@cat-factory/app 0.225.0 → 0.227.0

package/app/components/board/StepExecutionHistory.vue

@@ -22,22 +22,18 @@ type Entry =
 // clock-fallback `occurredAt`).
 const entries = computed<Entry[]>(() =>
   [
-    ...props.failures.map(
-      (failure, i): Entry => ({
-        kind: 'failure',
-        key: `failure-${i}`,
-        occurredAt: failure.occurredAt,
-        failure,
-      }),
-    ),
-    ...props.outputs.map(
-      (output, i): Entry => ({
-        kind: 'success',
-        key: `success-${i}`,
-        occurredAt: output.occurredAt,
-        output,
-      }),
-    ),
+    ...props.failures.map((failure, i): Entry => ({
+      kind: 'failure',
+      key: `failure-${i}`,
+      occurredAt: failure.occurredAt,
+      failure,
+    })),
+    ...props.outputs.map((output, i): Entry => ({
+      kind: 'success',
+      key: `success-${i}`,
+      occurredAt: output.occurredAt,
+      output,
+    })),
   ].sort((a, b) => b.occurredAt - a.occurredAt),
 )
 </script>

package/app/components/panels/MergerResultView.vue

@@ -71,6 +71,7 @@ const REASON_KEYS: Record<MergeDecision['reason'], string> = {
   class_auto_merge: 'panels.mergerResult.reason.class_auto_merge',
   class_requires_review: 'panels.mergerResult.reason.class_requires_review',
   role_requires_review: 'panels.mergerResult.reason.role_requires_review',
+  submission_not_allowed: 'panels.mergerResult.reason.submission_not_allowed',
   dry_run: 'panels.mergerResult.reason.dry_run',
 }
 const OUTCOME_KEYS: Record<MergeDecision['outcome'], string> = {
@@ -152,6 +153,12 @@ const reasonText = computed(() => {
   return t(REASON_KEYS[d.reason], {
     preset: d.thresholds.presetName,
     axes: axisLabels,
+    // The classes the initiator's role MAY land, so the refusal names what the remedy is
+    // measured against. Empty is a real policy (that role lands nothing) and reads as such
+    // through its own translated phrase rather than as a blank in the middle of a sentence.
+    classes: d.thresholds.submissionClasses?.length
+      ? d.thresholds.submissionClasses.map((c) => t(CLASS_KEYS[c])).join(', ')
+      : t('panels.mergerResult.noSubmittableClasses'),
     // Never blank: a role-scoped reason is only ever produced for a run that pinned one, and the
     // fallback keeps the sentence readable rather than leaving a hole if that ever changes.
     role: d.thresholds.initiatorRole

package/app/components/riskPolicy/RiskPolicyPicker.logic.spec.ts

@@ -1,6 +1,9 @@
 import { describe, expect, it } from 'vitest'
 import type { RiskPolicy } from '~/types/merge'
-import { resolveRiskPolicyPicker } from '~/components/riskPolicy/RiskPolicyPicker.logic'
+import {
+  refusedRiskPolicySelections,
+  resolveRiskPolicyPicker,
+} from '~/components/riskPolicy/RiskPolicyPicker.logic'
 
