@jwilleke/ngdpbase-types 5.32.0 → 5.33.0

package/lib/src/managers/RoleManager.d.ts

@@ -4,6 +4,8 @@ import type { Role, RoleUpdate } from '../types/Role.js';
 import type { RoleProvider } from '../types/RoleProvider.js';
 import { type ActorContext } from '../context/ActorContext.js';
 import type { JobContext } from '../context/JobContext.js';
+/** The title of the one notification for contacts found holding roles at start-up (#2040). */
+export declare const CONTACT_MEMBERS_TITLE = "Contacts are listed as role members";
 declare class RoleManager extends BaseManager {
     readonly description = "Canonical OrganizationRole records (#617 follow-up)";
     private provider;
@@ -142,6 +144,11 @@ declare class RoleManager extends BaseManager {
      * IdentityManager joins an account to an existing person, the roles the
      * account's person held go with the account. Returns how many records
      * changed. IdentityManager's join records the change. All or nothing (#2015).
+     *
+     * #2040: the roles go only with credentials. The join gives the account
+     * (`fromPersonId`'s credentials) to `toPersonId`, which is still a contact
+     * while the roles move, so the check is that `fromPersonId` is a user: a
+     * contact's memberships never move to anyone.
      */
     moveMemberships(fromPersonId: string, toPersonId: string): Promise<number>;
     /**
@@ -160,7 +167,12 @@ declare class RoleManager extends BaseManager {
      * be left without the role it was given, nor keep one it was meant to lose.
      */
     private membershipTarget;
-    /** One member change and its inverse. */
+    /**
+     * One member change and its inverse. An add is checked: the member must be a
+     * user (#2040), judged by `credentialsOf` when the credentials come from
+     * another identity in the same change (a join). An undo puts back what was
+     * there and is not checked.
+     */
     private memberChange;
     /**
      * Make each change in turn (#2015). When one fails, undo the ones made, in
@@ -186,6 +198,11 @@ declare class RoleManager extends BaseManager {
      * record is created in `createIn` for an add; with no `createIn` an add to a
      * missing record throws, and a removal from one changes nothing. False,
      * writing nothing, when the person already is (or is not) a member.
+     *
+     * `mustBeUser` (#2040): the identity whose credentials an add needs, or null
+     * for an undo, which puts back what was there. Only a user holds a role; a
+     * contact is refused with {@link RoleMemberRefusal} before anything is
+     * written, the role record included.
      */
     private setMember;
     /** assignRole / removeRole: the change, recorded as a user-edit whether it happened or not (#1204, #2015). */
@@ -199,6 +216,31 @@ declare class RoleManager extends BaseManager {
      * permits is the policies, resolved at the moment of each decision.
      */
     private getOrCreateRoleRecord;
+    /**
+     * Why the identity `personId` may not hold a role, or null when it may
+     * (#2040). Only a user holds a role: an identity with credentials, whose
+     * identity record's `identifier` is the username of an account that exists.
+     * A contact's identifier is `person:<uuid>` and it has no account.
+     * Read under the system context: this is RoleManager's own rule.
+     */
+    private notAUserReason;
+    /**
+     * Check the role records for members that are contacts (#2040), once at
+     * start-up when every manager is up. Nothing is dropped or rewritten: each
+     * role holding contacts is named, with how many, in a needs-attention entry
+     * on the dashboard and a log line, and administrators get one notification
+     * (not a second while the first is still active). A contact cannot sign in,
+     * so such a membership gives nothing; an administrator decides what to do.
+     *
+     * @returns role name → how many of its members are contacts
+     */
+    reportContactMembersAtBoot(): Promise<Record<string, number>>;
+    /**
+     * One error notification for the users holding `admin-system`, unless one
+     * with this title is still active. Nobody to tell: the log line stands
+     * alone, since an empty target list would tell every user.
+     */
+    private notifyAdminsOnce;
     /** The account must exist; membership of a missing account is refused. */
     private requireAccount;
     /** #1204: a role assigned or removed is a user-edit; what the account may do changed. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilleke/ngdpbase-types",
-  "version": "5.32.0",
+  "version": "5.33.0",
   "description": "TypeScript types for ngdpbase add-ons, and a test kit of core's own values. A dev dependency, versioned with ngdpbase.",
   "license": "Apache-2.0",
   "author": "Jim Willeke",