@byline/admin 2.4.0 → 2.4.2

package/dist/abilities.js

@@ -1,28 +1,9 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { registerAdminPermissionsAbilities } from './modules/admin-permissions/abilities.js';
-import { registerAdminRolesAbilities } from './modules/admin-roles/abilities.js';
-import { registerAdminUsersAbilities } from './modules/admin-users/abilities.js';
-/**
- * Register every ability contributed by the admin subsystem.
- *
- * Called once at `initBylineCore()` time from the webapp config. Each
- * admin module contributes its own registrar (`registerAdminUsersAbilities`,
- * `registerAdminRolesAbilities`, …); this function fans out to them so
- * the webapp wiring stays a single line.
- *
- * Admin does not self-register from core to keep the `@byline/core`
- * package free of a dependency on `@byline/admin` — the registration
- * call is an opt-in at the composition root.
- */
-export function registerAdminAbilities(registry) {
+import { registerAdminPermissionsAbilities } from "./modules/admin-permissions/abilities.js";
+import { registerAdminRolesAbilities } from "./modules/admin-roles/abilities.js";
+import { registerAdminUsersAbilities } from "./modules/admin-users/abilities.js";
+function registerAdminAbilities(registry) {
     registerAdminUsersAbilities(registry);
     registerAdminRolesAbilities(registry);
     registerAdminPermissionsAbilities(registry);
-    // registerAccountAbilities(registry) — added when that module lands
 }
+export { registerAdminAbilities };

package/dist/index.js

@@ -1,30 +1,8 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-/**
- * `@byline/admin` — the admin subsystem.
- *
- * Concrete implementation of the admin side of Byline: admin users,
- * roles, permissions, account self-service, and the built-in JWT
- * session provider. Depends on `@byline/auth` (the Actor / RequestContext
- * / SessionProvider contract) and `@byline/core` (collection and lifecycle
- * machinery). Third-party session providers (Lucia, WorkOS, Clerk, SSO)
- * are intentionally kept out of this package — they live as separate
- * adapters against `@byline/auth` directly.
- *
- * Prefer the per-module subpath exports (`@byline/admin/admin-users`,
- * `@byline/admin/auth`, etc.) over the root barrel; this root exists so
- * the package is importable as a single unit when that is convenient.
- */
-export { registerAdminAbilities } from './abilities.js';
-export { assertAdminActor, requireAdminActor } from './lib/assert-admin-actor.js';
-export { createCommand, } from './lib/create-command.js';
-export * from './modules/admin-account/index.js';
-export * from './modules/admin-permissions/index.js';
-export * from './modules/admin-roles/index.js';
-export * from './modules/admin-users/index.js';
-export * from './modules/auth/index.js';
+export * from "./modules/admin-account/index.js";
+export * from "./modules/admin-permissions/index.js";
+export * from "./modules/admin-roles/index.js";
+export * from "./modules/admin-users/index.js";
+export * from "./modules/auth/index.js";
+export { registerAdminAbilities } from "./abilities.js";
+export { assertAdminActor, requireAdminActor } from "./lib/assert-admin-actor.js";
+export { createCommand } from "./lib/create-command.js";

