@capybara-hq/kernel 0.1.0-rc.2 → 0.1.0-rc.20

package/dist/catalog/appearance.schemas.js

@@ -0,0 +1,20 @@
+import { z } from "zod";
+import { CatalogIdPathParams } from "./admin-catalog.schemas.js";
+import { OrgExtensionParams } from "./org-extension.schemas.js";
+/**
+ * The body of both "apply this plugin's appearance" routes (client extensions spec §6.5):
+ * `dryRun: true` answers what would change and writes nothing (the confirm dialog's preview).
+ */
+export const AppearanceApplyBody = z.object({ dryRun: z.boolean().optional() }).strict();
+export const APPEARANCE_ROUTES = [
+    {
+        route: "POST /api/v1/admin/catalog/items/:id/appearance",
+        params: CatalogIdPathParams,
+        body: AppearanceApplyBody,
+    },
+    {
+        route: "POST /api/v1/orgs/:orgId/extensions/:extension/appearance",
+        params: OrgExtensionParams,
+        body: AppearanceApplyBody,
+    },
+];

package/dist/catalog/appearance.service.d.ts

@@ -0,0 +1,105 @@
+import { type SuggestedAppearance } from "@capybara-hq/plugin-sdk";
+import { ExtensionHost } from "../extensions/host.js";
+import { SettingsService } from "../identity/settings.js";
+import { SuperAdminLock } from "../identity/super-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { OrgLock } from "../orgs/org-lock.js";
+import { OrgSettingsService } from "../orgs/settings.service.js";
+/** Where the suggestion is applied: the platform defaults, or one org's. */
+export type AppearanceLevel = {
+    platform: true;
+} | {
+    orgId: string;
+};
+/** Why a replacement of the suggestion was left out (client extensions spec §6.5). */
+export type AppearanceSkipReason = "unknown-slot" | "not-available" | "not-eligible";
+/**
+ * What applying a suggestion changes at its level: the default theme (`from`: the theme in effect,
+ * null for none; `to`: the `platform_themes` id; null when the plugin suggests no theme or it is
+ * in effect already), each replacement slot's `use` (`to`: the contribution key
+ * `<extension>/<contribution>`; `from`: the key in effect, null for the built-in; a slot that
+ * already uses it is not listed) and what was skipped, in plugin.json order. At org level `from`
+ * is the org's own entry, else the platform's: `followsPlatform` says which (absent at platform
+ * level), and when the org follows a platform that already uses the suggestion nothing is pinned.
+ */
+export interface AppearanceResult {
+    theme: {
+        from: string | null;
+        to: string;
+        followsPlatform?: boolean;
+    } | null;
+    replacements: {
+        slot: string;
+        from: string | null;
+        to: string;
+        followsPlatform?: boolean;
+    }[];
+    skipped: {
+        what: string;
+        reason: AppearanceSkipReason;
+    }[];
+}
+/** Who applies it: the account, the PAT when one made the call, and extra audit detail. */
+export interface AppearanceActor {
+    accountId: string;
+    tokenId?: string;
+    /** Merged into the settings writer's audit detail (the Platform tool's `via: "agent"`). */
+    auditDetail?: Record<string, unknown>;
+}
+/** The suggestion of a plugin's catalog version, or null (none, or not an object). */
+export declare function suggestedAppearanceOf(manifest: unknown): SuggestedAppearance | null;
+/**
+ * "Apply this plugin's appearance" (client extensions spec §6.5): one step that sets the plugin's
+ * suggested theme as the level's default theme and each suggested replacement as the level's `use`
+ * of its single slot. The writes go through the settings writers (`SettingsService.update` for the
+ * platform, `OrgSettingsService.update` for an org), so their validation, theme checks, lock order
+ * (the level's lock, then catalog item, theme row, `uiTheme` row) and audit apply, both settings in
+ * one call and one transaction: a theme that cannot be set (`theme.not_available`) refuses the
+ * whole call; a replacement that cannot be used where it is set is skipped, never refused (the
+ * arrangement keeps unknown keys anyway). A dry run computes the same answer and writes nothing.
