@arcblock/did-connect-service 4.1.12 → 4.1.14

package/dist/access/change-role.js

@@ -0,0 +1,52 @@
+const ROLE_LEVEL = { owner: 3, admin: 2, member: 1, guest: 0 };
+const ASSIGNABLE_ROLES = new Set(["admin", "member", "guest"]);
+export async function changeMembershipRole(params) {
+    const { store, instanceDid, callerDid, callerRole, targetDid, newRole, ip } = params;
+    if (!newRole || !ASSIGNABLE_ROLES.has(newRole)) {
+        return {
+            ok: false,
+            status: 400,
+            code: "VALIDATION_ERROR",
+            message: "Invalid role. Must be 'admin', 'member', or 'guest'",
+        };
+    }
+    if (targetDid === callerDid) {
+        return { ok: false, status: 409, code: "CONFLICT", message: "Cannot change your own role" };
+    }
+    // Only owner can assign admin role
+    if (newRole === "admin" && callerRole !== "owner") {
+        return {
+            ok: false,
+            status: 403,
+            code: "FORBIDDEN",
+            message: "Only the owner can assign admin role",
+        };
+    }
+    const membership = await store.getMembership(targetDid, instanceDid);
+    if (!membership) {
+        return { ok: false, status: 404, code: "NOT_FOUND", message: "Member not found" };
+    }
+    const oldRole = membership.role;
+    const callerLevel = ROLE_LEVEL[callerRole] ?? 0;
+    const targetLevel = ROLE_LEVEL[oldRole] ?? 0;
+    // Cannot modify someone at same or higher level (admin can't change admin/owner)
+    if (targetLevel >= callerLevel) {
+        return {
+            ok: false,
+            status: 403,
+            code: "FORBIDDEN",
+            message: "Cannot change the role of a member with equal or higher privileges",
+        };
+    }
+    await store.updateMembershipRole(targetDid, instanceDid, newRole, callerDid);
+    await store.createAuditLog({
+        action: "user.role_change",
+        operatorDid: callerDid,
+        targetDid,
+        metadata: { oldRole, newRole },
+        ip,
+        instanceDid,
+    });
+    return { ok: true, oldRole };
+}
+//# sourceMappingURL=change-role.js.map

package/dist/access/change-role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-role.js","sourceRoot":"","sources":["../../src/access/change-role.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,GAA2B,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AACvF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAqB/D,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAkC;IAElC,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC;IAErF,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,qDAAqD;SAC/D,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC;IAC9F,CAAC;IAED,mCAAmC;IACnC,IAAI,OAAO,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAClD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,sCAAsC;SAChD,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC;IAChC,MAAM,WAAW,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7C,iFAAiF;IACjF,IAAI,WAAW,IAAI,WAAW,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,oEAAoE;SAC9E,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,KAAK,CAAC,cAAc,CAAC;QACzB,MAAM,EAAE,kBAAkB;QAC1B,WAAW,EAAE,SAAS;QACtB,SAAS;QACT,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;QAC9B,EAAE;QACF,WAAW;KACZ,CAAC,CAAC;IAEH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC"}

package/dist/assets/{admin-core.cbbdbe6d.js → admin-core.a63bbc69.js}

@@ -35,12 +35,11 @@ function relativeTime(iso) {
   var h = Math.floor(m / 60);
   var d = Math.floor(h / 24);
   var label;
-  if (d > 0) label = d + "d " + (h % 24) + "h";
-  else if (h > 0) label = h + "h " + (m % 60) + "m";
-  else if (m > 0) label = m + " min";
-  else label = "just now";
-  if (label === "just now") return label;
-  return future ? "in " + label : label + " ago";
+  if (d > 0) label = __t("time.dh", { d: d, h: (h % 24) });
+  else if (h > 0) label = __t("time.hm", { h: h, m: (m % 60) });
+  else if (m > 0) label = __t("time.min", { m: m });
+  else return __t("time.justNow");
+  return future ? __t("time.in", { label: label }) : __t("time.ago", { label: label });
 }
 
 function absoluteTime(iso) {
@@ -53,7 +52,7 @@ function absoluteTime(iso) {
 function copyToClipboard(text) {
   if (navigator.clipboard && navigator.clipboard.writeText) {
     navigator.clipboard.writeText(text).then(function() {
-      showToast("Copied!", "success");
+      showToast(__t("common.copied"), "success");
     }).catch(function() {
       fallbackCopy(text);
     });
@@ -69,7 +68,7 @@ function fallbackCopy(text) {
   input.select();
   document.execCommand("copy");
   input.remove();
-  showToast("Copied!", "success");
+  showToast(__t("common.copied"), "success");
 }
 
