@inf-monkeys-tech/monkeys 1.0.46 → 1.0.47

package/lib/esm/runtime/index.mjs

@@ -9836,14 +9836,13 @@ var evaluateAccess = (item, context) => {
   if (!context.sessionResolved && protectedBySession) reasons.push("session-unresolved");
   if (item.access.authenticated && !context.authenticated) reasons.push("authentication");
   const granted = new Set(context.permissionCodes);
-  const elevated = context.isKernelSuperAdmin === true || granted.has("*");
   if (item.access.permissionAllOf.some((permission) => !granted.has(permission))) {
     reasons.push("permission-all");
   }
   if (item.access.permissionAnyOf.length > 0 && !item.access.permissionAnyOf.some((permission) => granted.has(permission))) {
     reasons.push("permission-any");
   }
-  if (!elevated && item.access.requiredPermission && !granted.has(item.access.requiredPermission)) {
+  if (item.access.requiredPermission && !granted.has(item.access.requiredPermission)) {
     reasons.push("required-permission");
   }
   if (item.access.featureFlags.some((flag) => context.featureFlags[flag] !== true)) {
@@ -13309,6 +13308,13 @@ var TenantApplicationConfigSchema = z11.object({
     teamAsUser: z11.boolean().optional(),
     themeMode: z11.enum(["shadow", "border"]).optional(),
     density: z11.enum(["compact", "default", "comfortable"]).optional(),
+    statusStates: z11.object({
+      loading: z11.object({ variant: z11.enum(["spinner", "skeleton"]).optional() }).strict().optional(),
+      empty: z11.object({ variant: z11.enum(["default", "compact"]).optional() }).strict().optional(),
+      error: z11.object({ showRetry: z11.boolean().optional() }).strict().optional(),
+      permission: z11.object({ showRequestAccess: z11.boolean().optional() }).strict().optional(),
+      density: z11.enum(["compact", "default", "comfortable"]).optional()
+    }).strict().optional(),
     pageZoom: z11.number().positive().optional(),
     miniMode: z11.object({ showPreviewViewExecutionResultGrid: z11.boolean() }).strict().optional(),
     workflow: z11.object({ allowConcurrentRuns: z11.boolean() }).strict().optional(),
@@ -13747,6 +13753,97 @@ var compileWorkflowPersistenceProjection = (input) => {
     output: Object.freeze(workflow.parameters.outputs)
   });
 };
+
+// src/contracts/access.ts
+import { z as z12 } from "zod";
+var PermissionDefinitionSchema = z12.object({
+  code: ContractIdentifierSchema,
+  name: LocalizedTextSchema,
+  description: LocalizedTextSchema.optional(),
+  resource: ContractIdentifierSchema,
+  action: ContractIdentifierSchema,
+  domain: ContractIdentifierSchema.optional()
+}).strict();
+var PermissionBundleSchema = z12.object({
+  bundleId: ContractIdentifierSchema,
+  name: LocalizedTextSchema,
+  permissionCodes: z12.array(ContractIdentifierSchema).default([])
+}).strict();
+var SystemGroupDefinitionSchema = z12.object({
+  groupCode: ContractIdentifierSchema,
+  name: LocalizedTextSchema,
+  description: LocalizedTextSchema.optional(),
+  permissionPolicy: z12.enum(["bundles", "studio_current", "all_current"]).default("bundles"),
+  permissionBundleIds: z12.array(ContractIdentifierSchema).default([])
+}).strict().refine((value) => value.permissionPolicy !== "bundles" || value.permissionBundleIds.length > 0, {
+  message: "A bundles permission policy requires at least one permission bundle.",
+  path: ["permissionBundleIds"]
+});
+var ProductAccessDeclarationSchema = z12.object({
+  contract: z12.literal("ProductAccessDeclaration"),
+  declarationId: ContractIdentifierSchema,
+  version: ContractVersionSchema,
+  ownerRepo: ContractIdentifierSchema,
+  permissions: z12.array(PermissionDefinitionSchema).default([]),
+  permissionBundles: z12.array(PermissionBundleSchema).default([]),
+  systemGroups: z12.array(SystemGroupDefinitionSchema).min(1)
+}).strict();
+
+// src/runtime/access-compiler.ts
+var uniqueBy = (values, key, label) => {
+  const result = /* @__PURE__ */ new Map();
+  for (const value of values) {
+    const id = key(value);
+    if (result.has(id)) throw new Error(`Duplicate ${label} ${id}.`);
+    result.set(id, value);
+  }
+  return result;
+};
+var compileProductAccessDeclaration = (input) => {
+  const declaration = ProductAccessDeclarationSchema.parse(input);
+  const permissionsByCode = uniqueBy(declaration.permissions, (item) => item.code, "permission");
+  const bundlesById = uniqueBy(declaration.permissionBundles, (item) => item.bundleId, "permission bundle");
+  uniqueBy(declaration.systemGroups, (item) => item.groupCode, "system group");
+  const permissionCodesByBundle = /* @__PURE__ */ new Map();
+  for (const bundle of declaration.permissionBundles) {
+    for (const permissionCode of bundle.permissionCodes) {
+      if (!permissionsByCode.has(permissionCode)) {
+        throw new Error(`Permission bundle ${bundle.bundleId} references unknown permission ${permissionCode}.`);
+      }
+    }
+    permissionCodesByBundle.set(bundle.bundleId, [...new Set(bundle.permissionCodes)]);
+  }
+  const permissionCodesBySystemGroup = /* @__PURE__ */ new Map();
+  const permissionPolicyBySystemGroup = /* @__PURE__ */ new Map();
+  for (const group of declaration.systemGroups) {
+    const permissionCodes = /* @__PURE__ */ new Set();
+    permissionPolicyBySystemGroup.set(group.groupCode, group.permissionPolicy);
+    if (group.permissionPolicy === "all_current") {
+      for (const permission of declaration.permissions) permissionCodes.add(permission.code);
+    }
+    if (group.permissionPolicy === "studio_current") {
+      for (const permission of declaration.permissions) {
+        if (permission.domain === "studio" || permission.code.startsWith("studio:")) permissionCodes.add(permission.code);
+      }
+    }
+    for (const bundleId of group.permissionBundleIds) {
+      if (!bundlesById.has(bundleId)) {
+        throw new Error(`System group ${group.groupCode} references unknown permission bundle ${bundleId}.`);
+      }
+      for (const permissionCode of permissionCodesByBundle.get(bundleId) ?? []) {
+        permissionCodes.add(permissionCode);
+      }
+    }
+    permissionCodesBySystemGroup.set(group.groupCode, [...permissionCodes]);
+  }
+  return {
+    declaration,
+    permissionsByCode,
+    permissionCodesByBundle,
+    permissionCodesBySystemGroup,
+    permissionPolicyBySystemGroup
+  };
+};
 export {
   APPLICATION_HANDOFF_QUERY_PARAMETER,
   DEFAULT_CONDUCTOR_OWNER_EMAIL,
@@ -13762,6 +13859,7 @@ export {
   compileConductorWorkflowDefinition,
   compileMenuRuntimeBundle,
   compilePageRuntimeProjection,
+  compileProductAccessDeclaration,
   compileProductDeclaration,
   compileProductRuntimeCatalog,
   compileRenderTree,