never reused.
- *
- * Only a 401 means the session is gone. A 400 (`unable_to_refresh`) can equally mean another tab
- * rotated the token first -- the backend rotation is not atomic -- which a changed JWT cookie shows,
- * up to a second later when that tab's answer arrives after this one's.
- * Everything else is the auth backend being unavailable, never a reason to log out.
+ * Single-flight session refresh. A running refresh is joined,
+ * otherwise a new one starts. A finished result is never reused.
+ * Only a 401 means the session is gone.
+ * A 400 (`unable_to_refresh`) can also mean another tab rotated the token first, because
+ * backend rotation is not atomic. A changed JWT cookie shows this, up to a second later.
+ * Any other error means the auth backend is unavailable and never causes a logout.
  */
 export declare function createRefreshSession(options: {
     /** Calls the refresh endpoint; rejects with whatever the api helper throws. */
@@ -28,10 +26,9 @@ export declare function createRefreshSession(options: {
     jwtPayload: () => string | null | undefined;
 }): () => Promise<RefreshResult>;
 /**
- * The axios request interceptor that refreshes an expired JWT before a request goes out, with the
- * `runWhen` that keeps it off the auth endpoints themselves. Concurrent requests share one refresh
- * (`refreshSession`), and a request is rejected with `SessionExpiredError` (after `logout`) or
- * `AuthUnavailableError` (the user stays logged in).
+ * Request interceptor that refreshes an expired JWT before a request goes out. Its `runWhen` skips the auth endpoints.
+ * Concurrent requests share one refresh (`refreshSession`). A request is rejected with
+ * `SessionExpiredError` (after `logout`) or `AuthUnavailableError` (the user stays logged in).
  */
 export declare function createRefreshRequestInterceptor(options: {
     cookies: () => AuthCookieState;
@@ -39,7 +36,7 @@ export declare function createRefreshRequestInterceptor(options: {
     logout: () => void;
     /** Requests to these urls (the auth endpoints) are never held for a refresh. */
     skipUrlPrefix: string;
-    /** A JWT that is still there but past its expiry also needs a refresh (default: only a missing one). */
+    /** Also refresh a JWT that exists but is expired. By default only a missing JWT is refreshed. */
     jwtExpired?: () => boolean;
 }): {
     interceptor: (requestConfig: InternalAxiosRequestConfig) => Promise<InternalAxiosRequestConfig>;

package/dist/domains/auth/composables/refreshSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshSession.js","names":["axios","HTTP_BAD_REQUEST","HTTP_UNAUTHORIZED","ROTATION_GRACE_MS","ROTATION_POLL_MS","httpStatusInCauseChain","status","isInCauseChain","error","value","isDefined","createRefreshSession","inFlight","rotatedMeanwhile","waited","now","options","isNull","before","resolve","run","jwtPayloadBefore","createRefreshRequestInterceptor","loggedOut","refreshTokenExists","jwtPayload","SessionExpiredError","result","requestConfig","AuthUnavailableError","skipUrlPrefixes"],"sources":["../../../../src/domains/auth/composables/refreshSession.ts"],"sourcesContent":["import axios, { type InternalAxiosRequestConfig } from 'axios'\nimport { isDefined, isNull } from '@/shared/utils/common'\nimport { skipUrlPrefixes } from '@/domains/api/composables/defineApiClient'\nimport { AuthUnavailableError } from '@/shared/error/AuthUnavailableError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\n\nconst HTTP_BAD_REQUEST = 400\nconst HTTP_UNAUTHORIZED = 401\n// How long a 400 waits for the cookie of the tab whose refresh won: its answer can come after this one's.