@camunda/ccma-shared-types 5.0.0 → 7.0.0

package/dist/_tests/approvals/dns-subdomain.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/approvals/expected-value.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/charts/chart-query.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/constants/customer-hardware-sizing.const.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/dashboards/definition.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/dtos/ClusterPlanWhiteList.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/elasticsearchPlanPath.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/_tests/utils/upgradeGateReason.utils.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/approvals/dns-subdomain.d.ts

@@ -0,0 +1,12 @@
+/** The longest DNS subdomain that Kubernetes accepts as a resource name. */
+export declare const DNS_SUBDOMAIN_MAX_LENGTH = 253;
+/**
+ * True when a name is a DNS-1123 subdomain, as Kubernetes accepts one for
+ * the name of a resource.
+ *
+ * Each dot-separated label is 1 to 63 characters of lower case letters,
+ * digits and `-`, and starts and ends with a letter or a digit. A single
+ * regular expression over the whole name accepts `a..b` and a label of 64
+ * characters, and Kubernetes refuses both.
+ */
+export declare function isDnsSubdomain(name: string): boolean;

package/dist/approvals/dns-subdomain.js

@@ -0,0 +1,16 @@
+const DNS_SUBDOMAIN_MAX_LENGTH = 253;
+const DNS_LABEL = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/;
+const DNS_LABEL_MAX_LENGTH = 63;
+function isDnsSubdomain(name) {
+  if (name.length === 0 || name.length > DNS_SUBDOMAIN_MAX_LENGTH) {
+    return false;
+  }
+  return name.split(".").every(
+    (label) => label.length <= DNS_LABEL_MAX_LENGTH && DNS_LABEL.test(label)
+  );
+}
+export {
+  DNS_SUBDOMAIN_MAX_LENGTH,
+  isDnsSubdomain
+};
+//# sourceMappingURL=dns-subdomain.js.map

package/dist/approvals/dns-subdomain.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/dns-subdomain.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/** The longest DNS subdomain that Kubernetes accepts as a resource name. */\nexport const DNS_SUBDOMAIN_MAX_LENGTH = 253\n\nconst DNS_LABEL = /^[a-z0-9]([-a-z0-9]*[a-z0-9])?$/\nconst DNS_LABEL_MAX_LENGTH = 63\n\n/**\n * True when a name is a DNS-1123 subdomain, as Kubernetes accepts one for\n * the name of a resource.\n *\n * Each dot-separated label is 1 to 63 characters of lower case letters,\n * digits and `-`, and starts and ends with a letter or a digit. A single\n * regular expression over the whole name accepts `a..b` and a label of 64\n * characters, and Kubernetes refuses both.\n */\nexport function isDnsSubdomain(name: string): boolean {\n  if (name.length === 0 || name.length > DNS_SUBDOMAIN_MAX_LENGTH) {\n    return false\n  }\n  return name\n    .split('.')\n    .every(\n      (label) => label.length <= DNS_LABEL_MAX_LENGTH && DNS_LABEL.test(label),\n    )\n}\n"],
+  "mappings": "AAOO,MAAM,2BAA2B;AAExC,MAAM,YAAY;AAClB,MAAM,uBAAuB;AAWtB,SAAS,eAAe,MAAuB;AACpD,MAAI,KAAK,WAAW,KAAK,KAAK,SAAS,0BAA0B;AAC/D,WAAO;AAAA,EACT;AACA,SAAO,KACJ,MAAM,GAAG,EACT;AAAA,IACC,CAAC,UAAU,MAAM,UAAU,wBAAwB,UAAU,KAAK,KAAK;AAAA,EACzE;AACJ;",
+  "names": []
+}

