@crombolo/core 0.13.2 → 0.14.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crombolo/core",
-  "version": "0.13.2",
+  "version": "0.14.4",
   "description": "Domain model, entity keys and shared contracts for crombolo. No I/O.",
   "license": "MIT",
   "author": "Crombolo",

package/src/content-types.ts

@@ -36,8 +36,18 @@ export interface PropertyTypeModel {
    * unchanged on a save, which is what a backoffice save sends.
    */
   searchable?: boolean
+  /**
+   * How much the property counts in site search, or false to leave it out.
+   * Absent means unchanged on a save, as for `searchable`.
+   */
+  siteSearch?: SiteSearchLevel | false
 }
 
+/** A property's weight in site search; the page name always ranks above all three. */
+export type SiteSearchLevel = 'high' | 'normal' | 'low'
+
+export const SITE_SEARCH_LEVELS: readonly SiteSearchLevel[] = ['high', 'normal', 'low']
+
 export interface PropertyGroupModel {
   key: string
   name: string | null
@@ -89,6 +99,8 @@ export interface ContentTypeAggregate {
   parentKey: string | null
   sinceVersion?: string | null
   pending?: { version: string; revision: string } | null
+  /** False leaves every page of the type out of site search. Absent means unchanged on a save. */
+  siteSearch?: boolean
 }
 
 /**

package/src/index.ts

@@ -10,6 +10,7 @@ export * from './paging.ts'
 export * from './permissions.ts'
 export * from './problem-details.ts'
 export * from './property-values.ts'
+export * from './public-access.ts'
 export * from './return-urls.ts'
 export * from './sections.ts'
 export * from './uploads.ts'

package/src/permissions.ts

@@ -54,6 +54,19 @@ export const FormPermissions = {
 
 export type FormVerb = (typeof FormPermissions)[keyof typeof FormPermissions]
 
+/**
+ * Sending and receiving whole sites through the remote protocol (story 107).
+ * A full pull carries people, and a push to a protected environment replaces
+ * something people rely on, so each is a grant of its own.
+ */
+export const RemotePermissions = {
+  Pull: 'Crombolo.Remote.Pull',
+  PullFull: 'Crombolo.Remote.PullFull',
+  Push: 'Crombolo.Remote.Push',
+  PushProtected: 'Crombolo.Remote.PushProtected',
+} as const
+export type RemoteVerb = (typeof RemotePermissions)[keyof typeof RemotePermissions]
+
 /** The discriminator on a granular permission row. */
 export type PermissionContext = 'Document' | 'Element' | 'DocumentTypeProperty'
 

package/src/public-access.ts

@@ -0,0 +1,41 @@
+/**
+ * Members-only pages: who a protection rule lets in, and which protected
+ * branches that leaves a member — one check for rendering a page, the Delivery
+ * API and site search. The nearest protected ancestor governs, as in Umbraco.
+ */
+
+/** Who a protected page lets in: members named by user name, or in a named group. */
+export interface MemberRule {
+  memberUserNames: readonly string[]
+  memberGroupNames: readonly string[]
+}
+
+/** The member asking, by user name and the names of their groups. */
+export interface RuleMember {
+  username: string
+  groups: readonly string[]
+}
+
+/** Whether a rule lets a member in. Names and groups both match in any case. Pure. */
+export function memberMayOpen(rule: MemberRule, member: RuleMember | undefined): boolean {
+  if (!member) return false
+  const name = member.username.toLowerCase()
+  if (rule.memberUserNames.some((n) => n.toLowerCase() === name)) return true
+  const groups = new Set(member.groups.map((g) => g.toLowerCase()))
+  return rule.memberGroupNames.some((g) => groups.has(g.toLowerCase()))
+}
+
+/**
+ * The protected nodes a member may not open (`denied`) and may (`allowed`). A
+ * page is closed to them when the nearest protected node on its path is
+ * denied: a denied branch can hold an allowed one below it. Pure.
+ */
+export function branchAccess(
+  rules: ReadonlyArray<MemberRule & { nodeId: number }>,
+  member: RuleMember | undefined,
+): { denied: number[]; allowed: number[] } {
+  const denied: number[] = []
+  const allowed: number[] = []
+  for (const rule of rules) (memberMayOpen(rule, member) ? allowed : denied).push(rule.nodeId)
+  return { denied, allowed }
+}