\nconst ROTATION_GRACE_MS = 1000\nconst ROTATION_POLL_MS = 100\n\nexport type RefreshResult =\n  | { type: 'refreshed' }\n  | { type: 'session-expired' }\n  | { type: 'auth-unavailable'; error: unknown }\n\n/** What the refresh needs to know about the auth cookies. */\nexport interface AuthCookieState {\n  refreshTokenExists: unknown\n  jwtPayload: string | null | undefined\n}\n\n// `undefined`: no response anywhere in the chain -- a timeout or a network failure.\nconst httpStatusInCauseChain = (error: unknown): number | undefined => {\n  let status: number | undefined\n  isInCauseChain(error, (value) => {\n    if (!axios.isAxiosError(value) || !isDefined(value.response)) return false\n    status = value.response.status\n    return true\n  })\n  return status\n}\n\n/**\n * The session refresh, single flight: a refresh already running is joined, otherwise a new one\n * starts; a finished result is never reused.\n *\n * Only a 401 means the session is gone. A 400 (`unable_to_refresh`) can equally mean another tab\n * rotated the token first -- the backend rotation is not atomic -- which a changed JWT cookie shows,\n * up to a second later when that tab's answer arrives after this one's.\n * Everything else is the auth backend being unavailable, never a reason to log out.\n */\nexport function createRefreshSession(options: {\n  /** Calls the refresh endpoint; rejects with whatever the api helper throws. */\n  refresh: () => Promise<unknown>\n  /** The JWT payload cookie as it is now. */\n  jwtPayload: () => string | null | undefined\n}): () => Promise<RefreshResult> {\n  let inFlight: Promise<RefreshResult> | null = null\n\n  const rotatedMeanwhile = async (before: string | null | undefined): Promise<boolean> => {\n    for (let waited = 0; ; waited += ROTATION_POLL_MS) {\n      const now = options.jwtPayload()\n      if (isDefined(now) && !isNull(now) && now !== before) return true\n      if (waited >= ROTATION_GRACE_MS) return false\n      await new Promise((resolve) => setTimeout(resolve, ROTATION_POLL_MS))\n    }\n  }\n\n  const run = async (): Promise<RefreshResult> => {\n    // Before the request: with a refresh in flight the cookie is already there, so only a changed\n    // value says something afterwards.\n    const jwtPayloadBefore = options.jwtPayload()\n    try {\n      await options.refresh()\n      return { type: 'refreshed' }\n    } catch (error) {\n      const status = httpStatusInCauseChain(error)\n      if (status === HTTP_UNAUTHORIZED) return { type: 'session-expired' }\n      if (status === HTTP_BAD_REQUEST) {\n        return (await rotatedMeanwhile(jwtPayloadBefore)) ? { type: 'refreshed' } : { type: 'session-expired' }\n      }\n      return { type: 'auth-unavailable', error }\n    }\n  }\n\n  return () => {\n    if (isNull(inFlight)) {\n      inFlight = run().finally(() => {\n        inFlight = null\n      })\n    }\n    return inFlight\n  }\n}\n\n/**\n * The axios request interceptor that refreshes an expired JWT before a request goes out, with the\n * `runWhen` that keeps it off the auth endpoints themselves. Concurrent requests share one refresh\n * (`refreshSession`), and a request is rejected with `SessionExpiredError` (after `logout`) or\n * `AuthUnavailableError` (the user stays logged in).