package/dist/approvals/expected-value.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The guard against a stale approval.
+ *
+ * Days can pass between the request and the run. A request that says "set X
+ * from 3 to 5" was approved as a CHANGE from 3. When somebody else set X to 4
+ * in the meantime, the run must not write 5 over the 4: the approvers never
+ * read that change, and they never agreed to undo it.
+ *
+ * So a use case that writes a value carries the value that the person who
+ * asked READ, as `expected`. The service that owns the value compares it with
+ * what it holds when the call ARRIVES, and it refuses the whole change when one
+ * value moved. It never applies a part of it: the approvers read the change as
+ * one thing.
+ *
+ * The comparison lives here so that the form of control-frontend, the use case
+ * of control-backend and the route of accounts-backend read "the same value"
+ * in one way.
+ */
+/** One value that a request writes, with the value that the asker read. */
+export interface ApprovalExpectedChange<T = unknown> {
+    key: string;
+    /** The value that the person who asked read. `undefined` for "not set". */
+    expected?: T;
+}
+/** True when the value that the asker read is the value that the service holds. */
+export declare function isSameApprovalValue(expected: unknown, current: unknown): boolean;
+/**
+ * The keys of a change whose value moved since the person who asked read it.
+ *
+ * An empty answer means the change can run. Any other answer means none of it
+ * can.
+ */
+export declare function staleApprovalKeys(changes: readonly ApprovalExpectedChange[], currentOf: (key: string) => unknown): string[];

package/dist/approvals/expected-value.js

@@ -0,0 +1,26 @@
+function canonical(value) {
+  if (value === void 0 || value === null) {
+    return "null";
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(canonical).join(",")}]`;
+  }
+  if (typeof value === "object") {
+    const entries = Object.entries(value).filter(([, inner]) => inner !== void 0).sort(([one], [other]) => one < other ? -1 : one > other ? 1 : 0).map(([key, inner]) => `${JSON.stringify(key)}:${canonical(inner)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function isSameApprovalValue(expected, current) {
+  return canonical(expected) === canonical(current);
+}
+function staleApprovalKeys(changes, currentOf) {
+  return changes.filter(
+    (change) => !isSameApprovalValue(change.expected, currentOf(change.key))
+  ).map((change) => change.key);
+}
+export {
+  isSameApprovalValue,
+  staleApprovalKeys
+};
+//# sourceMappingURL=expected-value.js.map