 // The resolver reads ids only, so the fixture carries just enough to be identifiable.
 const policy = (id: string, name: string) => ({ id, name }) as unknown as RiskPolicy
@@ -73,3 +76,60 @@ describe('resolveRiskPolicyPicker', () => {
     expect(state).toEqual({ policy: null, viaWorkspaceDefault: false })
   })
 })
+
+describe('refusedRiskPolicySelections', () => {
+  const rolePolicy = (id: string, over: Partial<RiskPolicy>) =>
+    ({ id, name: id, classRules: {}, classRulesByRole: {}, dryRunRoles: [], ...over }) as RiskPolicy
+
+  const sandboxed = rolePolicy('mp_sandboxed', { dryRunRoles: ['member'] })
+  const open = rolePolicy('mp_open', {})
+  const member = { role: 'member' as const, managesPolicy: false }
+
+  it('marks the rows a member may not move a sandboxed task to', () => {
+    // The picker must not offer what the backend refuses, including the "workspace default" row,
+    // which is a real policy (here: the open one) and not the absence of a choice.
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: open,
+      modelValue: 'mp_sandboxed',
+      actor: member,
+    })
+    expect(refused.get('mp_open')).toBe('relaxes_role_sandbox')
+    expect(refused.get('')).toBe('relaxes_role_sandbox')
+    expect(refused.has('mp_sandboxed')).toBe(false) // the row already selected
+  })
+
+  it('judges a task that picked nothing against the workspace default, as the engine does', () => {
+    // The create-form shape: nothing selected yet, so the policy being moved AWAY from is the one
+    // the task would have been governed by.
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: sandboxed,
+      modelValue: '',
+      actor: member,
+    })
+    expect(refused.get('mp_open')).toBe('relaxes_role_sandbox')
+    expect(refused.has('mp_sandboxed')).toBe(false)
+  })
+
+  it('refuses nothing to an editor who manages the policy library', () => {
+    const refused = refusedRiskPolicySelections({
+      options: [sandboxed, open],
+      defaultPolicy: open,
+      modelValue: 'mp_sandboxed',
+      actor: { role: 'admin', managesPolicy: true },
+    })
+    expect(refused.size).toBe(0)
+  })
+
+  it('refuses nothing between policies that treat every initiator alike', () => {
+    // Every built-in ships with an empty role layer, so the common case offers the whole library.
+    const refused = refusedRiskPolicySelections({
+      options: [open, rolePolicy('mp_other', {})],
+      defaultPolicy: open,
+      modelValue: 'mp_open',
+      actor: member,
+    })
+    expect(refused.size).toBe(0)
+  })
+})

package/app/components/riskPolicy/RiskPolicyPicker.logic.ts

@@ -6,6 +6,11 @@
 // riskPolicies store's `resolve()` falls back to the workspace default for both an empty id
 // and a dangling one; this mirrors that, so the picker can never tell the user "no risk policy
 // configured" about a task the default is quietly governing.
+import {
+  refuseRiskPolicySelection,
+  type BlockEditActor,
+  type RiskPolicySelectionRefusal,
+} from '@cat-factory/contracts'
 import type { RiskPolicy } from '~/types/merge'
 
 export interface RiskPolicyPickerState {
@@ -45,3 +50,38 @@ export function resolveRiskPolicyPicker(input: RiskPolicyPickerInput): RiskPolic
   if (named) return { policy: named, viaWorkspaceDefault: false }
   return { policy: input.defaultPolicy, viaWorkspaceDefault: !!input.defaultPolicy }
 }
+
+/**
+ * Which of the offered policies this user may not move THIS task to, keyed by option id (`''`
+ * for the "workspace default" row), with the reason.
+ *
+ * A task's policy decides whether its runs are sandboxed for the initiator's role and how their
+ * auto-merge is narrowed, so the backend refuses a selection that would relax what the selector's
+ * own role is held to (ADR 0037). The picker applies the SAME contracts rule rather than offering
+ * a row and handing back a 403: an authoring surface that offers what the engine discards is
+ * telling someone they made a choice they did not make.
+ *
+ * The policy being moved AWAY from is resolved exactly as the engine resolves it: the named
+ * option, else the workspace default. That is what makes the same call correct on the create form
+ * (nothing picked yet, so the default is what would have governed the task) and in the inspector.
+ */
+export function refusedRiskPolicySelections(input: {
+  options: readonly RiskPolicy[]
+  defaultPolicy: RiskPolicy | null
+  modelValue: string
+  actor: BlockEditActor
+}): Map<string, RiskPolicySelectionRefusal> {
+  const refusals = new Map<string, RiskPolicySelectionRefusal>()
+  const from =
+    (input.modelValue ? input.options.find((p) => p.id === input.modelValue) : undefined) ??
+    input.defaultPolicy
+  if (!from) return refusals
+  const judge = (id: string, to: RiskPolicy | null) => {
+    if (!to) return
+    const refusal = refuseRiskPolicySelection({ from, to, actor: input.actor })
+    if (refusal) refusals.set(id, refusal)
+  }
+  judge('', input.defaultPolicy)
+  for (const policy of input.options) judge(policy.id, policy)
+  return refusals
+}