\n */\nexport function createRefreshRequestInterceptor(options: {\n  cookies: () => AuthCookieState\n  refreshSession: () => Promise<RefreshResult>\n  logout: () => void\n  /** Requests to these urls (the auth endpoints) are never held for a refresh. */\n  skipUrlPrefix: string\n  /** A JWT that is still there but past its expiry also needs a refresh (default: only a missing one). */\n  jwtExpired?: () => boolean\n}) {\n  // Requests waiting on one refresh share its result: log out once for it, not once per request.\n  const loggedOut = new WeakSet<RefreshResult>()\n\n  const interceptor = async (requestConfig: InternalAxiosRequestConfig): Promise<InternalAxiosRequestConfig> => {\n    const { refreshTokenExists, jwtPayload } = options.cookies()\n    if (!refreshTokenExists && !jwtPayload) {\n      options.logout()\n      throw new SessionExpiredError()\n    }\n    if (refreshTokenExists && (!jwtPayload || options.jwtExpired?.())) {\n      const result = await options.refreshSession()\n      if (result.type === 'session-expired') {\n        if (!loggedOut.has(result)) {\n          loggedOut.add(result)\n          options.logout()\n        }\n        throw new SessionExpiredError()\n      }\n      // Stopped while it waited (its page is gone): cancelled, as it would have been on its way out, and not a\n      // failure to show on the page the user went to. Axios checks the signal only once the interceptors are done.\n      if (requestConfig.signal?.aborted) throw new axios.CanceledError()\n      if (result.type === 'auth-unavailable') throw new AuthUnavailableError(result.error)\n    }\n    return requestConfig\n  }\n\n  return {\n    interceptor,\n    options: { runWhen: skipUrlPrefixes(options.skipUrlPrefix) },\n  }\n}\n"],"mappings":";;;;;;;AAOA,IAAMC,IAAmB,KACnBC,IAAoB,KAEpBC,IAAoB,KACpBC,IAAmB,KAcnBC,KAA0B,MAAuC;CACrE,IAAIC;CAMJ,OALAC,EAAeC,IAAQ,MACjB,CAACR,EAAM,aAAaS,CAAK,KAAK,CAACC,EAAUD,EAAM,QAAQ,IAAU,MACrE,IAASA,EAAM,SAAS,QACjB,GACR,GACMH;AACT;AAWA,SAAgBK,EAAqB,GAKJ;CAC/B,IAAIC,IAA0C,MAExCC,IAAmB,OAAO,MAAwD;EACtF,KAAK,IAAIC,IAAS,IAAK,KAAUV,GAAkB;GACjD,IAAMW,IAAMC,EAAQ,WAAW;GAC/B,IAAIN,EAAUK,CAAG,KAAK,CAACE,EAAOF,CAAG,KAAKA,MAAQG,GAAQ,OAAO;GAC7D,IAAIJ,KAAUX,GAAmB,OAAO;GACxC,MAAM,IAAI,SAAS,MAAY,WAAWgB,GAASf,CAAgB,CAAC;EACtE;CACF,GAEMgB,IAAM,YAAoC;EAG9C,IAAMC,IAAmBL,EAAQ,WAAW;EAC5C,IAAI;GAEF,OADA,MAAMA,EAAQ,QAAQ,GACf,EAAE,MAAM,YAAY;EAC7B,SAASR,GAAO;GACd,IAAMF,IAASD,EAAuBG,CAAK;GAK3C,OAJIF,MAAWJ,IAA0B,EAAE,MAAM,kBAAkB,IAC/DI,MAAWL,IACL,MAAMY,EAAiBQ,CAAgB,IAAK,EAAE,MAAM,YAAY,IAAI,EAAE,MAAM,kBAAkB,IAEjG;IAAE,MAAM;IAAoB;GAAM;EAC3C;CACF;CAEA,cACMJ,EAAOL,CAAQ,MACjB,IAAWQ,EAAI,CAAC,CAAC,cAAc;EAC7B,IAAW;CACb,CAAC,IAEIR;AAEX;AAQA,SAAgBU,EAAgC,GAQ7C;CAED,IAAMC,oBAAY,IAAI,QAAuB;CAyB7C,OAAO;EACL,oBAxByB,MAAmF;GAC5G,IAAM,EAAE,uBAAoB,kBAAeP,EAAQ,QAAQ;GAC3D,IAAI,CAACQ,KAAsB,CAACC,GAE1B,MADAT,EAAQ,OAAO,GACT,IAAIU,EAAoB;GAEhC,IAAIF,MAAuB,CAACC,KAAcT,EAAQ,aAAa,IAAI;IACjE,IAAMW,IAAS,MAAMX,EAAQ,eAAe;IAC5C,IAAIW,EAAO,SAAS,mBAKlB,MAJKJ,EAAU,IAAII,CAAM,MACvBJ,EAAU,IAAII,CAAM,GACpBX,EAAQ,OAAO,IAEX,IAAIU,EAAoB;IAIhC,IAAIE,EAAc,QAAQ,SAAS,MAAM,IAAI5B,EAAM,cAAc;IACjE,IAAI2B,EAAO,SAAS,oBAAoB,MAAM,IAAIE,EAAqBF,EAAO,KAAK;GACrF;GACA,OAAOC;EACT;EAIE,SAAS,EAAE,SAASE,EAAgBd,EAAQ,aAAa,EAAE;CAC7D;AACF"}