package/dist/approvals/expected-value.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/approvals/expected-value.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The guard against a stale approval.\n *\n * Days can pass between the request and the run. A request that says \"set X\n * from 3 to 5\" was approved as a CHANGE from 3. When somebody else set X to 4\n * in the meantime, the run must not write 5 over the 4: the approvers never\n * read that change, and they never agreed to undo it.\n *\n * So a use case that writes a value carries the value that the person who\n * asked READ, as `expected`. The service that owns the value compares it with\n * what it holds when the call ARRIVES, and it refuses the whole change when one\n * value moved. It never applies a part of it: the approvers read the change as\n * one thing.\n *\n * The comparison lives here so that the form of control-frontend, the use case\n * of control-backend and the route of accounts-backend read \"the same value\"\n * in one way.\n */\n\n/** One value that a request writes, with the value that the asker read. */\nexport interface ApprovalExpectedChange<T = unknown> {\n  key: string\n  /** The value that the person who asked read. `undefined` for \"not set\". */\n  expected?: T\n}\n\n/**\n * Turns a value into the one text that two equal values share.\n *\n * `undefined` and `null` both mean \"not set\", because a JSON body cannot carry\n * `undefined` and a database column reads as `null`. The keys of an object\n * are sorted, because two objects with the same fields in another order are\n * the same value.\n */\nfunction canonical(value: unknown): string {\n  if (value === undefined || value === null) {\n    return 'null'\n  }\n  if (Array.isArray(value)) {\n    return `[${value.map(canonical).join(',')}]`\n  }\n  if (typeof value === 'object') {\n    const entries = Object.entries(value as Record<string, unknown>)\n      .filter(([, inner]) => inner !== undefined)\n      .sort(([one], [other]) => (one < other ? -1 : one > other ? 1 : 0))\n      .map(([key, inner]) => `${JSON.stringify(key)}:${canonical(inner)}`)\n    return `{${entries.join(',')}}`\n  }\n  return JSON.stringify(value)\n}\n\n/** True when the value that the asker read is the value that the service holds. */\nexport function isSameApprovalValue(\n  expected: unknown,\n  current: unknown,\n): boolean {\n  return canonical(expected) === canonical(current)\n}\n\n/**\n * The keys of a change whose value moved since the person who asked read it.\n *\n * An empty answer means the change can run. Any other answer means none of it\n * can.\n */\nexport function staleApprovalKeys(\n  changes: readonly ApprovalExpectedChange[],\n  currentOf: (key: string) => unknown,\n): string[] {\n  return changes\n    .filter(\n      (change) => !isSameApprovalValue(change.expected, currentOf(change.key)),\n    )\n    .map((change) => change.key)\n}\n"],
+  "mappings": "AAwCA,SAAS,UAAU,OAAwB;AACzC,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,IAAI,MAAM,IAAI,SAAS,EAAE,KAAK,GAAG,CAAC;AAAA,EAC3C;AACA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,MAAO,MAAM,QAAQ,KAAK,MAAM,QAAQ,IAAI,CAAE,EACjE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,UAAU,KAAK,CAAC,EAAE;AACrE,WAAO,IAAI,QAAQ,KAAK,GAAG,CAAC;AAAA,EAC9B;AACA,SAAO,KAAK,UAAU,KAAK;AAC7B;AAGO,SAAS,oBACd,UACA,SACS;AACT,SAAO,UAAU,QAAQ,MAAM,UAAU,OAAO;AAClD;AAQO,SAAS,kBACd,SACA,WACU;AACV,SAAO,QACJ;AAAA,IACC,CAAC,WAAW,CAAC,oBAAoB,OAAO,UAAU,UAAU,OAAO,GAAG,CAAC;AAAA,EACzE,EACC,IAAI,CAAC,WAAW,OAAO,GAAG;AAC/B;",
+  "names": []
+}

package/dist/approvals/policy.js

@@ -63,7 +63,7 @@ function canCreate(actor, useCase, request = {}) {
     );
   }
   const toRun = request.requiredPermissions ?? [useCase.requiredPermission];
-  if (resolveRequiredAcks(useCase, request.requiredAcks) === 0 && !hasEveryPermission(actor, toRun)) {
+  if (resolveRequiredAcks(useCase, request.requiredAcks) === 0 && !useCase.openToEveryone && !hasEveryPermission(actor, toRun)) {
     return deny(
       "forbidden",
       `This request needs no approval, so opening it runs it. That needs ${toRun.join(" and ")}, and you do not hold it.`

package/dist/approvals/policy.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/policy.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page already names a permission\n  // the same way (\"Approving needs aacp\").\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AACxE,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page already names a permission\n  // the same way (\"Approving needs aacp\").\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AACxE,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/approvals/use-cases.const.d.ts

