@jskit-ai/users-web 0.1.53 → 0.1.55

package/src/client/lib/surfaceAccessPolicy.js

@@ -1,350 +0,0 @@
-import { resolveSurfaceDefinitionFromPlacementContext } from "@jskit-ai/shell-web/client/placement";
-import { normalizeSurfaceId } from "@jskit-ai/kernel/shared/surface/registry";
-import {
-  normalizeRecord,
-  normalizeWorkspaceBootstrapStatusValue
-} from "../support/runtimeNormalization.js";
-import { hasPermission, normalizePermissionList } from "./permissions.js";
-
-const WORKSPACE_BOOTSTRAP_STATUS_NOT_FOUND = "not_found";
-const WORKSPACE_BOOTSTRAP_STATUS_FORBIDDEN = "forbidden";
-const WORKSPACE_ACCESS_BLOCKING_STATUSES = new Set([
-  WORKSPACE_BOOTSTRAP_STATUS_NOT_FOUND,
-  WORKSPACE_BOOTSTRAP_STATUS_FORBIDDEN
-]);
-
-function normalizeSurfaceAccessPolicyId(value = "") {
-  return String(value || "")
-    .trim()
-    .toLowerCase();
-}
-
-function normalizeWorkspaceSlug(value = "") {
-  return String(value || "")
-    .trim()
-    .toLowerCase();
-}
-
-function normalizeAccessFlagName(value = "") {
-  return String(value || "")
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "");
-}
-
-function normalizeStringList(value) {
-  const source = Array.isArray(value) ? value : [value];
-  const output = [];
-  for (const entry of source) {
-    const normalizedEntry = normalizeAccessFlagName(entry);
-    if (!normalizedEntry || output.includes(normalizedEntry)) {
-      continue;
-    }
-    output.push(normalizedEntry);
-  }
-  return output;
-}
-
-function normalizeSurfaceAccessFlags(value = null) {
-  const source = normalizeRecord(value);
-  const flags = {};
-
-  for (const [candidateKey, candidateValue] of Object.entries(source)) {
-    const key = normalizeAccessFlagName(candidateKey);
-    if (!key) {
-      continue;
-    }
-    flags[key] = candidateValue === true;
-  }
-
-  return flags;
-}
-
-function hasPlacementValue(source, key) {
-  if (!source || typeof source !== "object") {
-    return false;
-  }
-  return Object.hasOwn(source, key);
-}
-
-function hasKnownWorkspaceMembershipContext(contextValue = null) {
-  return hasPlacementValue(contextValue, "workspaces");
-}
-
-function hasKnownPermissionsContext(contextValue = null) {
-  return hasPlacementValue(contextValue, "permissions");
-}
-
-function hasKnownSurfaceAccessContext(contextValue = null) {
-  return hasPlacementValue(contextValue, "surfaceAccess");
-}
-
-function hasWorkspaceMembership(contextValue = null, workspaceSlug = "") {
-  const normalizedWorkspaceSlug = normalizeWorkspaceSlug(workspaceSlug);
-  if (!normalizedWorkspaceSlug) {
-    return false;
-  }
-
-  const context = normalizeRecord(contextValue);
-  if (normalizeWorkspaceSlug(context?.workspace?.slug) === normalizedWorkspaceSlug) {
-    return true;
-  }
-
-  const workspaces = Array.isArray(context.workspaces) ? context.workspaces : [];
-  for (const workspace of workspaces) {
-    if (normalizeWorkspaceSlug(workspace?.slug) === normalizedWorkspaceSlug) {
-      return true;
-    }
-  }
-
-  return false;
-}
-
-function resolveSurfaceAccessPolicies(contextValue = null) {
-  const context = normalizeRecord(contextValue);
-  const configuredPolicies = normalizeRecord(context.surfaceAccessPolicies);
-  const policies = {};
-
-  for (const [candidatePolicyId, candidatePolicy] of Object.entries(configuredPolicies)) {
-    const policyId = normalizeSurfaceAccessPolicyId(candidatePolicyId);
-    if (!policyId) {
-      continue;
-    }
-    policies[policyId] = normalizeRecord(candidatePolicy);