+{"version":3,"file":"refreshSession.js","names":["axios","HTTP_BAD_REQUEST","HTTP_UNAUTHORIZED","ROTATION_GRACE_MS","ROTATION_POLL_MS","httpStatusInCauseChain","status","isInCauseChain","error","value","isDefined","createRefreshSession","inFlight","rotatedMeanwhile","waited","now","options","isNull","before","resolve","run","jwtPayloadBefore","createRefreshRequestInterceptor","loggedOut","refreshTokenExists","jwtPayload","SessionExpiredError","result","requestConfig","AuthUnavailableError","skipUrlPrefixes"],"sources":["../../../../src/domains/auth/composables/refreshSession.ts"],"sourcesContent":["import axios, { type InternalAxiosRequestConfig } from 'axios'\nimport { isDefined, isNull } from '@/shared/utils/common'\nimport { skipUrlPrefixes } from '@/domains/api/composables/defineApiClient'\nimport { AuthUnavailableError } from '@/shared/error/AuthUnavailableError'\nimport { isInCauseChain } from '@/shared/error/isInCauseChain'\nimport { SessionExpiredError } from '@/shared/error/SessionExpiredError'\n\nconst HTTP_BAD_REQUEST = 400\nconst HTTP_UNAUTHORIZED = 401\n// How long a 400 waits for the cookie from the tab whose refresh won. That tab's response can arrive after this one.\nconst ROTATION_GRACE_MS = 1000\nconst ROTATION_POLL_MS = 100\n\nexport type RefreshResult =\n  | { type: 'refreshed' }\n  | { type: 'session-expired' }\n  | { type: 'auth-unavailable'; error: unknown }\n\nexport interface AuthCookieState {\n  refreshTokenExists: unknown\n  jwtPayload: string | null | undefined\n}\n\n// `undefined` means no response in the chain: a timeout or a network failure.\nconst httpStatusInCauseChain = (error: unknown): number | undefined => {\n  let status: number | undefined\n  isInCauseChain(error, (value) => {\n    if (!axios.isAxiosError(value) || !isDefined(value.response)) return false\n    status = value.response.status\n    return true\n  })\n  return status\n}\n\n/**\n * Single-flight session refresh. A running refresh is joined,\n * otherwise a new one starts. A finished result is never reused.\n * Only a 401 means the session is gone.\n * A 400 (`unable_to_refresh`) can also mean another tab rotated the token first, because\n * backend rotation is not atomic. A changed JWT cookie shows this, up to a second later.\n * Any other error means the auth backend is unavailable and never causes a logout.\n */\nexport function createRefreshSession(options: {\n  /** Calls the refresh endpoint; rejects with whatever the api helper throws. */\n  refresh: () => Promise<unknown>\n  /** The JWT payload cookie as it is now. */\n  jwtPayload: () => string | null | undefined\n}): () => Promise<RefreshResult> {\n  let inFlight: Promise<RefreshResult> | null = null\n\n  const rotatedMeanwhile = async (before: string | null | undefined): Promise<boolean> => {\n    for (let waited = 0; ; waited += ROTATION_POLL_MS) {\n      const now = options.jwtPayload()\n      if (isDefined(now) && !isNull(now) && now !== before) return true\n      if (waited >= ROTATION_GRACE_MS) return false\n      await new Promise((resolve) => setTimeout(resolve, ROTATION_POLL_MS))\n    }\n  }\n\n  const run = async (): Promise<RefreshResult> => {\n    // Read before the request. During an in-flight refresh the\n    // cookie already exists, so only a changed value is meaningful.