@camunda/ccma-shared-types 7.3.0 → 7.5.0

package/dist/_tests/constants/custom-hardware-sizing.const.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/approvals/policy.js

@@ -63,7 +63,8 @@ function canCreate(actor, useCase, request = {}) {
     );
   }
   const toRun = request.requiredPermissions ?? [useCase.requiredPermission];
-  if (resolveRequiredAcks(useCase, request.requiredAcks) === 0 && !useCase.openToEveryone && !hasEveryPermission(actor, toRun)) {
+  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission;
+  if (resolveRequiredAcks(useCase, request.requiredAcks) === 0 && !useCase.openToEveryone && !openedBySystem && !hasEveryPermission(actor, toRun)) {
     return deny(
       "forbidden",
       `This request needs no approval, so opening it runs it. That needs ${toRun.join(" and ")}, and you do not hold it.`

package/dist/approvals/policy.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/policy.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page already names a permission\n  // the same way (\"Approving needs aacp\").\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AACxE,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { UNKNOWN_ACTOR_EMAIL } from '../constants/misc.const.js'\nimport type {\n  ApprovalJobDto,\n  ApprovalUseCaseDto,\n} from '../dtos/ApprovalJob.dto.js'\nimport { ConsolePermissions } from '../permissions/console.permissions.js'\n\n/**\n * The rules of the approval mechanism, as pure functions.\n *\n * Three consumers run this file: control-backend decides whether to reject a\n * request, control-frontend decides whether to disable a button, and cloudbot\n * decides whether to answer. One copy means the button and the endpoint can\n * never disagree.\n *\n * Two choices in the signatures carry the design:\n *\n * - The actor is an interface with a `has` method. The backend holds an array\n *   of Auth0 claims, and `useSession()` in the frontend gives a flat record of\n *   booleans. Neither side has to convert to the shape of the other.\n * - `now` is a parameter. The expiry is lazy, so a stored `pending` request can\n *   be expired already. A parameter makes a difference between the two clocks\n *   an input that a test can set, and not a silent disagreement.\n *\n * No function here does I/O or returns a promise. The browser call site is what\n * enforces that, and it also stops a later use case from turning a list of 50\n * rows into 200 network calls.\n */\n\n/** Who is asking. See the note above on why this is an interface. */\nexport interface ApprovalActorView {\n  userId: string\n  /**\n   * The email of the actor. It is the SECOND identity of the four-eyes rule.\n   *\n   * `userId` alone is not enough. One person can hold more than one identity in\n   * Auth0 \u2014 a connection through SSO and a connection through a database, or an\n   * account that was made again \u2014 and each one carries a different `sub`. The\n   * same human then opens a request with one identity and approves it with the\n   * other, which is the rule defeated.\n   *\n   * It is optional because a token can carry no email. See\n   * `isSameActorEmail` for what that means for the comparison.\n   */\n  email?: string\n  has(permission: string): boolean\n}\n\n/**\n * Builds the `has` of an actor from the permissions that the actor holds.\n *\n * `ConsolePermissions.APPROVALS_ALL_USE_CASES` stands in for every permission\n * that a use case asks for. Both actor builders call this function, the one of\n * control-backend and the one of the browser, so the button and the route\n * agree on it. A rule that reads `actor.has` needs no change for it, and nor\n * does a use case that a later change adds.\n */\nexport function approvalPermissionCheck(\n  held: ReadonlySet<string>,\n): (permission: string) => boolean {\n  const all = held.has(ConsolePermissions.APPROVALS_ALL_USE_CASES)\n  return (permission) => all || held.has(permission)\n}\n\n/**\n * Reports whether two email addresses name one person.\n *\n * Two values that are absent, empty, or `UNKNOWN_ACTOR_EMAIL` are NOT one\n * person. A token with no email would otherwise make every actor equal to\n * every other actor, and the rule would refuse everybody.\n *\n * The comparison removes the spaces and the case. Auth0 gives the address as\n * the identity provider wrote it, so `A.B@camunda.com` and `a.b@camunda.com`\n * are one mailbox and must not pass as two people.\n */\nexport function isSameActorEmail(one?: string, other?: string): boolean {\n  const left = comparableActorEmail(one)\n  return left.length > 0 && left === comparableActorEmail(other)\n}\n\n/**\n * The address in the one form that a comparison may use.\n *\n * An absent address, an empty one and `UNKNOWN_ACTOR_EMAIL` all become an\n * empty string, because none of the three names a person. The spaces and the\n * case go as well: Auth0 gives the address as the identity provider wrote it.\n */\nfunction comparableActorEmail(value?: string): string {\n  const trimmed = value?.trim().toLowerCase() ?? ''\n  return trimmed === UNKNOWN_ACTOR_EMAIL ? '' : trimmed\n}\n\n/**\n * Reports whether one identity of a request names the actor.\n *\n * The `sub` of the token OR the email, because one person can hold more than\n * one Auth0 identity. Every rule that asks \"is this the same human?\" reads both\n * through this function, so a rule cannot forget the second half: `canWithdraw`\n * did, and it refused a creator whose browser and whose service resolved the\n * id from two different tokens.\n */\nexport function isSameActor(\n  identity: { userId: string; email?: string },\n  actor: ApprovalActorView,\n): boolean {\n  return (\n    identity.userId === actor.userId ||\n    isSameActorEmail(identity.email, actor.email)\n  )\n}\n\n/**\n * Reports whether this actor carries an address that names a person.\n *\n * A machine-to-machine token carries none: accounts-backend builds the\n * permissions of such a token from its `permissions` claim alone, and there is\n * no person behind it. See `creatorEmailRequired` of the use case.\n */\nexport function hasActorEmail(actor: ApprovalActorView): boolean {\n  return comparableActorEmail(actor.email).length > 0\n}\n\n/**\n * Why an action is not allowed.\n *\n * The code is for a program: control-backend maps it to a status, and the\n * frontend can branch on it. The message is for a person, and it is shown as\n * written.\n */\nexport type ApprovalDenialCode =\n  | 'forbidden'\n  | 'not-pending'\n  | 'self-approval'\n  | 'self-rejection'\n  | 'already-acknowledged'\n  | 'expired'\n  | 'not-creator'\n  | 'not-executable'\n  | 'no-reason'\n  | 'too-few-acks'\n  | 'no-creator-email'\n\nexport type ApprovalDecision =\n  | { allowed: true }\n  | { allowed: false; code: ApprovalDenialCode; message: string }\n\nconst ALLOWED: ApprovalDecision = { allowed: true }\n\nfunction deny(code: ApprovalDenialCode, message: string): ApprovalDecision {\n  return { allowed: false, code, message }\n}\n\n/**\n * Reports whether the time to answer a request has passed.\n *\n * Only a `pending` request expires. A request that already reached an end state\n * keeps that state, because \"expired\" would lose the answer that was given.\n */\nexport function isExpired(job: ApprovalJobDto, now: Date): boolean {\n  return (\n    job.status === 'pending' &&\n    new Date(job.expiresAt).getTime() <= now.getTime()\n  )\n}\n\n/** Reports the status to show, which is `expired` once the time has passed. */\nexport function effectiveStatus(\n  job: ApprovalJobDto,\n  now: Date,\n): ApprovalJobDto['status'] {\n  return isExpired(job, now) ? 'expired' : job.status\n}\n\n/** Reports how many more acknowledgements the request needs. */\nexport function remainingAcks(job: ApprovalJobDto): number {\n  return Math.max(0, job.requiredAcks - job.acks.length)\n}\n\n/**\n * Reports whether the actor holds EVERY permission of the set.\n *\n * Every, and not one of them. A payload that raises the guard adds a\n * permission, so \"one of them\" would let the base permission alone carry a\n * request that the extra permission exists to stop.\n *\n * An EMPTY set is held by nobody. That is the opposite of what `Array.every`\n * answers, and it is deliberate: this function guards a privileged action, so\n * the empty case must fail closed. A row with no permissions is not a row that\n * everybody may run \u2014 it is a row that lost its guard, through a migration\n * that did not backfill it or a write that went around the service. Every use\n * case builds a set of at least one, so no real request meets this branch.