@@ -23,7 +23,43 @@ export declare const APPROVAL_USE_CASE_TYPES: {
     readonly clusterBulkSleepWakeup: "cluster-bulk-sleep-wakeup";
     readonly clusterBulkDeletion: "cluster-bulk-deletion";
     readonly clusterBulkSpecUpdate: "cluster-bulk-spec-update";
+    readonly changePlatformRoles: "change-platform-roles";
+    readonly deleteInternalBackup: "delete-internal-backup";
+    readonly changeOrgLimits: "change-org-limits";
+    readonly deleteSsoConnection: "delete-sso-connection";
+    readonly changeSalesPlan: "change-sales-plan";
+    readonly deleteOrganization: "delete-organization";
+    readonly deleteUser: "delete-user";
+    readonly changeUserEmail: "change-user-email";
+    readonly purgeUsers: "purge-users";
+    readonly updateUserMetadata: "update-user-metadata";
+    readonly changeFeatureFlag: "change-feature-flag";
+    readonly createPersonalOrganisation: "create-personal-organisation";
+    readonly createCustomerHardwareSizing: "create-customer-hardware-sizing";
+    readonly removeCustomerHardwareSizing: "remove-customer-hardware-sizing";
+    readonly changeClusterPlanType: "change-cluster-plan-type";
 };
+/**
+ * The approvals that a change of the feature flag table needs on prod.
+ *
+ * A flag there turns a feature on or off for every customer, and a person who
+ * holds `aafw` could do it alone. Two other Camundis stand in every change,
+ * the same floor as a cluster bulk operation on prod
+ * (`CLUSTER_BULK_OPERATION_MIN_ACKS`). Int needs one.
+ */
+export declare const FEATURE_FLAG_MIN_ACKS_PROD = 2;
+/**
+ * The most personal organizations that one Camundi can request.
+ *
+ * The request runs with no approval, so this cap is the only guard against a
+ * loop that creates organizations without end. It counts the requests that a
+ * Camundi opened, and a person who needs more asks a Camundi who holds
+ * `AccountsPermissions.CREATE_ORG`.
+ */
+export declare const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10;
+/** The shortest and longest name of a personal organization. */
+export declare const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3;
+export declare const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100;
 export type ApprovalUseCaseType = (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES];
 /**
  * The shortest extension that accounts-backend accepts.
@@ -46,3 +82,63 @@ export declare const EXTEND_TRIAL_MIN_DAYS = 15;
  * margin as the floor above.
  */
 export declare const EXTEND_TRIAL_MAX_DAYS = 61;
+/**
+ * The most roles that one change-platform-roles request adds, or removes.
+ *
+ * The form of control-frontend offers every platform role, and a person who
+ * gives a Camundi a new position rarely changes more than a few. A request with
+ * more roles than this is a request that nobody reads before they approve it.
+ */
+export declare const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10;
+/**
+ * The longest text value that one change-org-limits request writes.
+ *
+ * A text limit holds a short value, such as a list of regions. The bound keeps
+ * a request readable for the person who approves it.
+ */
+export declare const ORG_LIMIT_TEXT_MAX_LENGTH = 2000;
+/**
+ * The most users that one purge-users request deletes.
+ *
+ * The God Mode purge deletes one user after the other, and Auth0 limits how
+ * fast that goes. A list longer than this is also a list that no approver
+ * reads before they agree.
+ */
+export declare const PURGE_USERS_MAX_USERS = 1000;
+/**
+ * What a person must hold to open or to approve a purge-users request.
+ *
+ * The purge of God Mode is behind `GOD_PURGE_USERS`, and each deletion calls a
+ * route behind `DELETE_USER`. The use case of control-backend returns this
+ * list from `permissionsFor`, and the form passes it to `canCreate`, so the
+ * button and the server never disagree.
+ */
+export declare const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[];
+/**
+ * The largest metadata object that one update-user-metadata request writes,
+ * in characters of its JSON text.
+ *
+ * This is a bound of the product, and not the limit of Auth0, which is far
+ * larger. The approvers read the whole object before they agree, and an
+ * object that is longer than this is an object that nobody reads.
+ */
+export declare const USER_METADATA_MAX_LENGTH = 16000;
+/**
+ * The largest metadata object that a request carries as the object that the
+ * person who asked READ.
+ *
+ * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew
+ * past that bound can still get an edit that makes it smaller. It still has a
+ * bound, because the request keeps the copy in its row.
+ */
+export declare const USER_METADATA_EXPECTED_MAX_LENGTH = 500000;
+/** The longest email address that a change-user-email request carries. */
+export declare const APPROVAL_EMAIL_MAX_LENGTH = 320;
+/**
+ * The email addresses that a change-user-email request accepts.
+ *
+ * It is the email pattern of zod 4.6. The pattern is here, so the schema of
+ * control-backend and the form of control-frontend accept the same addresses,
+ * and a form never sends an address that the service refuses.
+ */
+export declare const APPROVAL_EMAIL_PATTERN: RegExp;