package/app/components/riskPolicy/RiskPolicyPicker.vue

@@ -14,7 +14,10 @@
 import { computed, ref } from 'vue'
 import type { RiskPolicy } from '~/types/merge'
 import RiskPolicyPreview from '~/components/riskPolicy/RiskPolicyPreview.vue'
-import { resolveRiskPolicyPicker } from '~/components/riskPolicy/RiskPolicyPicker.logic'
+import {
+  refusedRiskPolicySelections,
+  resolveRiskPolicyPicker,
+} from '~/components/riskPolicy/RiskPolicyPicker.logic'
 
 const props = withDefaults(
   defineProps<{
@@ -37,6 +40,7 @@ const props = withDefaults(
 
 const emit = defineEmits<{ 'update:modelValue': [string] }>()
 const { t } = useI18n()
+const access = useWorkspaceAccess()
 
 const open = ref(false)
 // The row the pointer or the keyboard is currently on, driving the right-column preview.
@@ -56,6 +60,39 @@ const preview = computed(() =>
   }),
 )
 
+/**
+ * The policies this user may not move THIS task to, and why (ADR 0037): a selection may not
+ * relax what the selector's own role is held to, and the backend refuses one that does. Offering
+ * the row anyway would be telling someone they made a choice the engine then discards.
+ *
+ * Empty on every workspace whose policies treat each initiator alike (which is every built-in),
+ * and always empty for someone holding `settings.manage`, who owns the library.
+ */
+const refused = computed(() =>
+  refusedRiskPolicySelections({
+    options: props.options,
+    defaultPolicy: props.defaultPolicy,
+    modelValue: props.modelValue,
+    actor: { role: access.role.value, managesPolicy: access.canManageSettings.value },
+  }),
+)
+
+/** The reason the previewed row is refused, if it is: the pane explains what the row cannot. */
+const previewRefusal = computed(() => refused.value.get(activeId.value ?? props.modelValue))
+
+/**
+ * The same reason as a tooltip on the row itself, `undefined` when the row is selectable.
+ *
+ * A refused row is `aria-disabled`, NOT `disabled`: a disabled button is unfocusable, so keyboard
+ * users could never land on it, and landing on it is precisely what puts the reason in the detail
+ * pane (the `@focus` handler below drives the preview). Refusing the click is `choose`'s job, so
+ * the row stays reachable by both routes and explains itself on both.
+ */
+function refusalText(id: string): string | undefined {
+  const refusal = refused.value.get(id)
+  return refusal ? t(`riskPolicy.picker.refused.${refusal}`) : undefined
+}
+
 /**
  * Tabbing BETWEEN two rows fires `focusout` on the one being left, so only focus leaving the
  * panel altogether may drop the preview back to the selection.
@@ -68,6 +105,7 @@ function onPanelFocusOut(event: FocusEvent) {
 }
 