\n */\nexport function hasEveryPermission(\n  actor: ApprovalActorView,\n  permissions: string[],\n): boolean {\n  if (permissions.length === 0) {\n    return false\n  }\n  return permissions.every((permission) => actor.has(permission))\n}\n\n/**\n * What a person must hold to act on a request.\n *\n * A request carries its own set, because a payload can raise the guard. A use\n * case that never does has a set of one, and it is the base permission.\n */\nexport function requiredPermissionsOf(job: ApprovalJobDto): string[] {\n  return job.requiredPermissions\n}\n\n/**\n * Who can READ a request.\n *\n * Two people: one who can act on it, and the one who opened it. A Camundi who\n * holds neither has no reason to read which customer somebody proposed to\n * expire, so the list and the detail both hide it.\n *\n * The rule reads the BASE permission of the use case and not the effective set\n * of the request. A payload that raises the guard raises who can APPROVE, and\n * not who can look: a generation update with the yolo flag is visible to\n * everybody who can approve a plain one, and only the yolo permission runs it.\n * The list filters by use case in SQL, which is what makes one page of rows\n * the same page that a person is allowed to read.\n */\nexport function canView(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n): ApprovalDecision {\n  if (\n    actor.has(useCase.requiredPermission) ||\n    isSameActor(job.createdBy, actor)\n  ) {\n    return ALLOWED\n  }\n  return deny('forbidden', 'You cannot see this request.')\n}\n\n/**\n * Who can OPEN a request, and with what.\n *\n * `createPermission` is what keeps the pool that asks as small as the pool that\n * approves. A use case that leaves it absent says the opposite on purpose: the\n * approvals are the guard, and anybody signed in can propose the action.\n *\n * The two checks after it are about the request and not about the person. A\n * count below the floor of the use case, and a missing reason, are both a 400\n * and not a 403, so the words say which one the caller must repair.\n */\nexport function canCreate(\n  actor: ApprovalActorView,\n  useCase: ApprovalUseCaseDto,\n  request: {\n    reason?: string\n    requiredAcks?: number\n    /**\n     * The effective permissions of the payload, from `permissionsFor`.\n     *\n     * Absent means \"the base permission alone\", which is what most use cases\n     * build. Only the permissions ABOVE the base one gate opening a request:\n     * see the note in the body.\n     */\n    requiredPermissions?: string[]\n  } = {},\n): ApprovalDecision {\n  // The message NAMES the permission. \"You cannot open this request\" is true\n  // and useless: a Camundi who reads it cannot tell a missing permission from\n  // a rule they never heard of, and the detail page already names a permission\n  // the same way (\"Approving needs aacp\").\n  if (useCase.createPermission && !actor.has(useCase.createPermission)) {\n    return deny(\n      'forbidden',\n      `Opening this request needs ${useCase.createPermission}, and you do not hold it.`,\n    )\n  }\n  // What the PAYLOAD raised, on top of the base permission of the use case.\n  // A bulk generation update with the yolo flag needs the yolo permission, and\n  // without this check a person who holds the base permission alone could open\n  // one. They could not approve it and could not run it, so it is not an\n  // escalation \u2014 it is a request that its own author is not allowed to make,\n  // waiting in the queue of the people who are.\n  //\n  // The BASE permission is deliberately not checked here. `createPermission`\n  // above is the only gate on the person, and a use case that leaves it absent\n  // means that anybody signed in can propose the action. Checking the base\n  // permission too would take that choice away from every use case.\n  const raised = (request.requiredPermissions ?? []).filter(\n    (permission) => permission !== useCase.requiredPermission,\n  )\n  if (raised.length > 0 && !hasEveryPermission(actor, raised)) {\n    return deny(\n      'forbidden',\n      `This payload needs ${raised.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // A request that needs no approval RUNS when it is opened, so the person who\n  // opens it must hold what running it needs. Every other use case leaves this\n  // to the approvals, which is why the base permission is not checked above.\n  // With a floor of zero there is no approval to leave it to.\n  const toRun = request.requiredPermissions ?? [useCase.requiredPermission]\n  // A service that opens a request of its own use case holds the\n  // `createPermission` checked above, and that is the guard of the run. Without\n  // a `createPermission` there is no such guard, so the flag lifts nothing.\n  const openedBySystem = useCase.openedBySystem && !!useCase.createPermission\n  if (\n    resolveRequiredAcks(useCase, request.requiredAcks) === 0 &&\n    !useCase.openToEveryone &&\n    !openedBySystem &&\n    !hasEveryPermission(actor, toRun)\n  ) {\n    // The message NAMES the permission, and it says why opening needs it. A\n    // Camundi who reads \"you cannot open this request\" for an action that\n    // needs no approval cannot tell which of the two rules refused them.\n    return deny(\n      'forbidden',\n      `This request needs no approval, so opening it runs it. That needs ` +\n        `${toRun.join(' and ')}, and you do not hold it.`,\n    )\n  }\n  // The action of this use case carries the address of the person who asked,\n  // so a caller with no address must be refused HERE. The alternative is a\n  // request that looks ordinary, collects its approvals over days, and then\n  // fails because the other service cannot find a user called \"unknown\".\n  if (useCase.creatorEmailRequired && !hasActorEmail(actor)) {\n    return deny(\n      'no-creator-email',\n      'This action needs the email address of the person who asks for it, ' +\n        'and your session carries none. Sign in as a person to open this ' +\n        'request.',\n    )\n  }\n  if (useCase.reasonRequired && (request.reason ?? '').trim().length === 0) {\n    return deny('no-reason', 'Give a reason to open this request.')\n  }\n  if (\n    request.requiredAcks !== undefined &&\n    request.requiredAcks < useCase.minAcks\n  ) {\n    return deny(\n      'too-few-acks',\n      `This action needs at least ${useCase.minAcks} approvals.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * The approvals that a new request asks for.\n *\n * The caller names a number or names none. A number below the floor is refused\n * by `canCreate`, and this function holds the answer inside the range anyway:\n * the two run in the same call, and a floor that only one of them knows is a\n * floor that a later caller can step over.\n */\nexport function resolveRequiredAcks(\n  useCase: ApprovalUseCaseDto,\n  requested?: number,\n): number {\n  if (requested === undefined) {\n    return Math.max(useCase.defaultAcks, useCase.minAcks)\n  }\n  return Math.max(Math.trunc(requested), useCase.minAcks)\n}\n\n/**\n * The four-eyes rule.\n *\n * The bans are in the order a person meets them, and each one has its own\n * message: \"you already approved this\" and \"you cannot approve your own\n * request\" are different mistakes, and one message for both helps nobody.\n *\n * Each of the two bans on a person reads BOTH identities: the `sub` of the\n * token, and the email. See `ApprovalActorView.email` for why one of them is\n * not enough.\n */\nexport function canAcknowledge(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot approve this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be approved.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be approved.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-approval',\n      'You opened this request, so you cannot approve it.',\n    )\n  }\n  if (job.acks.some((ack) => isSameActor(ack, actor))) {\n    return deny('already-acknowledged', 'You already approved this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * A rejection needs the same permission as an acknowledgement, and a reason.