@bizapps/design-system-testing 1.9.0 → 1.10.0

package/dist/policy-DPpMNLiO.d.cts

@@ -0,0 +1,75 @@
+/**
+ * AUTO-GENERATED — do not edit by hand.
+ *
+ * Regenerate with `pnpm generate-permissions`, which reads the catalog from the
+ * Nexus backend. The list is committed so the library build never depends on a
+ * live backend call.
+ *
+ * While this list is empty, `Permission` degrades to plain `string` and the
+ * development-time unknown-permission warning is skipped entirely — an empty
+ * catalog must never produce false positives.
+ */
+declare const KNOWN_PERMISSIONS: readonly [];
+type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
+
+/**
+ * A permission string in `resource.action` or `module.resource.action`
+ * dot-notation, lowercase, with `*` as a segment wildcard and a bare `*` as the
+ * super-grant.
+ *
+ * Known catalog entries are suggested by autocomplete; any other string is still
+ * accepted, so a permission the catalog has not caught up with never blocks a
+ * build. The `(string & {})` half is the TypeScript idiom that keeps the literal
+ * suggestions from collapsing into plain `string`.
+ */
+type Permission = KnownPermission | (string & {});
+
+/**
+ * The server-safe half of the authorization system.
+ *
+ * Everything in this module is a pure function over plain data: no React, no hooks, no
+ * context, no module-level mutable state. That is not incidental — it is the contract.
+ * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which
+ * tsup deliberately does NOT stamp with `"use client"`, so a Next.js Server Component,
+ * Route Handler or Server Action can import it and evaluate permissions on the server.
+ *
+ * **Never import React (or anything that transitively does) into this file.** The build
+ * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a
+ * `"use client"` directive. Breaking that turns every server-side caller into a client
+ * reference, silently.
+ *
+ * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these
+ * same functions, so there is exactly one implementation of the matching rules. Two
+ * implementations of an authorization primitive drift, and drift on a security boundary
+ * is invisible until it matters.
+ */
+
+/**
+ * Tests one entry of the user's grant set against one requested permission.
+ *
+ * @param pattern - an entry from the user's grant set; may contain `*` as a segment
+ *   wildcard, or be a bare `*` meaning "everything"
+ * @param permission - the concrete permission being requested
+ *
+ * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of
+ * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the
+ * ambiguity of whether `users` names the resource or the namespace.
+ */
+declare function matchPermission(pattern: string, permission: string): boolean;
+/** Whether any entry in the grant set covers the requested permission. */
+declare function matchesAny(permissionSet: Set<string>, permission: string): boolean;
+/**
+ * Evaluates a permission requirement against a grant set.
+ *
+ * The order of the first two checks is load-bearing and must not be swapped: an empty
+ * required list denies **even for a super-grant holder**, because an empty list means
+ * "nothing satisfies this", not "anything does".
+ *
+ * @param permissionSet - the user's grants
+ * @param perms - the permission(s) required
+ * @param mode - with an array, `'any'` (default) passes when at least one matches,
+ *   `'all'` requires every one
+ */
+declare function can(permissionSet: Set<string>, perms: Permission | Permission[], mode?: 'any' | 'all'): boolean;
+
+export { KNOWN_PERMISSIONS as K, type Permission as P, type KnownPermission as a, matchesAny as b, can as c, matchPermission as m };