\n    const jwtPayloadBefore = options.jwtPayload()\n    try {\n      await options.refresh()\n      return { type: 'refreshed' }\n    } catch (error) {\n      const status = httpStatusInCauseChain(error)\n      if (status === HTTP_UNAUTHORIZED) return { type: 'session-expired' }\n      if (status === HTTP_BAD_REQUEST) {\n        return (await rotatedMeanwhile(jwtPayloadBefore)) ? { type: 'refreshed' } : { type: 'session-expired' }\n      }\n      return { type: 'auth-unavailable', error }\n    }\n  }\n\n  return () => {\n    if (isNull(inFlight)) {\n      inFlight = run().finally(() => {\n        inFlight = null\n      })\n    }\n    return inFlight\n  }\n}\n\n/**\n * Request interceptor that refreshes an expired JWT before a request goes out. Its `runWhen` skips the auth endpoints.\n * Concurrent requests share one refresh (`refreshSession`). A request is rejected with\n * `SessionExpiredError` (after `logout`) or `AuthUnavailableError` (the user stays logged in).\n */\nexport function createRefreshRequestInterceptor(options: {\n  cookies: () => AuthCookieState\n  refreshSession: () => Promise<RefreshResult>\n  logout: () => void\n  /** Requests to these urls (the auth endpoints) are never held for a refresh. */\n  skipUrlPrefix: string\n  /** Also refresh a JWT that exists but is expired. By default only a missing JWT is refreshed. */\n  jwtExpired?: () => boolean\n}) {\n  // Requests waiting on one refresh share its result. Log out once per refresh, not once per request.\n  const loggedOut = new WeakSet<RefreshResult>()\n\n  const interceptor = async (requestConfig: InternalAxiosRequestConfig): Promise<InternalAxiosRequestConfig> => {\n    const { refreshTokenExists, jwtPayload } = options.cookies()\n    if (!refreshTokenExists && !jwtPayload) {\n      options.logout()\n      throw new SessionExpiredError()\n    }\n    if (refreshTokenExists && (!jwtPayload || options.jwtExpired?.())) {\n      const result = await options.refreshSession()\n      if (result.type === 'session-expired') {\n        if (!loggedOut.has(result)) {\n          loggedOut.add(result)\n          options.logout()\n        }\n        throw new SessionExpiredError()\n      }\n      // Aborted while waiting (its page is gone): treat as cancelled, not as a failure to show on the new page.\n      // Axios checks the signal only after the interceptors finish.\n      if (requestConfig.signal?.aborted) throw new axios.CanceledError()\n      if (result.type === 'auth-unavailable') throw new AuthUnavailableError(result.error)\n    }\n    return requestConfig\n  }\n\n  return {\n    interceptor,\n    options: { runWhen: skipUrlPrefixes(options.skipUrlPrefix) },\n  }\n}\n"],"mappings":";;;;;;;AAOA,IAAMC,IAAmB,KACnBC,IAAoB,KAEpBC,IAAoB,KACpBC,IAAmB,KAanBC,KAA0B,MAAuC;CACrE,IAAIC;CAMJ,OALAC,EAAeC,IAAQ,MACjB,CAACR,EAAM,aAAaS,CAAK,KAAK,CAACC,EAAUD,EAAM,QAAQ,IAAU,MACrE,IAASA,EAAM,SAAS,QACjB,GACR,GACMH;AACT;AAUA,SAAgBK,EAAqB,GAKJ;CAC/B,IAAIC,IAA0C,MAExCC,IAAmB,OAAO,MAAwD;EACtF,KAAK,IAAIC,IAAS,IAAK,KAAUV,GAAkB;GACjD,IAAMW,IAAMC,EAAQ,WAAW;GAC/B,IAAIN,EAAUK,CAAG,KAAK,CAACE,EAAOF,CAAG,KAAKA,MAAQG,GAAQ,OAAO;GAC7D,IAAIJ,KAAUX,GAAmB,OAAO;GACxC,MAAM,IAAI,SAAS,MAAY,WAAWgB,GAASf,CAAgB,CAAC;EACtE;CACF,GAEMgB,IAAM,YAAoC;EAG9C,IAAMC,IAAmBL,EAAQ,WAAW;EAC5C,IAAI;GAEF,OADA,MAAMA,EAAQ,QAAQ,GACf,EAAE,MAAM,YAAY;EAC7B,SAASR,GAAO;GACd,IAAMF,IAASD,EAAuBG,CAAK;GAK3C,OAJIF,MAAWJ,IAA0B,EAAE,MAAM,kBAAkB,IAC/DI,MAAWL,IACL,MAAMY,EAAiBQ,CAAgB,IAAK,EAAE,MAAM,YAAY,IAAI,EAAE,MAAM,kBAAkB,IAEjG;IAAE,MAAM;IAAoB;GAAM;EAC3C;CACF;CAEA,cACMJ,EAAOL,CAAQ,MACjB,IAAWQ,EAAI,CAAC,CAAC,cAAc;EAC7B,IAAW;CACb,CAAC,IAEIR;AAEX;AAOA,SAAgBU,EAAgC,GAQ7C;CAED,IAAMC,oBAAY,IAAI,QAAuB;CAyB7C,OAAO;EACL,oBAxByB,MAAmF;GAC5G,IAAM,EAAE,uBAAoB,kBAAeP,EAAQ,QAAQ;GAC3D,IAAI,CAACQ,KAAsB,CAACC,GAE1B,MADAT,EAAQ,OAAO,GACT,IAAIU,EAAoB;GAEhC,IAAIF,MAAuB,CAACC,KAAcT,EAAQ,aAAa,IAAI;IACjE,IAAMW,IAAS,MAAMX,EAAQ,eAAe;IAC5C,IAAIW,EAAO,SAAS,mBAKlB,MAJKJ,EAAU,IAAII,CAAM,MACvBJ,EAAU,IAAII,CAAM,GACpBX,EAAQ,OAAO,IAEX,IAAIU,EAAoB;IAIhC,IAAIE,EAAc,QAAQ,SAAS,MAAM,IAAI5B,EAAM,cAAc;IACjE,IAAI2B,EAAO,SAAS,oBAAoB,MAAM,IAAIE,EAAqBF,EAAO,KAAK;GACrF;GACA,OAAOC;EACT;EAIE,SAAS,EAAE,SAASE,EAAgBd,EAAQ,aAAa,EAAE;CAC7D;AACF"}

package/dist/domains/cached/components/ACachedChip.js.map

@@ -1 +1 @@
-{"version":3,"file":"ACachedChip.js","names":["_sfc_main","ACachedChip_vue_vue_type_script_setup_true_lang_default","ACachedChip_default"],"sources":["../../../../src/domains/cached/components/ACachedChip.vue"],"sourcesContent":["<script lang=\"ts\" setup>\nimport { computed } from 'vue'\nimport { useI18n } from 'vue-i18n'\nimport { useRouter } from 'vue-router'\nimport type { DocId, IntegerId } from '@/shared/types/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { isNull, isUndefined } from '@/shared/utils/common'\nimport { COMMON_CONFIG } from '@/shared/commonConfig'\nimport { useCachedItem } from '@/domains/cached/composables/useCachedItem'\n\nconst props = withDefaults(\n  defineProps<{\n    id?: null | undefined | IntegerId | DocId\n    title?: string\n    containerClass?: undefined | string\n    getCachedFn: (id: any) => any\n    displayTextPath: string\n    route: string\n    disableClick?: boolean\n    openInNew?: boolean\n    size?: string\n    forceRounded?: boolean\n    textOnly?: boolean\n    fallbackIdText?: boolean\n    wrapText?: boolean\n    closable?: boolean\n    customTitleFn?: (\n      cachedItem: any,\n      defaultTitle: string,\n      displayTextPath: string,\n      fallbackIdText: boolean\n    ) => string | undefined\n  }>(),\n  {\n    id: null,\n    title: '',\n    containerClass: 'd-inline-flex',\n    disableClick: false,\n    openInNew: false,\n    size: 'small',\n    forceRounded: false,\n    textOnly: false,\n    fallbackIdText: false,\n    wrapText: false,\n    closable: false,\n    customTitleFn: undefined,\n  }\n)\n\nconst emit = defineEmits<{\n  (e: 'close', id: null | undefined | IntegerId | DocId): void\n}>()\n\nconst { t } = useI18n()\nconst router = useRouter()\nconst { cached, loaded, unresolved } = useCachedItem(() => props.getCachedFn(props.id as any))\n\n// An item the fetch could not resolve has only its placeholder to show: its id, and no link to a\n// detail that would not load either.\nconst linkDisabled = computed(() => props.disableClick || unresolved.value)\n\nconst containerClassComputed = computed(() => {\n  return props.wrapText ? props.containerClass + ' a-chip--wrap' : props.containerClass\n})\n\n// A title given by the caller still wins over the placeholder.