\n *\n * Two people answer a request, and each one has ONE verb. Somebody else\n * approves or rejects it; the person who opened it withdraws it. The creator is\n * refused here for the same reason `canAcknowledge` refuses them: one person\n * must not be both sides of a four-eyes decision. The message names the button\n * that they do have, and the trail loses nothing, because a withdrawal writes\n * its reason into the same field.\n *\n * The ORDER of the checks is the order that a person meets them, and the state\n * of the request comes before the reason. A closed request must answer\n * \"already closed\" whatever the caller typed: with the reason first, a page\n * that had no reason yet read `no-reason` from a rejected request, and the\n * Reject button of control-frontend stayed enabled on a request that nothing\n * could reject any more.\n */\nexport function canReject(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n  reason: string,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot reject this request.')\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be rejected.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be rejected.`,\n    )\n  }\n  if (isSameActor(job.createdBy, actor)) {\n    return deny(\n      'self-rejection',\n      'You opened this request, so withdraw it instead of rejecting it.',\n    )\n  }\n  if (reason.trim().length === 0) {\n    return deny('no-reason', 'Give a reason to reject this request.')\n  }\n  return ALLOWED\n}\n\n/**\n * Only the person who opened a request can take it back.\n *\n * BOTH identities, as every other rule of this file reads them. One person can\n * hold two Auth0 identities with two different `sub` values, and a rule that\n * read the id alone refused the creator their own withdrawal as soon as the\n * browser and the service resolved that id from two different tokens.\n */\nexport function canWithdraw(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n  now: Date,\n): ApprovalDecision {\n  if (!isSameActor(job.createdBy, actor)) {\n    return deny(\n      'not-creator',\n      'Only the person who opened a request can withdraw it.',\n    )\n  }\n  if (isExpired(job, now)) {\n    return deny(\n      'expired',\n      'This request expired and can no longer be withdrawn.',\n    )\n  }\n  if (job.status !== 'pending') {\n    return deny(\n      'not-pending',\n      `This request is ${job.status} and can no longer be withdrawn.`,\n    )\n  }\n  return ALLOWED\n}\n\n/**\n * Runs a request that has its approvals.\n *\n * This is the button of the explicit mode. `failed` is executable again,\n * because a failure is often a problem of the system that is now repaired, and\n * asking for the approvals a second time helps nobody.\n *\n * ANY holder of the permission may press it, and not only the person who\n * opened the request. The decision was made when the request reached\n * `approved`: `canAcknowledge` refuses the creator, so the approvals on the\n * row came from other people, and the button only carries out what they\n * already agreed to. Holding the button to the creator would let one Camundi\n * on holiday freeze an approved action, and a use case that must not run\n * without its author has `executionMode: 'auto'` instead.\n *\n * Who PRESSED it and who ASKED for it are two different facts, and both are\n * kept: the audit trail of control-backend records the actor of the run, and\n * an action that names a person to another service names the creator. See\n * `onBehalfOf` of `extend-trial`.\n */\nexport function canExecute(\n  job: ApprovalJobDto,\n  actor: ApprovalActorView,\n): ApprovalDecision {\n  if (!hasEveryPermission(actor, job.requiredPermissions)) {\n    return deny('forbidden', 'You cannot run this request.')\n  }\n  if (job.status !== 'approved' && job.status !== 'failed') {\n    return deny(\n      'not-executable',\n      `This request is ${job.status} and cannot be run.`,\n    )\n  }\n  return ALLOWED\n}\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAKpC,SAAS,0BAA0B;AAoD5B,SAAS,wBACd,MACiC;AACjC,QAAM,MAAM,KAAK,IAAI,mBAAmB,uBAAuB;AAC/D,SAAO,CAAC,eAAe,OAAO,KAAK,IAAI,UAAU;AACnD;AAaO,SAAS,iBAAiB,KAAc,OAAyB;AACtE,QAAM,OAAO,qBAAqB,GAAG;AACrC,SAAO,KAAK,SAAS,KAAK,SAAS,qBAAqB,KAAK;AAC/D;AASA,SAAS,qBAAqB,OAAwB;AACpD,QAAM,UAAU,OAAO,KAAK,EAAE,YAAY,KAAK;AAC/C,SAAO,YAAY,sBAAsB,KAAK;AAChD;AAWO,SAAS,YACd,UACA,OACS;AACT,SACE,SAAS,WAAW,MAAM,UAC1B,iBAAiB,SAAS,OAAO,MAAM,KAAK;AAEhD;AASO,SAAS,cAAc,OAAmC;AAC/D,SAAO,qBAAqB,MAAM,KAAK,EAAE,SAAS;AACpD;AA0BA,MAAM,UAA4B,EAAE,SAAS,KAAK;AAElD,SAAS,KAAK,MAA0B,SAAmC;AACzE,SAAO,EAAE,SAAS,OAAO,MAAM,QAAQ;AACzC;AAQO,SAAS,UAAU,KAAqB,KAAoB;AACjE,SACE,IAAI,WAAW,aACf,IAAI,KAAK,IAAI,SAAS,EAAE,QAAQ,KAAK,IAAI,QAAQ;AAErD;AAGO,SAAS,gBACd,KACA,KAC0B;AAC1B,SAAO,UAAU,KAAK,GAAG,IAAI,YAAY,IAAI;AAC/C;AAGO,SAAS,cAAc,KAA6B;AACzD,SAAO,KAAK,IAAI,GAAG,IAAI,eAAe,IAAI,KAAK,MAAM;AACvD;AAgBO,SAAS,mBACd,OACA,aACS;AACT,MAAI,YAAY,WAAW,GAAG;AAC5B,WAAO;AAAA,EACT;AACA,SAAO,YAAY,MAAM,CAAC,eAAe,MAAM,IAAI,UAAU,CAAC;AAChE;AAQO,SAAS,sBAAsB,KAA+B;AACnE,SAAO,IAAI;AACb;AAgBO,SAAS,QACd,KACA,OACA,SACkB;AAClB,MACE,MAAM,IAAI,QAAQ,kBAAkB,KACpC,YAAY,IAAI,WAAW,KAAK,GAChC;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,aAAa,8BAA8B;AACzD;AAaO,SAAS,UACd,OACA,SACA,UAWI,CAAC,GACa;AAKlB,MAAI,QAAQ,oBAAoB,CAAC,MAAM,IAAI,QAAQ,gBAAgB,GAAG;AACpE,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,gBAAgB;AAAA,IACxD;AAAA,EACF;AAYA,QAAM,UAAU,QAAQ,uBAAuB,CAAC,GAAG;AAAA,IACjD,CAAC,eAAe,eAAe,QAAQ;AAAA,EACzC;AACA,MAAI,OAAO,SAAS,KAAK,CAAC,mBAAmB,OAAO,MAAM,GAAG;AAC3D,WAAO;AAAA,MACL;AAAA,MACA,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,IAC5C;AAAA,EACF;AAKA,QAAM,QAAQ,QAAQ,uBAAuB,CAAC,QAAQ,kBAAkB;AAIxE,QAAM,iBAAiB,QAAQ,kBAAkB,CAAC,CAAC,QAAQ;AAC3D,MACE,oBAAoB,SAAS,QAAQ,YAAY,MAAM,KACvD,CAAC,QAAQ,kBACT,CAAC,kBACD,CAAC,mBAAmB,OAAO,KAAK,GAChC;AAIA,WAAO;AAAA,MACL;AAAA,MACA,qEACK,MAAM,KAAK,OAAO,CAAC;AAAA,IAC1B;AAAA,EACF;AAKA,MAAI,QAAQ,wBAAwB,CAAC,cAAc,KAAK,GAAG;AACzD,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IAGF;AAAA,EACF;AACA,MAAI,QAAQ,mBAAmB,QAAQ,UAAU,IAAI,KAAK,EAAE,WAAW,GAAG;AACxE,WAAO,KAAK,aAAa,qCAAqC;AAAA,EAChE;AACA,MACE,QAAQ,iBAAiB,UACzB,QAAQ,eAAe,QAAQ,SAC/B;AACA,WAAO;AAAA,MACL;AAAA,MACA,8BAA8B,QAAQ,OAAO;AAAA,IAC/C;AAAA,EACF;AACA,SAAO;AACT;AAUO,SAAS,oBACd,SACA,WACQ;AACR,MAAI,cAAc,QAAW;AAC3B,WAAO,KAAK,IAAI,QAAQ,aAAa,QAAQ,OAAO;AAAA,EACtD;AACA,SAAO,KAAK,IAAI,KAAK,MAAM,SAAS,GAAG,QAAQ,OAAO;AACxD;AAaO,SAAS,eACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,kCAAkC;AAAA,EAC7D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,KAAK,KAAK,CAAC,QAAQ,YAAY,KAAK,KAAK,CAAC,GAAG;AACnD,WAAO,KAAK,wBAAwB,oCAAoC;AAAA,EAC1E;AACA,SAAO;AACT;AAmBO,SAAS,UACd,KACA,OACA,KACA,QACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,iCAAiC;AAAA,EAC5D;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,MAAI,YAAY,IAAI,WAAW,KAAK,GAAG;AACrC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,OAAO,KAAK,EAAE,WAAW,GAAG;AAC9B,WAAO,KAAK,aAAa,uCAAuC;AAAA,EAClE;AACA,SAAO;AACT;AAUO,SAAS,YACd,KACA,OACA,KACkB;AAClB,MAAI,CAAC,YAAY,IAAI,WAAW,KAAK,GAAG;AACtC,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,KAAK,GAAG,GAAG;AACvB,WAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,WAAW,WAAW;AAC5B,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAsBO,SAAS,WACd,KACA,OACkB;AAClB,MAAI,CAAC,mBAAmB,OAAO,IAAI,mBAAmB,GAAG;AACvD,WAAO,KAAK,aAAa,8BAA8B;AAAA,EACzD;AACA,MAAI,IAAI,WAAW,cAAc,IAAI,WAAW,UAAU;AACxD,WAAO;AAAA,MACL;AAAA,MACA,mBAAmB,IAAI,MAAM;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/approvals/use-cases.const.d.ts

@@ -35,10 +35,13 @@ export declare const APPROVAL_USE_CASE_TYPES: {
     readonly updateUserMetadata: "update-user-metadata";
     readonly changeFeatureFlag: "change-feature-flag";
     readonly createPersonalOrganisation: "create-personal-organisation";
-    readonly createCustomerHardwareSizing: "create-customer-hardware-sizing";
-    readonly removeCustomerHardwareSizing: "remove-customer-hardware-sizing";
+    readonly createCustomHardwareSizing: "create-custom-hardware-sizing";
+    readonly removeCustomHardwareSizing: "remove-custom-hardware-sizing";
+    readonly createCustomGeneration: "create-custom-generation";
+    readonly removeCustomGeneration: "remove-custom-generation";
     readonly onboardToEnterprise: "onboard-to-enterprise";
     readonly changeClusterPlanType: "change-cluster-plan-type";
+    readonly clusterTtlDeletion: "cluster-ttl-deletion";
 };
 /**
  * The approvals that a change of the feature flag table needs on prod.