-  }
-
-  return policies;
-}
-
-function resolveSurfaceAccessPolicy(contextValue = null, surfaceDefinition = null) {
-  const definition = normalizeRecord(surfaceDefinition);
-  const policyId = normalizeSurfaceAccessPolicyId(definition.accessPolicyId);
-  const configuredPolicies = resolveSurfaceAccessPolicies(contextValue);
-  const configuredPolicy = policyId ? normalizeRecord(configuredPolicies[policyId]) : {};
-
-  const requireAuth = Object.hasOwn(configuredPolicy, "requireAuth")
-    ? configuredPolicy.requireAuth === true
-    : definition.requiresAuth === true;
-  const requireWorkspaceMembership = Object.hasOwn(configuredPolicy, "requireWorkspaceMembership")
-    ? configuredPolicy.requireWorkspaceMembership === true
-    : definition.requiresWorkspace === true;
-  const requireAnyPermissions = normalizePermissionList(configuredPolicy.requireAnyPermissions);
-  const requireAllPermissions = normalizePermissionList(configuredPolicy.requireAllPermissions);
-  const requireFlagsAny = normalizeStringList(configuredPolicy.requireFlagsAny);
-  const requireFlagsAll = normalizeStringList(configuredPolicy.requireFlagsAll);
-
-  return Object.freeze({
-    policyId,
-    requireAuth,
-    requireWorkspaceMembership,
-    requireAnyPermissions: Object.freeze([...requireAnyPermissions]),
-    requireAllPermissions: Object.freeze([...requireAllPermissions]),
-    requireFlagsAny: Object.freeze([...requireFlagsAny]),
-    requireFlagsAll: Object.freeze([...requireFlagsAll])
-  });
-}
-
-function toAccessDecision({ allowed = false, pending = false, reason = "" } = {}) {
-  return Object.freeze({
-    allowed: allowed === true,
-    pending: pending === true,
-    reason: String(reason || "").trim()
-  });
-}
-
-function evaluatePermissionRequirements(policy, permissions = []) {
-  if (policy.requireAnyPermissions.length > 0) {
-    const hasAnyRequiredPermission = policy.requireAnyPermissions.some((permission) => hasPermission(permissions, permission));
-    if (!hasAnyRequiredPermission) {
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-missing-any-permission"
-      });
-    }
-  }
-
-  if (policy.requireAllPermissions.length > 0) {
-    for (const permission of policy.requireAllPermissions) {
-      if (hasPermission(permissions, permission)) {
-        continue;
-      }
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-missing-permission"
-      });
-    }
-  }
-
-  return toAccessDecision({
-    allowed: true
-  });
-}
-
-function evaluateFlagRequirements(policy, flags = {}) {
-  const normalizedFlags = normalizeSurfaceAccessFlags(flags);
-  if (policy.requireFlagsAll.length > 0) {
-    for (const flagName of policy.requireFlagsAll) {
-      if (normalizedFlags[flagName] === true) {
-        continue;
-      }
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-missing-flag"
-      });
-    }
-  }
-
-  if (policy.requireFlagsAny.length > 0) {
-    const hasAnyRequiredFlag = policy.requireFlagsAny.some((flagName) => normalizedFlags[flagName] === true);
-    if (!hasAnyRequiredFlag) {
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-missing-any-flag"
-      });
-    }
-  }
-
-  return toAccessDecision({
-    allowed: true
-  });
-}
-
-function evaluateSurfaceAccess({
-  context = null,
-  surfaceId = "",
-  workspaceSlug = "",
-  allowOnUnknown = false
-} = {}) {
-  const source = normalizeRecord(context);
-  const normalizedSurfaceId = normalizeSurfaceId(surfaceId);
-  if (!normalizedSurfaceId) {
-    return toAccessDecision({