package/dist/lib/assert-admin-actor.js

@@ -1,81 +1,20 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { ERR_UNAUTHENTICATED, isAdminAuth } from '@byline/auth';
-/**
- * Gate every admin command behind three checks, in order:
- *
- *   1. `context` exists. No in-process call may reach an admin command
- *      without threading a `RequestContext` — seeds/tests pass
- *      `createSuperAdminContext()`.
- *   2. `context.actor` is an `AdminAuth`. Anonymous admin calls are
- *      rejected outright — admin actions are never public. A `UserAuth`
- *      (end-user identity) also fails here: it may sign in against the
- *      app realm, but it does not have an admin identity.
- *   3. The actor holds the required ability. `AdminAuth.assertAbility`
- *      short-circuits on `isSuperAdmin: true`; otherwise the flat
- *      ability set is consulted.
- *
- * Returns the narrowed `AdminAuth` so callers can use it without a
- * second type guard — the typical shape is:
- *
- *   ```ts
- *   export async function deleteAdminUserCommand(context, input, deps) {
- *     const parsed = deleteAdminUserRequestSchema.parse(input)
- *     const actor = assertAdminActor(context, ADMIN_USERS_ABILITIES.delete)
- *     return service.deleteUser(actor, parsed)
- *   }
- *   ```
- *
- * The three failures produce distinct error codes:
- *   - missing context / missing actor / wrong actor type → `ERR_UNAUTHENTICATED`
- *   - ability missing                                    → `ERR_FORBIDDEN`
- *     (thrown from `AdminAuth.assertAbility`)
- */
-export function assertAdminActor(context, ability) {
+import { ERR_UNAUTHENTICATED, isAdminAuth } from "@byline/auth";
+function assertAdminActor(context, ability) {
     const actor = requireAdminActor(context, `admin action requiring '${ability}'`);
     actor.assertAbility(ability);
     return actor;
 }
-/**
- * Authentication-only counterpart of `assertAdminActor`. Runs the same
- * three checks (context present, actor present, actor is `AdminAuth`)
- * but **does not** assert any ability key.
- *
- * Used by self-service commands where the actor is the target by
- * definition — `@byline/admin/admin-account` for "change my own
- * password" / "update my own profile". For those flows there is no
- * meaningful ability to gate against; the security property is "you
- * may only mutate your own row," and the commands enforce that by
- * sourcing the target id from `actor.id` rather than from the
- * request payload.
- *
- * Reasoning is described as part of the request narrative so the
- * `ERR_UNAUTHENTICATED` message stays useful when it surfaces in logs
- * — the helper has no `ability` argument to fall back on.
- */
-export function requireAdminActor(context, reasonForLog) {
-    if (!context) {
-        throw ERR_UNAUTHENTICATED({
-            message: `missing requestContext on ${reasonForLog}. Pass createSuperAdminContext() ` +
-                `from @byline/auth for scripts/tests, or construct a request-scoped context from your ` +
-                `session provider in the admin webapp.`,
-        });
-    }
+function requireAdminActor(context, reasonForLog) {
+    if (!context) throw ERR_UNAUTHENTICATED({
+        message: `missing requestContext on ${reasonForLog}. Pass createSuperAdminContext() from @byline/auth for scripts/tests, or construct a request-scoped context from your session provider in the admin webapp.`
+    });
     const { actor } = context;
-    if (actor == null) {
-        throw ERR_UNAUTHENTICATED({
-            message: `anonymous caller cannot perform ${reasonForLog}`,
-        });
-    }
-    if (!isAdminAuth(actor)) {
-        throw ERR_UNAUTHENTICATED({
-            message: `non-admin actor cannot perform ${reasonForLog}`,
-        });
-    }
+    if (null == actor) throw ERR_UNAUTHENTICATED({
+        message: `anonymous caller cannot perform ${reasonForLog}`
+    });
+    if (!isAdminAuth(actor)) throw ERR_UNAUTHENTICATED({
+        message: `non-admin actor cannot perform ${reasonForLog}`
+    });
     return actor;
 }
+export { assertAdminActor, requireAdminActor };

package/dist/lib/create-command.js

@@ -1,25 +1,15 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { assertAdminActor, requireAdminActor } from './assert-admin-actor.js';
-export function createCommand(spec) {
-    return async function command(context, input, deps) {
+import { assertAdminActor, requireAdminActor } from "./assert-admin-actor.js";
+function createCommand(spec) {
+    return async function(context, input, deps) {
         const parsed = spec.schemas.input.parse(input ?? {});
-        const actor = spec.auth.ability !== undefined
-            ? assertAdminActor(context, spec.auth.ability)
-            : requireAdminActor(context, spec.method);
-        // `context` is non-null after the auth step — both helpers throw
-        // `ERR_UNAUTHENTICATED` when the request context is missing.
+        const actor = void 0 !== spec.auth.ability ? assertAdminActor(context, spec.auth.ability) : requireAdminActor(context, spec.method);
         const result = await spec.handler({
             context: context,
             input: parsed,
             deps,
-            actor,
+            actor
         });
         return spec.schemas.output.parse(result);
     };
 }
+export { createCommand };