package/dist/approvals/use-cases.const.js

@@ -30,9 +30,13 @@ const APPROVAL_USE_CASE_TYPES = {
   // Open to every Camundi, and it needs no approval on any stage.
   createPersonalOrganisation: "create-personal-organisation",
   // Open to every Camundi, runs on dev only, and needs no approval. The two
-  // use cases of customer hardware sizing.
-  createCustomerHardwareSizing: "create-customer-hardware-sizing",
-  removeCustomerHardwareSizing: "remove-customer-hardware-sizing",
+  // use cases of custom hardware sizing.
+  createCustomHardwareSizing: "create-custom-hardware-sizing",
+  removeCustomHardwareSizing: "remove-custom-hardware-sizing",
+  // Open to every Camundi, runs on dev only, and needs no approval. The two
+  // use cases of custom generations.
+  createCustomGeneration: "create-custom-generation",
+  removeCustomGeneration: "remove-custom-generation",
   // The enterprise onboarding of one organization, behind
   // `control.onboardToEnterpriseApproval`: the contract, the plan type of
   // each cluster, and the reservations, in one request.
@@ -41,7 +45,11 @@ const APPROVAL_USE_CASE_TYPES = {
   // `control.changeClusterPlanType`. The bulk plan type update beside it
   // checks no reservation and moves no cluster plan, so this one is not a
   // duplicate of it. See `change-cluster-plan-type.ts` in control-backend.
-  changeClusterPlanType: "change-cluster-plan-type"
+  changeClusterPlanType: "change-cluster-plan-type",
+  // The deletion of one cluster whose TTL ran out. Only the delete cron of
+  // console-backend opens it, and it needs no approval. It is a record of the
+  // deletion. See `cluster-ttl-deletion.ts` in control-backend.
+  clusterTtlDeletion: "cluster-ttl-deletion"
 };
 const FEATURE_FLAG_MIN_ACKS_PROD = 2;
 const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10;

package/dist/approvals/use-cases.const.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/approvals/use-cases.const.ts"],
-  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n  // The second group, behind `control.approvalAdminActions`.\n  changePlatformRoles: 'change-platform-roles',\n  deleteInternalBackup: 'delete-internal-backup',\n  changeOrgLimits: 'change-org-limits',\n  deleteSsoConnection: 'delete-sso-connection',\n  changeSalesPlan: 'change-sales-plan',\n  // The third group, behind `control.approvalAccountActions`.\n  deleteOrganization: 'delete-organization',\n  deleteUser: 'delete-user',\n  changeUserEmail: 'change-user-email',\n  purgeUsers: 'purge-users',\n  updateUserMetadata: 'update-user-metadata',\n  // A change of the feature flag table, on a stage where\n  // `isFeatureFlagApprovalRequired` is true.\n  changeFeatureFlag: 'change-feature-flag',\n  // Open to every Camundi, and it needs no approval on any stage.\n  createPersonalOrganisation: 'create-personal-organisation',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of customer hardware sizing.\n  createCustomerHardwareSizing: 'create-customer-hardware-sizing',\n  removeCustomerHardwareSizing: 'remove-customer-hardware-sizing',\n  // The enterprise onboarding of one organization, behind\n  // `control.onboardToEnterpriseApproval`: the contract, the plan type of\n  // each cluster, and the reservations, in one request.\n  onboardToEnterprise: 'onboard-to-enterprise',\n  // The plan type and the hardware packages of ONE cluster, behind\n  // `control.changeClusterPlanType`. The bulk plan type update beside it\n  // checks no reservation and moves no cluster plan, so this one is not a\n  // duplicate of it. See `change-cluster-plan-type.ts` in control-backend.\n  changeClusterPlanType: 'change-cluster-plan-type',\n} as const\n\n/**\n * The approvals that a change of the feature flag table needs on prod.\n *\n * A flag there turns a feature on or off for every customer, and a person who\n * holds `aafw` could do it alone. Two other Camundis stand in every change,\n * the same floor as a cluster bulk operation on prod\n * (`CLUSTER_BULK_OPERATION_MIN_ACKS`). Int needs one.\n */\nexport const FEATURE_FLAG_MIN_ACKS_PROD = 2\n\n/**\n * The most personal organizations that one Camundi can request.\n *\n * The request runs with no approval, so this cap is the only guard against a\n * loop that creates organizations without end. It counts the requests that a\n * Camundi opened, and a person who needs more asks a Camundi who holds\n * `AccountsPermissions.CREATE_ORG`.\n */\nexport const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10\n\n/** The shortest and longest name of a personal organization. */\nexport const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3\nexport const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n\n/**\n * The most roles that one change-platform-roles request adds, or removes.\n *\n * The form of control-frontend offers every platform role, and a person who\n * gives a Camundi a new position rarely changes more than a few. A request with\n * more roles than this is a request that nobody reads before they approve it.\n */\nexport const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10\n\n/**\n * The longest text value that one change-org-limits request writes.\n *\n * A text limit holds a short value, such as a list of regions. The bound keeps\n * a request readable for the person who approves it.\n */\nexport const ORG_LIMIT_TEXT_MAX_LENGTH = 2000\n\n/**\n * The most users that one purge-users request deletes.\n *\n * The God Mode purge deletes one user after the other, and Auth0 limits how\n * fast that goes. A list longer than this is also a list that no approver\n * reads before they agree.\n */\nexport const PURGE_USERS_MAX_USERS = 1000\n\n/**\n * What a person must hold to open or to approve a purge-users request.\n *\n * The purge of God Mode is behind `GOD_PURGE_USERS`, and each deletion calls a\n * route behind `DELETE_USER`. The use case of control-backend returns this\n * list from `permissionsFor`, and the form passes it to `canCreate`, so the\n * button and the server never disagree.\n */\nexport const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.GOD_PURGE_USERS,\n  AccountsPermissions.DELETE_USER,\n]\n\n/**\n * The largest metadata object that one update-user-metadata request writes,\n * in characters of its JSON text.\n *\n * This is a bound of the product, and not the limit of Auth0, which is far\n * larger. The approvers read the whole object before they agree, and an\n * object that is longer than this is an object that nobody reads.\n */\nexport const USER_METADATA_MAX_LENGTH = 16_000\n\n/**\n * The largest metadata object that a request carries as the object that the\n * person who asked READ.\n *\n * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew\n * past that bound can still get an edit that makes it smaller. It still has a\n * bound, because the request keeps the copy in its row.\n */\nexport const USER_METADATA_EXPECTED_MAX_LENGTH = 500_000\n\n/** The longest email address that a change-user-email request carries. */\nexport const APPROVAL_EMAIL_MAX_LENGTH = 320\n\n/**\n * The email addresses that a change-user-email request accepts.\n *\n * It is the email pattern of zod 4.6. The pattern is here, so the schema of\n * control-backend and the form of control-frontend accept the same addresses,\n * and a form never sends an address that the service refuses.\n */\nexport const APPROVAL_EMAIL_PATTERN =\n  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/\n"],
