@campfire-interactive/master-data-client 5.28.0 → 5.30.0

package/dist/scopeGate.d.ts

@@ -1,103 +0,0 @@
-import { HttpTransport } from './http';
-import type { ScopeDimension, SingleResponse } from './types';
-/**
- * The scope gate: who may see which records, once a tenant turns gating on.
- *
- * ONE implementation, shared. master-data can express the gate as an RLS policy
- * because it owns the tables; OMSF and pm cannot — they have no RLS extension,
- * so their gate is a clause in a query builder. A clause copied into a dozen
- * call sites is a clause that gets missed in one of them, and a missed scope
- * clause is a data leak rather than a cosmetic bug. So it lives here, with the
- * fetching and caching it needs, and callers spread the result.
- *
- * TWO RULES SHAPE EVERYTHING, and both fail OPEN by deliberate decision
- * (nextgen ADR 2026-09-14, decisions 3 and 4):
- *
- *   - A user with NO assignment is unrestricted. On the day gating ships nobody
- *     has an assignment, and failing closed would lock out every user in the
- *     tenant at once — with the omission that caused it looking exactly like
- *     the feature working.
- *   - A record with NO scope is visible to everyone. Almost nothing is scoped
- *     at first, so failing closed would hide the entire dataset until someone
- *     hand-scoped it.
- *
- * The consequence, which is easy to misread as the gate being broken: gating
- * restricts nothing until BOTH a user is assigned AND records are scoped.
- */
-export interface UserScopeSets {
-    userId: string;
-    geographicScopeIds: string[];
-    productScopeIds: string[];
-}
-/** A Prisma-shaped `where` fragment. Deliberately a plain object: this package
- *  has no Prisma dependency and does not want one, and every consumer speaks
- *  this shape. Spread it into an existing `where`. */
-export type ScopeGatePredicate = Record<string, unknown>;
-export interface BuildScopeGateOptions {
-    /** Which dimensions the tenant has gating switched ON for. A dimension that
-     *  is off contributes no clause at all. */
-    gatedDimensions: ScopeDimension[];
-    /** Column names, so a consumer whose table spells them differently can say
-     *  so. Defaults match master-data and OMSF. */
-    columns?: {
-        geographic?: string;
-        product?: string;
-    };
-}
-/**
- * Build the `where` fragment restricting a list to what this user may see.
- *
- * Returns an EMPTY object when the gate should not restrict — spreading `{}`
- * into a `where` is a no-op, so a caller never has to branch on "is gating on".
- *
- * Per dimension, when gating is on for it AND the user has assignments:
- *
- *   { OR: [ { <col>: null }, { <col>: { in: [...] } } ] }
- *
- * The `null` branch is rule 2 — an unscoped record is visible to everyone. Drop
- * it and the gate hides almost the whole dataset on day one.
- *
- * Both dimensions gated produces an AND of the two, so a user must match on
- * each. That is intersection, not union: someone assigned to Europe and to
- * Doors sees European Doors work, which is what "my slice" means to the person
- * asking for this feature.
- */
-export declare function buildScopeGate(scopes: UserScopeSets | null, options: BuildScopeGateOptions): ScopeGatePredicate;
-/** Clear everything. Exposed for tests and for a process that wants a clean
- *  slate; ordinary revocation is handled by the TTL. */
-export declare function clearScopeCache(): void;
-export declare class UserScopeResource {
-    private readonly http;
-    private readonly ttlMs;
-    private readonly cache;
-    constructor(http: HttpTransport, ttlMs?: number);
-    /** The caller's own sets, uncached. */
-    me(): Promise<SingleResponse<UserScopeSets>>;
-    /**
-     * The caller's own sets, cached for the TTL.
-     *
-     * Returns `null` rather than throwing when master-data cannot be reached.
-     * That is deliberate and it is the fail-open rule again: a gate that throws
-     * on a network blip takes every list in the app down, which is a worse
-     * outcome than briefly not restricting a feature that restricts nothing for
-     * most tenants anyway. Callers pass the null straight to buildScopeGate.
-     */
-    mineCached(cacheKey: string): Promise<UserScopeSets | null>;
-    /** Drop a cached entry, so an admin who just changed an assignment can see it
-     *  take effect without waiting out the TTL. */
-    invalidate(cacheKey: string): void;
-    /** Admin surface: every user in the tenant WITH an assignment. Users with
-     *  none are absent — master-data does not know the tenant's roster, so the
-     *  caller joins this against identity's user list. */
-    list(): Promise<{
-        data: UserScopeSets[];
-    }>;
-    get(userId: string): Promise<SingleResponse<UserScopeSets>>;
-    /** Replace a user's sets. Omit a dimension to leave it alone; send `[]` to
-     *  clear it, which returns the user to unrestricted. */
-    set(userId: string, input: {
-        geographicScopeIds?: string[];
-        productScopeIds?: string[];
-    }, idempotencyKey?: string): Promise<SingleResponse<UserScopeSets>>;
-}
-//# sourceMappingURL=scopeGate.d.ts.map

