@astrale-domains/shell 0.1.8 → 0.1.9

package/dist/domain.d.ts

@@ -35,6 +35,28 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
+        readonly view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
+            readonly depth: 0;
+            readonly abstract: false;
+            readonly extends: readonly [];
+            readonly properties: never;
+            readonly source: {
+                readonly as: "audience";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
+                    readonly origin: "kernel.astrale.ai";
+                })[];
+                readonly outgoing: "0..*";
+            };
+            readonly target: {
+                readonly as: "view";
+                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"View"> & {
+                    readonly origin: "kernel.astrale.ai";
+                })[];
+                readonly incoming: "0..*";
+            };
+            readonly constraints: Record<never, never>;
+            readonly effectiveProperties: never;
+        }>;
         readonly User: import("@astrale-os/sdk/schema").AuthoredNodeClass<{
             readonly icon: import("@astrale-os/sdk/schema").ClassIcon;
             readonly inheritance: "open";
@@ -578,28 +600,6 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
             readonly constraints: Record<never, never>;
             readonly effectiveProperties: never;
         }>;
-        readonly view_access: import("@astrale-os/sdk/schema").DirectedEdgeClass<{
-            readonly depth: 0;
-            readonly abstract: false;
-            readonly extends: readonly [];
-            readonly properties: never;
-            readonly source: {
-                readonly as: "audience";
-                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"Identity"> & {
-                    readonly origin: "kernel.astrale.ai";
-                })[];
-                readonly outgoing: "0..*";
-            };
-            readonly target: {
-                readonly as: "view";
-                readonly accepts: readonly (import("@astrale-os/sdk/schema").ClassRef<"View"> & {
-                    readonly origin: "kernel.astrale.ai";
-                })[];
-                readonly incoming: "0..*";
-            };
-            readonly constraints: Record<never, never>;
-            readonly effectiveProperties: never;
-        }>;
     };
     readonly functions: {
         readonly listEntrypoints: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
@@ -633,6 +633,13 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
                 profiles: number;
             };
         }, "authorized", false, false, undefined, undefined>>;
+        readonly legacyMigrateViewAccess: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<Record<string, never>, {
+            readonly mode: 'value';
+            readonly value: {
+                copied: number;
+                removed: number;
+            };
+        }, "authorized", false, false, undefined, undefined>>;
         readonly disconnectDirectory: import("@astrale-os/sdk/schema").Function<import("@astrale-os/sdk/schema").CallableProjection<{
             directory: string;
         }, {
@@ -650,8 +657,8 @@ declare const frontend: import("@astrale-os/sdk/view").Frontend<import("@astrale
         readonly usesFunction: import("@astrale-os/sdk/schema").Policy;
         readonly isSelf: import("@astrale-os/sdk/schema").Policy;
         readonly legacyOwnsMembershipGroup: import("@astrale-os/sdk/schema").Policy;
-        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
         readonly holdsViewAccess: import("@astrale-os/sdk/schema").Policy;
+        readonly hasRole: import("@astrale-os/sdk/schema").Policy;
         readonly describesSubject: import("@astrale-os/sdk/schema").Policy;
         readonly isProfileSource: import("@astrale-os/sdk/schema").Policy;
         readonly describesGroupOfSubject: import("@astrale-os/sdk/schema").Policy;

package/dist/domain.js

@@ -107,6 +107,14 @@ const domainRequirements = requirements(legacyRelease({
             members: [S.core.nodes['workspace.member']],
             granters: [S.core.nodes['workspace.admin']],
         },
+        // Shell writes the Kernel's view_access for assignViews and its migration (L-SHELL-12,
+        // L-SHELL-20); an administrator writes it from the console through Kernel admin. Transition
+        // only: removed with those two Functions (step 5).
+        {
+            role: K.core.nodes['view.manager'],
+            members: [requirements.domain],
+            granters: [S.core.nodes['workspace.admin']],
+        },
         { role: K.core.nodes['domain.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['execution.reader'], granters: [S.core.nodes['workspace.admin']] },
         { role: K.core.nodes['journal.reader'], granters: [S.core.nodes['workspace.admin']] },

