@helyx/core 0.1.17 → 0.1.19

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.1.19
+
+### Patch Changes
+
+- Updated dependencies
+  - @helyx/sdk@0.7.0
+
+## 0.1.18
+
+### Patch Changes
+
+- Add the private testing-stage Forms module contracts and runtime integration,
+  and introduce server-configurable Helyx Administrator, Moderator, dashboard
+  access, and command-permission policies with fresh Discord authorization.
+
 ## 0.1.17
 
 ### Patch Changes

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import type { HealthResult, Logger, ModuleDefinition, ModulePermissionConfiguration, PermissionActor, PermissionPolicy, ServiceAccess } from "@helyx/sdk";
+import type { HealthResult, Logger, ModuleDefinition, ModulePermissionConfiguration, PermissionActor, GuildAccessPolicy, HelyxAccessLevel, PermissionPolicy, ServiceAccess } from "@helyx/sdk";
 export type RuntimeState = "created" | "starting" | "running" | "stopping" | "stopped" | "failed";
 export interface ModuleHealth {
     id: string;
@@ -25,5 +25,26 @@ export declare class HelyxRuntime {
 }
 export declare function safeError(error: unknown): Record<string, unknown>;
 export declare function resolveCommandPermissionPolicy(configuration: ModulePermissionConfiguration, commandName: string): PermissionPolicy;
-export declare function canUseCommand(actor: PermissionActor, policy: PermissionPolicy): boolean;
+export declare function canUseCommand(actor: PermissionActor, policy: PermissionPolicy, guildAccess?: GuildAccessPolicy): boolean;
+export type HelyxAuthority = "owner" | "administrator" | "moderator" | "member";
+export declare function resolveHelyxAuthority(actor: PermissionActor, policy: GuildAccessPolicy): HelyxAuthority;
+export declare function hasHelyxAccessLevel(actor: PermissionActor, level: HelyxAccessLevel, policy?: GuildAccessPolicy): boolean;
+export declare function canAccessGuildDashboard(actor: PermissionActor, policy: GuildAccessPolicy): boolean;
+export type PermissionTargetLevel = HelyxAccessLevel | "everyone";
+export type PermissionTargetDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: "administrator_required" | "moderator_required";
+};
+export declare function canAssignPermissionTarget(actor: PermissionActor, target: PermissionTargetLevel, policy: GuildAccessPolicy): PermissionTargetDecision;
+export type PermissionMutationDenialReason = "current_policy_required" | "administrator_required" | "moderator_required" | "selected_role_too_high" | "policy_would_broaden";
+export type PermissionMutationDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: PermissionMutationDenialReason;
+};
+export declare function permissionMutationDenialMessage(reason: PermissionMutationDenialReason): string;
+export declare function canMutatePermissionPolicy(actor: PermissionActor, current: PermissionPolicy, target: PermissionPolicy, guildAccess: GuildAccessPolicy, rolePositions?: Readonly<Record<string, number>>): PermissionMutationDecision;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -155,7 +155,7 @@ function toError(error) {
 export function resolveCommandPermissionPolicy(configuration, commandName) {
     return configuration.commands[commandName] ?? configuration.module;
 }
-export function canUseCommand(actor, policy) {
+export function canUseCommand(actor, policy, guildAccess) {
     if (actor.isServerOwner || actor.isAdministrator)
         return true;
     if (policy.deniedUserIds.includes(actor.userId))
@@ -166,9 +166,112 @@ export function canUseCommand(actor, policy) {
         return false;
     if (actor.roleIds.some((roleId) => policy.allowedRoleIds.includes(roleId)))
         return true;
+    if (policy.accessLevel &&
+        hasHelyxAccessLevel(actor, policy.accessLevel, guildAccess))
+        return true;
     if (policy.requiredPermissions.length > 0 &&
         policy.requiredPermissions.every((permission) => actor.permissions.includes(permission)))
         return true;
     return policy.everyone;
 }
+export function resolveHelyxAuthority(actor, policy) {
+    if (actor.isServerOwner)
+        return "owner";
+    if (actor.isAdministrator ||
+        actor.roleIds.some((roleId) => policy.administratorRoleIds.includes(roleId)))
+        return "administrator";
+    if (actor.permissions.includes("MANAGE_GUILD") ||
+        actor.roleIds.some((roleId) => policy.moderatorRoleIds.includes(roleId)))
+        return "moderator";
+    return "member";
+}
+export function hasHelyxAccessLevel(actor, level, policy) {
+    if (actor.isServerOwner || actor.isAdministrator)
+        return true;
+    if (level === "moderator" && actor.permissions.includes("MANAGE_GUILD"))
