@camunda/ccma-shared-types 10.2.0 → 10.4.0

package/dist/agent-tokens/agent-tokens.d.ts

@@ -0,0 +1,112 @@
+/**
+ * The agent tokens of ccmacli: machine credentials that a Camundi creates in
+ * Camunda Control for an agent, with read access only.
+ *
+ * control-backend stores the clients. token-issuer exchanges the credentials
+ * for an Auth0 token of the agent audience. control-backend, console-backend
+ * and accounts-backend accept that token on their read routes. Every type and
+ * rule that two of these services share is in this file.
+ */
+/** AGENT_CLAIM is the claim of an agent token that names the client. */
+export declare const AGENT_CLAIM = "https://camunda.com/agent";
+/** AGENT_CLIENT_ID_PREFIX starts every client id of an agent client. */
+export declare const AGENT_CLIENT_ID_PREFIX = "ccma_";
+/** AGENT_TOKENS_FEATURE_FLAG closes create and rotate while it is off. */
+export declare const AGENT_TOKENS_FEATURE_FLAG = "control.agentTokens";
+/** AGENT_TOKEN_EXPIRY_DAYS lists the lifetimes that a creator can choose. */
+export declare const AGENT_TOKEN_EXPIRY_DAYS: readonly [7, 30, 90];
+export type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number];
+/** AGENT_TOKEN_NAME_MAX is the length limit of a name, after the trim. */
+export declare const AGENT_TOKEN_NAME_MAX = 64;
+/** AGENT_TOKENS_ACTIVE_MAX is the limit of active clients for one creator. */
+export declare const AGENT_TOKENS_ACTIVE_MAX = 10;
+/** Phase 1 has read access only. Phase 2 adds `write`. */
+export type AgentAccess = 'read';
+/** The value of `AGENT_CLAIM` in a verified agent token. */
+export interface AgentClaim {
+    uuid: string;
+    access: AgentAccess;
+    /** The `sub` of the Camundi who created the client. */
+    createdByUserId: string;
+}
+/** `inactive` means that the creator is no longer a Camundi. */
+export type AgentTokenStatus = 'active' | 'expired' | 'revoked' | 'inactive';
+/** AGENT_TOKEN_STATUSES lists every value of `AgentTokenStatus`. */
+export declare const AGENT_TOKEN_STATUSES: readonly ["active", "expired", "revoked", "inactive"];
+/** One agent client, as its creator sees it. It never holds the secret. */
+export interface AgentToken {
+    uuid: string;
+    clientId: string;
+    name: string;
+    access: AgentAccess;
+    status: AgentTokenStatus;
+    createdAt: string;
+    expiresAt: string;
+    lastUsedAt?: string;
+    revokedAt?: string;
+}
+/**
+ * AgentTokenCreated is the answer of create and rotate. It is the only answer
+ * that holds `clientSecret`, and the backend cannot show the secret again.
+ */
+export interface AgentTokenCreated extends AgentToken {
+    clientSecret: string;
+}
+/** One agent client, as the admin list shows it. */
+export interface AgentTokenAdmin extends AgentToken {
+    createdBy: {
+        userId: string;
+        email: string;
+    };
+    revokedByUserId?: string;
+}
+/** The body of `POST /api/agent-tokens`. */
+export interface CreateAgentTokenDto {
+    name: string;
+    expiresInDays: AgentTokenExpiryDays;
+}
+/** The answer of `POST /internal/agent-clients/verify`. */
+export interface AgentVerifyResponse {
+    uuid: string;
+    access: AgentAccess;
+    createdByUserId: string;
+}
+/**
+ * The answer of `GET /internal/agent-clients/:uuid/status`.
+ *
+ * `permissions` is `AGENT_READ_PERMISSIONS` of all backends, intersected with
+ * the permissions of the creator at create time. It is empty when `active` is
+ * false.
+ */
+export interface AgentStatusResponse {
+    active: boolean;
+    permissions: string[];
+}
+/**
+ * AGENT_READ_PERMISSIONS is the most that an agent token can do in each
+ * backend. A backend intersects its set with the `permissions` of the status
+ * answer, so an agent never holds a permission that its creator did not hold.
+ *
+ * `crtp` is a publish permission. It is here for one read only, the
+ * release-train sanity check. The agent allowlist of console-backend, which a
+ * later change of epic #10804 adds, must be the bound. Never add a route to
+ * that allowlist that `crtp` guards for a write.
+ */
+export declare const AGENT_READ_PERMISSIONS: Readonly<{
+    control: readonly string[];
+    console: readonly string[];
+    accounts: readonly string[];
+}>;
+/** agentReadPermissionUnion is the union of the three backend sets. */
+export declare function agentReadPermissionUnion(): string[];
+/** The codes of the two denials that only an agent token can get. */
+export declare const AGENT_ERROR: {
+    readonly readOnly: "auth.agent_read_only";
+    readonly inactive: "auth.agent_inactive";
+};
+/**
+ * parseAgentClaim reads `AGENT_CLAIM` from the payload of a VERIFIED token.
+ * It returns `undefined` when the claim is absent or has a wrong shape, and
+ * the caller must then refuse the token.
+ */
+export declare function parseAgentClaim(payload: Record<string, unknown>): AgentClaim | undefined;