package/dist/functions/authority/roles.js

@@ -26,7 +26,8 @@ const keyOf = (ref) => `${ref.origin}:${ref.name}`;
 const ROLE_STEP = 256;
 /**
  * One handler's view of authority. Each composition, and the Roles it holds, is read once; only the
- * Roles a composition reaches are read, never the catalogue of every installed Role.
+ * Roles a composition reaches are read, never the catalogue of every installed Role. What the
+ * caller holds is asked once per Role too, so a handler may ask early and use the answer later.
  */
 export function authority(capabilities) {
     const S = capabilities.domain;
@@ -75,13 +76,20 @@ export function authority(capabilities) {
         return ((origin === S.origin && SHELL_ADMINISTRATIVE.has(name)) ||
             (origin === kernel && !KERNEL_ORDINARY.has(name)));
     };
+    const callerRoles = new Map();
     return {
         roleNode,
-        async callerHolds(role) {
-            const caller = capabilities.graph.caller;
-            if (caller === undefined)
-                return false;
-            return caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+        callerHolds(role) {
+            let holds = callerRoles.get(role);
+            if (holds === undefined) {
+                const caller = capabilities.graph.caller;
+                holds =
+                    caller === undefined
+                        ? Promise.resolve(false)
+                        : caller.query(readRoleNode, { role: S.core.nodes[role].ref });
+                callerRoles.set(role, holds);
+            }
+            return holds;
         },
         async heldRole(identity) {
             const held = await heldKeys(identity);

package/dist/functions/group/change-group-membership.js

@@ -1,3 +1,4 @@
+import { authority } from '../authority/index.js';
 import { setGroupMemberships } from '../../mutations/group/index.js';
 import { readGroupMembers, readGroupMembersEndpoints } from '../../queries/group/index.js';
 import { readIdentities } from '../../queries/identity/index.js';
@@ -21,12 +22,17 @@ export async function changeGroupMembers(context, input, present, { checkMembers
     if (first === undefined)
         throw invalid();
     const members = [first, ...others];
+    const authorities = authority(context);
     // A fixed number of reads, whatever the number of members: one per kind, never one per member.
+    // What the caller holds is asked with them, so G2 and G3 wait on no further round trip for it.
     const [identities, observed, stored] = await Promise.all([
         // A list of members is not a typed Path input: each must be an account or a group.
         checkMembers ? identitiesOnly(context, members) : true,
         observeMembers(context, { members, group }, present),
         readGroup(context, group),
+        authorities.callerHolds('directory.provisioner'),
+        authorities.callerHolds('group.writer'),
+        authorities.callerHolds('workspace.admin'),
     ]);
     if (!identities)
         throw invalid();
@@ -41,7 +47,7 @@ export async function changeGroupMembers(context, input, present, { checkMembers
     }
     if (stored === undefined)
         throw context.error('GROUP_NOT_FOUND', {});
-    const refusal = await membershipRefusal(context, stored);
+    const refusal = await membershipRefusal(context, stored, authorities);
     if (refusal !== undefined) {
         if (refusal.code === 'GROUP_ROLE_PROTECTED') {
             throw context.error(refusal.code, { role: refusal.role });