package/dist/modules/admin-account/commands.js

@@ -1,32 +1,43 @@
-/**
- * This Source Code is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * Copyright (c) Infonomic Company Limited
- */
-import { createCommand } from '../../lib/create-command.js';
-import { adminUserResponseSchema } from '../admin-users/schemas.js';
-import { changeAccountPasswordRequestSchema, getAccountRequestSchema, updateAccountRequestSchema, } from './schemas.js';
-import { AdminAccountService } from './service.js';
+import { createCommand } from "../../lib/create-command.js";
+import { adminUserResponseSchema } from "../admin-users/schemas.js";
+import { changeAccountPasswordRequestSchema, getAccountRequestSchema, updateAccountRequestSchema } from "./schemas.js";
+import { AdminAccountService } from "./service.js";
 function serviceOf(deps) {
-    return new AdminAccountService({ repo: deps.store.adminUsers });
+    return new AdminAccountService({
+        repo: deps.store.adminUsers
+    });
 }
-export const getAccountCommand = createCommand({
+const getAccountCommand = createCommand({
     method: 'getAccount',
-    auth: { authenticated: true },
-    schemas: { input: getAccountRequestSchema, output: adminUserResponseSchema },
-    handler: ({ deps, actor }) => serviceOf(deps).getAccount(actor.id),
+    auth: {
+        authenticated: true
+    },
+    schemas: {
+        input: getAccountRequestSchema,
+        output: adminUserResponseSchema
+    },
+    handler: ({ deps, actor })=>serviceOf(deps).getAccount(actor.id)
 });
-export const updateAccountCommand = createCommand({
+const updateAccountCommand = createCommand({
     method: 'updateAccount',
-    auth: { authenticated: true },
-    schemas: { input: updateAccountRequestSchema, output: adminUserResponseSchema },
-    handler: ({ input, deps, actor }) => serviceOf(deps).updateAccount(actor.id, input),
+    auth: {
+        authenticated: true
+    },
+    schemas: {
+        input: updateAccountRequestSchema,
+        output: adminUserResponseSchema
+    },
+    handler: ({ input, deps, actor })=>serviceOf(deps).updateAccount(actor.id, input)
 });
-export const changeAccountPasswordCommand = createCommand({
+const changeAccountPasswordCommand = createCommand({
     method: 'changeAccountPassword',
-    auth: { authenticated: true },
-    schemas: { input: changeAccountPasswordRequestSchema, output: adminUserResponseSchema },
-    handler: ({ input, deps, actor }) => serviceOf(deps).changePassword(actor.id, input),
+    auth: {
+        authenticated: true
+    },
+    schemas: {
+        input: changeAccountPasswordRequestSchema,
+        output: adminUserResponseSchema
+    },
+    handler: ({ input, deps, actor })=>serviceOf(deps).changePassword(actor.id, input)
 });
+export { changeAccountPasswordCommand, getAccountCommand, updateAccountCommand };

package/dist/modules/admin-account/components/change-password.d.ts

@@ -0,0 +1,8 @@
+import type { AccountResponse } from '../index.js';
+interface ChangePasswordProps {
+    account: AccountResponse;
+    onClose?: () => void;
+    onSuccess?: (account: AccountResponse) => void;
+}
+export declare function ChangeAccountPassword({ account, onClose, onSuccess }: ChangePasswordProps): import("react").JSX.Element;
+export {};

