@franzzemen/brokenstock-shell 0.3.2 → 0.4.0

package/fesm2022/franzzemen-brokenstock-shell.mjs

@@ -84,9 +84,6 @@ class AuthenticationService {
         ...(ngDevMode ? [{ debugName: "authenticating" }] : /* istanbul ignore next */ []));
         this.userSession = signal(undefined, /* @ts-ignore */
         ...(ngDevMode ? [{ debugName: "userSession" }] : /* istanbul ignore next */ []));
-        /** Plan-feature grants for the current session. Absent key = not granted. */
-        this.features = signal({}, /* @ts-ignore */
-        ...(ngDevMode ? [{ debugName: "features" }] : /* istanbul ignore next */ []));
         this.conflictSessions = signal(undefined, /* @ts-ignore */
         ...(ngDevMode ? [{ debugName: "conflictSessions" }] : /* istanbul ignore next */ []));
         this.pendingCredentials = signal(undefined, /* @ts-ignore */
@@ -108,36 +105,19 @@ class AuthenticationService {
         return this.#auth;
     }
     // Legacy hasRole/hasAnyRole removed (legacy-authz-teardown): sessions carry no
-    // roles, and every gate migrated to hasFeature (commerce) with the BE enforcing
-    // the security axis.
-    /**
-     * Is this BOOLEAN feature granted and on? e.g. `hasFeature('real-time')`.
-     *
-     * Strictly `=== true`, matching the back end's `hasFeature`. It used to be
-     * `!!this.features()[slug]`, which is NOT a valid entitlement test now that `0` is
-     * a real state: `Features` has FOUR states and truthiness collapses two of them.
-     *
-     *   - key absent → not granted (an upsell)
-     *   - `0`        → granted, ZERO allowance (a limit — a different product, and
-     *                  FALSY, so `!!` reported it as "not in your plan")
-     *   - `true`     → granted, unlimited
-     *   - `number`>0 → granted with that limit
-     *
-     * It also matters in the other direction: `!!` passed on any positive number, so a
-     * boolean slug misconfigured with a numeric value would show the affordance while
-     * the BE — which requires exactly `true` — refused every call behind it. The user
-     * sees the door and cannot open it.
-     *
-     * For QUANTITY features use {@link featureValue} and compare the limit yourself;
-     * this returns false for every numeric grant, including a valid one.
-     */
-    hasFeature(slug) {
-        return this.authenticated() && this.features()[slug] === true;
-    }
-    /** Raw plan-feature value (`true` for boolean grants, the numeric limit for quantity features, else undefined). */
-    featureValue(slug) {
-        return this.features()[slug];
-    }
+    // roles, and every gate moved to hasFeature (commerce) with the BE enforcing the
+    // security axis.
+    //
+    // `hasFeature` and `featureValue` are now gone too, with all entitlement gating
+    // (commercial-surface-decommission.prd.md D3). BrokenStock is not a commercial
+    // product; there is nothing to be entitled to. Per P1 every capability they hid is
+    // unconditionally available, so the callers did not migrate to some other check —
+    // they simply stopped asking. The session's `features` map is no longer read here at
+    // all, which is what makes it safe for the back end to stop populating it (E9).
+    //
+    // The security axis is unaffected and still enforced server-side: this app cannot see
+    // security roles by design (`@franzzemen/endpoint-identity` is deliberately absent
+    // from its dependency graph).
     refresh() {
         if (this.#refreshing) {
             return this.#refreshing;
@@ -195,7 +175,6 @@ class AuthenticationService {
                         // @ts-ignore
                         delete authResponse.session.token;
                         this.userSession.set(authResponse.session);
-                        this.features.set(authResponse.features ?? {});
                         const auth = response.headers.get(HttpHeader.Authorization);
                         if (!auth || !BEARER_TOKEN_REGEX.test(auth)) {
                             reject('Unable to login');
@@ -253,7 +232,6 @@ class AuthenticationService {
             const body = await response.json();
             this.#auth = auth;
             this.userSession.set(body.session);
-            this.features.set(body.features ?? {});
             return true;
         }
         catch {
@@ -263,7 +241,6 @@ class AuthenticationService {
     #clearSession() {
         this.authenticated.set(false);
         this.userSession.set(undefined);
-        this.features.set({});
         this.conflictSessions.set(undefined);
         this.pendingCredentials.set(undefined);
         this.#auth = 'Bearer ..';