package/dist/functions/group/membership-laws.js

@@ -4,34 +4,32 @@ import { isProvidedGroup } from './group.js';
  * G2 and G3 for one change of a Shell group's members. A provided group changes its members only
  * through its directory, a local one through `group.writer`; a group that holds a Role, directly or
  * through what it extends, only by an admin or its directory. A member that would join a group it
- * already holds is refused by the Kernel, which keeps `extends_with` acyclic.
+ * already holds is refused by the Kernel, which keeps `extends_with` acyclic. What the caller holds
+ * is asked at once; the group's composition is walked only for a caller who is no admin.
  */
-export async function membershipRefusal(capabilities, group) {
-    const authorities = authority(capabilities);
-    const provided = isProvidedGroup(group);
-    if (provided) {
-        if (!(await authorities.callerHolds('directory.provisioner'))) {
-            return { code: 'GROUP_DIRECTORY_MANAGED' };
-        }
+export async function membershipRefusal(capabilities, group, authorities = authority(capabilities)) {
+    if (isProvidedGroup(group)) {
+        return (await authorities.callerHolds('directory.provisioner'))
+            ? undefined
+            : { code: 'GROUP_DIRECTORY_MANAGED' };
     }
-    else if (!(await authorities.callerHolds('group.writer'))) {
+    const [writer, admin] = await Promise.all([
+        authorities.callerHolds('group.writer'),
+        authorities.callerHolds('workspace.admin'),
+    ]);
+    if (!writer)
         return { code: 'GROUP_NOT_DIRECTORY_MANAGED' };
-    }
-    if (!provided) {
-        const role = await roleProtected(capabilities, group);
-        if (role !== undefined)
-            return { code: 'GROUP_ROLE_PROTECTED', role };
-    }
-    return undefined;
+    if (admin)
+        return undefined;
+    const role = await authorities.heldRole(group.id);
+    return role === undefined ? undefined : { code: 'GROUP_ROLE_PROTECTED', role };
 }
 /**
  * G3: the Role a group holds, when the caller is no admin and so may not change who holds it,
- * through its members or by deleting it.
+ * through its members or by deleting it. An admin is never refused, so its composition is not read.
  */
-export async function roleProtected(capabilities, group) {
-    const authorities = authority(capabilities);
-    const role = await authorities.heldRole(group.id);
-    if (role === undefined || (await authorities.callerHolds('workspace.admin')))
+export async function roleProtected(capabilities, group, authorities = authority(capabilities)) {
+    if (await authorities.callerHolds('workspace.admin'))
         return undefined;
-    return role;
+    return authorities.heldRole(group.id);
 }

package/dist/functions/view-access/index.js

@@ -1,2 +1,2 @@
-// Seam L-SHELL-12: the legacy handler the Runtime registers.
-export { legacyAssignViews } from './legacy/index.js';
+// Seams L-SHELL-12, L-SHELL-20: the legacy handlers the Runtime registers.
+export { legacyAssignViews, legacyMigrateViewAccess } from './legacy/index.js';

package/dist/functions/view-access/legacy/index.js

@@ -1 +1,2 @@
 export { legacyAssignViews } from './assign-views.js';
+export { legacyMigrateViewAccess } from './migrate-view-access.js';

package/dist/functions/view-access/legacy/migrate-view-access.js

@@ -0,0 +1,29 @@
+import { defineAction } from '@astrale-os/sdk/action';
+import { legacyMoveViewAccess } from '../../../mutations/view-access/legacy/index.js';
+import { legacyGivenViewKey, legacyReadViewAccessToMove } from '../../../queries/view-access/legacy/index.js';
+/** Edges moved by one write. */
+const BATCH = 200;
+/**
+ * @deprecated Copy every Shell `view_access` Edge to the Kernel's, the one the Kernel enforces
+ * from kernel-host 1.0.0-beta.45, then delete the Shell's (L-SHELL-20). Idempotent: a View the
+ * Kernel's Edge already gives is not copied again, and a second run finds no Shell Edge. Each batch
+ * copies and deletes in one write, so a View is never given by neither Edge. Replaced by nothing:
+ * Views are given through the Kernel's Edge. Removal: Shell major (delivery step 5), once every
+ * instance has run it.
+ */
+export const legacyMigrateViewAccess = defineAction()('legacyMigrateViewAccess', async (context) => {
+    const { shell, kernel } = await context.query(legacyReadViewAccessToMove, {});
+    let copied = 0;
+    let removed = 0;
+    for (let start = 0; start < shell.length; start += BATCH) {
+        const remove = shell.slice(start, start + BATCH);
+        const copy = remove.filter((given) => !kernel.has(legacyGivenViewKey(given)));
+        const result = await context.mutate(legacyMoveViewAccess, { copy, remove });
+        if (!result.ok) {
+            throw new Error(`view_access migration stopped after ${removed} Edges: ${result.code}; run it again.`);
+        }
+        copied += copy.length;
+        removed += remove.length;
+    }
+    return { copied, removed };
+});