package/dist/policy-DPpMNLiO.d.ts

@@ -0,0 +1,75 @@
+/**
+ * AUTO-GENERATED — do not edit by hand.
+ *
+ * Regenerate with `pnpm generate-permissions`, which reads the catalog from the
+ * Nexus backend. The list is committed so the library build never depends on a
+ * live backend call.
+ *
+ * While this list is empty, `Permission` degrades to plain `string` and the
+ * development-time unknown-permission warning is skipped entirely — an empty
+ * catalog must never produce false positives.
+ */
+declare const KNOWN_PERMISSIONS: readonly [];
+type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
+
+/**
+ * A permission string in `resource.action` or `module.resource.action`
+ * dot-notation, lowercase, with `*` as a segment wildcard and a bare `*` as the
+ * super-grant.
+ *
+ * Known catalog entries are suggested by autocomplete; any other string is still
+ * accepted, so a permission the catalog has not caught up with never blocks a
+ * build. The `(string & {})` half is the TypeScript idiom that keeps the literal
+ * suggestions from collapsing into plain `string`.
+ */
+type Permission = KnownPermission | (string & {});
+
+/**
+ * The server-safe half of the authorization system.
+ *
+ * Everything in this module is a pure function over plain data: no React, no hooks, no
+ * context, no module-level mutable state. That is not incidental — it is the contract.
+ * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which
+ * tsup deliberately does NOT stamp with `"use client"`, so a Next.js Server Component,
+ * Route Handler or Server Action can import it and evaluate permissions on the server.
+ *
+ * **Never import React (or anything that transitively does) into this file.** The build
+ * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a
+ * `"use client"` directive. Breaking that turns every server-side caller into a client
+ * reference, silently.
+ *
+ * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these
+ * same functions, so there is exactly one implementation of the matching rules. Two
+ * implementations of an authorization primitive drift, and drift on a security boundary
+ * is invisible until it matters.
+ */
+
+/**
+ * Tests one entry of the user's grant set against one requested permission.
+ *
+ * @param pattern - an entry from the user's grant set; may contain `*` as a segment
+ *   wildcard, or be a bare `*` meaning "everything"
+ * @param permission - the concrete permission being requested
+ *
+ * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of
+ * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the
+ * ambiguity of whether `users` names the resource or the namespace.
+ */
+declare function matchPermission(pattern: string, permission: string): boolean;
+/** Whether any entry in the grant set covers the requested permission. */
+declare function matchesAny(permissionSet: Set<string>, permission: string): boolean;
+/**
+ * Evaluates a permission requirement against a grant set.
+ *
+ * The order of the first two checks is load-bearing and must not be swapped: an empty
+ * required list denies **even for a super-grant holder**, because an empty list means
+ * "nothing satisfies this", not "anything does".
+ *
+ * @param permissionSet - the user's grants
+ * @param perms - the permission(s) required
+ * @param mode - with an array, `'any'` (default) passes when at least one matches,
+ *   `'all'` requires every one
+ */
+declare function can(permissionSet: Set<string>, perms: Permission | Permission[], mode?: 'any' | 'all'): boolean;
+
+export { KNOWN_PERMISSIONS as K, type Permission as P, type KnownPermission as a, matchesAny as b, can as c, matchPermission as m };

package/dist/policy.cjs

@@ -0,0 +1,33 @@
+'use strict';
+
+// src/components/authorization/policy.ts
+function matchPermission(pattern, permission) {
+  if (pattern === "*") return true;
+  if (pattern === permission) return true;
+  const patternParts = pattern.split(".");
+  const permParts = permission.split(".");
+  if (patternParts.length !== permParts.length) return false;
+  return patternParts.every((part, i) => part === "*" || part === permParts[i]);
+}
+function matchesAny(permissionSet, permission) {
+  if (permissionSet.has(permission)) return true;
+  for (const pattern of permissionSet) {
+    if (matchPermission(pattern, permission)) return true;
+  }
+  return false;
+}
+function can(permissionSet, perms, mode = "any") {
+  const list = Array.isArray(perms) ? perms : [perms];
+  if (list.length === 0) return false;
+  if (permissionSet.has("*")) return true;
+  if (mode === "all") {
+    return list.every((p) => matchesAny(permissionSet, p));
+  }
+  return list.some((p) => matchesAny(permissionSet, p));
+}
+
+exports.can = can;
+exports.matchPermission = matchPermission;
+exports.matchesAny = matchesAny;
+//# sourceMappingURL=policy.cjs.map
+//# sourceMappingURL=policy.cjs.map