 function choose(id: string) {
+  if (refused.value.has(id)) return
   emit('update:modelValue', id)
   open.value = false
 }
@@ -101,14 +139,22 @@ function choose(id: string) {
           <li>
             <button
               type="button"
-              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm hover:bg-slate-800/60"
-              :class="modelValue ? 'text-slate-300' : 'text-slate-100'"
+              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm"
+              :class="[
+                refused.has('') ? 'cursor-not-allowed opacity-50' : 'hover:bg-slate-800/60',
+                modelValue ? 'text-slate-300' : 'text-slate-100',
+              ]"
+              :aria-disabled="refused.has('')"
+              :title="refusalText('')"
               data-testid="risk-policy-option-none"
               @mouseenter="activeId = ''"
               @focus="activeId = ''"
               @click="choose('')"
             >
-              <UIcon name="i-lucide-rotate-ccw" class="h-4 w-4 shrink-0 text-slate-400" />
+              <UIcon
+                :name="refused.has('') ? 'i-lucide-lock' : 'i-lucide-rotate-ccw'"
+                class="h-4 w-4 shrink-0 text-slate-400"
+              />
               <span class="flex-1 truncate">{{ noneLabel }}</span>
               <UIcon
                 v-if="!modelValue"
@@ -120,14 +166,22 @@ function choose(id: string) {
           <li v-for="p in options" :key="p.id">
             <button
               type="button"
-              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm hover:bg-slate-800/60"
-              :class="modelValue === p.id ? 'text-slate-100' : 'text-slate-300'"
+              class="flex w-full items-center gap-2 rounded px-2 py-1.5 text-start text-sm"
+              :class="[
+                refused.has(p.id) ? 'cursor-not-allowed opacity-50' : 'hover:bg-slate-800/60',
+                modelValue === p.id ? 'text-slate-100' : 'text-slate-300',
+              ]"
+              :aria-disabled="refused.has(p.id)"
+              :title="refusalText(p.id)"
               :data-testid="`risk-policy-option-${p.id}`"
               @mouseenter="activeId = p.id"
               @focus="activeId = p.id"
               @click="choose(p.id)"
             >
-              <UIcon name="i-lucide-git-merge" class="h-4 w-4 shrink-0 text-slate-400" />
+              <UIcon
+                :name="refused.has(p.id) ? 'i-lucide-lock' : 'i-lucide-git-merge'"
+                class="h-4 w-4 shrink-0 text-slate-400"
+              />
               <span class="flex-1 truncate">{{ p.name }}</span>
               <UIcon
                 v-if="modelValue === p.id"
@@ -141,6 +195,13 @@ function choose(id: string) {
         <!-- right: what the active (or selected) policy actually does -->
         <div class="w-1/2 overflow-y-auto p-3">
           <template v-if="preview.policy">
+            <p
+              v-if="previewRefusal"
+              class="mb-2 text-[11px] leading-snug text-amber-400"
+              data-testid="risk-policy-refusal"
+            >
+              {{ t(`riskPolicy.picker.refused.${previewRefusal}`) }}
+            </p>
             <p
               v-if="preview.viaWorkspaceDefault"
               class="mb-2 text-[11px] leading-snug text-slate-500"

package/app/components/riskPolicy/RiskPolicyPreview.vue

@@ -23,11 +23,12 @@ const ROLE_LABEL: Record<WorkspaceRole, () => string> = {
   viewer: () => t('merge.role.viewer'),
 }
 const roleLayer = computed(() => {
-  const { sandboxed, narrowed } = rolePolicySummary(props.policy)
+  const { sandboxed, narrowed, scoped } = rolePolicySummary(props.policy)
   return {
     sandboxed: sandboxed.map((r) => ROLE_LABEL[r]()).join(', '),
     narrowed: narrowed.map((r) => ROLE_LABEL[r]()).join(', '),
-    any: sandboxed.length > 0 || narrowed.length > 0,
+    scoped: scoped.map((r) => ROLE_LABEL[r]()).join(', '),
+    any: sandboxed.length > 0 || narrowed.length > 0 || scoped.length > 0,
   }
 })
 