package/dist/approvals/use-cases.const.js

@@ -1,3 +1,4 @@
+import { AccountsPermissions } from "../permissions/accounts.permissions.js";
 const APPROVAL_USE_CASE_TYPES = {
   sendToExpiredTrial: "send-to-expired-trial",
   extendTrial: "extend-trial",
@@ -10,13 +11,69 @@ const APPROVAL_USE_CASE_TYPES = {
   clusterBulkPlanTypeUpdate: "cluster-bulk-plan-type-update",
   clusterBulkSleepWakeup: "cluster-bulk-sleep-wakeup",
   clusterBulkDeletion: "cluster-bulk-deletion",
-  clusterBulkSpecUpdate: "cluster-bulk-spec-update"
+  clusterBulkSpecUpdate: "cluster-bulk-spec-update",
+  // The second group, behind `control.approvalAdminActions`.
+  changePlatformRoles: "change-platform-roles",
+  deleteInternalBackup: "delete-internal-backup",
+  changeOrgLimits: "change-org-limits",
+  deleteSsoConnection: "delete-sso-connection",
+  changeSalesPlan: "change-sales-plan",
+  // The third group, behind `control.approvalAccountActions`.
+  deleteOrganization: "delete-organization",
+  deleteUser: "delete-user",
+  changeUserEmail: "change-user-email",
+  purgeUsers: "purge-users",
+  updateUserMetadata: "update-user-metadata",
+  // A change of the feature flag table, on a stage where
+  // `isFeatureFlagApprovalRequired` is true.
+  changeFeatureFlag: "change-feature-flag",
+  // Open to every Camundi, and it needs no approval on any stage.
+  createPersonalOrganisation: "create-personal-organisation",
+  // Open to every Camundi, runs on dev only, and needs no approval. The two
+  // use cases of customer hardware sizing.
+  createCustomerHardwareSizing: "create-customer-hardware-sizing",
+  removeCustomerHardwareSizing: "remove-customer-hardware-sizing",
+  // The plan type and the hardware packages of ONE cluster, behind
+  // `control.changeClusterPlanType`. The bulk plan type update beside it
+  // checks no reservation and moves no cluster plan, so this one is not a
+  // duplicate of it. See `change-cluster-plan-type.ts` in control-backend.
+  changeClusterPlanType: "change-cluster-plan-type"
 };
+const FEATURE_FLAG_MIN_ACKS_PROD = 2;
+const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10;
+const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3;
+const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100;
 const EXTEND_TRIAL_MIN_DAYS = 15;
 const EXTEND_TRIAL_MAX_DAYS = 61;
+const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10;
+const ORG_LIMIT_TEXT_MAX_LENGTH = 2e3;
+const PURGE_USERS_MAX_USERS = 1e3;
+const PURGE_USERS_REQUIRED_PERMISSIONS = [
+  AccountsPermissions.GOD_PURGE_USERS,
+  AccountsPermissions.DELETE_USER
+];
+const USER_METADATA_MAX_LENGTH = 16e3;
+const USER_METADATA_EXPECTED_MAX_LENGTH = 5e5;
+const APPROVAL_EMAIL_MAX_LENGTH = 320;
+const APPROVAL_EMAIL_PATTERN = (
+  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character
+  /^(?:[A-Za-z0-9_'+\-]+\.)*[A-Za-z0-9_'+\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\-]*\.)+[A-Za-z]{2,}$/
+);
 export {
+  APPROVAL_EMAIL_MAX_LENGTH,
+  APPROVAL_EMAIL_PATTERN,
   APPROVAL_USE_CASE_TYPES,
   EXTEND_TRIAL_MAX_DAYS,
-  EXTEND_TRIAL_MIN_DAYS
+  EXTEND_TRIAL_MIN_DAYS,
+  FEATURE_FLAG_MIN_ACKS_PROD,
+  ORG_LIMIT_TEXT_MAX_LENGTH,
+  PERSONAL_ORGANIZATION_MAX_PER_REQUESTER,
+  PERSONAL_ORGANIZATION_NAME_MAX_LENGTH,
+  PERSONAL_ORGANIZATION_NAME_MIN_LENGTH,
+  PLATFORM_ROLE_CHANGE_MAX_ROLES,
+  PURGE_USERS_MAX_USERS,
+  PURGE_USERS_REQUIRED_PERMISSIONS,
+  USER_METADATA_EXPECTED_MAX_LENGTH,
+  USER_METADATA_MAX_LENGTH
 };
 //# sourceMappingURL=use-cases.const.js.map