 // Delegate to the canonical implementation from @arcblock/did-connect-core
@@ -154,19 +153,19 @@ async function api(method, path, body, callOpts) {
 
     if (res.status === 401) {
       location.href = "/.well-known/service/api/did/logout";
-      return { ok: false, error: "Session expired", code: "UNAUTHENTICATED" };
+      return { ok: false, error: __t("common.sessionExpired"), code: "UNAUTHENTICATED" };
     }
     if (res.status === 403 && data.code === "BLOCKED") {
       location.href = "/.well-known/service/api/did/logout";
-      return { ok: false, error: "Account blocked", code: "BLOCKED" };
+      return { ok: false, error: __t("common.accountBlocked"), code: "BLOCKED" };
     }
     if (!res.ok) {
-      if (!callOpts.silent) showToast(data.error || "Request failed", "error");
+      if (!callOpts.silent) showToast(data.error || __t("common.requestFailed"), "error");
       return { ok: false, error: data.error, code: data.code };
     }
     return data;
   } catch (err) {
-    if (!callOpts.silent) showToast("Network error", "error");
+    if (!callOpts.silent) showToast(__t("common.networkError"), "error");
     return { ok: false, error: err.message, code: "NETWORK_ERROR" };
   }
 }
@@ -848,7 +847,7 @@ function connectOAuth(provider) {
   var left = (screen.width - w) / 2, top = (screen.height - h) / 2;
   var popup = window.open(url, "oauth_bind", "width=" + w + ",height=" + h + ",left=" + left + ",top=" + top);
   if (!popup) {
-    showToast("Popup blocked — please allow popups and try again", "error");
+    showToast(__t("common.popupBlocked"), "error");
     return;
   }
 
@@ -1233,10 +1232,10 @@ function renderAccessKeys(keys, paging) {
 
 function openCreateAkDialog() {
   var callerRole = __caller.role;
-  var roleOptions = '<option value="guest">Guest</option>';
-  if (callerRole === "member" || callerRole === "admin" || callerRole === "owner") roleOptions += '<option value="member"' + (callerRole === "member" ? ' selected' : '') + '>Member</option>';
-  if (callerRole === "admin" || callerRole === "owner") roleOptions += '<option value="admin"' + (callerRole === "admin" ? ' selected' : '') + '>Admin</option>';
-  if (callerRole === "owner") roleOptions += '<option value="owner">Owner</option>';
+  var roleOptions = '<option value="guest">' + __t("common.guest") + '</option>';
+  if (callerRole === "member" || callerRole === "admin" || callerRole === "owner") roleOptions += '<option value="member"' + (callerRole === "member" ? ' selected' : '') + '>' + __t("common.member") + '</option>';
+  if (callerRole === "admin" || callerRole === "owner") roleOptions += '<option value="admin"' + (callerRole === "admin" ? ' selected' : '') + '>' + __t("common.admin") + '</option>';
+  if (callerRole === "owner") roleOptions += '<option value="owner">' + __t("common.owner") + '</option>';
 
   var expiryOptions = '<option value="">' + __t("accessKeys.expirations.never") + '</option><option value="7d">' + __t("accessKeys.expirations.days7") + '</option><option value="30d">' + __t("accessKeys.expirations.days30") + '</option><option value="90d">' + __t("accessKeys.expirations.days90") + '</option><option value="custom">' + __t("accessKeys.expirations.custom") + '</option>';
 