package/dist/agent-tokens/agent-tokens.js

@@ -0,0 +1,63 @@
+import { AccountsPermissions } from "../permissions/accounts.permissions.js";
+import { ConsolePermissions } from "../permissions/console.permissions.js";
+const AGENT_CLAIM = "https://camunda.com/agent";
+const AGENT_CLIENT_ID_PREFIX = "ccma_";
+const AGENT_TOKENS_FEATURE_FLAG = "control.agentTokens";
+const AGENT_TOKEN_EXPIRY_DAYS = [7, 30, 90];
+const AGENT_TOKEN_NAME_MAX = 64;
+const AGENT_TOKENS_ACTIVE_MAX = 10;
+const AGENT_TOKEN_STATUSES = [
+  "active",
+  "expired",
+  "revoked",
+  "inactive"
+];
+const AGENT_READ_PERMISSIONS = {
+  control: [AccountsPermissions.READ_ALL],
+  console: [
+    ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,
+    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,
+    ConsolePermissions.CLUSTER_PLAN_SEE_ALL,
+    ConsolePermissions.RELEASE_TRAIN_PUBLISH
+  ],
+  accounts: [AccountsPermissions.READ_ALL]
+};
+function agentReadPermissionUnion() {
+  return [
+    .../* @__PURE__ */ new Set([
+      ...AGENT_READ_PERMISSIONS.control,
+      ...AGENT_READ_PERMISSIONS.console,
+      ...AGENT_READ_PERMISSIONS.accounts
+    ])
+  ];
+}
+const AGENT_ERROR = {
+  readOnly: "auth.agent_read_only",
+  inactive: "auth.agent_inactive"
+};
+const UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function parseAgentClaim(payload) {
+  const claim = payload[AGENT_CLAIM];
+  if (typeof claim !== "object" || claim === null || Array.isArray(claim)) {
+    return void 0;
+  }
+  const { uuid, access, createdByUserId } = claim;
+  if (typeof uuid !== "string" || !UUID_SHAPE.test(uuid) || access !== "read" || typeof createdByUserId !== "string" || createdByUserId.length === 0) {
+    return void 0;
+  }
+  return { uuid, access, createdByUserId };
+}
+export {
+  AGENT_CLAIM,
+  AGENT_CLIENT_ID_PREFIX,
+  AGENT_ERROR,
+  AGENT_READ_PERMISSIONS,
+  AGENT_TOKENS_ACTIVE_MAX,
+  AGENT_TOKENS_FEATURE_FLAG,
+  AGENT_TOKEN_EXPIRY_DAYS,
+  AGENT_TOKEN_NAME_MAX,
+  AGENT_TOKEN_STATUSES,
+  agentReadPermissionUnion,
+  parseAgentClaim
+};
+//# sourceMappingURL=agent-tokens.js.map