\nconst showUnresolved = computed(() => unresolved.value && props.title.length === 0)\n\nconst displayTitle = computed(() => {\n  if (showUnresolved.value) return '#' + props.id\n  if (props.customTitleFn && cached.value) {\n    const customTitle = props.customTitleFn(cached.value, props.title, props.displayTextPath, props.fallbackIdText)\n    if (customTitle !== undefined) {\n      return customTitle\n    }\n  }\n  if (props.title.length > 0) return props.title\n  if (cached.value) {\n    return objectGetValueByPath(cached.value, props.displayTextPath)\n  }\n  return props.fallbackIdText ? props.id : ''\n})\n\nconst onClick = () => {\n  router.push({ name: props.route, params: { id: props.id } })\n}\n</script>\n\n<template>\n  <div :class=\"containerClassComputed\">\n    <template v-if=\"isNull(id) || isUndefined(id)\">\n      <slot name=\"empty\">-</slot>\n    </template>\n    <div\n      v-else-if=\"textOnly\"\n      :title=\"unresolved ? t('common.model.cachedUnavailable') : undefined\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </div>\n    <VChip\n      v-else-if=\"linkDisabled\"\n      :size=\"size\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VTooltip\n        v-if=\"unresolved\"\n        activator=\"parent\"\n        location=\"bottom\"\n      >\n        {{ t('common.model.cachedUnavailable') }}\n      </VTooltip>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n    <VChip\n      v-else\n      :size=\"size\"\n      :append-icon=\"openInNew ? COMMON_CONFIG.CHIP.ICON.LINK_EXTERNAL : COMMON_CONFIG.CHIP.ICON.LINK\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click.stop=\"onClick\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      {{ displayTitle }}\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n  </div>\n</template>\n\n<style lang=\"scss\">\n.a-chip--wrap {\n  .v-chip {\n    height: auto !important;\n  }\n\n  .v-chip .v-chip__content {\n    max-width: 100%;\n    height: auto;\n    min-height: 26px;\n    white-space: pre-wrap;\n  }\n}\n</style>\n"],"mappings":""}
+{"version":3,"file":"ACachedChip.js","names":["_sfc_main","ACachedChip_vue_vue_type_script_setup_true_lang_default","ACachedChip_default"],"sources":["../../../../src/domains/cached/components/ACachedChip.vue"],"sourcesContent":["<script lang=\"ts\" setup>\nimport { computed } from 'vue'\nimport { useI18n } from 'vue-i18n'\nimport { useRouter } from 'vue-router'\nimport type { DocId, IntegerId } from '@/shared/types/common'\nimport { objectGetValueByPath } from '@/shared/utils/object'\nimport { isNull, isUndefined } from '@/shared/utils/common'\nimport { COMMON_CONFIG } from '@/shared/commonConfig'\nimport { useCachedItem } from '@/domains/cached/composables/useCachedItem'\n\nconst props = withDefaults(\n  defineProps<{\n    id?: null | undefined | IntegerId | DocId\n    title?: string\n    containerClass?: undefined | string\n    getCachedFn: (id: any) => any\n    displayTextPath: string\n    route: string\n    disableClick?: boolean\n    openInNew?: boolean\n    size?: string\n    forceRounded?: boolean\n    textOnly?: boolean\n    fallbackIdText?: boolean\n    wrapText?: boolean\n    closable?: boolean\n    customTitleFn?: (\n      cachedItem: any,\n      defaultTitle: string,\n      displayTextPath: string,\n      fallbackIdText: boolean\n    ) => string | undefined\n  }>(),\n  {\n    id: null,\n    title: '',\n    containerClass: 'd-inline-flex',\n    disableClick: false,\n    