-      allowed: false,
-      reason: "surface-access-invalid-surface"
-    });
-  }
-
-  const surfaceDefinition = resolveSurfaceDefinitionFromPlacementContext(source, normalizedSurfaceId);
-  if (!surfaceDefinition || surfaceDefinition.enabled === false) {
-    return toAccessDecision({
-      allowed: false,
-      reason: "surface-access-disabled"
-    });
-  }
-
-  const policy = resolveSurfaceAccessPolicy(source, surfaceDefinition);
-  if (policy.requireAuth && source?.auth?.authenticated !== true) {
-    return toAccessDecision({
-      allowed: false,
-      reason: "surface-access-auth-required"
-    });
-  }
-
-  const normalizedWorkspaceSlug = normalizeWorkspaceSlug(workspaceSlug);
-  if (policy.requireWorkspaceMembership) {
-    if (!normalizedWorkspaceSlug) {
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-workspace-required"
-      });
-    }
-
-    const workspaceBootstrapStatuses = normalizeRecord(source.workspaceBootstrapStatuses);
-    const workspaceStatus = normalizeWorkspaceBootstrapStatusValue(
-      workspaceBootstrapStatuses[normalizedWorkspaceSlug],
-      WORKSPACE_ACCESS_BLOCKING_STATUSES
-    );
-    if (workspaceStatus === WORKSPACE_BOOTSTRAP_STATUS_NOT_FOUND) {
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-workspace-not-found"
-      });
-    }
-    if (workspaceStatus === WORKSPACE_BOOTSTRAP_STATUS_FORBIDDEN) {
-      return toAccessDecision({
-        allowed: false,
-        reason: "surface-access-workspace-forbidden"
-      });
-    }
-
-    if (hasKnownWorkspaceMembershipContext(source)) {
-      if (!hasWorkspaceMembership(source, normalizedWorkspaceSlug)) {
-        if (allowOnUnknown && !workspaceStatus) {
-          return toAccessDecision({
-            allowed: true,
-            pending: true
-          });
-        }
-        return toAccessDecision({
-          allowed: false,
-          reason: "surface-access-workspace-membership-required"
-        });
-      }
-    } else if (allowOnUnknown) {
-      return toAccessDecision({
-        allowed: true,
-        pending: true
-      });
-    } else {
-      return toAccessDecision({
-        allowed: false,
-        pending: true,
-        reason: "surface-access-pending"
-      });
-    }
-  }
-
-  const placementPermissions = normalizePermissionList(source.permissions);
-  if (policy.requireAnyPermissions.length > 0 || policy.requireAllPermissions.length > 0) {
-    if (!hasKnownPermissionsContext(source)) {
-      if (allowOnUnknown) {
-        return toAccessDecision({
-          allowed: true,
-          pending: true
-        });
-      }
-      return toAccessDecision({
-        allowed: false,
-        pending: true,
-        reason: "surface-access-pending"
-      });
-    }
-
-    const permissionDecision = evaluatePermissionRequirements(policy, placementPermissions);
-    if (!permissionDecision.allowed) {
-      return permissionDecision;
-    }
-  }
-
-  if (policy.requireFlagsAny.length > 0 || policy.requireFlagsAll.length > 0) {
-    if (!hasKnownSurfaceAccessContext(source)) {
-      if (allowOnUnknown) {
-        return toAccessDecision({
-          allowed: true,
-          pending: true
-        });
-      }
-      return toAccessDecision({
-        allowed: false,
-        pending: true,
-        reason: "surface-access-pending"
-      });
-    }
-
-    const accessFlags = normalizeRecord(source.surfaceAccess);
-    const flagDecision = evaluateFlagRequirements(policy, accessFlags);
