@burtson-labs/bandit-nav 0.1.0 → 0.2.0

package/README.md

@@ -7,10 +7,23 @@ settings live; the package decides which items are local routes and which
 cross to the other site. Cross-site items are ordinary same-tab links, and
 single sign-on between the two sites makes the destination open signed in.
 
+Agents and Artifacts are Stealth, and Stealth access is membership in a
+Stealth organization: a user outside every organization sees **Chat ·
+Settings** only, so the bar never offers a link that dead-ends.
+
 ```tsx
-import { ProductNav, productNavActive, productNavItems } from '@burtson-labs/bandit-nav';
+import {
+  ProductNav,
+  productNavActive,
+  productNavItems,
+  stealthAccessFromToken,
+} from '@burtson-labs/bandit-nav';
 
-const items = productNavItems({ site: 'stealth', settingsPath: '/settings' });
+const items = productNavItems({
+  site: 'stealth',
+  settingsPath: '/settings',
+  stealthAccess: stealthAccessFromToken(accessToken),
+});
 const active = productNavActive(items, location.pathname);
 
 <ProductNav
@@ -24,9 +37,18 @@ const active = productNavActive(items, location.pathname);
 />;
 ```
 
-- `productNavItems({ site, settingsPath, chatOrigin?, stealthOrigin?, artifactsHref? })`
-  returns the four items in display order. `artifactsHref` is for a host that
-  serves the shared artifacts page itself (default: Stealth's page).
+- `productNavItems({ site, settingsPath, chatOrigin?, stealthOrigin?, artifactsHref?, stealthAccess? })`
+  returns the items in display order: all four with `stealthAccess: true`,
+  Chat and Settings otherwise (the default, so an unknown session fails
+  closed). `artifactsHref` is for a host that serves the shared artifacts
+  page itself (default: Stealth's page).
+- `stealthAccessFromToken(token)` / `stealthAccessFromClaims(claims)` apply
+  the access rule to the host's access token: true when it carries a
+  non-empty `stealthTenants` array (AuthApi stamps the user's active Stealth
+  memberships on platform tokens) or an organization session's `tenant_sso`.
+  The token is decoded, not verified: this decides what the bar shows, and
+  the Stealth APIs enforce membership themselves. Membership changes show
+  with the next token the host receives.
 - `productNavActive(items, pathname, aliases?)` picks the item the page
   belongs to; `aliases` adds host paths to a section (account pages under
   Settings, for instance).

package/dist/index.d.ts

@@ -1,2 +1,2 @@
-export { PRODUCT_ORIGINS, productNavActive, productNavItems, type ProductNavItem, type ProductNavItemId, type ProductNavOptions, type ProductSite, } from './items.js';
+export { PRODUCT_ORIGINS, STEALTH_SECTIONS, decodeJwtPayload, productNavActive, productNavItems, stealthAccessFromClaims, stealthAccessFromToken, type ProductNavItem, type ProductNavItemId, type ProductNavOptions, type ProductSite, } from './items.js';
 export { ProductNav, ensureProductNavStyles, type ProductNavProps } from './ProductNav.js';

package/dist/index.js

@@ -1,2 +1,2 @@
-export { PRODUCT_ORIGINS, productNavActive, productNavItems, } from './items.js';
+export { PRODUCT_ORIGINS, STEALTH_SECTIONS, decodeJwtPayload, productNavActive, productNavItems, stealthAccessFromClaims, stealthAccessFromToken, } from './items.js';
 export { ProductNav, ensureProductNavStyles } from './ProductNav.js';