package/dist/assets/{admin-extra.35b91f98.js → admin-extra.5b309e5e.js}

@@ -158,8 +158,12 @@ async function loadMembers(page) {
 
 function renderMembersTable(users, paging) {
   var wrap = document.getElementById("members-table-wrap");
+  // Aggregated (cross-instance "All Instances") view can't tell which instance
+  // a role change should apply to, so per-row actions are disabled there — see
+  // canOperate below. Surface why, instead of silently hiding the buttons.
+  var aggregatedHint = __membersAggregated ? '<p class="text-muted" style="font-size:13px;margin-bottom:12px;">' + __t("members.aggregatedHint") + '</p>' : '';
   if (!users || users.length === 0) {
-    wrap.innerHTML = '<div class="empty-state"><div class="empty-state-icon"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/></svg></div><div class="empty-state-title">' + __t("members.noMembers") + '</div><div class="empty-state-desc">' + __t("members.noMembersHint") + '</div></div>';
+    wrap.innerHTML = aggregatedHint + '<div class="empty-state"><div class="empty-state-icon"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M17 21v-2a4 4 0 0 0-4-4H5a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/></svg></div><div class="empty-state-title">' + __t("members.noMembers") + '</div><div class="empty-state-desc">' + __t("members.noMembersHint") + '</div></div>';
     document.getElementById("members-pagination").innerHTML = "";
     return;
   }
@@ -167,7 +171,7 @@ function renderMembersTable(users, paging) {
   var instanceSel = document.getElementById("members-instance-filter");
   var instanceVisible = instanceSel && instanceSel.style.display !== 'none';
   var showInstance = instanceVisible && instanceSel.value === "all";
-  var html = '<table class="table"><thead><tr>';
+  var html = aggregatedHint + '<table class="table"><thead><tr>';
   html += sortableTh("name", __t("members.col.member"));
   html += sortableTh("role", __t("members.col.role"));
   if (showInstance) html += '<th>' + __t("members.col.instance") + '</th>';
@@ -521,7 +525,7 @@ function renderInvitationsTable(invitations, paging) {
     var uses = inv.useCount + " / " + inv.maxUses;
     if (inv.useCount >= inv.maxUses) uses += ' <span class="badge badge-blocked">' + __t("invitations.closed") + '</span>';
     var expired = new Date(inv.expireAt) < new Date();
-    var expireText = expired ? '<span class="badge badge-expired">expired</span>' : '<span class="cell-date">' + escapeHtml(relativeTime(inv.expireAt)) + '</span>';
+    var expireText = expired ? '<span class="badge badge-expired">' + __t("common.expired") + '</span>' : '<span class="cell-date">' + escapeHtml(relativeTime(inv.expireAt)) + '</span>';
     var isActive = !expired && inv.status !== "closed" && inv.useCount < inv.maxUses;
     var inviter = inv.inviterName ? escapeHtml(inv.inviterName) : '<span class="text-muted">—</span>';
 
@@ -580,7 +584,7 @@ async function deleteInvitation(id) {
 function initInviteRoleOptions() {
   var select = document.getElementById("invite-role");
   if (__caller.role === "owner") {
-    select.innerHTML = '<option value="guest">Guest</option><option value="member">Member</option><option value="admin">Admin</option>';
+    select.innerHTML = '<option value="guest">' + __t("common.guest") + '</option><option value="member">' + __t("common.member") + '</option><option value="admin">' + __t("common.admin") + '</option>';
   }
 }
 

package/dist/assets/{admin.c26bb17a.css → admin.dfeedbe4.css}

@@ -1157,11 +1157,20 @@
     max-width: 520px;
     width: 90%;
     box-shadow: var(--shadow-lg);
+    max-height: calc(100vh - 32px);
+    max-height: calc(100dvh - 32px);
     overflow: hidden;
     animation: modalIn 0.2s ease;
   }
+  dialog[open] {
+    display: flex;
+    flex-direction: column;
+  }
   dialog::backdrop { background: rgba(0,0,0,0.7); }
   .dialog-content {
+    min-height: 0;
+    overflow-y: auto;
+    overscroll-behavior: contain;
     padding: 24px;
   }
   .dialog-content h3 {
@@ -1179,6 +1188,7 @@
   }
   .dialog-actions {
     display: flex;
+    flex: 0 0 auto;
     justify-content: flex-end;
     gap: 8px;
     padding: 16px 24px;