-    if (!flagDecision.allowed) {
-      return flagDecision;
-    }
-  }
-
-  return toAccessDecision({
-    allowed: true
-  });
-}
-
-export {
-  hasWorkspaceMembership,
-  resolveSurfaceAccessPolicy,
-  evaluateSurfaceAccess
-};

package/src/client/lib/workspaceLinkResolver.js

@@ -1,207 +0,0 @@
-import { unref } from "vue";
-import { resolveLinkPath } from "@jskit-ai/kernel/shared";
-import { normalizeSurfaceId } from "@jskit-ai/kernel/shared/surface/registry";
-import {
-  useWebPlacementContext,
-  resolveRuntimePathname,
-  resolveSurfaceDefinitionFromPlacementContext,
-  resolveSurfaceIdFromPlacementPathname,
-  resolveSurfaceRootPathFromPlacementContext
-} from "@jskit-ai/shell-web/client/placement";
-import {
-  resolveWorkspaceSurfaceIdFromPlacementPathname,
-  resolveSurfaceWorkspacePathFromPlacementContext,
-  extractWorkspaceSlugFromSurfacePathname
-} from "./workspaceSurfacePaths.js";
-import { surfaceRequiresWorkspaceFromPlacementContext } from "./workspaceSurfaceContext.js";
-import { parseWorkspacePathname } from "@jskit-ai/users-core/shared/support/workspacePathModel";
-
-function resolveSurfaceBasePath(context = null, surface = "") {
-  const normalizedSurface = normalizeSurfaceId(surface);
-  if (!normalizedSurface) {
-    return "";
-  }
-
-  if (!resolveSurfaceDefinitionFromPlacementContext(context, normalizedSurface)) {
-    return "";
-  }
-
-  return resolveSurfaceRootPathFromPlacementContext(context, normalizedSurface);
-}
-
-function resolveWorkspaceSlugFromContextOrPath({
-  context = null,
-  surface = "",
-  workspaceSlug = "",
-  pathname = ""
-} = {}) {
-  const explicitWorkspaceSlug = String(workspaceSlug || "").trim();
-  if (explicitWorkspaceSlug) {
-    return explicitWorkspaceSlug;
-  }
-
-  const workspaceSlugFromContext = String(context?.workspace?.slug || "").trim();
-  if (workspaceSlugFromContext) {
-    return workspaceSlugFromContext;
-  }
-
-  const currentPathname = resolveRuntimePathname(pathname);
-  const workspaceSlugFromPath = String(parseWorkspacePathname(currentPathname)?.workspaceSlug || "").trim();
-  if (workspaceSlugFromPath) {
-    return workspaceSlugFromPath;
-  }
-
-  const normalizedSurface = normalizeSurfaceId(surface);
-  const workspaceSurfaceId = resolveWorkspaceSurfaceIdFromPlacementPathname(context, currentPathname);
-  const surfaceIdFromPath = workspaceSurfaceId || resolveSurfaceIdFromPlacementPathname(context, currentPathname);
-  const activeSurfaceId = normalizeSurfaceId(surfaceIdFromPath || normalizedSurface);
-  if (!activeSurfaceId) {
-    return "";
-  }
-
-  return String(extractWorkspaceSlugFromSurfacePathname(context, activeSurfaceId, currentPathname) || "").trim();
-}
-
-function resolveWorkspaceBasePath(context = null, surface = "", workspaceSlug = "") {
-  const normalizedSurface = normalizeSurfaceId(surface);
-  const normalizedWorkspaceSlug = String(workspaceSlug || "").trim();
-  if (!normalizedSurface || !normalizedWorkspaceSlug) {
-    return "";
-  }
-
-  if (!resolveSurfaceDefinitionFromPlacementContext(context, normalizedSurface)) {
-    return "";
-  }
-
-  if (!surfaceRequiresWorkspaceFromPlacementContext(context, normalizedSurface)) {
-    return resolveSurfaceBasePath(context, normalizedSurface);
-  }
-
-  return resolveSurfaceWorkspacePathFromPlacementContext(context, normalizedSurface, normalizedWorkspaceSlug, "/");
-}
-
-function resolveWorkspaceShellLinkPath({
-  context = null,
-  surface = "",
-  mode = "auto",
-  explicitTo = "",
-  relativePath = "/",