package/dist/agent-tokens/agent-tokens.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/agent-tokens/agent-tokens.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The agent tokens of ccmacli: machine credentials that a Camundi creates in\n * Camunda Control for an agent, with read access only.\n *\n * control-backend stores the clients. token-issuer exchanges the credentials\n * for an Auth0 token of the agent audience. control-backend, console-backend\n * and accounts-backend accept that token on their read routes. Every type and\n * rule that two of these services share is in this file.\n */\n\n/** AGENT_CLAIM is the claim of an agent token that names the client. */\nexport const AGENT_CLAIM = 'https://camunda.com/agent'\n\n/** AGENT_CLIENT_ID_PREFIX starts every client id of an agent client. */\nexport const AGENT_CLIENT_ID_PREFIX = 'ccma_'\n\n/** AGENT_TOKENS_FEATURE_FLAG closes create and rotate while it is off. */\nexport const AGENT_TOKENS_FEATURE_FLAG = 'control.agentTokens'\n\n/** AGENT_TOKEN_EXPIRY_DAYS lists the lifetimes that a creator can choose. */\nexport const AGENT_TOKEN_EXPIRY_DAYS = [7, 30, 90] as const\n\nexport type AgentTokenExpiryDays = (typeof AGENT_TOKEN_EXPIRY_DAYS)[number]\n\n/** AGENT_TOKEN_NAME_MAX is the length limit of a name, after the trim. */\nexport const AGENT_TOKEN_NAME_MAX = 64\n\n/** AGENT_TOKENS_ACTIVE_MAX is the limit of active clients for one creator. */\nexport const AGENT_TOKENS_ACTIVE_MAX = 10\n\n/** Phase 1 has read access only. Phase 2 adds `write`. */\nexport type AgentAccess = 'read'\n\n/** The value of `AGENT_CLAIM` in a verified agent token. */\nexport interface AgentClaim {\n  uuid: string\n  access: AgentAccess\n  /** The `sub` of the Camundi who created the client. */\n  createdByUserId: string\n}\n\n/** `inactive` means that the creator is no longer a Camundi. */\nexport type AgentTokenStatus = 'active' | 'expired' | 'revoked' | 'inactive'\n\n/** AGENT_TOKEN_STATUSES lists every value of `AgentTokenStatus`. */\nexport const AGENT_TOKEN_STATUSES = [\n  'active',\n  'expired',\n  'revoked',\n  'inactive',\n] as const satisfies readonly AgentTokenStatus[]\n\n/** One agent client, as its creator sees it. It never holds the secret. */\nexport interface AgentToken {\n  uuid: string\n  clientId: string\n  name: string\n  access: AgentAccess\n  status: AgentTokenStatus\n  createdAt: string\n  expiresAt: string\n  lastUsedAt?: string\n  revokedAt?: string\n}\n\n/**\n * AgentTokenCreated is the answer of create and rotate. It is the only answer\n * that holds `clientSecret`, and the backend cannot show the secret again.\n */\nexport interface AgentTokenCreated extends AgentToken {\n  clientSecret: string\n}\n\n/** One agent client, as the admin list shows it. */\nexport interface AgentTokenAdmin extends AgentToken {\n  createdBy: { userId: string; email: string }\n  revokedByUserId?: string\n}\n\n/** The body of `POST /api/agent-tokens`. */\nexport interface CreateAgentTokenDto {\n  name: string\n  expiresInDays: AgentTokenExpiryDays\n}\n\n/** The answer of `POST /internal/agent-clients/verify`. */\nexport interface AgentVerifyResponse {\n  uuid: string\n  access: AgentAccess\n  createdByUserId: string\n}\n\n/**\n * The answer of `GET /internal/agent-clients/:uuid/status`.\n *\n * `permissions` is `AGENT_READ_PERMISSIONS` of all backends, intersected with\n * the permissions of the creator at create time. It is empty when `active` is\n * false.\n */\nexport interface AgentStatusResponse {\n  active: boolean\n  permissions: string[]\n}\n\n/**\n * AGENT_READ_PERMISSIONS is the most that an agent token can do in each\n * backend. A backend intersects its set with the `permissions` of the status\n * answer, so an agent never holds a permission that its creator did not hold.\n *\n * `crtp` is a publish permission. It is here for one read only, the\n * release-train sanity check. The agent allowlist of console-backend, which a\n * later change of epic #10804 adds, must be the bound. Never add a route to\n * that allowlist that `crtp` guards for a write.\n */\nexport const AGENT_READ_PERMISSIONS: Readonly<{\n  control: readonly string[]\n  console: readonly string[]\n  accounts: readonly string[]\n}> = {\n  control: [AccountsPermissions.READ_ALL],\n  console: [\n    ConsolePermissions.CHANNELS_AND_GENERATIONS_ADMIN_SEE,\n    ConsolePermissions.CLUSTERS_READALLCLUSTERINFO,\n    ConsolePermissions.CLUSTER_PLAN_SEE_ALL,\n    ConsolePermissions.RELEASE_TRAIN_PUBLISH,\n  ],\n  accounts: [AccountsPermissions.READ_ALL],\n}\n\n/** agentReadPermissionUnion is the union of the three backend sets. */\nexport function agentReadPermissionUnion(): string[] {\n  return [\n    ...new Set([\n      ...AGENT_READ_PERMISSIONS.control,\n      ...AGENT_READ_PERMISSIONS.console,\n      ...AGENT_READ_PERMISSIONS.accounts,\n    ]),\n  ]\n}\n\n/** The codes of the two denials that only an agent token can get. */\nexport const AGENT_ERROR = {\n  readOnly: 'auth.agent_read_only',\n  inactive: 'auth.agent_inactive',\n} as const\n\nconst UUID_SHAPE =\n  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\n/**\n * parseAgentClaim reads `AGENT_CLAIM` from the payload of a VERIFIED token.\n * It returns `undefined` when the claim is absent or has a wrong shape, and\n * the caller must then refuse the token.\n */\nexport function parseAgentClaim(\n  payload: Record<string, unknown>,\n): AgentClaim | undefined {\n  const claim = payload[AGENT_CLAIM]\n  if (typeof claim !== 'object' || claim === null || Array.isArray(claim)) {\n    return undefined\n  }\n  const { uuid, access, createdByUserId } = claim as Record<string, unknown>\n  if (\n    typeof uuid !== 'string' ||\n    !UUID_SHAPE.test(uuid) ||\n    access !== 'read' ||\n    typeof createdByUserId !== 'string' ||\n    createdByUserId.length === 0\n  ) {\n    return undefined\n  }\n  return { uuid, access, createdByUserId }\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AAa5B,MAAM,cAAc;AAGpB,MAAM,yBAAyB;AAG/B,MAAM,4BAA4B;AAGlC,MAAM,0BAA0B,CAAC,GAAG,IAAI,EAAE;AAK1C,MAAM,uBAAuB;AAG7B,MAAM,0BAA0B;AAiBhC,MAAM,uBAAuB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgEO,MAAM,yBAIR;AAAA,EACH,SAAS,CAAC,oBAAoB,QAAQ;AAAA,EACtC,SAAS;AAAA,IACP,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,IACnB,mBAAmB;AAAA,EACrB;AAAA,EACA,UAAU,CAAC,oBAAoB,QAAQ;AACzC;AAGO,SAAS,2BAAqC;AACnD,SAAO;AAAA,IACL,GAAG,oBAAI,IAAI;AAAA,MACT,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,MAC1B,GAAG,uBAAuB;AAAA,IAC5B,CAAC;AAAA,EACH;AACF;AAGO,MAAM,cAAc;AAAA,EACzB,UAAU;AAAA,EACV,UAAU;AACZ;AAEA,MAAM,aACJ;AAOK,SAAS,gBACd,SACwB;AACxB,QAAM,QAAQ,QAAQ,WAAW;AACjC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;AACvE,WAAO;AAAA,EACT;AACA,QAAM,EAAE,MAAM,QAAQ,gBAAgB,IAAI;AAC1C,MACE,OAAO,SAAS,YAChB,CAAC,WAAW,KAAK,IAAI,KACrB,WAAW,UACX,OAAO,oBAAoB,YAC3B,gBAAgB,WAAW,GAC3B;AACA,WAAO;AAAA,EACT;AACA,SAAO,EAAE,MAAM,QAAQ,gBAAgB;AACzC;",
+  "names": []
+}