package/dist/policy.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/authorization/policy.ts"],"names":[],"mappings":";;;AAgCA,SAAS,eAAA,CAAgB,SAAiB,UAAA,EAA6B;AACnE,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAC5B,EAAA,IAAI,OAAA,KAAY,YAAY,OAAO,IAAA;AACnC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,CAAU,MAAA,EAAQ,OAAO,KAAA;AACrD,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,IAAA,EAAM,CAAA,KAAM,SAAS,GAAA,IAAO,IAAA,KAAS,SAAA,CAAU,CAAC,CAAC,CAAA;AAChF;AAGA,SAAS,UAAA,CAAW,eAA4B,UAAA,EAA6B;AACzE,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACjC,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACX;AAcA,SAAS,GAAA,CACL,aAAA,EACA,KAAA,EACA,IAAA,GAAsB,KAAA,EACf;AACP,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAClD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,SAAS,KAAA,EAAO;AAChB,IAAA,OAAO,KAAK,KAAA,CAAM,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AACxD","file":"policy.cjs","sourcesContent":["/**\n * The server-safe half of the authorization system.\n *\n * Everything in this module is a pure function over plain data: no React, no hooks, no\n * context, no module-level mutable state. That is not incidental — it is the contract.\n * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which\n * tsup deliberately does NOT stamp with `\"use client\"`, so a Next.js Server Component,\n * Route Handler or Server Action can import it and evaluate permissions on the server.\n *\n * **Never import React (or anything that transitively does) into this file.** The build\n * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a\n * `\"use client\"` directive. Breaking that turns every server-side caller into a client\n * reference, silently.\n *\n * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these\n * same functions, so there is exactly one implementation of the matching rules. Two\n * implementations of an authorization primitive drift, and drift on a security boundary\n * is invisible until it matters.\n */\nimport type { Permission } from './permission-catalog';\n\n/**\n * Tests one entry of the user's grant set against one requested permission.\n *\n * @param pattern - an entry from the user's grant set; may contain `*` as a segment\n *   wildcard, or be a bare `*` meaning \"everything\"\n * @param permission - the concrete permission being requested\n *\n * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of\n * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the\n * ambiguity of whether `users` names the resource or the namespace.\n */\nfunction matchPermission(pattern: string, permission: string): boolean {\n    if (pattern === '*') return true;\n    if (pattern === permission) return true;\n    const patternParts = pattern.split('.');\n    const permParts = permission.split('.');\n    if (patternParts.length !== permParts.length) return false;\n    return patternParts.every((part, i) => part === '*' || part === permParts[i]);\n}\n\n/** Whether any entry in the grant set covers the requested permission. */\nfunction matchesAny(permissionSet: Set<string>, permission: string): boolean {\n    if (permissionSet.has(permission)) return true;\n    for (const pattern of permissionSet) {\n        if (matchPermission(pattern, permission)) return true;\n    }\n    return false;\n}\n\n/**\n * Evaluates a permission requirement against a grant set.\n *\n * The order of the first two checks is load-bearing and must not be swapped: an empty\n * required list denies **even for a super-grant holder**, because an empty list means\n * \"nothing satisfies this\", not \"anything does\".\n *\n * @param permissionSet - the user's grants\n * @param perms - the permission(s) required\n * @param mode - with an array, `'any'` (default) passes when at least one matches,\n *   `'all'` requires every one\n */\nfunction can(\n    permissionSet: Set<string>,\n    perms: Permission | Permission[],\n    mode: 'any' | 'all' = 'any',\n): boolean {\n    const list = Array.isArray(perms) ? perms : [perms];\n    if (list.length === 0) return false;\n    if (permissionSet.has('*')) return true;\n    if (mode === 'all') {\n        return list.every((p) => matchesAny(permissionSet, p));\n    }\n    return list.some((p) => matchesAny(permissionSet, p));\n}\n\nexport { can, matchPermission, matchesAny };\n"]}

package/dist/policy.d.cts

@@ -0,0 +1 @@
+export { P as Permission, c as can, m as matchPermission, b as matchesAny } from './policy-DPpMNLiO.cjs';

package/dist/policy.d.ts

@@ -0,0 +1 @@
+export { P as Permission, c as can, m as matchPermission, b as matchesAny } from './policy-DPpMNLiO.js';