package/dist/modules/admin-account/components/change-password.js

@@ -0,0 +1,192 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { useState } from "react";
+import { revalidateLogic, useForm } from "@tanstack/react-form-start";
+import { passwordSchema } from "@byline/core/validation";
+import { Alert, Button, InputPassword, LoaderEllipsis } from "@byline/ui/react";
+import classnames from "classnames";
+import { z } from "zod";
+import { useBylineAdminServices } from "../../../services/admin-services-context.js";
+import change_password_module from "./change-password.module.js";
+const changePasswordFormSchema = z.object({
+    currentPassword: z.string().min(1, {
+        message: 'Please enter your current password'
+    }),
+    newPassword: passwordSchema,
+    confirm: z.string({
+        message: 'Please confirm the new password'
+    })
+}).refine((v)=>v.newPassword === v.confirm, {
+    message: 'New passwords do not match',
+    path: [
+        'confirm'
+    ]
+});
+function ChangeAccountPassword({ account, onClose, onSuccess }) {
+    const { changeAccountPassword } = useBylineAdminServices();
+    const [formError, setFormError] = useState(null);
+    const [successMessage, setSuccessMessage] = useState(null);
+    const form = useForm({
+        defaultValues: {
+            currentPassword: '',
+            newPassword: '',
+            confirm: ''
+        },
+        validationLogic: revalidateLogic({
+            mode: 'blur',
+            modeAfterSubmission: 'change'
+        }),
+        validators: {
+            onDynamic: changePasswordFormSchema
+        },
+        onSubmit: async ({ value })=>{
+            setFormError(null);
+            setSuccessMessage(null);
+            try {
+                const updated = await changeAccountPassword({
+                    data: {
+                        vid: account.vid,
+                        currentPassword: value.currentPassword,
+                        newPassword: value.newPassword
+                    }
+                });
+                setSuccessMessage('Password updated.');
+                form.reset({
+                    currentPassword: '',
+                    newPassword: '',
+                    confirm: ''
+                });
+                onSuccess?.(updated);
+            } catch (err) {
+                const code = getErrorCode(err);
+                if ('admin.account.invalidCurrentPassword' === code) return void form.setFieldMeta('currentPassword', (meta)=>({
+                        ...meta,
+                        errorMap: {
+                            ...meta.errorMap,
+                            onServer: 'Current password is incorrect.'
+                        },
+                        errors: [
+                            'Current password is incorrect.'
+                        ]
+                    }));
+                if ('admin.users.versionConflict' === code) return void setFormError('Your account has been modified elsewhere since you opened this form. Reload to refresh and try again.');
+                if ('admin.account.notFound' === code) return void setFormError('Your admin account could not be found. Please sign in again.');
+                setFormError('Could not change the password. Please try again.');
+            }
+        }
+    });
+    return /*#__PURE__*/ jsx("div", {
+        className: classnames('byline-account-change-password-wrap', change_password_module.wrap),
+        children: /*#__PURE__*/ jsxs("form", {
+            noValidate: true,
+            onSubmit: (event)=>{
+                event.preventDefault();
+                event.stopPropagation();
+                form.handleSubmit();
+            },
+            className: classnames('byline-account-change-password-form', change_password_module.form),
+            children: [
+                formError ? /*#__PURE__*/ jsx(Alert, {
+                    intent: "danger",
+                    children: formError
+                }) : null,
+                successMessage ? /*#__PURE__*/ jsx(Alert, {
+                    intent: "success",
+                    children: successMessage
+                }) : null,
+                /*#__PURE__*/ jsx("p", {
+                    className: "muted",
+                    children: "Other active sessions will continue to work until their tokens expire. Sign out elsewhere if you suspect another device has been compromised."
+                }),
+                /*#__PURE__*/ jsx(form.Field, {
+                    name: "currentPassword",
+                    children: (field)=>/*#__PURE__*/ jsx(InputPassword, {
+                            label: "Current password",
+                            id: "currentPassword",
+                            name: field.name,
+                            value: field.state.value,
+                            onBlur: field.handleBlur,
+                            onChange: (e)=>field.handleChange(e.currentTarget.value),
+                            error: field.state.meta.errors.length > 0,
+                            errorText: firstError(field.state.meta.errors),
+                            autoComplete: "current-password",
+                            required: true
+                        })
+                }),
+                /*#__PURE__*/ jsx(form.Field, {
+                    name: "newPassword",
+                    children: (field)=>/*#__PURE__*/ jsx(InputPassword, {
+                            label: "New password",
+                            id: "newPassword",
+                            name: field.name,
+                            value: field.state.value,
+                            onBlur: field.handleBlur,
+                            onChange: (e)=>field.handleChange(e.currentTarget.value),
+                            error: field.state.meta.errors.length > 0,
+                            errorText: firstError(field.state.meta.errors),
+                            autoComplete: "new-password",
+                            required: true
+                        })
+                }),
+                /*#__PURE__*/ jsx(form.Field, {
+                    name: "confirm",
+                    children: (field)=>/*#__PURE__*/ jsx(InputPassword, {
+                            label: "Confirm new password",
+                            id: "confirm",
+                            name: field.name,
+                            value: field.state.value,
+                            onBlur: field.handleBlur,
+                            onChange: (e)=>field.handleChange(e.currentTarget.value),
+                            error: field.state.meta.errors.length > 0,
+                            errorText: firstError(field.state.meta.errors),
+                            autoComplete: "new-password",
+                            required: true
+                        })
+                }),
+                /*#__PURE__*/ jsxs("div", {
+                    className: classnames('byline-account-change-password-actions', change_password_module.actions),
+                    children: [
+                        /*#__PURE__*/ jsx(Button, {
+                            type: "button",
+                            intent: "secondary",
+                            size: "sm",
+                            onClick: onClose,
+                            className: classnames('byline-account-change-password-action', change_password_module.action),
+                            children: successMessage ? 'Close' : 'Cancel'
+                        }),
+                        /*#__PURE__*/ jsx(form.Subscribe, {
+                            selector: (state)=>({
+                                    canSubmit: state.canSubmit,
+                                    isSubmitting: state.isSubmitting,
+                                    isDirty: state.isDirty
+                                }),
+                            children: ({ canSubmit, isSubmitting })=>/*#__PURE__*/ jsx(Button, {
+                                    size: "sm",
+                                    intent: "primary",
+                                    type: "submit",
+                                    disabled: !canSubmit || isSubmitting,
+                                    className: classnames('byline-account-change-password-action', change_password_module.action),
+                                    children: true === isSubmitting ? /*#__PURE__*/ jsx(LoaderEllipsis, {
+                                        size: 42
+                                    }) : 'Save'
+                                })
+                        })
+                    ]
+                })
+            ]
+        })
+    });
+}
+function firstError(errors) {
+    for (const err of errors){
+        if ('string' == typeof err) return err;
+        if (err && 'object' == typeof err && 'message' in err) {
+            const msg = err.message;
+            if ('string' == typeof msg) return msg;
+        }
+    }
+}
+function getErrorCode(err) {
+    return 'string' == typeof err?.code ? err.code : null;
+}
+export { ChangeAccountPassword };