-  workspaceRelativePath = "",
-  surfaceRelativePath = "",
-  workspaceSlug = "",
-  pathname = ""
-} = {}) {
-  const explicitTarget = String(explicitTo || "").trim();
-  if (explicitTarget) {
-    return explicitTarget;
-  }
-
-  const normalizedSurface = normalizeSurfaceId(surface);
-  const normalizedMode = String(mode || "auto").trim().toLowerCase();
-  const hasSurfaceDefinition = Boolean(
-    normalizedSurface && resolveSurfaceDefinitionFromPlacementContext(context, normalizedSurface)
-  );
-  if (!hasSurfaceDefinition) {
-    return "";
-  }
-
-  const resolvedWorkspaceSlug = resolveWorkspaceSlugFromContextOrPath({
-    context,
-    surface: normalizedSurface,
-    workspaceSlug,
-    pathname
-  });
-
-  const nextWorkspaceRelativePath = String(workspaceRelativePath || "").trim() || String(relativePath || "").trim() || "/";
-  const nextSurfaceRelativePath = String(surfaceRelativePath || "").trim() || String(relativePath || "").trim() || "/";
-  const nextSurfaceBasePath = resolveSurfaceBasePath(context, normalizedSurface);
-
-  if (normalizedMode === "surface") {
-    return resolveLinkPath(nextSurfaceBasePath, nextSurfaceRelativePath);
-  }
-
-  if (normalizedMode === "workspace") {
-    if (!surfaceRequiresWorkspaceFromPlacementContext(context, normalizedSurface)) {
-      return resolveLinkPath(nextSurfaceBasePath, nextSurfaceRelativePath);
-    }
-    if (!resolvedWorkspaceSlug) {
-      return "";
-    }
-    const workspaceBasePath = resolveWorkspaceBasePath(context, normalizedSurface, resolvedWorkspaceSlug);
-    if (!workspaceBasePath) {
-      return "";
-    }
-    return resolveLinkPath(
-      workspaceBasePath,
-      nextWorkspaceRelativePath
-    );
-  }
-
-  if (surfaceRequiresWorkspaceFromPlacementContext(context, normalizedSurface)) {
-    if (!resolvedWorkspaceSlug) {
-      return "";
-    }
-    const workspaceBasePath = resolveWorkspaceBasePath(context, normalizedSurface, resolvedWorkspaceSlug);
-    if (!workspaceBasePath) {
-      return "";
-    }
-    return resolveLinkPath(
-      workspaceBasePath,
-      nextWorkspaceRelativePath
-    );
-  }
-
-  return resolveLinkPath(nextSurfaceBasePath, nextSurfaceRelativePath);
-}
-
-function useWorkspaceLinkResolver({ surface = "", workspaceSlug = "", pathname = "" } = {}) {
-  const { context: placementContext } = useWebPlacementContext();
-
-  function resolve(relativePath = "/", options = {}) {
-    return resolveWorkspaceShellLinkPath({
-      context: placementContext.value,
-      surface: String(unref(options.surface ?? surface) || ""),
-      workspaceSlug: String(unref(options.workspaceSlug ?? workspaceSlug) || ""),
-      pathname: String(unref(options.pathname ?? pathname) || ""),
-      mode: String(options.mode || "auto"),
-      explicitTo: options.explicitTo,
-      relativePath,
-      workspaceRelativePath: options.workspaceRelativePath,
-      surfaceRelativePath: options.surfaceRelativePath
-    });
-  }
-
-  function toSurface(relativePath = "/", options = {}) {
-    return resolve(relativePath, {
-      ...options,
-      mode: "surface"
-    });
-  }
-
-  function toWorkspace(relativePath = "/", options = {}) {
-    return resolve(relativePath, {
-      ...options,
-      mode: "workspace"
-    });
-  }
-
-  function toAuto(relativePath = "/", options = {}) {
-    return resolve(relativePath, {
-      ...options,
-      mode: "auto"
-    });
-  }
-
-  return Object.freeze({
-    resolve,
-    toSurface,
-    toWorkspace,
-    toAuto