package/dist/agent-tokens/agent-tokens.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/approvals/delete-cluster-corpses.d.ts

@@ -0,0 +1,86 @@
+/**
+ * The flag of the `delete-cluster-corpses` use case.
+ *
+ * control-backend opens a request only while it is on. Control shows the
+ * request in place of the direct "Delete all corpses" while it is on.
+ */
+export declare const DELETE_CLUSTER_CORPSES_FLAG = "control.deleteClusterCorpses";
+/**
+ * The two kinds of cluster corpse.
+ *
+ * - `db`: a cluster row of console with no ZeebeCluster resource in
+ *   Kubernetes. The delete removes the row and what belongs to it.
+ * - `k8s`: a ZeebeCluster resource in Kubernetes with no cluster row of
+ *   console. The delete removes the resource.
+ */
+export declare const CLUSTER_CORPSE_KINDS: readonly ["db", "k8s"];
+export type ClusterCorpseKind = (typeof CLUSTER_CORPSE_KINDS)[number];
+/**
+ * The most corpses that one request deletes.
+ *
+ * The request lists each corpse, so that the approvers read what they delete.
+ * When there are more, the request takes the oldest ones, and a later request
+ * takes the rest.
+ */
+export declare const DELETE_CLUSTER_CORPSES_MAX = 500;
+/**
+ * The youngest corpse that a request takes, in milliseconds.
+ *
+ * Console creates the Kubernetes resource of a new cluster before it commits
+ * the row, and its watch of Kubernetes sees a new resource some time later.
+ * So a cluster that is being created can look like either kind of corpse for
+ * a short time.
+ */
+export declare const CLUSTER_CORPSE_MIN_AGE_MS: number;
+/**
+ * The approvals of a corpse deletion on prod: two people other than the
+ * person who asks, the same as a cluster bulk deletion
+ * (`CLUSTER_BULK_OPERATION_MIN_ACKS`).
+ */
+export declare const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2;
+/** The approvals of a corpse deletion on dev, int and local. */
+export declare const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1;
+/** One corpse, as console answers it to control-backend. */
+export interface ClusterCorpseDto {
+    /** The uuid of the cluster row, or the name of the Kubernetes resource. */
+    clusterId: string;
+    orgId: string;
+    /** The name of the cluster. Only a `db` corpse has one. */
+    name?: string;
+    /**
+     * The Kubernetes context. A `k8s` corpse always has one. A `db` corpse has
+     * the context of its row, when the row names one.
+     */
+    k8sContextUuid?: string;
+    /**
+     * The `metadata.uid` of the resource of a `k8s` corpse. Console deletes the
+     * resource only while it has this uid, so a new resource with the same name
+     * stays. A `k8s` corpse without it never goes into a request.
+     */
+    resourceUid?: string;
+    /**
+     * When the row or the resource was created, as an ISO 8601 string. A
+     * corpse without it is never old enough for a request.
+     */
+    created?: string;
+}
+/**
+ * The corpses of one kind now. Console answers it on
+ * `GET api/admin/approvals/cluster-corpses/:kind`.
+ */
+export interface ClusterCorpsesDto {
+    kind: ClusterCorpseKind;
+    corpses: ClusterCorpseDto[];
+}
+/**
+ * What console did with one corpse of a request.
+ *
+ * Console reads the live source again before it deletes. `not-a-corpse` means
+ * that the cluster is not a corpse any more: a `db` corpse has a resource in
+ * Kubernetes now, or a `k8s` corpse has a row now. `gone` means that there was
+ * nothing to delete: the row or the resource does not exist, or the resource
+ * of a `k8s` corpse has another uid now. Console deletes nothing for both.
+ */
+export interface DeleteClusterCorpseResult {
+    outcome: 'deleted' | 'gone' | 'not-a-corpse';
+}

package/dist/approvals/delete-cluster-corpses.js

@@ -0,0 +1,15 @@
+const DELETE_CLUSTER_CORPSES_FLAG = "control.deleteClusterCorpses";
+const CLUSTER_CORPSE_KINDS = ["db", "k8s"];
+const DELETE_CLUSTER_CORPSES_MAX = 500;
+const CLUSTER_CORPSE_MIN_AGE_MS = 60 * 60 * 1e3;
+const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2;
+const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1;
+export {
+  CLUSTER_CORPSE_KINDS,
+  CLUSTER_CORPSE_MIN_AGE_MS,
+  DELETE_CLUSTER_CORPSES_FLAG,
+  DELETE_CLUSTER_CORPSES_MAX,
+  DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD,
+  DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE
+};
+//# sourceMappingURL=delete-cluster-corpses.js.map