+ */
+export declare class AppearanceService {
+    private readonly db;
+    readonly txHost: TransactionHost;
+    private readonly settings;
+    private readonly orgSettings;
+    private readonly adminLock;
+    private readonly orgLock;
+    private readonly host;
+    constructor(db: KernelDb, txHost: TransactionHost, settings: SettingsService, orgSettings: OrgSettingsService, adminLock: SuperAdminLock, orgLock: OrgLock, host: ExtensionHost);
+    /**
+     * The suggestions of the live plugins named `names`, from the version their components come from
+     * (`platform_synced_version`, else the latest); a plugin without one maps to null.
+     */
+    suggestions(names: readonly string[]): Promise<Map<string, SuggestedAppearance | null>>;
+    /** The live catalog item `itemId` with its suggestion; else `catalog.item_not_found`. */
+    private platformItem;
+    /**
+     * The live plugin of extension `extension`, which must be on in the org, with its suggestion;
+     * else `extension.not_found`.
+     */
+    private orgItem;
+    /**
+     * Applies (or, with `dryRun`, previews) the suggestion of `item` at `level`: for the platform,
+     * `item` is the catalog item id (`POST /api/v1/admin/catalog/items/:id/appearance`, super
+     * admin); for an org, the extension name (`POST /api/v1/orgs/:orgId/extensions/:extension/
+     * appearance`, `org.update`). The writers re-check the actor under their lock.
+     */
+    apply(level: AppearanceLevel, item: string, actor: AppearanceActor, dryRun: boolean): Promise<AppearanceResult>;
+    /** Refuses (`theme.not_available`) a theme the level's writer would refuse; reads only. */
+    private assertThemeSettable;
+    private applyPlatform;
+    private applyOrg;
+    /**
+     * What applying `found` at `level` changes, from the stored settings (no writes): the level's
+     * own, and at org level the platform's it follows where it stores nothing.
+     */
+    private plan;
+}
+/**
+ * The suggested appearance action: its own module, since it writes through the org settings
+ * writer (`OrgsModule`, which imports `CatalogModule`) and the deployment settings writer.
+ */
+export declare class AppearanceModule {
+}

package/dist/catalog/appearance.service.js

@@ -0,0 +1,306 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { parseSlotRef, UI_ARRANGEABLE_SLOTS, uiSlot, } from "@capybara-hq/plugin-sdk";
+import { Inject, Injectable, Module } from "@nestjs/common";
+import { ApiError } from "../errors.js";
+import { ExtensionsModule } from "../extensions/extensions.module.js";
+import { ExtensionHost } from "../extensions/host.js";
+import { IdentityModule } from "../identity/identity.module.js";
+import { readUiArrangement, readUiTheme, SettingsService } from "../identity/settings.js";
+import { SuperAdminLock, SuperAdminLockModule } from "../identity/super-admin.js";
+import { KernelDb } from "../infra/database/kernel-db.js";
+import { TransactionHost } from "../infra/database/transaction-host.js";
+import { Transactional } from "../infra/database/transactional.decorator.js";
+import { OrgLock, OrgLockModule } from "../orgs/org-lock.js";
+import { OrgsModule } from "../orgs/orgs.module.js";
+import { OrgSettingsService, readOrgSettings } from "../orgs/settings.service.js";
+import { assertPlatformDefaultEligible, eligiblePlatformDefault, themeNotAvailable, themeOnIn, } from "../themes/theme-state.js";
+import { ORG_ARRANGEABLE } from "../ui/arrangement.js";
+import { inAuthorOrder } from "./catalog-items.js";
+/** The suggestion of a plugin's catalog version, or null (none, or not an object). */
+export function suggestedAppearanceOf(manifest) {
+    const sa = manifest?.suggestedAppearance;
+    return sa !== null && typeof sa === "object" ? sa : null;
+}
+const itemNotFound = () => new ApiError("catalog.item_not_found", "No such plugin, or it suggests no appearance");
+const extensionNotFound = () => new ApiError("extension.not_found", "No such extension on in this organization, or its plugin suggests no appearance");
+const useOf = (e) => e !== undefined && "use" in e ? e.use : null;
+/**
+ * "Apply this plugin's appearance" (client extensions spec §6.5): one step that sets the plugin's
+ * suggested theme as the level's default theme and each suggested replacement as the level's `use`
+ * of its single slot. The writes go through the settings writers (`SettingsService.update` for the
+ * platform, `OrgSettingsService.update` for an org), so their validation, theme checks, lock order
+ * (the level's lock, then catalog item, theme row, `uiTheme` row) and audit apply, both settings in
+ * one call and one transaction: a theme that cannot be set (`theme.not_available`) refuses the
+ * whole call; a replacement that cannot be used where it is set is skipped, never refused (the
+ * arrangement keeps unknown keys anyway). A dry run computes the same answer and writes nothing.