-  "mappings": "AAMA,SAAS,2BAA2B;AAkB7B,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,oBAAoB;AAAA;AAAA;AAAA,EAGpB,mBAAmB;AAAA;AAAA,EAEnB,4BAA4B;AAAA;AAAA;AAAA,EAG5B,8BAA8B;AAAA,EAC9B,8BAA8B;AAAA;AAAA;AAAA;AAAA,EAI9B,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrB,uBAAuB;AACzB;AAUO,MAAM,6BAA6B;AAUnC,MAAM,0CAA0C;AAGhD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAkB9C,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;AAS9B,MAAM,iCAAiC;AAQvC,MAAM,4BAA4B;AASlC,MAAM,wBAAwB;AAU9B,MAAM,mCAAsD;AAAA,EACjE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAUO,MAAM,2BAA2B;AAUjC,MAAM,oCAAoC;AAG1C,MAAM,4BAA4B;AASlC,MAAM;AAAA;AAAA,EAEX;AAAA;",
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport { AccountsPermissions } from '../permissions/accounts.permissions.js'\n\n/**\n * The names and the value ranges of the registered use cases.\n *\n * control-backend owns the registry, and a frontend reads it at run time\n * (`GET /api/approvals/use-cases`). Two things cannot wait for that answer:\n *\n * - **The identifier**, because a caller must NAME a use case to find it in the\n *   registry, and to open a request of it.\n * - **The range of a payload field**, because a form holds the value before any\n *   call goes out.\n *\n * Both live here, so the schema of the service and the form of the browser can\n * never hold different numbers.\n */\n\n/** The identifier of each use case, on the wire and in the table. */\nexport const APPROVAL_USE_CASE_TYPES = {\n  sendToExpiredTrial: 'send-to-expired-trial',\n  extendTrial: 'extend-trial',\n  moveClusterOrg: 'move-cluster-org',\n  // One use case for each type of a cluster bulk operation. The types need\n  // different permissions and different approval counts, and a use case holds\n  // one of each. See `cluster-bulk-operation.ts` beside this file.\n  clusterBulkGenerationUpdate: 'cluster-bulk-generation-update',\n  clusterBulkPlanUpdate: 'cluster-bulk-plan-update',\n  clusterBulkPlanTypeUpdate: 'cluster-bulk-plan-type-update',\n  clusterBulkSleepWakeup: 'cluster-bulk-sleep-wakeup',\n  clusterBulkDeletion: 'cluster-bulk-deletion',\n  clusterBulkSpecUpdate: 'cluster-bulk-spec-update',\n  // The second group, behind `control.approvalAdminActions`.\n  changePlatformRoles: 'change-platform-roles',\n  deleteInternalBackup: 'delete-internal-backup',\n  changeOrgLimits: 'change-org-limits',\n  deleteSsoConnection: 'delete-sso-connection',\n  changeSalesPlan: 'change-sales-plan',\n  // The third group, behind `control.approvalAccountActions`.\n  deleteOrganization: 'delete-organization',\n  deleteUser: 'delete-user',\n  changeUserEmail: 'change-user-email',\n  purgeUsers: 'purge-users',\n  updateUserMetadata: 'update-user-metadata',\n  // A change of the feature flag table, on a stage where\n  // `isFeatureFlagApprovalRequired` is true.\n  changeFeatureFlag: 'change-feature-flag',\n  // Open to every Camundi, and it needs no approval on any stage.\n  createPersonalOrganisation: 'create-personal-organisation',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom hardware sizing.\n  createCustomHardwareSizing: 'create-custom-hardware-sizing',\n  removeCustomHardwareSizing: 'remove-custom-hardware-sizing',\n  // Open to every Camundi, runs on dev only, and needs no approval. The two\n  // use cases of custom generations.\n  createCustomGeneration: 'create-custom-generation',\n  removeCustomGeneration: 'remove-custom-generation',\n  // The enterprise onboarding of one organization, behind\n  // `control.onboardToEnterpriseApproval`: the contract, the plan type of\n  // each cluster, and the reservations, in one request.\n  onboardToEnterprise: 'onboard-to-enterprise',\n  // The plan type and the hardware packages of ONE cluster, behind\n  // `control.changeClusterPlanType`. The bulk plan type update beside it\n  // checks no reservation and moves no cluster plan, so this one is not a\n  // duplicate of it. See `change-cluster-plan-type.ts` in control-backend.\n  changeClusterPlanType: 'change-cluster-plan-type',\n  // The deletion of one cluster whose TTL ran out. Only the delete cron of\n  // console-backend opens it, and it needs no approval. It is a record of the\n  // deletion. See `cluster-ttl-deletion.ts` in control-backend.\n  clusterTtlDeletion: 'cluster-ttl-deletion',\n} as const\n\n/**\n * The approvals that a change of the feature flag table needs on prod.\n *\n * A flag there turns a feature on or off for every customer, and a person who\n * holds `aafw` could do it alone. Two other Camundis stand in every change,\n * the same floor as a cluster bulk operation on prod\n * (`CLUSTER_BULK_OPERATION_MIN_ACKS`). Int needs one.\n */\nexport const FEATURE_FLAG_MIN_ACKS_PROD = 2\n\n/**\n * The most personal organizations that one Camundi can request.\n *\n * The request runs with no approval, so this cap is the only guard against a\n * loop that creates organizations without end. It counts the requests that a\n * Camundi opened, and a person who needs more asks a Camundi who holds\n * `AccountsPermissions.CREATE_ORG`.\n */\nexport const PERSONAL_ORGANIZATION_MAX_PER_REQUESTER = 10\n\n/** The shortest and longest name of a personal organization. */\nexport const PERSONAL_ORGANIZATION_NAME_MIN_LENGTH = 3\nexport const PERSONAL_ORGANIZATION_NAME_MAX_LENGTH = 100\n\nexport type ApprovalUseCaseType =\n  (typeof APPROVAL_USE_CASE_TYPES)[keyof typeof APPROVAL_USE_CASE_TYPES]\n\n/**\n * The shortest extension that accounts-backend accepts.\n *\n * `POST /:orgId/extendtrial` refuses a date that is less than 14 days away\n * when the body carries `onBehalfOf`, and it measures those 14 days when the\n * CALL arrives. The floor here is 15 and not 14, for two reasons:\n *\n * - The two clocks are not the same instant. Accounts builds its own \"14 days\n *   from now\" a few milliseconds after control-backend builds the date, so a\n *   date of exactly 14 days is already in the past for the comparison.\n * - Accounts counts with `setDate`, which is calendar arithmetic. A change of\n *   the daylight saving time moves its limit by an hour.\n */\nexport const EXTEND_TRIAL_MIN_DAYS = 15\n\n/**\n * The longest extension that accounts-backend accepts.\n *\n * The same route refuses a date more than 62 days away. 61 keeps the same\n * margin as the floor above.\n */\nexport const EXTEND_TRIAL_MAX_DAYS = 61\n\n/**\n * The most roles that one change-platform-roles request adds, or removes.\n *\n * The form of control-frontend offers every platform role, and a person who\n * gives a Camundi a new position rarely changes more than a few. A request with\n * more roles than this is a request that nobody reads before they approve it.\n */\nexport const PLATFORM_ROLE_CHANGE_MAX_ROLES = 10\n\n/**\n * The longest text value that one change-org-limits request writes.\n *\n * A text limit holds a short value, such as a list of regions. The bound keeps\n * a request readable for the person who approves it.\n */\nexport const ORG_LIMIT_TEXT_MAX_LENGTH = 2000\n\n/**\n * The most users that one purge-users request deletes.\n *\n * The God Mode purge deletes one user after the other, and Auth0 limits how\n * fast that goes. A list longer than this is also a list that no approver\n * reads before they agree.\n */\nexport const PURGE_USERS_MAX_USERS = 1000\n\n/**\n * What a person must hold to open or to approve a purge-users request.\n *\n * The purge of God Mode is behind `GOD_PURGE_USERS`, and each deletion calls a\n * route behind `DELETE_USER`. The use case of control-backend returns this\n * list from `permissionsFor`, and the form passes it to `canCreate`, so the\n * button and the server never disagree.