package/dist/scopeGate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scopeGate.d.ts","sourceRoot":"","sources":["../src/scopeGate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;sDAEsD;AACtD,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,WAAW,qBAAqB;IACpC;+CAC2C;IAC3C,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC;mDAC+C;IAC/C,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,aAAa,GAAG,IAAI,EAC5B,OAAO,EAAE,qBAAqB,GAC7B,kBAAkB,CAyBpB;AAiCD;wDACwD;AACxD,wBAAgB,eAAe,IAAI,IAAI,CAEtC;AAED,qBAAa,iBAAiB;IAI1B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAJxB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAc;gBAGjB,IAAI,EAAE,aAAa,EACnB,KAAK,GAAE,MAAe;IAGzC,uCAAuC;IACjC,EAAE,IAAI,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAOlD;;;;;;;;OAQG;IACG,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAejE;mDAC+C;IAC/C,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAIlC;;0DAEsD;IAChD,IAAI,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAO1C,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;IAOjE;4DACwD;IAClD,GAAG,CACP,MAAM,EAAE,MAAM,EACd,KAAK,EAAE;QAAE,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,EACpE,cAAc,CAAC,EAAE,MAAM,GACtB,OAAO,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;CAQ1C"}

package/dist/scopeGate.js

@@ -1,155 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.UserScopeResource = void 0;
-exports.buildScopeGate = buildScopeGate;
-exports.clearScopeCache = clearScopeCache;
-/**
- * Build the `where` fragment restricting a list to what this user may see.
- *
- * Returns an EMPTY object when the gate should not restrict — spreading `{}`
- * into a `where` is a no-op, so a caller never has to branch on "is gating on".
- *
- * Per dimension, when gating is on for it AND the user has assignments:
- *
- *   { OR: [ { <col>: null }, { <col>: { in: [...] } } ] }
- *
- * The `null` branch is rule 2 — an unscoped record is visible to everyone. Drop
- * it and the gate hides almost the whole dataset on day one.
- *
- * Both dimensions gated produces an AND of the two, so a user must match on
- * each. That is intersection, not union: someone assigned to Europe and to
- * Doors sees European Doors work, which is what "my slice" means to the person
- * asking for this feature.
- */
-function buildScopeGate(scopes, options) {
-    // No scope information at all — treat as unrestricted rather than guessing.
-    // A resolver that failed is the likely cause, and failing a read closed on a
-    // network blip would take the app down for everyone.
-    if (!scopes)
-        return {};
-    const geoColumn = options.columns?.geographic ?? 'geographicScopeId';
-    const productColumn = options.columns?.product ?? 'productScopeId';
-    const clauses = [];
-    if (options.gatedDimensions.includes('geographic') && scopes.geographicScopeIds.length > 0) {
-        clauses.push({
-            OR: [{ [geoColumn]: null }, { [geoColumn]: { in: [...scopes.geographicScopeIds] } }],
-        });
-    }
-    if (options.gatedDimensions.includes('product') && scopes.productScopeIds.length > 0) {
-        clauses.push({
-            OR: [{ [productColumn]: null }, { [productColumn]: { in: [...scopes.productScopeIds] } }],
-        });
-    }
-    if (clauses.length === 0)
-        return {};
-    if (clauses.length === 1)
-        return clauses[0];
-    return { AND: clauses };
-}
-/**
- * The caller's own scope sets, cached briefly.
- *
- * The cache exists because the gate needs this on EVERY request in OMSF and pm,
- * and a cross-service hop in front of every list query is the one place latency
- * is most visible. master-data itself needs none of this — its tables are local.
- *
- * **The TTL is a revocation window.** Removing someone's scope does not take
- * effect until their entry expires. 60 seconds is the agreed value: short
- * enough that "I removed her access and she can still see it" never becomes a
- * support call, long enough that a warm Lambda makes roughly one call per user
- * per container lifetime.
- *
- * Keyed by tenant AND user: a container serves many callers, and the whole
- * point of the gate is that they get different answers.
- */
-/**
- * MODULE-LEVEL, not per-instance, and that is not an optimization — it is the
- * only thing that makes the cache work at all.
- *
- * OMSF constructs a fresh `MasterDataClient` on every call, because the auth
- * token comes from the request context. A cache living on the resource instance
- * would therefore be born and discarded inside a single request and never once
- * be read, while looking entirely correct. Hoisting it to the module makes the
- * lifetime what the design assumes: the container's.
- *
- * Safe to share because every key carries the tenant AND the user — two callers
- * can never collide, which is the whole point of the gate.
- */
-const scopeCache = new Map();
-/** Clear everything. Exposed for tests and for a process that wants a clean
- *  slate; ordinary revocation is handled by the TTL. */
-function clearScopeCache() {
-    scopeCache.clear();
-}
-class UserScopeResource {
-    http;
-    ttlMs;
-    cache = scopeCache;
-    constructor(http, ttlMs = 60_000) {
-        this.http = http;
-        this.ttlMs = ttlMs;
-    }
-    /** The caller's own sets, uncached. */
-    async me() {
-        return this.http.request({
-            method: 'GET',
-            path: '/v1/user-scopes/me',
-        });
-    }
-    /**
-     * The caller's own sets, cached for the TTL.
-     *
-     * Returns `null` rather than throwing when master-data cannot be reached.
-     * That is deliberate and it is the fail-open rule again: a gate that throws
-     * on a network blip takes every list in the app down, which is a worse
-     * outcome than briefly not restricting a feature that restricts nothing for
-     * most tenants anyway. Callers pass the null straight to buildScopeGate.
-     */
-    async mineCached(cacheKey) {
-        const hit = this.cache.get(cacheKey);
-        if (hit && Date.now() - hit.at < this.ttlMs)
-            return hit.value;
-        try {
-            const response = await this.me();
-            this.cache.set(cacheKey, { at: Date.now(), value: response.data });
-            return response.data;
-        }
-        catch {
-            // Serve a stale entry if we have one — it is closer to the truth than
-            // nothing, and it keeps the revocation window bounded to the outage.
-            return hit ? hit.value : null;
-        }
-    }
-    /** Drop a cached entry, so an admin who just changed an assignment can see it
-     *  take effect without waiting out the TTL. */
-    invalidate(cacheKey) {
-        this.cache.delete(cacheKey);
-    }
-    /** Admin surface: every user in the tenant WITH an assignment. Users with
-     *  none are absent — master-data does not know the tenant's roster, so the
-     *  caller joins this against identity's user list. */
-    async list() {
-        return this.http.request({
-            method: 'GET',
-            path: '/v1/user-scopes',
-        });
-    }
-    async get(userId) {
-        return this.http.request({
-            method: 'GET',
-            path: `/v1/user-scopes/${encodeURIComponent(userId)}`,
-        });
-    }
-    /** Replace a user's sets. Omit a dimension to leave it alone; send `[]` to
-     *  clear it, which returns the user to unrestricted. */
-    async set(userId, input, idempotencyKey) {
-        return this.http.request({
-            method: 'PUT',
-            path: `/v1/user-scopes/${encodeURIComponent(userId)}`,
-            body: input,
-            idempotencyKey,
-        });
-    }
-}
-exports.UserScopeResource = UserScopeResource;
-//# sourceMappingURL=scopeGate.js.map