package/dist/approvals/delete-cluster-corpses.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/delete-cluster-corpses.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The flag of the `delete-cluster-corpses` use case.\n *\n * control-backend opens a request only while it is on. Control shows the\n * request in place of the direct \"Delete all corpses\" while it is on.\n */\nexport const DELETE_CLUSTER_CORPSES_FLAG = 'control.deleteClusterCorpses'\n\n/**\n * The two kinds of cluster corpse.\n *\n * - `db`: a cluster row of console with no ZeebeCluster resource in\n *   Kubernetes. The delete removes the row and what belongs to it.\n * - `k8s`: a ZeebeCluster resource in Kubernetes with no cluster row of\n *   console. The delete removes the resource.\n */\nexport const CLUSTER_CORPSE_KINDS = ['db', 'k8s'] as const\n\nexport type ClusterCorpseKind = (typeof CLUSTER_CORPSE_KINDS)[number]\n\n/**\n * The most corpses that one request deletes.\n *\n * The request lists each corpse, so that the approvers read what they delete.\n * When there are more, the request takes the oldest ones, and a later request\n * takes the rest.\n */\nexport const DELETE_CLUSTER_CORPSES_MAX = 500\n\n/**\n * The youngest corpse that a request takes, in milliseconds.\n *\n * Console creates the Kubernetes resource of a new cluster before it commits\n * the row, and its watch of Kubernetes sees a new resource some time later.\n * So a cluster that is being created can look like either kind of corpse for\n * a short time.\n */\nexport const CLUSTER_CORPSE_MIN_AGE_MS = 60 * 60 * 1000\n\n/**\n * The approvals of a corpse deletion on prod: two people other than the\n * person who asks, the same as a cluster bulk deletion\n * (`CLUSTER_BULK_OPERATION_MIN_ACKS`).\n */\nexport const DELETE_CLUSTER_CORPSES_MIN_ACKS_PROD = 2\n\n/** The approvals of a corpse deletion on dev, int and local. */\nexport const DELETE_CLUSTER_CORPSES_MIN_ACKS_TEST_STAGE = 1\n\n/** One corpse, as console answers it to control-backend. */\nexport interface ClusterCorpseDto {\n  /** The uuid of the cluster row, or the name of the Kubernetes resource. */\n  clusterId: string\n  orgId: string\n  /** The name of the cluster. Only a `db` corpse has one. */\n  name?: string\n  /**\n   * The Kubernetes context. A `k8s` corpse always has one. A `db` corpse has\n   * the context of its row, when the row names one.\n   */\n  k8sContextUuid?: string\n  /**\n   * The `metadata.uid` of the resource of a `k8s` corpse. Console deletes the\n   * resource only while it has this uid, so a new resource with the same name\n   * stays. A `k8s` corpse without it never goes into a request.\n   */\n  resourceUid?: string\n  /**\n   * When the row or the resource was created, as an ISO 8601 string. A\n   * corpse without it is never old enough for a request.\n   */\n  created?: string\n}\n\n/**\n * The corpses of one kind now. Console answers it on\n * `GET api/admin/approvals/cluster-corpses/:kind`.\n */\nexport interface ClusterCorpsesDto {\n  kind: ClusterCorpseKind\n  corpses: ClusterCorpseDto[]\n}\n\n/**\n * What console did with one corpse of a request.\n *\n * Console reads the live source again before it deletes. `not-a-corpse` means\n * that the cluster is not a corpse any more: a `db` corpse has a resource in\n * Kubernetes now, or a `k8s` corpse has a row now. `gone` means that there was\n * nothing to delete: the row or the resource does not exist, or the resource\n * of a `k8s` corpse has another uid now. Console deletes nothing for both.\n */\nexport interface DeleteClusterCorpseResult {\n  outcome: 'deleted' | 'gone' | 'not-a-corpse'\n}\n"],
+  "mappings": "AAYO,MAAM,8BAA8B;AAUpC,MAAM,uBAAuB,CAAC,MAAM,KAAK;AAWzC,MAAM,6BAA6B;AAUnC,MAAM,4BAA4B,KAAK,KAAK;AAO5C,MAAM,uCAAuC;AAG7C,MAAM,6CAA6C;",
+  "names": []
+}

package/dist/approvals/force-delete-cluster-plan-type.d.ts

@@ -3,8 +3,9 @@
  *
  * Three services read it. control-backend opens a request only while it is
  * on. Control shows the request in place of the direct force delete. Console
- * refuses the direct force delete route while it is on, so a person who holds
- * `cptfd` cannot skip the approvals.
+ * refuses the direct force delete route to a person only while
+ * `control.lockDirectRoutes` is on too. While the lock is off, a person who
+ * holds `cptfd` can still call that route and skip the approvals.
  */
 export declare const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG = "control.forceDeleteClusterPlanType";
 /**