package/dist/items.d.ts

@@ -31,9 +31,35 @@ export interface ProductNavOptions {
      * page itself passes its own path.
      */
     artifactsHref?: string;
+    /**
+     * Whether the signed-in user may use Stealth (Agents and Artifacts): a
+     * member of at least one Stealth organization. Off or omitted, the bar is
+     * Chat and Settings only, so a user without Stealth never gets a link that
+     * dead-ends. Derive it with `stealthAccessFromToken` (or
+     * `stealthAccessFromClaims`); unknown means no.
+     */
+    stealthAccess?: boolean;
 }
-/** The canonical list, in display order. */
+/** The Stealth-only sections, shown to members of a Stealth organization. */
+export declare const STEALTH_SECTIONS: readonly ProductNavItemId[];
+/**
+ * The canonical list, in display order: Chat, Agents, Artifacts, Settings with
+ * `stealthAccess`, Chat and Settings without it.
+ */
 export declare function productNavItems(options: ProductNavOptions): ProductNavItem[];
+/**
+ * The access rule, from a token's claims: Stealth access is membership in a
+ * Stealth organization. AuthApi puts `stealthTenants` (the organizations
+ * where the user is an active member) on platform tokens, and an organization
+ * session token names its organization in `tenant_sso`. Anything else, or a
+ * value of the wrong shape, is no access. A display decision only: the
+ * Stealth APIs enforce membership themselves.
+ */
+export declare function stealthAccessFromClaims(claims: unknown): boolean;
+/** The payload of a JWT, unverified; null when it is not one. */
+export declare function decodeJwtPayload(token: string | null | undefined): unknown;
+/** `stealthAccessFromClaims` for the host's access token; no token is no access. */
+export declare function stealthAccessFromToken(token: string | null | undefined): boolean;
 /**
  * Which item the current page belongs to: the local item whose path is the
  * pathname or one of its ancestors, or one of the host's extra paths for it

package/dist/items.js

@@ -22,7 +22,12 @@ const hrefFor = (section, home, site, origin) => {
     const path = `/${SECTION_PATHS[section]}`;
     return home === site ? path : `${trimSlash(origin)}${path}`;
 };
-/** The canonical list, in display order. */
+/** The Stealth-only sections, shown to members of a Stealth organization. */
+export const STEALTH_SECTIONS = ['agents', 'artifacts'];
+/**
+ * The canonical list, in display order: Chat, Agents, Artifacts, Settings with
+ * `stealthAccess`, Chat and Settings without it.
+ */
 export function productNavItems(options) {
     const chatOrigin = options.chatOrigin ?? PRODUCT_ORIGINS.chat;
     const stealthOrigin = options.stealthOrigin ?? PRODUCT_ORIGINS.stealth;
@@ -35,13 +40,54 @@ export function productNavItems(options) {
         ],
         ['settings', options.settingsPath],
     ];
-    return entries.map(([id, href]) => ({
+    return entries
+        .filter(([id]) => options.stealthAccess === true || !STEALTH_SECTIONS.includes(id))
+        .map(([id, href]) => ({
         id,
         label: LABELS[id],
         href,
         external: !href.startsWith('/'),
     }));
 }
+/**
+ * The access rule, from a token's claims: Stealth access is membership in a
+ * Stealth organization. AuthApi puts `stealthTenants` (the organizations
+ * where the user is an active member) on platform tokens, and an organization
+ * session token names its organization in `tenant_sso`. Anything else, or a
+ * value of the wrong shape, is no access. A display decision only: the
+ * Stealth APIs enforce membership themselves.
+ */
+export function stealthAccessFromClaims(claims) {
+    if (!claims || typeof claims !== 'object')
+        return false;
+    const { stealthTenants, tenant_sso: orgSession } = claims;
+    if (Array.isArray(stealthTenants) &&
+        stealthTenants.some((tenant) => typeof tenant === 'string' && tenant.trim() !== '')) {
+        return true;
+    }
+    return typeof orgSession === 'string' && orgSession.trim() !== '';
+}
+/** The payload of a JWT, unverified; null when it is not one. */
+export function decodeJwtPayload(token) {
+    if (typeof token !== 'string')
+        return null;
+    const part = token.split('.')[1];
+    if (!part)
+        return null;
+    try {
+        const base64 = part.replace(/-/g, '+').replace(/_/g, '/');
+        const binary = atob(base64 + '='.repeat((4 - (base64.length % 4)) % 4));
+        const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
+        return JSON.parse(new TextDecoder().decode(bytes));
+    }
+    catch {
+        return null;
+    }
+}
+/** `stealthAccessFromClaims` for the host's access token; no token is no access. */
+export function stealthAccessFromToken(token) {
+    return stealthAccessFromClaims(decodeJwtPayload(token));
+}
 /**
  * Which item the current page belongs to: the local item whose path is the
  * pathname or one of its ancestors, or one of the host's extra paths for it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burtson-labs/bandit-nav",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The Bandit product navigation (Chat, Agents, Artifacts, Settings) shared by banditailabs.com, stealth.banditailabs.com and the mobile apps.",
   "license": "Apache-2.0",
   "author": {