package/dist/approvals/use-cases.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/use-cases.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n} as const\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n"],
-  "mappings": "AAsBO,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AACzB;AAkBO,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n  // The second group, behind `control.approvalAdminActions`.\n  changePlatformRoles: 'change-platform-roles',\n  deleteInternalBackup: 'delete-internal-backup',\n  changeOrgLimits: 'change-org-limits',\n  deleteSsoConnection: 'delete-sso-connection',\n  changeSalesPlan: 'change-sales-plan',\n  // The third group, behind `control.approvalAccountActions`.\n  deleteOrganization: 'delete-organization',\n  deleteUser: 'delete-user',\n  changeUserEmail: 'change-user-email',\n  purgeUsers: 'purge-users',\n  updateUserMetadata: 'update-user-metadata',\n  // A change of the feature flag table, on a stage where\n  // `isFeatureFlagApprovalRequired` is true.\n  changeFeatureFlag: 'change-feature-flag',\n  // Open to every Camundi, and it needs no approval on any stage.\n  createPersonalOrganisation: 'create-personal-organisation',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of customer hardware sizing.\n  createCustomerHardwareSizing: 'create-customer-hardware-sizing',\n  removeCustomerHardwareSizing: 'remove-customer-hardware-sizing',\n  // The plan type and the hardware packages of ONE cluster, behind\n  // `control.changeClusterPlanType`. The bulk plan type update beside it\n  // checks no reservation and moves no cluster plan, so this one is not a\n  // duplicate of it. See `change-cluster-plan-type.ts` in control-backend.\n  changeClusterPlanType: 'change-cluster-plan-type',\n} as const\n\n/**\n * The approvals that a change of the feature flag table needs on prod.\n *\n * A flag there turns a feature on or off for every customer, and a person who\n * holds `aafw` could do it alone. Two other Camundis stand in every change,\n * the same floor as a cluster bulk operation on prod\n * (`CLUSTER_BULK_OPERATION_MIN_ACKS`). Int needs one.\n */\nexport const FEATURE_FLAG_MIN_ACKS_PROD = 2\n\n/**\n * The most personal organizations that one Camundi can request.\n *\n * The request runs with no approval, so this cap is the only guard against a\n * loop that creates organizations without end. It counts the requests that a\n * Camundi opened, and a person who needs more asks a Camundi who holds\n * `AccountsPermissions.CREATE_ORG`.\n */\nexport const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10\n\n/** The shortest and longest name of a personal organization. */\nexport const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3\nexport const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n\n/**\n * The most roles that one change-platform-roles request adds, or removes.\n *\n * The form of control-frontend offers every platform role, and a person who\n * gives a Camundi a new position rarely changes more than a few. A request with\n * more roles than this is a request that nobody reads before they approve it.\n */\nexport const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10\n\n/**\n * The longest text value that one change-org-limits request writes.\n *\n * A text limit holds a short value, such as a list of regions. The bound keeps\n * a request readable for the person who approves it.\n */\nexport const ORG_LIMIT_TEXT_MAX_LENGTH = 2000\n\n/**\n * The most users that one purge-users request deletes.\n *\n * The God Mode purge deletes one user after the other, and Auth0 limits how\n * fast that goes. A list longer than this is also a list that no approver\n * reads before they agree.\n */\nexport const PURGE_USERS_MAX_USERS = 1000\n\n/**\n * What a person must hold to open or to approve a purge-users request.\n *\n * The purge of God Mode is behind `GOD_PURGE_USERS`, and each deletion calls a\n * route behind `DELETE_USER`. The use case of control-backend returns this\n * list from `permissionsFor`, and the form passes it to `canCreate`, so the\n * button and the server never disagree.\n */\nexport const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.GOD_PURGE_USERS,\n  AccountsPermissions.DELETE_USER,\n]\n\n/**\n * The largest metadata object that one update-user-metadata request writes,\n * in characters of its JSON text.\n *\n * This is a bound of the product, and not the limit of Auth0, which is far\n * larger. The approvers read the whole object before they agree, and an\n * object that is longer than this is an object that nobody reads.\n */\nexport const USER_METADATA_MAX_LENGTH = 16_000\n\n/**\n * The largest metadata object that a request carries as the object that the\n * person who asked READ.\n *\n * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew\n * past that bound can still get an edit that makes it smaller. It still has a\n * bound, because the request keeps the copy in its row.\n */\nexport const USER_METADATA_EXPECTED_MAX_LENGTH = 500_000\n\n/** The longest email address that a change-user-email request carries. */\nexport const APPROVAL_EMAIL_MAX_LENGTH = 320\n\n/**\n * The email addresses that a change-user-email request accepts.\n *\n * It is the email pattern of zod 4.6. The pattern is here, so the schema of\n * control-backend and the form of control-frontend accept the same addresses,\n * and a form never sends an address that the service refuses.\n */\nexport const APPROVAL_EMAIL_PATTERN =\n  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAkB7B,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,oBAAoB;AAAA;AAAA;AAAA,EAGpB,mBAAmB;AAAA;AAAA,EAEnB,4BAA4B;AAAA;AAAA;AAAA,EAG5B,8BAA8B;AAAA,EAC9B,8BAA8B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9B,uBAAuB;AACzB;AAUO,MAAM,6BAA6B;AAUnC,MAAM,0CAA0C;AAGhD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAkB9C,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;AAS9B,MAAM,iCAAiC;AAQvC,MAAM,4BAA4B;AASlC,MAAM,wBAAwB;AAU9B,MAAM,mCAAsD;AAAA,EACjE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAUO,MAAM,2BAA2B;AAUjC,MAAM,oCAAoC;AAG1C,MAAM,4BAA4B;AASlC,MAAM;AAAA;AAAA,EAEX;AAAA;",
   "names": []
 }