+ */
+let AppearanceService = class AppearanceService {
+    db;
+    txHost;
+    settings;
+    orgSettings;
+    adminLock;
+    orgLock;
+    host;
+    constructor(db, txHost, settings, orgSettings, adminLock, orgLock, host) {
+        this.db = db;
+        this.txHost = txHost;
+        this.settings = settings;
+        this.orgSettings = orgSettings;
+        this.adminLock = adminLock;
+        this.orgLock = orgLock;
+        this.host = host;
+    }
+    /**
+     * The suggestions of the live plugins named `names`, from the version their components come from
+     * (`platform_synced_version`, else the latest); a plugin without one maps to null.
+     */
+    async suggestions(names) {
+        const out = new Map(names.map((n) => [n, null]));
+        if (names.length === 0)
+            return out;
+        const rows = await this.db
+            .selectFrom("catalog_items as i")
+            .innerJoin("catalog_item_versions as v", (j) => j
+            .onRef("v.item_id", "=", "i.id")
+            .on((eb) => eb("v.version", "=", eb.fn.coalesce("i.platform_synced_version", "i.latest_version"))))
+            .select(["i.name", "v.manifest", "v.appearance_order"])
+            .where("i.name", "in", [...names])
+            .where("i.deleted_at", "is", null)
+            .execute();
+        for (const r of rows) {
+            out.set(r.name, suggestedAppearanceOf(inAuthorOrder(r.manifest, r.appearance_order)));
+        }
+        return out;
+    }
+    /** The live catalog item `itemId` with its suggestion; else `catalog.item_not_found`. */
+    async platformItem(itemId) {
+        if (!/^[0-9a-f-]{36}$/i.test(itemId))
+            throw itemNotFound();
+        const row = await this.db
+            .selectFrom("catalog_items")
+            .select(["id", "name"])
+            .where("id", "=", itemId)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        const suggestion = row && (await this.suggestions([row.name])).get(row.name);
+        if (!row || !suggestion)
+            throw itemNotFound();
+        return { id: row.id, name: row.name, suggestion };
+    }
+    /**
+     * The live plugin of extension `extension`, which must be on in the org, with its suggestion;
+     * else `extension.not_found`.
+     */
+    async orgItem(orgId, extension) {
+        if (!(await this.host.enabledPlugins(orgId)).has(extension))
+            throw extensionNotFound();
+        const row = await this.db
+            .selectFrom("catalog_items")
+            .select(["id", "name"])
+            .where("name", "=", extension)
+            .where("deleted_at", "is", null)
+            .executeTakeFirst();
+        const suggestion = row && (await this.suggestions([row.name])).get(row.name);
+        if (!row || !suggestion)
+            throw extensionNotFound();
+        return { id: row.id, name: row.name, suggestion };
+    }
+    /**
+     * Applies (or, with `dryRun`, previews) the suggestion of `item` at `level`: for the platform,
+     * `item` is the catalog item id (`POST /api/v1/admin/catalog/items/:id/appearance`, super
+     * admin); for an org, the extension name (`POST /api/v1/orgs/:orgId/extensions/:extension/
+     * appearance`, `org.update`). The writers re-check the actor under their lock.