@@ -94,6 +95,9 @@ const ceilings = computed(() =>
       <p v-if="roleLayer.sandboxed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleSandboxed', { roles: roleLayer.sandboxed }) }}
       </p>
+      <p v-if="roleLayer.scoped" class="text-[12px] leading-snug text-slate-400">
+        {{ t('riskPolicy.preview.roleScoped', { roles: roleLayer.scoped }) }}
+      </p>
       <p v-if="roleLayer.narrowed" class="text-[12px] leading-snug text-slate-400">
         {{ t('riskPolicy.preview.roleNarrowed', { roles: roleLayer.narrowed }) }}
       </p>

package/app/components/settings/MergeRolePolicyEditor.logic.spec.ts

@@ -1,13 +1,17 @@
 import { describe, expect, it } from 'vitest'
-import { MERGE_CLASS_RULES } from '@cat-factory/contracts'
-import type { ClassRulesByRole, MergeClassRules } from '~/types/merge'
+import { MERGE_CLASS_RULES, RULEABLE_CHANGE_CLASSES } from '@cat-factory/contracts'
+import type { ClassRulesByRole, MergeClassRules, SubmissionClassesByRole } from '~/types/merge'
 import {
   INHERIT_RULE,
   narrowingOptionsFor,
   roleClassRuleRows,
   roleNarrowedCount,
+  roleSubmissionRows,
+  roleSubmissionScoped,
   setRoleClassRule,
+  setRoleSubmissionScoped,
   toggleDryRunRole,
+  toggleSubmissionClass,
 } from '~/components/settings/MergeRolePolicyEditor.logic'
 
 describe('narrowingOptionsFor', () => {
@@ -144,3 +148,62 @@ describe('roleNarrowedCount', () => {
     expect(roleNarrowedCount({ docs: 'never', source: 'never' })).toBe(2)
   })
 })
+
+// The submission allowlist's editing shape turns on one distinction the wire contract makes and a
+// tick-box grid cannot render on its own: an ABSENT entry (unrestricted) and an EMPTY list (lands
+// nothing) are different policies. Every case below is about keeping those two apart.
+describe('roleSubmissionScoped', () => {
+  it('reads an EMPTY allowlist as scoped, not as the unrestricted default', () => {
+    expect(roleSubmissionScoped({ member: [] }, 'member')).toBe(true)
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'member')).toBe(true)
+  })
+
+  it('reads a role with no entry as unrestricted', () => {
+    expect(roleSubmissionScoped({ member: ['docs'] }, 'admin')).toBe(false)
+    expect(roleSubmissionScoped({}, 'member')).toBe(false)
+  })
+})
+
+describe('roleSubmissionRows', () => {
+  it('renders one row per ruleable class, in the shared order, ticked by membership', () => {
+    const rows = roleSubmissionRows(['source', 'docs'])
+    expect(rows.map((r) => r.changeClass)).toEqual([...RULEABLE_CHANGE_CLASSES])
+    expect(rows.filter((r) => r.allowed).map((r) => r.changeClass)).toEqual(['docs', 'source'])
+  })
+})
+
+describe('setRoleSubmissionScoped', () => {
+  // Turning the switch ON must not silently impose a policy nobody clicked: seeding today's
+  // landable classes leaves the role exactly where it was, and the operator subtracts from there.
+  it('seeds every class when scoping is turned on', () => {
+    expect(setRoleSubmissionScoped({}, 'member', true).member).toEqual([...RULEABLE_CHANGE_CLASSES])
+  })
+
+  it('removes the entry entirely when scoping is turned off', () => {
+    const byRole: SubmissionClassesByRole = { member: [], admin: ['docs'] }
+    const next = setRoleSubmissionScoped(byRole, 'member', false)
+    expect('member' in next).toBe(false)
+    expect(next.admin).toEqual(['docs'])
+  })
+})
+
+describe('toggleSubmissionClass', () => {
+  it('adds and removes one class, keeping the shared class order', () => {
+    const ticked = toggleSubmissionClass({ member: ['source'] }, 'member', 'docs', true)
+    expect(ticked.member).toEqual(['docs', 'source'])
+    expect(toggleSubmissionClass(ticked, 'member', 'source', false).member).toEqual(['docs'])
+  })
+
+  // Unticking the last class is the policy "this role lands nothing", so it must NOT prune back
+  // to an absent entry, which would silently invert the click into "unrestricted".
+  it('leaves an EMPTY list rather than un-scoping the role', () => {
+    const next = toggleSubmissionClass({ member: ['docs'] }, 'member', 'docs', false)
+    expect(next.member).toEqual([])
+    expect(roleSubmissionScoped(next, 'member')).toBe(true)
+  })
+
+  it('leaves other roles untouched', () => {
+    const next = toggleSubmissionClass({ admin: ['docs'] }, 'member', 'docs', true)
+    expect(next.admin).toEqual(['docs'])
+  })
+})