package/dist/mutations/view-access/legacy/index.js

@@ -0,0 +1 @@
+export { legacyMoveViewAccess } from './move-view-access.js';

package/dist/mutations/view-access/legacy/move-view-access.js

@@ -0,0 +1,26 @@
+import { defineMutation } from '@astrale-os/sdk/mutation';
+/**
+ * @deprecated Create Kernel `view_access` Edges and delete Shell ones in one write (L-SHELL-20).
+ * Replaced by nothing. Removal: with `legacyMigrateViewAccess`.
+ */
+export const legacyMoveViewAccess = defineMutation()((domain) => ({
+    id: 'shell.view-access.legacy-move',
+    build(input, mutation) {
+        for (const { identity, view } of input.copy) {
+            mutation.createEdge({
+                class: domain.dependencies.kernel.classes.view_access,
+                source: identity,
+                target: view,
+            });
+        }
+        for (const { identity, view } of input.remove) {
+            mutation.deleteEdge({ class: domain.classes.view_access, source: identity, target: view });
+        }
+    },
+    project: () => ({ ok: true }),
+    reject: (failure) => ({
+        ok: false,
+        code: failure.code,
+        outcomeKnown: failure.outcomeKnown,
+    }),
+}));

package/dist/mutations/view-access/set-view-access.js

@@ -5,7 +5,7 @@ export const setViewAccess = defineMutation()((domain) => ({
     build(input, mutation) {
         mutation.expect.query(input.guard);
         const edge = ({ identity, view }) => ({
-            class: domain.classes.view_access,
+            class: domain.dependencies.kernel.classes.view_access,
             source: identity,
             target: view,
         });

package/dist/queries/view-access/legacy/index.js

@@ -0,0 +1 @@
+export { legacyGivenViewKey, legacyReadViewAccessToMove, } from './read-view-access-to-move.js';

package/dist/queries/view-access/legacy/read-view-access-to-move.js

@@ -0,0 +1,40 @@
+import { defineQuery, Query, queryResult, } from '@astrale-os/sdk/query';
+/**
+ * @deprecated The key `LegacyViewAccessToMove.kernel` holds for an Edge (L-SHELL-20). Replaced by
+ * nothing. Removal: with `legacyMigrateViewAccess`.
+ */
+export const legacyGivenViewKey = ({ identity, view }) => `${identity} ${view}`;
+/**
+ * @deprecated Every `view_access` Edge, the Shell's and the Kernel's, in one read (L-SHELL-20).
+ * Replaced by nothing: the Kernel's alone is written. Removal: with `legacyMigrateViewAccess`.
+ */
+export const legacyReadViewAccessToMove = defineQuery()((domain) => {
+    const shellClass = domain.classes.view_access;
+    const kernelClass = domain.dependencies.kernel.classes.view_access;
+    return {
+        id: 'shell.view-access.legacy-to-move',
+        page: { size: 1000 },
+        pagination: { maximumPages: 103 },
+        build: () => Query.from({ edges: [shellClass, kernelClass] }).select({
+            kind: 'edges',
+            projection: { edge: 'value', source: 'reference', target: 'reference' },
+        }),
+        project(pages) {
+            const shell = [];
+            const kernel = new Set();
+            for (const page of pages) {
+                for (const item of queryResult.edgeItems(page, 'Shell view access to move')) {
+                    if (item.edge.kind !== 'value')
+                        continue;
+                    const { class: key, source, target } = item.edge.value;
+                    const given = { identity: source, view: target };
+                    if (key === shellClass.key)
+                        shell.push(given);
+                    else if (key === kernelClass.key)
+                        kernel.add(legacyGivenViewKey(given));
+                }
+            }
+            return { shell, kernel };
+        },
+    };
+});

package/dist/queries/view-access/read-view-access.js

@@ -7,7 +7,7 @@ export const readViewAccess = defineQuery()((domain) => ({
         const held = Query.from({
             nodes: [Path.id(identities[0]), ...identities.slice(1).map((identity) => Path.id(identity))],
         }).expand({
-            via: [domain.classes.view_access],
+            via: [domain.dependencies.kernel.classes.view_access],
             direction: 'outgoing',
         });
         return held.select({