\n */\nexport const PURGE_USERS_REQUIRED_PERMISSIONS: readonly string[] = [\n  AccountsPermissions.GOD_PURGE_USERS,\n  AccountsPermissions.DELETE_USER,\n]\n\n/**\n * The largest metadata object that one update-user-metadata request writes,\n * in characters of its JSON text.\n *\n * This is a bound of the product, and not the limit of Auth0, which is far\n * larger. The approvers read the whole object before they agree, and an\n * object that is longer than this is an object that nobody reads.\n */\nexport const USER_METADATA_MAX_LENGTH = 16_000\n\n/**\n * The largest metadata object that a request carries as the object that the\n * person who asked READ.\n *\n * It is larger than `USER_METADATA_MAX_LENGTH`, so a user whose metadata grew\n * past that bound can still get an edit that makes it smaller. It still has a\n * bound, because the request keeps the copy in its row.\n */\nexport const USER_METADATA_EXPECTED_MAX_LENGTH = 500_000\n\n/** The longest email address that a change-user-email request carries. */\nexport const APPROVAL_EMAIL_MAX_LENGTH = 320\n\n/**\n * The email addresses that a change-user-email request accepts.\n *\n * It is the email pattern of zod 4.6. The pattern is here, so the schema of\n * control-backend and the form of control-frontend accept the same addresses,\n * and a form never sends an address that the service refuses.\n */\nexport const APPROVAL_EMAIL_PATTERN =\n  // biome-ignore lint/complexity/noUselessEscapeInRegex: the same source as zod, character for character\n  /^(?:[A-Za-z0-9_'+\\-]+\\.)*[A-Za-z0-9_'+\\-]*[A-Za-z0-9_+-]@(?:[A-Za-z0-9][A-Za-z0-9\\-]*\\.)+[A-Za-z]{2,}$/\n"],
+  "mappings": "AAMA,SAAS,2BAA2B;AAkB7B,MAAM,0BAA0B;AAAA,EACrC,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIhB,6BAA6B;AAAA,EAC7B,uBAAuB;AAAA,EACvB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,uBAAuB;AAAA;AAAA,EAEvB,qBAAqB;AAAA,EACrB,sBAAsB;AAAA,EACtB,iBAAiB;AAAA,EACjB,qBAAqB;AAAA,EACrB,iBAAiB;AAAA;AAAA,EAEjB,oBAAoB;AAAA,EACpB,YAAY;AAAA,EACZ,iBAAiB;AAAA,EACjB,YAAY;AAAA,EACZ,oBAAoB;AAAA;AAAA;AAAA,EAGpB,mBAAmB;AAAA;AAAA,EAEnB,4BAA4B;AAAA;AAAA;AAAA,EAG5B,4BAA4B;AAAA,EAC5B,4BAA4B;AAAA;AAAA;AAAA,EAG5B,wBAAwB;AAAA,EACxB,wBAAwB;AAAA;AAAA;AAAA;AAAA,EAIxB,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKrB,uBAAuB;AAAA;AAAA;AAAA;AAAA,EAIvB,oBAAoB;AACtB;AAUO,MAAM,6BAA6B;AAUnC,MAAM,0CAA0C;AAGhD,MAAM,wCAAwC;AAC9C,MAAM,wCAAwC;AAkB9C,MAAM,wBAAwB;AAQ9B,MAAM,wBAAwB;AAS9B,MAAM,iCAAiC;AAQvC,MAAM,4BAA4B;AASlC,MAAM,wBAAwB;AAU9B,MAAM,mCAAsD;AAAA,EACjE,oBAAoB;AAAA,EACpB,oBAAoB;AACtB;AAUO,MAAM,2BAA2B;AAUjC,MAAM,oCAAoC;AAG1C,MAAM,4BAA4B;AASlC,MAAM;AAAA;AAAA,EAEX;AAAA;",
   "names": []
 }

package/dist/constants/custom-generation.const.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Custom generation: a bespoke generation that a Camundi creates for an
+ * organization of their own, with no admin permission. The approval use cases
+ * `create-custom-generation` and `remove-custom-generation` run on dev only.
+ */
+/** The stage where custom generations run. */
+export declare const isCustomGenerationStage: (stage: string) => boolean;
+/**
+ * The most custom generations that one Camundi can own. The count is the
+ * bespoke generations that the Camundi created and did not delete. A bespoke
+ * generation that the Camundi created in the admin tool counts too.
+ */
+export declare const CUSTOM_GENERATION_MAX_PER_REQUESTER = 50;
+/** The most generations that a custom generation can list in `upgradeableFrom`. */
+export declare const CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM = 50;
+export declare const CUSTOM_GENERATION_NAME_MIN_LENGTH = 3;
+export declare const CUSTOM_GENERATION_NAME_MAX_LENGTH = 100;
+/**
+ * Returns what is wrong with the versions of a new generation, or an empty
+ * list. It is the check of the admin route and of the custom generation
+ * request, thus both give the same messages. The admin route throws the first
+ * message.
+ *
+ * It does not change `versions`. A caller that saves the versions must still
+ * set the blank optional fields to `undefined`. Here a blank text in one of
+ * those fields counts as no value.
+ */
+export declare function checkNewGenerationVersions(versions: Record<string, unknown>): string[];

package/dist/constants/custom-generation.const.js

@@ -0,0 +1,67 @@
+import {
+  ImmutableThings,
+  MutableThings
+} from "../types/C8ClusterComponentVersions.type.js";
+import {
+  generationImageErrorMessage,
+  isValidGenerationImage
+} from "../utils/versionCheck.utils.js";
+const isCustomGenerationStage = (stage) => stage === "dev";
+const CUSTOM_GENERATION_MAX_PER_REQUESTER = 50;
+const CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM = 50;
+const CUSTOM_GENERATION_NAME_MIN_LENGTH = 3;
+const CUSTOM_GENERATION_NAME_MAX_LENGTH = 100;
+const REQUIRED_IMAGES = ["zeebe", "elasticSearchCurator", "elasticSearchOss"];
+const OPTIONAL_IMAGES = [
+  "operate",
+  "tasklist",
+  "optimize",
+  "connectorBridge",
+  "zeebeAnalytics"
+];
+const BLANK_IS_ABSENT = [
+  "operate",
+  "tasklist",
+  "connectorBridge",
+  "zeebeAnalytics",
+  "elasticSearchCurator"
+];
+const imageProblem = (field, value) => typeof value === "string" && isValidGenerationImage(value) ? void 0 : generationImageErrorMessage(field, value);
+function checkNewGenerationVersions(versions) {
+  const valueOf = (field) => {
+    const value = versions[field];
+    return BLANK_IS_ABSENT.includes(field) && typeof value === "string" && value.trim() === "" ? void 0 : value;
+  };
+  const problems = [];
+  for (const field of REQUIRED_IMAGES) {
+    const problem = imageProblem(field, valueOf(field));
+    if (problem) {
+      problems.push(problem);
+    }
+  }
+  for (const field of OPTIONAL_IMAGES) {
+    const value = valueOf(field);
+    if (value === void 0 || value === "") {
+      continue;
+    }
+    const problem = imageProblem(field, value);
+    if (problem) {
+      problems.push(problem);
+    }
+  }
+  for (const key of Object.keys(versions)) {
+    if (!MutableThings.includes(key) && !ImmutableThings.includes(key)) {
+      problems.push(`${key} is not a valid thing`);
+    }
+  }
+  return problems;
+}
+export {
+  CUSTOM_GENERATION_MAX_PER_REQUESTER,
+  CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM,
+  CUSTOM_GENERATION_NAME_MAX_LENGTH,
+  CUSTOM_GENERATION_NAME_MIN_LENGTH,
+  checkNewGenerationVersions,
+  isCustomGenerationStage
+};
+//# sourceMappingURL=custom-generation.const.js.map

package/dist/constants/custom-generation.const.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/constants/custom-generation.const.ts"],
