@fuzdev/fuz_app 0.117.1 → 0.119.0

package/dist/ui/auth_state.svelte.js

@@ -35,6 +35,7 @@ import { to_error_message } from '@fuzdev/fuz_util/error.ts';
 import { create_context } from '@fuzdev/fuz_ui/context_helpers.ts';
 import { ui_fetch } from './ui_fetch.js';
 import { is_role_grant_active } from '../auth/account_schema.js';
+import { ROLE_ADMIN } from '../auth/role_schema.js';
 /**
  * Svelte context for `AuthState`.
  * Use `auth_state_context.set(state)` in the provider and `auth_state_context.get()` to access.
@@ -47,10 +48,36 @@ export class AuthState {
     account = $state.raw(null);
     actor = $state.raw(null);
     role_grants = $state.raw([]);
+    /**
+     * The live subset of `role_grants`, at every scope. Liveness is judged when
+     * `role_grants` is assigned, so a grant that expires while the page stays
+     * open reads as active until the next `check_session`.
+     */
     active_role_grants = $derived(this.role_grants.filter((p) => is_role_grant_active(p)));
-    roles = $derived(this.active_role_grants.map((p) => p.role));
+    /**
+     * The roles held globally — the role of each active grant whose `scope_id`
+     * is `null`. A grant scoped to one resource is not in here: it confers its
+     * role on that resource only, and a scoped grant of a builtin role confers
+     * nothing, so a role gate reads the global grant. Scoped grants are read
+     * from `active_role_grants`, by `scope_id`.
+     *
+     * Shapes the UI only — the server re-checks every request.
+     */
+    global_roles = $derived(new Set(this.active_role_grants.filter((p) => p.scope_id === null).map((p) => p.role)));
+    /** True for an active global `admin` grant, the rule the server's admin gates apply. */
+    is_admin = $derived(this.global_roles.has(ROLE_ADMIN));
     /** True when bootstrap is available (no accounts exist yet). */
     needs_bootstrap = $state.raw(false);
+    /**
+     * Whether the account holds an active global grant of `role` — reactive
+     * when read in a `$derived` or the template. A scoped grant doesn't count;
+     * see `global_roles`.
+     *
+     * @param role - the role to check
+     */
+    has_global_role(role) {
+        return this.global_roles.has(role);
+    }
     /**
      * Check auth state and bootstrap availability.
      *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fuzdev/fuz_app",
-  "version": "0.117.1",
+  "version": "0.119.0",
   "description": "fullstack app library",
   "glyph": "🗝",
   "logo": "logo.svg",
@@ -78,7 +78,7 @@
     "@fuzdev/fuz_css": "^0.64.0",
     "@fuzdev/fuz_ui": "^0.208.0",
     "@fuzdev/fuz_util": "^0.69.0",
-    "@fuzdev/gro": "^0.212.0",
+    "@fuzdev/gro": "^0.213.0",
     "@fuzdev/mdz": "^0.3.0",
     "@hono/node-server": "^1.19.14",
     "@hono/node-ws": "^1.3.1",