package/dist/scopeGate.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scopeGate.js","sourceRoot":"","sources":["../src/scopeGate.ts"],"names":[],"mappings":";;;AAkEA,wCA4BC;AAmCD,0CAEC;AAnFD;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,cAAc,CAC5B,MAA4B,EAC5B,OAA8B;IAE9B,4EAA4E;IAC5E,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,UAAU,IAAI,mBAAmB,CAAC;IACrE,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,IAAI,gBAAgB,CAAC;IAEnE,MAAM,OAAO,GAA8B,EAAE,CAAC;IAE9C,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,CAAC;SACrF,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrF,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5C,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAgD,CAAC;AAE3E;wDACwD;AACxD,SAAgB,eAAe;IAC7B,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC;AAED,MAAa,iBAAiB;IAIT;IACA;IAJF,KAAK,GAAG,UAAU,CAAC;IAEpC,YACmB,IAAmB,EACnB,QAAgB,MAAM;QADtB,SAAI,GAAJ,IAAI,CAAe;QACnB,UAAK,GAAL,KAAK,CAAiB;IACtC,CAAC;IAEJ,uCAAuC;IACvC,KAAK,CAAC,EAAE;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgC;YACtD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;SAC3B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,UAAU,CAAC,QAAgB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE,EAAE,CAAC;YACjC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACnE,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;YACtE,qEAAqE;YACrE,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAChC,CAAC;IACH,CAAC;IAED;mDAC+C;IAC/C,UAAU,CAAC,QAAgB;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED;;0DAEsD;IACtD,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAA4B;YAClD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAc;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgC;YACtD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,EAAE;SACtD,CAAC,CAAC;IACL,CAAC;IAED;4DACwD;IACxD,KAAK,CAAC,GAAG,CACP,MAAc,EACd,KAAoE,EACpE,cAAuB;QAEvB,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAgC;YACtD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,MAAM,CAAC,EAAE;YACrD,IAAI,EAAE,KAAK;YACX,cAAc;SACf,CAAC,CAAC;IACL,CAAC;CACF;AA7ED,8CA6EC"}