@cyberismo/backend 0.0.27 → 1.1.0

package/src/domain/projects/service.ts

@@ -0,0 +1,98 @@
+/**
+  Cyberismo
+  Copyright © Cyberismo Ltd and contributors 2026
+  This program is free software: you can redistribute it and/or modify it under
+  the terms of the GNU Affero General Public License version 3 as published by
+  the Free Software Foundation.
+  This program is distributed in the hope that it will be useful, but WITHOUT
+  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+  FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
+  details. You should have received a copy of the GNU Affero General Public
+  License along with this program. If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import { join } from 'node:path';
+import {
+  CommandManager,
+  Create,
+  scanForProjects,
+} from '@cyberismo/data-handler';
+import type { ProjectRegistry } from '../../project-registry.js';
+
+export interface CreateProjectParams {
+  name: string;
+  prefix: string;
+  category?: string;
+  description?: string;
+}
+
+export interface CreateProjectResult {
+  prefix: string;
+  name: string;
+  category?: string;
+  description?: string;
+}
+
+export async function createProject(
+  registry: ProjectRegistry,
+  rootPath: string,
+  params: CreateProjectParams,
+  user?: { name: string; email: string } | null,
+): Promise<CreateProjectResult> {
+  const { name, prefix, category, description } = params;
+  const projectPath = join(rootPath, prefix);
+
+  const commands = await CommandManager.createProjectWithDefaults(
+    projectPath,
+    params,
+    {
+      ...registry.options,
+      gitUser: user ?? undefined,
+    },
+  );
+
+  registry.add(prefix, commands);
+
+  return {
+    prefix,
+    name,
+    category: category || undefined,
+    description: description || undefined,
+  };
+}
+
+export interface CloneProjectResult {
+  projects: { prefix: string; name: string }[];
+  skippedDuplicates?: string[];
+}
+
+export async function cloneProject(
+  registry: ProjectRegistry,
+  rootPath: string,
+  url: string,
+): Promise<CloneProjectResult> {
+  const clonedPath = await Create.cloneProject(url, rootPath);
+  const scanned = await scanForProjects(clonedPath);
+
+  const registered: { prefix: string; name: string }[] = [];
+  const skippedDuplicates: string[] = [];
+
+  for (const project of scanned) {
+    if (registry.has(project.prefix)) {
+      skippedDuplicates.push(project.prefix);
+      continue;
+    }
+    const commands = new CommandManager(project.path, registry.options);
+    await commands.initialize();
+    registry.add(project.prefix, commands);
+    registered.push({
+      prefix: project.prefix,
+      name: project.name,
+    });
+  }
+
+  return {
+    projects: registered,
+    ...(skippedDuplicates.length > 0 && { skippedDuplicates }),
+  };
+}

package/src/domain/resources/index.ts

@@ -213,7 +213,7 @@ router.get(
 
 router.post(
   '/:prefix/:type/:identifier/operation',
-  requireRole(UserRole.Admin),
+  requireRole(UserRole.Admin, [UserRole.Connector]),
   zValidator('param', resourceParamsSchema),
   zValidator('json', updateOperationBodySchema),
   async (c) => {

package/src/domain/resources/schema.ts

@@ -25,7 +25,7 @@ export const resourceFileParamsSchema = resourceParamsSchema.extend({
 export type ResourceFileParams = z.infer<typeof resourceFileParamsSchema>;
 
 export const validateResourceParamsSchema = resourceParamsSchema.extend({
-  type: z.enum(resourceTypes.filter((type) => type !== 'calculations')),
+  type: z.enum(resourceTypes),
 });
 
 export type ValidateResourceParams = z.infer<
@@ -54,7 +54,9 @@ export const updateOperationBodySchema = z.object({
     }),
     z.object({
       name: z.literal('change'),
-      target: z.unknown(),
+      // The old value; scalar changes have none, and clients drop the key
+      // entirely when it is undefined (JSON.stringify omits undefined).
+      target: z.unknown().optional(),
       to: z.unknown(),
       mappingTable: z
         .object({

package/src/domain/resources/service.ts

@@ -532,7 +532,7 @@ export async function getWorkflowGraph(
 
 /**
  * Perform an updateOperation on a resource key.
- * This delegates to data-handler Update.applyResourceOperation.
+ * This delegates to the data-handler mutation engine.
  */
 export async function updateResourceWithOperation(
   commands: CommandManager,
@@ -542,11 +542,12 @@ export async function updateResourceWithOperation(
   const { updateKey, operation } = body;
   await commands.atomic(
     () =>
-      commands.updateCmd.applyResourceOperation(
-        resourceNameToString(resource),
+      commands.updateCmd.apply({
+        kind: 'edit',
+        target: resource,
         updateKey,
         operation,
-      ),
+      }),
     `Update ${resource.type} ${resource.identifier}`,
   );
 }