+  "sourcesContent": ["/*\n * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH\n * under one or more contributor license agreements. Licensed under a commercial license.\n * You may not use this file except in compliance with the commercial license.\n */\n\nimport {\n  ImmutableThings,\n  MutableThings,\n} from '../types/C8ClusterComponentVersions.type.js'\nimport {\n  generationImageErrorMessage,\n  isValidGenerationImage,\n} from '../utils/versionCheck.utils.js'\n\n/**\n * Custom generation: a bespoke generation that a Camundi creates for an\n * organization of their own, with no admin permission. The approval use cases\n * `create-custom-generation` and `remove-custom-generation` run on dev only.\n */\n\n/** The stage where custom generations run. */\nexport const isCustomGenerationStage = (stage: string): boolean =>\n  stage === 'dev'\n\n/**\n * The most custom generations that one Camundi can own. The count is the\n * bespoke generations that the Camundi created and did not delete. A bespoke\n * generation that the Camundi created in the admin tool counts too.\n */\nexport const CUSTOM_GENERATION_MAX_PER_REQUESTER = 50\n\n/** The most generations that a custom generation can list in `upgradeableFrom`. */\nexport const CUSTOM_GENERATION_MAX_UPGRADEABLE_FROM = 50\n\nexport const CUSTOM_GENERATION_NAME_MIN_LENGTH = 3\nexport const CUSTOM_GENERATION_NAME_MAX_LENGTH = 100\n\n/** Images that every generation must have. */\nconst REQUIRED_IMAGES = ['zeebe', 'elasticSearchCurator', 'elasticSearchOss']\n\n/**\n * Images that a generation can have. `undefined` and an empty text mean no\n * image. Any other value, `null` too, must be a valid image, because\n * `ZeebeClusterVersionsDto` types these fields as text.\n */\nconst OPTIONAL_IMAGES = [\n  'operate',\n  'tasklist',\n  'optimize',\n  'connectorBridge',\n  'zeebeAnalytics',\n]\n\n/** Fields where a blank text means no value. */\nconst BLANK_IS_ABSENT = [\n  'operate',\n  'tasklist',\n  'connectorBridge',\n  'zeebeAnalytics',\n  'elasticSearchCurator',\n]\n\nconst imageProblem = (field: string, value: unknown): string | undefined =>\n  typeof value === 'string' && isValidGenerationImage(value)\n    ? undefined\n    : generationImageErrorMessage(field, value)\n\n/**\n * Returns what is wrong with the versions of a new generation, or an empty\n * list. It is the check of the admin route and of the custom generation\n * request, thus both give the same messages. The admin route throws the first\n * message.\n *\n * It does not change `versions`. A caller that saves the versions must still\n * set the blank optional fields to `undefined`. Here a blank text in one of\n * those fields counts as no value.\n */\nexport function checkNewGenerationVersions(\n  versions: Record<string, unknown>,\n): string[] {\n  const valueOf = (field: string): unknown => {\n    const value = versions[field]\n    return BLANK_IS_ABSENT.includes(field) &&\n      typeof value === 'string' &&\n      value.trim() === ''\n      ? undefined\n      : value\n  }\n\n  const problems: string[] = []\n  for (const field of REQUIRED_IMAGES) {\n    const problem = imageProblem(field, valueOf(field))\n    if (problem) {\n      problems.push(problem)\n    }\n  }\n  for (const field of OPTIONAL_IMAGES) {\n    const value = valueOf(field)\n    if (value === undefined || value === '') {\n      continue\n    }\n    const problem = imageProblem(field, value)\n    if (problem) {\n      problems.push(problem)\n    }\n  }\n  for (const key of Object.keys(versions)) {\n    if (!MutableThings.includes(key) && !ImmutableThings.includes(key)) {\n      problems.push(`${key} is not a valid thing`)\n    }\n  }\n  return problems\n}\n"],
+  "mappings": "AAMA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AASA,MAAM,0BAA0B,CAAC,UACtC,UAAU;AAOL,MAAM,sCAAsC;AAG5C,MAAM,yCAAyC;AAE/C,MAAM,oCAAoC;AAC1C,MAAM,oCAAoC;AAGjD,MAAM,kBAAkB,CAAC,SAAS,wBAAwB,kBAAkB;AAO5E,MAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,MAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,eAAe,CAAC,OAAe,UACnC,OAAO,UAAU,YAAY,uBAAuB,KAAK,IACrD,SACA,4BAA4B,OAAO,KAAK;AAYvC,SAAS,2BACd,UACU;AACV,QAAM,UAAU,CAAC,UAA2B;AAC1C,UAAM,QAAQ,SAAS,KAAK;AAC5B,WAAO,gBAAgB,SAAS,KAAK,KACnC,OAAO,UAAU,YACjB,MAAM,KAAK,MAAM,KACf,SACA;AAAA,EACN;AAEA,QAAM,WAAqB,CAAC;AAC5B,aAAW,SAAS,iBAAiB;AACnC,UAAM,UAAU,aAAa,OAAO,QAAQ,KAAK,CAAC;AAClD,QAAI,SAAS;AACX,eAAS,KAAK,OAAO;AAAA,IACvB;AAAA,EACF;AACA,aAAW,SAAS,iBAAiB;AACnC,UAAM,QAAQ,QAAQ,KAAK;AAC3B,QAAI,UAAU,UAAa,UAAU,IAAI;AACvC;AAAA,IACF;AACA,UAAM,UAAU,aAAa,OAAO,KAAK;AACzC,QAAI,SAAS;AACX,eAAS,KAAK,OAAO;AAAA,IACvB;AAAA,EACF;AACA,aAAW,OAAO,OAAO,KAAK,QAAQ,GAAG;AACvC,QAAI,CAAC,cAAc,SAAS,GAAG,KAAK,CAAC,gBAAgB,SAAS,GAAG,GAAG;AAClE,eAAS,KAAK,GAAG,GAAG,uBAAuB;AAAA,IAC7C;AAAA,EACF;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/constants/{customer-hardware-sizing.const.d.ts → custom-hardware-sizing.const.d.ts}

@@ -1,7 +1,7 @@
 /**
- * Customer hardware sizing: a cluster plan that a Camundi creates for an
+ * Custom hardware sizing: a cluster plan that a Camundi creates for an
  * organization of their own, with no admin permission. The approval use cases
- * `create-customer-hardware-sizing` and `remove-customer-hardware-sizing` run
+ * `create-custom-hardware-sizing` and `remove-custom-hardware-sizing` run
  * on dev only, and the limits in this file keep one plan from asking for a
  * machine park.
  *
@@ -11,23 +11,23 @@
  * `G3-M (adapted for Cisco load test)` ask for 10 TB on purpose, and a cap
  * from them would be 100 TB.
  */
-/** The stage where customer hardware sizing runs. */
-export declare const isCustomerHardwareSizingStage: (stage: string) => boolean;
+/** The stage where custom hardware sizing runs. */
+export declare const isCustomHardwareSizingStage: (stage: string) => boolean;
 /**
- * The most plans that one Camundi can own through customer hardware sizing.
+ * The most plans that one Camundi can own through custom hardware sizing.
  *
  * The count is the number of plans the Camundi created. A plan that the
  * Camundi deleted does not count.
  */
-export declare const CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER = 10;
-/** The shortest and longest name of a customer hardware sizing plan. */
-export declare const CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH = 3;
-export declare const CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH = 100;
+export declare const CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER = 10;
+/** The shortest and longest name of a custom hardware sizing plan. */
+export declare const CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH = 3;
+export declare const CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH = 100;
 /**
  * The longest plan, as JSON text. The largest plan of prod is about 6000
  * characters. The cap stops a request that carries a huge object.
  */
-export declare const CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 50000;
+export declare const CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 50000;
 /**
  * Caps for the requests and the limits of one component.
  *
@@ -40,7 +40,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 50000;
  * - Elasticsearch: 30 CPU, 100 GiB, 3000 GiB of storage (no load test)
  * - other: 6 CPU, 30 GiB, no storage
  */
-export declare const CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS: {
+export declare const CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS: {
     readonly broker: {
         readonly cpu: 160;
         readonly memoryGi: 500;
@@ -58,7 +58,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS: {
     };
 };
 /** Caps for the count fields of a plan. Prod maximum is in the comments. */
-export declare const CUSTOMER_HARDWARE_SIZING_COUNT_CAPS: {
+export declare const CUSTOM_HARDWARE_SIZING_COUNT_CAPS: {
     readonly clusterSize: 70;
     readonly partitionsCount: 500;
     readonly replicationFactor: 30;
@@ -66,7 +66,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_COUNT_CAPS: {
     readonly replicas: 30;
 };
 /** `zeebe.broker.storage.autoResizing.increase`. Prod maximum is 18 GiB. */
-export declare const CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180;
+export declare const CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180;
 /**
  * The caps over the whole broker set, which the caps for one broker do not
  * give. A plan with 70 brokers of 160 CPU passes every cap above, and it asks
@@ -74,7 +74,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180;
  * 250 GiB of memory (5 brokers, `GLS HA`) and 2500 GiB of storage (5 brokers,
  * `GLS HA`, no load test).