package/dist/policy.js

@@ -0,0 +1,29 @@
+// src/components/authorization/policy.ts
+function matchPermission(pattern, permission) {
+  if (pattern === "*") return true;
+  if (pattern === permission) return true;
+  const patternParts = pattern.split(".");
+  const permParts = permission.split(".");
+  if (patternParts.length !== permParts.length) return false;
+  return patternParts.every((part, i) => part === "*" || part === permParts[i]);
+}
+function matchesAny(permissionSet, permission) {
+  if (permissionSet.has(permission)) return true;
+  for (const pattern of permissionSet) {
+    if (matchPermission(pattern, permission)) return true;
+  }
+  return false;
+}
+function can(permissionSet, perms, mode = "any") {
+  const list = Array.isArray(perms) ? perms : [perms];
+  if (list.length === 0) return false;
+  if (permissionSet.has("*")) return true;
+  if (mode === "all") {
+    return list.every((p) => matchesAny(permissionSet, p));
+  }
+  return list.some((p) => matchesAny(permissionSet, p));
+}
+
+export { can, matchPermission, matchesAny };
+//# sourceMappingURL=policy.js.map
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/components/authorization/policy.ts"],"names":[],"mappings":";AAgCA,SAAS,eAAA,CAAgB,SAAiB,UAAA,EAA6B;AACnE,EAAA,IAAI,OAAA,KAAY,KAAK,OAAO,IAAA;AAC5B,EAAA,IAAI,OAAA,KAAY,YAAY,OAAO,IAAA;AACnC,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,MAAM,SAAA,GAAY,UAAA,CAAW,KAAA,CAAM,GAAG,CAAA;AACtC,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,SAAA,CAAU,MAAA,EAAQ,OAAO,KAAA;AACrD,EAAA,OAAO,YAAA,CAAa,KAAA,CAAM,CAAC,IAAA,EAAM,CAAA,KAAM,SAAS,GAAA,IAAO,IAAA,KAAS,SAAA,CAAU,CAAC,CAAC,CAAA;AAChF;AAGA,SAAS,UAAA,CAAW,eAA4B,UAAA,EAA6B;AACzE,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AAC1C,EAAA,KAAA,MAAW,WAAW,aAAA,EAAe;AACjC,IAAA,IAAI,eAAA,CAAgB,OAAA,EAAS,UAAU,CAAA,EAAG,OAAO,IAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACX;AAcA,SAAS,GAAA,CACL,aAAA,EACA,KAAA,EACA,IAAA,GAAsB,KAAA,EACf;AACP,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,GAAQ,CAAC,KAAK,CAAA;AAClD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,KAAA;AAC9B,EAAA,IAAI,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,IAAA;AACnC,EAAA,IAAI,SAAS,KAAA,EAAO;AAChB,IAAA,OAAO,KAAK,KAAA,CAAM,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AAAA,EACzD;AACA,EAAA,OAAO,KAAK,IAAA,CAAK,CAAC,MAAM,UAAA,CAAW,aAAA,EAAe,CAAC,CAAC,CAAA;AACxD","file":"policy.js","sourcesContent":["/**\n * The server-safe half of the authorization system.\n *\n * Everything in this module is a pure function over plain data: no React, no hooks, no\n * context, no module-level mutable state. That is not incidental — it is the contract.\n * `src/policy.ts` re-exports this file as the `@bizapps/ui/policy` entry point, which\n * tsup deliberately does NOT stamp with `\"use client\"`, so a Next.js Server Component,\n * Route Handler or Server Action can import it and evaluate permissions on the server.\n *\n * **Never import React (or anything that transitively does) into this file.** The build\n * asserts it: `tsup.config.ts` fails if `dist/policy.js` contains a react import or a\n * `\"use client\"` directive. Breaking that turns every server-side caller into a client\n * reference, silently.\n *\n * The client half — `AbilityProvider`, `useAbility`, `useCan`, `Can` — consumes these\n * same functions, so there is exactly one implementation of the matching rules. Two\n * implementations of an authorization primitive drift, and drift on a security boundary\n * is invisible until it matters.\n */\nimport type { Permission } from './permission-catalog';\n\n/**\n * Tests one entry of the user's grant set against one requested permission.\n *\n * @param pattern - an entry from the user's grant set; may contain `*` as a segment\n *   wildcard, or be a bare `*` meaning \"everything\"\n * @param permission - the concrete permission being requested\n *\n * Matching is arity-strict: a grant of `users.*` covers `users.delete`, but a grant of\n * `users` does NOT, and neither covers `users.delete.confirm`. That rules out the\n * ambiguity of whether `users` names the resource or the namespace.\n */\nfunction matchPermission(pattern: string, permission: string): boolean {\n    if (pattern === '*') return true;\n    if (pattern === permission) return true;\n    const patternParts = pattern.split('.');\n    const permParts = permission.split('.');\n    if (patternParts.length !== permParts.length) return false;\n    return patternParts.every((part, i) => part === '*' || part === permParts[i]);\n}\n\n/** Whether any entry in the grant set covers the requested permission. */\nfunction matchesAny(permissionSet: Set<string>, permission: string): boolean {\n    if (permissionSet.has(permission)) return true;\n    for (const pattern of permissionSet) {\n        if (matchPermission(pattern, permission)) return true;\n    }\n    return false;\n}\n\n/**\n * Evaluates a permission requirement against a grant set.\n *\n * The order of the first two checks is load-bearing and must not be swapped: an empty\n * required list denies **even for a super-grant holder**, because an empty list means\n * \"nothing satisfies this\", not \"anything does\".\n *\n * @param permissionSet - the user's grants\n * @param perms - the permission(s) required\n * @param mode - with an array, `'any'` (default) passes when at least one matches,\n *   `'all'` requires every one\n */\nfunction can(\n    permissionSet: Set<string>,\n    perms: Permission | Permission[],\n    mode: 'any' | 'all' = 'any',\n): boolean {\n    const list = Array.isArray(perms) ? perms : [perms];\n    if (list.length === 0) return false;\n    if (permissionSet.has('*')) return true;\n    if (mode === 'all') {\n        return list.every((p) => matchesAny(permissionSet, p));\n    }\n    return list.some((p) => matchesAny(permissionSet, p));\n}\n\nexport { can, matchPermission, matchesAny };\n"]}