+     */
+    async apply(level, item, actor, dryRun) {
+        if (dryRun) {
+            const found = "orgId" in level ? await this.orgItem(level.orgId, item) : await this.platformItem(item);
+            const plan = await this.plan(level, found);
+            if (plan.theme !== undefined)
+                await this.assertThemeSettable(level, plan.theme);
+            return plan.result;
+        }
+        return "orgId" in level
+            ? this.applyOrg(level.orgId, item, actor)
+            : this.applyPlatform(item, actor);
+    }
+    /** Refuses (`theme.not_available`) a theme the level's writer would refuse; reads only. */
+    async assertThemeSettable(level, themeId) {
+        if ("orgId" in level) {
+            if (!(await themeOnIn(this.db.db, level.orgId, themeId))) {
+                throw themeNotAvailable(themeId, "in this organization");
+            }
+        }
+        else {
+            await assertPlatformDefaultEligible(this.db.db, themeId);
+        }
+    }
+    async applyPlatform(itemId, actor) {
+        // The writer's own lock first, so what the plan reads (the stored theme and arrangement) is
+        // what the write replaces; the writer takes it again (re-entrant) and then the theme rows
+        await this.adminLock.lockAndAuthorize(actor.accountId);
+        const found = await this.platformItem(itemId);
+        const plan = await this.plan({ platform: true }, found);
+        if (plan.theme === undefined && Object.keys(plan.arrangement).length === 0)
+            return plan.result;
+        await this.settings.update({
+            ...(plan.theme !== undefined && { uiTheme: { id: plan.theme } }),
+            ...(Object.keys(plan.arrangement).length > 0 && { uiArrangement: plan.arrangement }),
+        }, actor.accountId, actor.tokenId, { ...actor.auditDetail, appearance: { itemId: found.id, plugin: found.name } });
+        return plan.result;
+    }
+    async applyOrg(orgId, extension, actor) {
+        // The org lock first (as the writer takes it): `personal` and the stored arrangement are read
+        // under it, so the write keeps the lock setting it read
+        await this.orgLock.lockAndAuthorize(orgId, actor.accountId, "org.update");
+        const found = await this.orgItem(orgId, extension);
+        const plan = await this.plan({ orgId }, found);
+        if (plan.theme === undefined && Object.keys(plan.arrangement).length === 0)
+            return plan.result;
+        const stored = await readOrgSettings(this.db.db, orgId);
+        await this.orgSettings.update(orgId, {
+            ...(plan.theme !== undefined && {
+                theme: { id: plan.theme, personal: stored.theme?.personal ?? "allowed" },
+            }),
+            ...(Object.keys(plan.arrangement).length > 0 && { uiArrangement: plan.arrangement }),
+        }, actor.accountId, actor.tokenId, { ...actor.auditDetail, appearance: { itemId: found.id, plugin: found.name } });
+        return plan.result;
+    }
+    /**
+     * What applying `found` at `level` changes, from the stored settings (no writes): the level's
+     * own, and at org level the platform's it follows where it stores nothing.
+     */
+    async plan(level, found) {
+        const { suggestion } = found;
+        const [platformTheme, platformArrangement] = await Promise.all([
+            readUiTheme(this.db.db).then((t) => t.id),
+            readUiArrangement(this.db.db),
+        ]);
+        const org = "orgId" in level ? await readOrgSettings(this.db.db, level.orgId) : null;
+        // the theme in effect: an org without its own theme (id null) follows the platform default,
+        // which renders only while it is eligible (else the org sees the built-in, as ThemesService
+        // resolves it)
+        const orgTheme = org === null ? undefined : (org.theme?.id ?? null);
+        const themeFollows = orgTheme === null;
+        const followed = themeFollows && platformTheme !== null
+            ? (await eligiblePlatformDefault(this.db.db, platformTheme)) !== null
+                ? platformTheme
+                : null
+            : platformTheme;
+        const themeInEffect = orgTheme ?? followed;
+        /** The `use` in effect for a single slot, and whether an org follows the platform's. */
+        const inEffect = (slot) => {
+            if (org === null)
+                return { use: useOf(platformArrangement[slot]) };
+            const own = org.uiArrangement?.[slot];
+            return own !== undefined