-  });
-}
-
-export {
-  resolveWorkspaceSlugFromContextOrPath,
-  resolveWorkspaceShellLinkPath,
-  useWorkspaceLinkResolver
-};

package/src/client/lib/workspaceSurfaceContext.js

@@ -1,82 +0,0 @@
-import { normalizeSurfaceId } from "@jskit-ai/kernel/shared/surface";
-import {
-  readPlacementSurfaceConfig,
-  resolveSurfaceDefinitionFromPlacementContext
-} from "@jskit-ai/shell-web/client/placement";
-
-function listWorkspaceSurfaceIdsFromSurfaceConfig(surfaceConfig = null) {
-  return listSurfaceIdsFromSurfaceConfig(surfaceConfig, {
-    requiresWorkspace: true
-  });
-}
-
-function listNonWorkspaceSurfaceIdsFromSurfaceConfig(surfaceConfig = null) {
-  return listSurfaceIdsFromSurfaceConfig(surfaceConfig, {
-    requiresWorkspace: false
-  });
-}
-
-function listSurfaceIdsFromSurfaceConfig(surfaceConfig = null, { requiresWorkspace = null } = {}) {
-  const source = surfaceConfig && typeof surfaceConfig === "object" ? surfaceConfig : {};
-  const enabledSurfaceIds = Array.isArray(source.enabledSurfaceIds) ? source.enabledSurfaceIds : [];
-  const surfacesById = source.surfacesById && typeof source.surfacesById === "object" ? source.surfacesById : {};
-
-  const result = [];
-  for (const candidate of enabledSurfaceIds) {
-    const surfaceId = normalizeSurfaceId(candidate);
-    if (!surfaceId) {
-      continue;
-    }
-    const surfaceRequiresWorkspace = surfacesById[surfaceId]?.requiresWorkspace === true;
-    if (requiresWorkspace === true && !surfaceRequiresWorkspace) {
-      continue;
-    }
-    if (requiresWorkspace === false && surfaceRequiresWorkspace) {
-      continue;
-    }
-    result.push(surfaceId);
-  }
-  return result;
-}
-
-function surfaceRequiresWorkspaceFromPlacementContext(contextValue = null, surfaceId = "") {
-  return Boolean(resolveSurfaceDefinitionFromPlacementContext(contextValue, surfaceId)?.requiresWorkspace);
-}
-
-function firstAlternativeSurfaceId(surfaceIds = [], excludeSurfaceId = "") {
-  const normalizedExcludeSurfaceId = normalizeSurfaceId(excludeSurfaceId);
-  for (const candidate of Array.isArray(surfaceIds) ? surfaceIds : []) {
-    const surfaceId = normalizeSurfaceId(candidate);
-    if (!surfaceId || surfaceId === normalizedExcludeSurfaceId) {
-      continue;
-    }
-    return surfaceId;
-  }
-  return "";
-}
-
-function resolveSurfaceSwitchTargetsFromPlacementContext(contextValue = null, surfaceId = "") {
-  const surfaceConfig = readPlacementSurfaceConfig(contextValue);
-  const currentSurface = resolveSurfaceDefinitionFromPlacementContext(contextValue, surfaceId);
-  const currentSurfaceId = normalizeSurfaceId(currentSurface?.id);
-  const defaultSurfaceId = normalizeSurfaceId(surfaceConfig.defaultSurfaceId);
-  const defaultSurface = defaultSurfaceId ? surfaceConfig.surfacesById[defaultSurfaceId] || null : null;
-  const workspaceSurfaceIds = listWorkspaceSurfaceIdsFromSurfaceConfig(surfaceConfig);
-  const nonWorkspaceSurfaceIds = listNonWorkspaceSurfaceIdsFromSurfaceConfig(surfaceConfig);
-
-  return Object.freeze({
-    surfaceConfig,
-    currentSurfaceId,
-    currentSurface,
-    defaultSurfaceId,
-    defaultSurface,
-    workspaceSurfaceId: firstAlternativeSurfaceId(workspaceSurfaceIds, currentSurfaceId),
-    nonWorkspaceSurfaceId: firstAlternativeSurfaceId(nonWorkspaceSurfaceIds, currentSurfaceId)
-  });
-}
-
-export {
-  listWorkspaceSurfaceIdsFromSurfaceConfig,
-  surfaceRequiresWorkspaceFromPlacementContext,
-  resolveSurfaceSwitchTargetsFromPlacementContext
-};