package/src/index.ts

@@ -37,13 +37,12 @@ const DEFAULT_MAX_PORT = DEFAULT_PORT + 100;
 export async function previewSite(dir: string, findPort: boolean = true) {
   const app = new Hono();
   app.use(serveStatic({ root: dir }));
-  app.get('*', (c) => {
+  app.get('*', async (c) => {
     if (c.req.path.startsWith('/api/')) {
       return c.json({ error: 'Resource not found' }, 404);
     }
-    return c.html(
-      readFile(path.join(dir, 'index.html')).then((file) => file.toString()),
-    );
+    const file = await readFile(path.join(dir, 'index.html'));
+    return c.html(file.toString());
   });
 
   let port = parseInt(process.env.PORT || DEFAULT_PORT.toString(), 10);
@@ -64,7 +63,7 @@ export async function startServer(
   authProvider: AuthProvider,
   registry: ProjectRegistry,
   findPort: boolean = true,
-  rootPath?: string,
+  multiProjectRoot?: string,
 ) {
   const useOsAssigned = process.env.CYBERISMO_E2E_OSPORT === 'true';
   let port = useOsAssigned
@@ -73,7 +72,13 @@ export async function startServer(
   if (findPort && !useOsAssigned) {
     port = await findFreePort(port, DEFAULT_MAX_PORT);
   }
-  const app = createApp(authProvider, registry, undefined, false, rootPath);
+  const app = createApp(
+    authProvider,
+    registry,
+    undefined,
+    false,
+    multiProjectRoot,
+  );
   startApp(app, port);
 }
 

package/src/main.ts

@@ -91,12 +91,6 @@ if (args.export) {
         : undefined,
   });
 } else {
-  if (projects.length === 0) {
-    console.error(
-      `No projects found in "${projectPath}". Cannot start the server without at least one project.`,
-    );
-    process.exit(1);
-  }
   const autocommit = process.env.CYBERISMO_AUTOCOMMIT === 'true';
   const registry = await ProjectRegistry.fromScannedProjects(projects, {
     autocommit,

package/src/middleware/auth.ts

@@ -24,6 +24,7 @@ declare module 'hono' {
 }
 
 const roleLevel: Record<UserRole, number> = {
+  [UserRole.Connector]: -1,
   [UserRole.Reader]: 0,
   [UserRole.Editor]: 1,
   [UserRole.Admin]: 2,
@@ -72,10 +73,15 @@ export function hasRole(c: Context, minimumRole: UserRole): boolean {
 }
 
 /**
- * Require minimum role middleware factory
- * Returns a middleware that checks if the user has at least the required role
+ * Require minimum role middleware factory.
+ * Optional exactRoles allows orthogonal roles (e.g. Connector) that bypass
+ * the hierarchy with an exact match.
+ * e.g. requireRole(Admin, [Connector]) → Admin ✓, Editor ✗, Connector ✓
  */
-export function requireRole(minimumRole: UserRole): MiddlewareHandler {
+export function requireRole(
+  minimumRole: UserRole,
+  exactRoles?: UserRole[],
+): MiddlewareHandler {
   return async (c, next) => {
     const user = c.get('user');
 
@@ -83,7 +89,7 @@ export function requireRole(minimumRole: UserRole): MiddlewareHandler {
       return c.json({ error: 'Unauthorized' }, 401);
     }
 
-    if (!hasRole(c, minimumRole)) {
+    if (!hasRole(c, minimumRole) && !exactRoles?.includes(user.role)) {
       return c.json({ error: 'Forbidden' }, 403);
     }
 

package/src/project-registry.ts

@@ -34,8 +34,13 @@ export interface ScannedProject {
 
 export class ProjectRegistry implements ProjectProvider {
   private projects: Map<string, CommandManager> = new Map();
+  readonly options: ConstructorParameters<typeof CommandManager>[1];
 
-  constructor(entries: ProjectRegistryEntry[] = []) {
+  constructor(
+    entries: ProjectRegistryEntry[] = [],
+    options?: ConstructorParameters<typeof CommandManager>[1],
+  ) {
+    this.options = options;
     for (const entry of entries) {
       this.add(entry.prefix, entry.commands);
     }
@@ -120,6 +125,6 @@ export class ProjectRegistry implements ProjectProvider {
       await commands.initialize();
       entries.push({ prefix: project.prefix, commands });
     }
-    return new ProjectRegistry(entries);
+    return new ProjectRegistry(entries, options);
   }
 }

package/src/types.ts

@@ -32,11 +32,14 @@ export interface TreeOptions {
  * - Admin: All operations including configuration
  * - Editor: Can create, edit, and manage content but not config
  * - Reader: Can only view content
+ * Orthogonal role (outside hierarchy):
+ * - Connector: Service accounts that can only create/update calculations
  */
 export enum UserRole {
   Admin = 'admin',
   Editor = 'editor',
   Reader = 'reader',
+  Connector = 'connector',
 }
 
 /**

package/dist/public/assets/architecture-7EHR7CIX-CHU1xuYF.js

@@ -1 +0,0 @@
-import"./chunk-NNHCCRGN-DlpIbxXb.js";import{x as e}from"./mermaid-parser.core-DFZGVidJ.js";export{e as createArchitectureServices};