package/dist/approvals/force-delete-cluster-plan-type.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/force-delete-cluster-plan-type.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The flag of the `force-delete-cluster-plan-type` use case.\n *\n * Three services read it. control-backend opens a request only while it is\n * on. Control shows the request in place of the direct force delete. Console\n * refuses the direct force delete route while it is on, so a person who holds\n * `cptfd` cannot skip the approvals.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG =\n  'control.forceDeleteClusterPlanType'\n\n/**\n * The most clusters that one force delete request can delete.\n *\n * The request lists each cluster, so that the approvers read what they\n * delete. A plan type with more clusters needs a cluster bulk deletion first.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500\n\n/**\n * The approvals of a force delete on prod: two people other than the person\n * who asks. The request deletes customer clusters of many organizations, the\n * same harm as a cluster bulk deletion (`CLUSTER_BULK_OPERATION_MIN_ACKS`).\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD = 2\n\n/** The approvals of a force delete on dev, int and local. */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE = 1\n\n/** One cluster of a plan type, as console answers it to control-backend. */\nexport interface ClusterPlanTypeClusterDto {\n  id: string\n  name: string\n  orgId: string\n}\n\n/**\n * The clusters of a plan type now. Console answers it on\n * `GET api/admin/approvals/cluster-plan-types/:planTypeId/clusters`.\n */\nexport interface ClusterPlanTypeClustersDto {\n  planTypeId: string\n  planTypeName: string\n  clusters: ClusterPlanTypeClusterDto[]\n}\n\n/**\n * What console did with one step of a force delete.\n *\n * `gone` means that there was nothing to delete: the cluster or the plan type\n * does not exist, or the cluster moved to another plan type. A second run\n * then reads `gone` for a step that the first run finished.\n */\nexport interface ForceDeleteClusterPlanTypeStepResult {\n  outcome: 'deleted' | 'gone'\n}\n"],
-  "mappings": "AAcO,MAAM,sCACX;AAQK,MAAM,8CAA8C;AAOpD,MAAM,+CAA+C;AAGrD,MAAM,qDAAqD;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The flag of the `force-delete-cluster-plan-type` use case.\n *\n * Three services read it. control-backend opens a request only while it is\n * on. Control shows the request in place of the direct force delete. Console\n * refuses the direct force delete route to a person only while\n * `control.lockDirectRoutes` is on too. While the lock is off, a person who\n * holds `cptfd` can still call that route and skip the approvals.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_FLAG =\n  'control.forceDeleteClusterPlanType'\n\n/**\n * The most clusters that one force delete request can delete.\n *\n * The request lists each cluster, so that the approvers read what they\n * delete. A plan type with more clusters needs a cluster bulk deletion first.\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MAX_CLUSTERS = 500\n\n/**\n * The approvals of a force delete on prod: two people other than the person\n * who asks. The request deletes customer clusters of many organizations, the\n * same harm as a cluster bulk deletion (`CLUSTER_BULK_OPERATION_MIN_ACKS`).\n */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_PROD = 2\n\n/** The approvals of a force delete on dev, int and local. */\nexport const FORCE_DELETE_CLUSTER_PLAN_TYPE_MIN_ACKS_TEST_STAGE = 1\n\n/** One cluster of a plan type, as console answers it to control-backend. */\nexport interface ClusterPlanTypeClusterDto {\n  id: string\n  name: string\n  orgId: string\n}\n\n/**\n * The clusters of a plan type now. Console answers it on\n * `GET api/admin/approvals/cluster-plan-types/:planTypeId/clusters`.\n */\nexport interface ClusterPlanTypeClustersDto {\n  planTypeId: string\n  planTypeName: string\n  clusters: ClusterPlanTypeClusterDto[]\n}\n\n/**\n * What console did with one step of a force delete.\n *\n * `gone` means that there was nothing to delete: the cluster or the plan type\n * does not exist, or the cluster moved to another plan type. A second run\n * then reads `gone` for a step that the first run finished.\n */\nexport interface ForceDeleteClusterPlanTypeStepResult {\n  outcome: 'deleted' | 'gone'\n}\n"],
+  "mappings": "AAeO,MAAM,sCACX;AAQK,MAAM,8CAA8C;AAOpD,MAAM,+CAA+C;AAGrD,MAAM,qDAAqD;",
   "names": []
 }