+                ? { use: useOf(own), follows: false }
+                : { use: useOf(platformArrangement[slot]), follows: true };
+        };
+        const follows = (f) => (f === undefined ? {} : { followsPlatform: f });
+        const result = { theme: null, replacements: [], skipped: [] };
+        const plan = { result, arrangement: {} };
+        if (suggestion.theme !== undefined) {
+            const row = await this.db
+                .selectFrom("platform_themes")
+                .select("id")
+                .where("catalog_item_id", "=", found.id)
+                .where("name", "=", suggestion.theme)
+                .where("deleted_at", "is", null)
+                .executeTakeFirst();
+            if (!row) {
+                throw themeNotAvailable(suggestion.theme, "orgId" in level ? "in this organization" : "as the platform default");
+            }
+            if (row.id !== themeInEffect) {
+                plan.theme = row.id;
+                result.theme = {
+                    from: themeInEffect,
+                    to: row.id,
+                    ...follows(org === null ? undefined : themeFollows),
+                };
+            }
+        }
+        // in plugin.json order (`suggestions` restores it from `appearance_order`)
+        const entries = Object.entries(suggestion.replacements ?? {});
+        if (entries.length === 0)
+            return plan;
+        const enabled = "orgId" in level ? await this.host.enabledPlugins(level.orgId) : null;
+        const loaded = this.host
+            .uiContributions()
+            .filter((c) => c.plugin === found.name &&
+            c.contribution.aliasOf === undefined &&
+            (enabled === null || enabled.has(c.plugin)));
+        const arrangeable = "orgId" in level ? ORG_ARRANGEABLE : UI_ARRANGEABLE_SLOTS;
+        const planned = new Set();
+        for (const [ref, id] of entries) {
+            const parsed = parseSlotRef(ref);
+            const known = parsed === null ? undefined : uiSlot(parsed.id);
+            if (parsed === null || known === undefined || parsed.version > known.version) {
+                result.skipped.push({ what: ref, reason: "unknown-slot" });
+                continue;
+            }
+            const slot = known.id;
+            // a second ref to one slot (`shell.brand` and `shell.brand@1`; the SDK refuses it at parse)
+            if (known.cardinality !== "single" || !arrangeable.includes(slot) || planned.has(slot)) {
+                result.skipped.push({ what: ref, reason: "not-eligible" });
+                continue;
+            }
+            const c = loaded.find((l) => l.slot.id === slot && l.contribution.id === id);
+            if (c === undefined) {
+                result.skipped.push({ what: ref, reason: "not-available" });
+                continue;
+            }
+            if (c.contribution.kind !== "component") {
+                result.skipped.push({ what: ref, reason: "not-eligible" });
+                continue;
+            }
+            planned.add(slot);
+            const key = `${found.name}/${id}`;
+            const now = inEffect(slot);
+            if (now.use === key)
+                continue;
+            plan.arrangement[slot] = { use: key };
+            result.replacements.push({ slot, from: now.use, to: key, ...follows(now.follows) });
+        }
+        return plan;
+    }
+};
+__decorate([
+    Transactional()
+], AppearanceService.prototype, "applyPlatform", null);
+__decorate([
+    Transactional()
+], AppearanceService.prototype, "applyOrg", null);
+AppearanceService = __decorate([
+    Injectable(),
+    __param(0, Inject(KernelDb)),
+    __param(1, Inject(TransactionHost)),
+    __param(2, Inject(SettingsService)),
+    __param(3, Inject(OrgSettingsService)),
+    __param(4, Inject(SuperAdminLock)),
+    __param(5, Inject(OrgLock)),
+    __param(6, Inject(ExtensionHost))
+], AppearanceService);
+export { AppearanceService };
+/**
+ * The suggested appearance action: its own module, since it writes through the org settings
+ * writer (`OrgsModule`, which imports `CatalogModule`) and the deployment settings writer.
+ */
+let AppearanceModule = class AppearanceModule {
+};
+AppearanceModule = __decorate([
+    Module({
+        imports: [IdentityModule, OrgsModule, SuperAdminLockModule, OrgLockModule, ExtensionsModule],
+        providers: [AppearanceService],
+        exports: [AppearanceService],
+    })
+], AppearanceModule);
+export { AppearanceModule };