@capxul/sdk 4.20.0-beta.3 → 4.20.0-beta.31

package/dist/permission-approvals-BLI_uadD.mjs

@@ -0,0 +1,138 @@
+import { a as verifiedConfiguration, d as verifiedPreparation, f as buildCommand, i as prepareConfiguration, l as preparePermission, m as validateReplacementInput, r as authorInvitation, u as preparedIdentity } from "./organizations-wucUfgJr.mjs";
+import { En as CAPXUL_OPERATIONS, Fr as absurd, Ii as Errors, Li as CapxulError, Lt as asCapxulError, X as abandonPrepared } from "./access-B-2qmxF_.mjs";
+//#region src/accounts/permission-approvals.ts
+/** Prepare a Permission write or an invitation's configuration for `signerAddress`, checked. */
+function prepareVerifiedPermissionChange(deps, input, signerAddress, signal) {
+	return "permission" in input ? prepareVerifiedPermissionWrite(deps, input, signerAddress, signal) : prepareVerifiedInvitation(deps, input, signerAddress, signal);
+}
+/**
+* Hand the verified identity to the caller before the approval opens. A
+* caller that refuses it has not authorized the command: close the prepared
+* command, so its nonce lane is free again.
+*/
+async function delivered(deps, executionId, deliver) {
+	let refused;
+	try {
+		const result = await deliver();
+		if (result !== void 0 && !result.ok) refused = result;
+	} catch (cause) {
+		refused = {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+	return refused === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : abandonPrepared(deps, executionId, "prepared_mismatch", refused);
+}
+/** The command a write sends, decoded exactly as its `org(id).permissions` method decodes it. */
+function command(write) {
+	try {
+		switch (write.operation) {
+			case "create": return {
+				ok: true,
+				value: buildCommand.create(write)
+			};
+			case "change": return {
+				ok: true,
+				value: buildCommand.change(write)
+			};
+			case "assign": return {
+				ok: true,
+				value: buildCommand.assign(write)
+			};
+			case "revoke": return {
+				ok: true,
+				value: buildCommand.revoke(write)
+			};
+			case "replace": return {
+				ok: true,
+				value: {
+					operation: "replace",
+					requestKey: write.requestKey
+				}
+			};
+			default: return absurd(write);
+		}
+	} catch (cause) {
+		return {
+			ok: false,
+			error: asCapxulError(cause)
+		};
+	}
+}
+async function prepareVerifiedPermissionWrite(deps, input, signerAddress, signal) {
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const built = command(input.permission);
+	if (!built.ok) return built;
+	const orgId = input.organizationId;
+	const expectedSnapshotHash = input.permission.operation === "replace" ? input.permission.expectedSnapshotHash : void 0;
+	const admitted = validateReplacementInput(orgId, built.value, expectedSnapshotHash);
+	if (!admitted.ok) return admitted;
+	const preparation = {
+		orgId,
+		command: built.value,
+		signerAddress,
+		email: session.email,
+		chainId: deps.chainId,
+		expectedSnapshotHash
+	};
+	const prepared = await preparePermission(deps, preparation, signal, void 0);
+	if (!prepared.ok) return prepared;
+	const executionId = prepared.value.executionId;
+	const verified = verifiedPreparation(prepared.value, preparation);
+	if (!verified.ok) return abandonPrepared(deps, executionId, "prepared_mismatch", verified);
+	const { onPrepared } = input;
+	return onPrepared === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : delivered(deps, executionId, () => onPrepared(preparedIdentity(verified.value)));
+}
+async function prepareVerifiedInvitation(deps, input, signerAddress, signal) {
+	const session = deps.actor?.authSession() ?? null;
+	if (session === null || deps.chainId === void 0) return {
+		ok: false,
+		error: Errors.notAuthenticated()
+	};
+	const orgId = input.organizationId;
+	const authored = await authorInvitation(deps, orgId, input.invite, signal, void 0);
+	if (!authored.ok) return authored;
+	const view = authored.value;
+	if (view.phase !== "authorizing" || view.commandId === null) return {
+		ok: false,
+		error: new CapxulError("WRONG_STATE", "The invitation's rights are already set up, or it ended: nothing is left to sign.", { details: {
+			method: CAPXUL_OPERATIONS.approvals.prepare,
+			currentState: view.phase,
+			validStates: ["authorizing"],
+			invitationId: view.id
+		} })
+	};
+	const preparation = {
+		orgId,
+		view,
+		commandId: view.commandId,
+		signerAddress,
+		email: session.email,
+		chainId: deps.chainId
+	};
+	const built = await prepareConfiguration(deps, preparation, signal, void 0);
+	if (!built.ok) return built;
+	const { executionId, invitationId, commandId } = built.value;
+	const verified = verifiedConfiguration(built.value, preparation);
+	if (!verified.ok) return abandonPrepared(deps, executionId, "prepared_mismatch", verified);
+	const { onPrepared } = input;
+	return onPrepared === void 0 ? {
+		ok: true,
+		value: { executionId }
+	} : delivered(deps, executionId, () => onPrepared({
+		invitationId,
+		commandId
+	}));
+}
+//#endregion
+export { prepareVerifiedPermissionChange };