package/app/components/settings/MergeRolePolicyEditor.logic.ts

@@ -23,6 +23,7 @@ import type {
   MergeClassRule,
   MergeClassRules,
   RuleableChangeClass,
+  SubmissionClassesByRole,
   WorkspaceRole,
 } from '~/types/merge'
 
@@ -131,3 +132,74 @@ export function toggleDryRunRole(
 export function roleNarrowedCount(entry: MergeClassRules | undefined): number {
   return entry ? Object.keys(entry).length : 0
 }
+
+// ---------------------------------------------------------------------------
+// The per-role SUBMISSION ALLOWLIST: which change classes a role may LAND at all. A third
+// setting rather than a fourth rule value, because it answers a different question: a class rule
+// decides how much review landing takes, where this decides whether the platform lands it at all,
+// and it is refused at BOTH exits, the manual merge included.
+//
+// The editing shape follows the wire shape's own distinction: an ABSENT entry is unrestricted
+// and an EMPTY list is "this role lands nothing", which are different policies. So the row is a
+// switch (scoped / not) plus a set of tick boxes, never a set of tick boxes alone. With tick
+// boxes alone, "unrestricted" and "lands nothing" would be the same rendered state.
+// ---------------------------------------------------------------------------
+
+/** One class's tick box inside one role's allowlist. */
+export interface RoleSubmissionRow {
+  changeClass: RuleableChangeClass
+  allowed: boolean
+}
+
+/** Whether this role carries an allowlist at all (as opposed to being unrestricted). */
+export function roleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+): boolean {
+  return byRole[role] !== undefined
+}
+
+/** One role's tick boxes, in the shared class order. Empty rows for an unscoped role. */
+export function roleSubmissionRows(entry: readonly RuleableChangeClass[]): RoleSubmissionRow[] {
+  return RULEABLE_CHANGE_CLASSES.map((changeClass) => ({
+    changeClass,
+    allowed: entry.includes(changeClass),
+  }))
+}
+
+/**
+ * Turn the allowlist on or off for a role. Turning it ON seeds the classes that are landable
+ * TODAY, which is behaviourally where the role already was, so the operator subtracts from a
+ * known state rather than starting from a policy ("lands nothing") they did not ask for.
+ *
+ * That seeded list is NOT the identity, and deliberately: from here on the role is scoped, so a
+ * class the vocabulary gains in a later release falls outside it. Opting in is what earns that.
+ */
+export function setRoleSubmissionScoped(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  scoped: boolean,
+): SubmissionClassesByRole {
+  const next: SubmissionClassesByRole = { ...byRole }
+  if (scoped) next[role] = [...RULEABLE_CHANGE_CLASSES]
+  else delete next[role]
+  return next
+}
+
+/**
+ * Tick or untick one class for a role that is already scoped, keeping the shared class order so
+ * two presets carrying the same policy carry the same array. Unticking the last class leaves an
+ * EMPTY list rather than removing the entry: that is the real policy "this role lands nothing",
+ * and silently promoting it to unrestricted would be the exact inversion of what was clicked.
+ */
+export function toggleSubmissionClass(
+  byRole: SubmissionClassesByRole,
+  role: WorkspaceRole,
+  changeClass: RuleableChangeClass,
+  allowed: boolean,
+): SubmissionClassesByRole {
+  const current = new Set(byRole[role] ?? [])
+  if (allowed) current.add(changeClass)
+  else current.delete(changeClass)
+  return { ...byRole, [role]: RULEABLE_CHANGE_CLASSES.filter((c) => current.has(c)) }
+}