openInNew: false,\n    size: 'small',\n    forceRounded: false,\n    textOnly: false,\n    fallbackIdText: false,\n    wrapText: false,\n    closable: false,\n    customTitleFn: undefined,\n  }\n)\n\nconst emit = defineEmits<{\n  (e: 'close', id: null | undefined | IntegerId | DocId): void\n}>()\n\nconst { t } = useI18n()\nconst router = useRouter()\nconst { cached, loaded, unresolved } = useCachedItem(() => props.getCachedFn(props.id as any))\n\n// An item the fetch could not resolve shows only its id placeholder.\n// It gets no link, because its detail would not load either.\nconst linkDisabled = computed(() => props.disableClick || unresolved.value)\n\nconst containerClassComputed = computed(() => {\n  return props.wrapText ? props.containerClass + ' a-chip--wrap' : props.containerClass\n})\n\n// A title given by the caller still wins over the placeholder.\nconst showUnresolved = computed(() => unresolved.value && props.title.length === 0)\n\nconst displayTitle = computed(() => {\n  if (showUnresolved.value) return '#' + props.id\n  if (props.customTitleFn && cached.value) {\n    const customTitle = props.customTitleFn(cached.value, props.title, props.displayTextPath, props.fallbackIdText)\n    if (customTitle !== undefined) {\n      return customTitle\n    }\n  }\n  if (props.title.length > 0) return props.title\n  if (cached.value) {\n    return objectGetValueByPath(cached.value, props.displayTextPath)\n  }\n  return props.fallbackIdText ? props.id : ''\n})\n\nconst onClick = () => {\n  router.push({ name: props.route, params: { id: props.id } })\n}\n</script>\n\n<template>\n  <div :class=\"containerClassComputed\">\n    <template v-if=\"isNull(id) || isUndefined(id)\">\n      <slot name=\"empty\">-</slot>\n    </template>\n    <div\n      v-else-if=\"textOnly\"\n      :title=\"unresolved ? t('common.model.cachedUnavailable') : undefined\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </div>\n    <VChip\n      v-else-if=\"linkDisabled\"\n      :size=\"size\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      <slot\n        v-if=\"showUnresolved\"\n        :id=\"id\"\n        name=\"unresolved\"\n      >\n        {{ displayTitle }}\n      </slot>\n      <template v-else>{{ displayTitle }}</template>\n      <VTooltip\n        v-if=\"unresolved\"\n        activator=\"parent\"\n        location=\"bottom\"\n      >\n        {{ t('common.model.cachedUnavailable') }}\n      </VTooltip>\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n    <VChip\n      v-else\n      :size=\"size\"\n      :append-icon=\"openInNew ? COMMON_CONFIG.CHIP.ICON.LINK_EXTERNAL : COMMON_CONFIG.CHIP.ICON.LINK\"\n      :label=\"forceRounded ? undefined : true\"\n      :closable=\"closable\"\n      close-label=\"common.button.remove\"\n      @click.stop=\"onClick\"\n      @click:close=\"() => emit('close', id)\"\n    >\n      {{ displayTitle }}\n      <VProgressCircular\n        v-if=\"!loaded && title.length === 0\"\n        :size=\"12\"\n        :width=\"2\"\n        indeterminate\n        class=\"mx-1\"\n      />\n    </VChip>\n  </div>\n</template>\n\n<style lang=\"scss\">\n.a-chip--wrap {\n  .v-chip {\n    height: auto !important;\n  }\n\n  .v-chip .v-chip__content {\n    max-width: 100%;\n    height: auto;\n    min-height: 26px;\n    white-space: pre-wrap;\n  }\n}\n</style>\n"],"mappings":""}