+        return true;
+    if (!policy)
+        return false;
+    const authority = resolveHelyxAuthority(actor, policy);
+    return level === "administrator"
+        ? authority === "owner" || authority === "administrator"
+        : authority !== "member";
+}
+export function canAccessGuildDashboard(actor, policy) {
+    if (actor.isServerOwner || actor.isAdministrator)
+        return true;
+    if (actor.roleIds.some((roleId) => policy.dashboardDeniedRoleIds.includes(roleId)))
+        return false;
+    if (actor.roleIds.some((roleId) => policy.administratorRoleIds.includes(roleId)))
+        return true;
+    if (policy.dashboardModeratorsEnabled &&
+        hasHelyxAccessLevel(actor, "moderator", policy))
+        return true;
+    return actor.roleIds.some((roleId) => policy.dashboardAllowedRoleIds.includes(roleId));
+}
+export function canAssignPermissionTarget(actor, target, policy) {
+    const authority = resolveHelyxAuthority(actor, policy);
+    if (authority === "owner" || authority === "administrator")
+        return { allowed: true };
+    if (authority === "moderator")
+        return target === "everyone"
+            ? { allowed: false, reason: "administrator_required" }
+            : { allowed: true };
+    return { allowed: false, reason: "moderator_required" };
+}
+export function permissionMutationDenialMessage(reason) {
+    return {
+        current_policy_required: "You cannot edit a permission policy you are not authorised to use.",
+        administrator_required: "Only a Helyx Administrator can grant access to everyone.",
+        moderator_required: "Helyx Moderator access is required for this permission target.",
+        selected_role_too_high: "Selected roles must be below your highest Discord role.",
+        policy_would_broaden: "This change would broaden the policy beyond your authority.",
+    }[reason];
+}
+export function canMutatePermissionPolicy(actor, current, target, guildAccess, rolePositions = {}) {
+    const authority = resolveHelyxAuthority(actor, guildAccess);
+    const administrator = authority === "owner" || authority === "administrator";
+    const moderator = authority === "moderator";
+    const qualifiesForCurrent = canUseCommand(actor, current, guildAccess);
+    if (!administrator && !moderator && !qualifiesForCurrent)
+        return { allowed: false, reason: "current_policy_required" };
+    if (!administrator && moderator && !current.everyone && !qualifiesForCurrent)
+        return { allowed: false, reason: "current_policy_required" };
+    const targetLevel = permissionPolicyTarget(target);
+    if (!administrator && targetLevel === "everyone")
+        return { allowed: false, reason: "administrator_required" };
+    if (!administrator && !moderator && targetLevel !== "custom")
+        return { allowed: false, reason: "moderator_required" };
+    const currentAllowed = new Set(current.allowedRoleIds);
+    const currentDenied = new Set(current.deniedRoleIds);
+    const selectedRoleIds = [
+        ...target.allowedRoleIds.filter((roleId) => !currentAllowed.has(roleId)),
+        ...target.deniedRoleIds.filter((roleId) => !currentDenied.has(roleId)),
+    ];
+    if (selectedRoleIds.some((roleId) => {
+        const position = rolePositions[roleId];
+        return (position === undefined ||
+            actor.highestRolePosition === undefined ||
+            position >= actor.highestRolePosition);
+    }))
+        return { allowed: false, reason: "selected_role_too_high" };
+    if (!administrator && !moderator) {
+        const targetDenied = new Set(target.deniedRoleIds);
+        if (target.allowedRoleIds.some((roleId) => !currentAllowed.has(roleId)) ||
+            current.deniedRoleIds.some((roleId) => !targetDenied.has(roleId)))
+            return { allowed: false, reason: "policy_would_broaden" };
+    }
+    return { allowed: true };
+}
+function permissionPolicyTarget(policy) {
+    if (policy.everyone)
+        return "everyone";
+    if (policy.accessLevel)
+        return policy.accessLevel;
+    if (policy.requiredPermissions.includes("ADMINISTRATOR"))
+        return "administrator";
+    if (policy.requiredPermissions.includes("MANAGE_GUILD"))
+        return "moderator";
+    return "custom";
+}
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@helyx/core",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Module lifecycle and runtime registry for Helyx.",
   "keywords": [
     "helyx",
@@ -48,6 +48,6 @@
   },
   "dependencies": {
     "@helyx/module-manifest": ">=0.6.0 <0.7.0",
-    "@helyx/sdk": ">=0.6.0 <0.7.0"
+    "@helyx/sdk": ">=0.7.0 <0.8.0"
   }
 }