package/dist/modules/admin-account/components/change-password.module.js

@@ -0,0 +1,8 @@
+import "./change-password_module.css";
+const change_password_module = {
+    wrap: "wrap-S1VOJs",
+    form: "form-W_yW2Y",
+    actions: "actions-vW3jby",
+    action: "action-DnlRqk"
+};
+export default change_password_module;

package/dist/modules/admin-account/components/change-password_module.css

@@ -0,0 +1,27 @@
+:is(.wrap-S1VOJs, .byline-account-change-password-wrap) {
+  gap: var(--spacing-8);
+  padding: var(--spacing-4);
+  margin-top: var(--spacing-4);
+  flex-direction: column;
+  display: flex;
+}
+
+:is(.form-W_yW2Y, .byline-account-change-password-form) {
+  gap: var(--spacing-16);
+  padding-top: var(--spacing-8);
+  flex-direction: column;
+  display: flex;
+}
+
+:is(.actions-vW3jby, .byline-account-change-password-actions) {
+  justify-content: flex-end;
+  align-items: center;
+  gap: var(--spacing-8);
+  margin-top: var(--spacing-16);
+  display: flex;
+}
+
+:is(.action-DnlRqk, .byline-account-change-password-action) {
+  min-width: 4rem;
+}
+

package/dist/modules/admin-account/components/container.d.ts

@@ -0,0 +1,29 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+/**
+ * Self-service account container.
+ *
+ * Same drawer pattern as `admin-users/ui/container.tsx` but
+ * narrower: only Profile and Password sections (no Roles, no
+ * Delete) — those are admin-only actions on someone else, not
+ * self-service. Each card surfaces the read-only summary plus an
+ * "Edit" affordance that opens the matching drawer.
+ *
+ * Forms lift the fresh `AccountResponse` back into local state on
+ * success so the container's bumped `vid` is in hand for any
+ * subsequent edit without a refetch.
+ *
+ * Stable override handles: see `container.module.css`.
+ */
+import type React from 'react';
+import type { AccountResponse } from '../index.js';
+interface AccountSelfContainerProps {
+    account: AccountResponse;
+}
+export declare function AccountSelfContainer({ account }: AccountSelfContainerProps): React.JSX.Element;
+export {};