  */
-export declare const CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS: {
+export declare const CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS: {
     readonly cpu: 840;
     readonly memoryGi: 2500;
     readonly storageGi: 25000;
@@ -85,7 +85,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS: {
  * (5 nodes, `CCL G3L HA`). The storage of one node is a claim of one volume,
  * so the total is the claim times the number of nodes.
  */
-export declare const CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS: {
+export declare const CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS: {
     readonly cpu: 900;
     readonly memoryGi: 3000;
     readonly storageGi: 100000;
@@ -98,7 +98,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS: {
  * the cap for one pod, 10 times over. The check counts a storage request of a
  * pod in `resources` against it.
  */
-export declare const CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS: {
+export declare const CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS: {
     readonly cpu: 120;
     readonly memoryGi: 600;
     readonly storageGi: 50000;
@@ -112,7 +112,7 @@ export declare const CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS: {
  */
 export declare function parseKubernetesQuantity(value: unknown): number | undefined;
 /**
- * Checks a cluster plan against the caps of customer hardware sizing.
+ * Checks a cluster plan against the caps of custom hardware sizing.
  *
  * Returns the list of violations, and an empty list when the plan is within
  * the caps. It checks the size only. The shape of the plan is the job of the
@@ -121,4 +121,4 @@ export declare function parseKubernetesQuantity(value: unknown): number | undefi
  * A value that this function cannot read is a violation too: a cap that the
  * plan can skip with a strange spelling is no cap.
  */
-export declare function checkCustomerHardwareSizing(plan: unknown): string[];
+export declare function checkCustomHardwareSizing(plan: unknown): string[];

package/dist/constants/{customer-hardware-sizing.const.js → custom-hardware-sizing.const.js}

@@ -1,15 +1,15 @@
 import { canonicalPlan } from "../utils/elasticsearchPlanPath.utils.js";
-const isCustomerHardwareSizingStage = (stage) => stage === "dev";
-const CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER = 10;
-const CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH = 3;
-const CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH = 100;
-const CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 5e4;
-const CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS = {
+const isCustomHardwareSizingStage = (stage) => stage === "dev";
+const CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER = 10;
+const CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH = 3;
+const CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH = 100;
+const CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH = 5e4;
+const CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS = {
   broker: { cpu: 160, memoryGi: 500, storageGi: 5e3 },
   elasticsearch: { cpu: 300, memoryGi: 1e3, storageGi: 3e4 },
   other: { cpu: 60, memoryGi: 300, storageGi: 5e3 }
 };
-const CUSTOMER_HARDWARE_SIZING_COUNT_CAPS = {
+const CUSTOM_HARDWARE_SIZING_COUNT_CAPS = {
   // 7
   clusterSize: 70,
   // 50
@@ -21,18 +21,18 @@ const CUSTOMER_HARDWARE_SIZING_COUNT_CAPS = {
   // `replicas` of any component. 3.
   replicas: 30
 };
-const CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180;
-const CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS = {
+const CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI = 180;
+const CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS = {
   cpu: 840,
   memoryGi: 2500,
   storageGi: 25e3
 };
-const CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS = {
+const CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS = {
   cpu: 900,
   memoryGi: 3e3,
   storageGi: 1e5
 };
-const CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS = {
+const CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS = {
   cpu: 120,
   memoryGi: 600,
   storageGi: 5e4
@@ -87,7 +87,7 @@ function checkNumberCap(violations, path, value, cap) {
 }
 function checkResource(violations, path, value, kind) {
   const name = path.join(".");
-  const caps = CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS[componentOf(path)];
+  const caps = CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS[componentOf(path)];
   const parsed = parseKubernetesQuantity(value);
   if (parsed === void 0) {
     violations.push(`${name} is not a quantity that can be checked`);
@@ -115,12 +115,12 @@ function walk(violations, node, path) {
     const next = [...path, key];
     const parent = path.at(-1);
     const grandParent = path.at(-2);
-    if (Object.hasOwn(CUSTOMER_HARDWARE_SIZING_COUNT_CAPS, key) && !isRecord(value)) {
+    if (Object.hasOwn(CUSTOM_HARDWARE_SIZING_COUNT_CAPS, key) && !isRecord(value)) {
       checkNumberCap(
         violations,
         next,
         value,
-        CUSTOMER_HARDWARE_SIZING_COUNT_CAPS[key]
+        CUSTOM_HARDWARE_SIZING_COUNT_CAPS[key]
       );
     } else if ((parent === "limits" || parent === "requests") && grandParent === "resources" && (key === "cpu" || key === "memory" || key === "storage")) {
       checkResource(violations, next, value, key);
@@ -130,9 +130,9 @@ function walk(violations, node, path) {
       checkResource(violations, next, value, "storage");
     } else if (parent === "autoResizing" && key === "increase") {
       const parsed = parseKubernetesQuantity(value);
-      if (parsed === void 0 || parsed / GIBIBYTE > CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI) {
+      if (parsed === void 0 || parsed / GIBIBYTE > CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI) {
         violations.push(
-          `${next.join(".")} is not a quantity of at most ${CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI} GiB`
+          `${next.join(".")} is not a quantity of at most ${CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI} GiB`
         );
       }
     } else {
@@ -191,7 +191,7 @@ function checkReplicaSets(violations, node, path) {
         storageResources: podResources,
         legacyStorage: void 0
       },
-      CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS
+      CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS
     );
   }
   for (const [key, value] of Object.entries(node)) {
@@ -212,7 +212,7 @@ function checkNodeSetTotals(violations, plan) {
         storageResources: storage?.resources,
         legacyStorage: broker.persistentStorageCapacity
       },
-      CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS
+      CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS
     );
   }
   checkReplicaSets(violations, plan, []);
@@ -229,17 +229,17 @@ function checkNodeSetTotals(violations, plan) {
         storageResources: storage?.resources,
         legacyStorage: elasticsearch.persistentStorageCapacity
       },
-      CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS
+      CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS
     );
   }
 }
-function checkCustomerHardwareSizing(plan) {
+function checkCustomHardwareSizing(plan) {
   if (!isRecord(plan)) {
     return ["the plan is not an object"];
   }
-  if (JSON.stringify(plan).length > CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH) {
+  if (JSON.stringify(plan).length > CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH) {
     return [
-      `the plan is longer than ${CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH} characters`
+      `the plan is longer than ${CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH} characters`
     ];
   }
   const canonical = canonicalPlan(plan);
@@ -249,18 +249,18 @@ function checkCustomerHardwareSizing(plan) {
   return violations;
 }
 export {
-  CUSTOMER_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_COUNT_CAPS,
-  CUSTOMER_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
-  CUSTOMER_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_NAME_MAX_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_NAME_MIN_LENGTH,
-  CUSTOMER_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
-  CUSTOMER_HARDWARE_SIZING_RESOURCE_CAPS,
-  checkCustomerHardwareSizing,
-  isCustomerHardwareSizingStage,
+  CUSTOM_HARDWARE_SIZING_BROKER_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_COUNT_CAPS,
+  CUSTOM_HARDWARE_SIZING_ELASTICSEARCH_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_MAX_AUTO_RESIZE_INCREASE_GI,
+  CUSTOM_HARDWARE_SIZING_MAX_PLANS_PER_REQUESTER,
+  CUSTOM_HARDWARE_SIZING_MAX_PLAN_JSON_LENGTH,
+  CUSTOM_HARDWARE_SIZING_NAME_MAX_LENGTH,
+  CUSTOM_HARDWARE_SIZING_NAME_MIN_LENGTH,
+  CUSTOM_HARDWARE_SIZING_REPLICA_SET_TOTAL_CAPS,
+  CUSTOM_HARDWARE_SIZING_RESOURCE_CAPS,
+  checkCustomHardwareSizing,
+  isCustomHardwareSizingStage,
   parseKubernetesQuantity
 };
-//# sourceMappingURL=customer-hardware-sizing.const.js.map
+//# sourceMappingURL=custom-hardware-sizing.const.js.map