package/dist/charts/chart-metrics.d.ts

@@ -0,0 +1,35 @@
+import type { SearchFieldSpec } from '../search/fields.js';
+import type { ChartGrain, ChartUnit } from './chart-spec.js';
+export interface ChartDimensionSpec {
+    /** As typed after `by`. */
+    id: string;
+    label: string;
+    description: string;
+}
+export interface ChartMetricSpec {
+    /** As typed at the start of a query. */
+    id: string;
+    label: string;
+    description: string;
+    unit: ChartUnit;
+    dimensions: readonly ChartDimensionSpec[];
+    /** The fields that `where` can use. */
+    filters: readonly SearchFieldSpec[];
+    grains: readonly ChartGrain[];
+    /** The longest window, in days. */
+    maxWindowDays: number;
+    /**
+     * How one number comes from a chart, for the `stat` render: first over the
+     * series of a bucket, then over the buckets of the window. A counter sums
+     * both. A gauge must not: a sum of daily load percentages means nothing.
+     */
+    stat: {
+        series: 'sum' | 'mean';
+        window: 'sum' | 'max' | 'mean';
+    };
+}
+export declare const CHART_METRICS: readonly ChartMetricSpec[];
+/** Case-insensitive. */
+export declare const findChartMetric: (id: string, metrics?: readonly ChartMetricSpec[]) => ChartMetricSpec | undefined;
+/** Case-insensitive. */
+export declare const findChartDimension: (metric: ChartMetricSpec, id: string) => ChartDimensionSpec | undefined;