package/dist/approvals/policy.d.ts

@@ -103,7 +103,11 @@ export type ApprovalDecision = {
  * keeps that state, because "expired" would lose the answer that was given.
  */
 export declare function isExpired(job: ApprovalJobDto, now: Date): boolean;
-/** Reports the status to show, which is `expired` once the time has passed. */
+/**
+ * Reports the status to show. It is `expired` once the time to answer has
+ * passed, or once the run window of an `approved` or `failed` request has
+ * ended. control-backend writes both, and this shows them before the write.
+ */
 export declare function effectiveStatus(job: ApprovalJobDto, now: Date): ApprovalJobDto['status'];
 /** Reports how many more acknowledgements the request needs. */
 export declare function remainingAcks(job: ApprovalJobDto): number;
@@ -220,7 +224,8 @@ export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorVie
  *
  * This is the button of the explicit mode. `failed` is executable again,
  * because a failure is often a problem of the system that is now repaired, and
- * asking for the approvals a second time helps nobody.
+ * asking for the approvals a second time helps nobody. Both run only inside
+ * the run window, see `EXECUTE_WINDOW_DAYS`.
  *
  * ANY holder of the permission may press it, and not only the person who
  * opened the request. The decision was made when the request reached
@@ -235,4 +240,38 @@ export declare function canWithdraw(job: ApprovalJobDto, actor: ApprovalActorVie
  * an action that names a person to another service names the creator. See
  * `onBehalfOf` of `extend-trial`.
  */
-export declare function canExecute(job: ApprovalJobDto, actor: ApprovalActorView): ApprovalDecision;
+export declare function canExecute(job: ApprovalJobDto, actor: ApprovalActorView, now?: Date): ApprovalDecision;
+/**
+ * How many days a request can run after its last approval.
+ *
+ * The approvers agreed to the request as the world was on that day. Later the
+ * facts can change: an organization in trial becomes a paying customer. A
+ * request that is older than this window needs new approvals. The rule is here
+ * and not in each use case, so a new use case cannot forget it.
+ *
+ * A `failed` request counts from the same day. A retry is for a problem of the
+ * system that is now repaired, not for a run weeks later.
+ */
+export declare const EXECUTE_WINDOW_DAYS = 7;
+/**
+ * Reports the end of the run window of a request.
+ *
+ * The window starts at the last approval. A use case that needs zero
+ * approvals has none, so its window starts when the request was opened.
+ */
+export declare function runWindowEnd(job: ApprovalJobDto): Date;
+/**
+ * Reports whether an `approved` or `failed` request is past its run window.
+ *
+ * It fails closed: a date that does not parse gives NaN, and NaN closes the
+ * window. The window guards a privileged action.
+ */
+export declare function isRunWindowClosed(job: ApprovalJobDto, now: Date): boolean;
+/**
+ * Reports whether a request ran, failed, and will not run again by itself.
+ *
+ * That is a `failed` request, or a failed request that control-backend then
+ * wrote as `expired` at the end of its run window. Only a run raises
+ * `attempts`, and an `executed` request never expires.
+ */
+export declare function hasFailedRun(job: ApprovalJobDto): boolean;

package/dist/approvals/policy.js

@@ -26,7 +26,7 @@ function isExpired(job, now) {
   return job.status === "pending" && new Date(job.expiresAt).getTime() <= now.getTime();
 }
 function effectiveStatus(job, now) {
-  return isExpired(job, now) ? "expired" : job.status;
+  return isExpired(job, now) || isRunWindowClosed(job, now) ? "expired" : job.status;
 }
 function remainingAcks(job) {
   return Math.max(0, job.requiredAcks - job.acks.length);
@@ -168,19 +168,47 @@ function canWithdraw(job, actor, now) {
   }
   return ALLOWED;
 }
-function canExecute(job, actor) {
+function canExecute(job, actor, now = /* @__PURE__ */ new Date()) {
   if (!hasEveryPermission(actor, job.requiredPermissions)) {
     return deny("forbidden", "You cannot run this request.");
   }
+  if (job.status === "expired") {
+    return deny("expired", "This request is expired. Open a new request.");
+  }
   if (job.status !== "approved" && job.status !== "failed") {
     return deny(
       "not-executable",
       `This request is ${job.status} and cannot be run.`
     );
   }
+  if (isRunWindowClosed(job, now)) {
+    return deny(
+      "expired",
+      `The approvals of this request are older than ${EXECUTE_WINDOW_DAYS} days. Open a new request.`
+    );
+  }
   return ALLOWED;
 }
+const EXECUTE_WINDOW_DAYS = 7;
+const DAY_MS = 24 * 60 * 60 * 1e3;
+function runWindowEnd(job) {
+  const start = job.acks.reduce(
+    (latest, ack) => Math.max(latest, new Date(ack.date).getTime()),
+    new Date(job.createdAt).getTime()
+  );
+  return new Date(start + EXECUTE_WINDOW_DAYS * DAY_MS);
+}
+function isRunWindowClosed(job, now) {
+  if (job.status !== "approved" && job.status !== "failed") {
+    return false;
+  }
+  return !(runWindowEnd(job).getTime() > now.getTime());
+}
+function hasFailedRun(job) {
+  return job.status === "failed" || job.status === "expired" && job.attempts > 0;
+}
 export {
+  EXECUTE_WINDOW_DAYS,
   approvalPermissionCheck,
   canAcknowledge,
   canCreate,
@@ -191,11 +219,14 @@ export {
   effectiveStatus,
   hasActorEmail,
   hasEveryPermission,
+  hasFailedRun,
   isExpired,
+  isRunWindowClosed,
   isSameActor,
   isSameActorEmail,
   remainingAcks,
   requiredPermissionsOf,
-  resolveRequiredAcks
+  resolveRequiredAcks,
+  runWindowEnd
 };
 //# sourceMappingURL=policy.js.map

package/dist/approvals/policy.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/policy.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page names the permissions of\n  // a request in the same way.\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  // A service that opens a request of its own use case holds the\n  // `createPermission` checked above, and that is the guard of the run. Without\n  // a `createPermission` there is no such guard, so the flag lifts nothing.\n  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !openedBySystem &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AAIxE,QAAM,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC,QAAQ;AAC3D,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,kBACD,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/**\n * Reports the status to show. It is `expired` once the time to answer has\n * passed, or once the run window of an `approved` or `failed` request has\n * ended. control-backend writes both, and this shows them before the write.\n */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) || isRunWindowClosed(job, now)\n    ? 'expired'\n    : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page names the permissions of\n  // a request in the same way.\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  // A service that opens a request of its own use case holds the\n  // `createPermission` checked above, and that is the guard of the run. Without\n  // a `createPermission` there is no such guard, so the flag lifts nothing.\n  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !openedBySystem &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody. Both run only inside\n * the run window, see `EXECUTE_WINDOW_DAYS`.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  // A default, because the package is published and a caller from before\n  // the run window passes two arguments.\n  now: Date = new Date(),\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  // control-backend writes `expired` before it answers a read, so the row\n  // that a person sees is usually already `expired` and not past its window.\n  if (job.status === 'expired') {\n    return deny('expired', 'This request is expired. Open a new request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  if (isRunWindowClosed(job, now)) {\n    return deny(\n      'expired',\n      `The approvals of this request are older than ${EXECUTE_WINDOW_DAYS} days. Open a new request.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * How many days a request can run after its last approval.\n *\n * The approvers agreed to the request as the world was on that day. Later the\n * facts can change: an organization in trial becomes a paying customer. A\n * request that is older than this window needs new approvals. The rule is here\n * and not in each use case, so a new use case cannot forget it.\n *\n * A `failed` request counts from the same day. A retry is for a problem of the\n * system that is now repaired, not for a run weeks later.\n */\nexport const EXECUTE_WINDOW_DAYS = 7\n\nconst DAY_MS = 24 * 60 * 60 * 1000\n\n/**\n * Reports the end of the run window of a request.\n *\n * The window starts at the last approval. A use case that needs zero\n * approvals has none, so its window starts when the request was opened.\n */\nexport function runWindowEnd(job: ApprovalJobDto): Date {\n  const start = job.acks.reduce(\n    (latest, ack) => Math.max(latest, new Date(ack.date).getTime()),\n    new Date(job.createdAt).getTime(),\n  )\n  return new Date(start + EXECUTE_WINDOW_DAYS * DAY_MS)\n}\n\n/**\n * Reports whether an `approved` or `failed` request is past its run window.\n *\n * It fails closed: a date that does not parse gives NaN, and NaN closes the\n * window. The window guards a privileged action.\n */\nexport function isRunWindowClosed(job: ApprovalJobDto, now: Date): boolean {\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return false\n  }\n  return !(runWindowEnd(job).getTime() > now.getTime())\n}\n\n/**\n * Reports whether a request ran, failed, and will not run again by itself.\n *\n * That is a `failed` request, or a failed request that control-backend then\n * wrote as `expired` at the end of its run window. Only a run raises\n * `attempts`, and an `executed` request never expires.\n */\nexport function hasFailedRun(job: ApprovalJobDto): boolean {\n  return (\n    job.status === 'failed' || (job.status === 'expired' && job.attempts > 0)\n  )\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAOO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,KAAK,kBAAkB,KAAK,GAAG,IACpD,YACA,IAAI;AACV;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AAIxE,QAAM,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC,QAAQ;AAC3D,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,kBACD,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAuBO,SAAS,WACd,KACA,OAGA,MAAY,oBAAI,KAAK,GACH;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AAGA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO,KAAK,WAAW,8CAA8C;AAAA,EACvE;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,kBAAkB,KAAK,GAAG,GAAG;AAC/B,WAAO;AAAA,MACL;AAAA,MACA,gDAAgD,mBAAmB;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAaO,MAAM,sBAAsB;AAEnC,MAAM,SAAS,KAAK,KAAK,KAAK;AAQvB,SAAS,aAAa,KAA2B;AACtD,QAAM,QAAQ,IAAI,KAAK;AAAA,IACrB,CAAC,QAAQ,QAAQ,KAAK,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,QAAQ,CAAC;AAAA,IAC9D,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ;AAAA,EAClC;AACA,SAAO,IAAI,KAAK,QAAQ,sBAAsB,MAAM;AACtD;AAQO,SAAS,kBAAkB,KAAqB,KAAoB;AACzE,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,EACT;AACA,SAAO,EAAE,aAAa,GAAG,EAAE,QAAQ,IAAI,IAAI,QAAQ;AACrD;AASO,SAAS,aAAa,KAA8B;AACzD,SACE,IAAI,WAAW,YAAa,IAAI,WAAW,aAAa,IAAI,WAAW;AAE3E;",
   "names": []
 }

package/dist/approvals/use-cases.const.d.ts

@@ -47,6 +47,7 @@ export declare const APPROVAL_USE_CASE_TYPES: {
     readonly onboardToEnterprise: "onboard-to-enterprise";
     readonly changeClusterPlanType: "change-cluster-plan-type";
     readonly clusterTtlDeletion: "cluster-ttl-deletion";
+    readonly deleteClusterCorpses: "delete-cluster-corpses";
     readonly forceDeleteClusterPlanType: "force-delete-cluster-plan-type";
 };
 /**