@karni/ui 0.0.0-stage → 0.3.1

package/dist/manifest.json

@@ -0,0 +1,85 @@
+{
+  "components": [
+    "AuthGuard",
+    "AuthProvider",
+    "Button",
+    "ChangeHistory",
+    "Checkbox",
+    "DataChart",
+    "DropdownMenu",
+    "DropdownMenuCheckboxItem",
+    "DropdownMenuContent",
+    "DropdownMenuGroup",
+    "DropdownMenuItem",
+    "DropdownMenuLabel",
+    "DropdownMenuPortal",
+    "DropdownMenuSeparator",
+    "DropdownMenuTrigger",
+    "EmptyState",
+    "FileUpload",
+    "Input",
+    "KarniMark",
+    "KarniProvider",
+    "Label",
+    "Layout",
+    "LoginForm",
+    "Modal",
+    "ModalClose",
+    "Page",
+    "ResourceDetail",
+    "ResourceForm",
+    "ResourceImport",
+    "ResourceSelect",
+    "ResourceTable",
+    "Select",
+    "SelectContent",
+    "SelectGroup",
+    "SelectItem",
+    "SelectLabel",
+    "SelectRoot",
+    "SelectSeparator",
+    "SelectTrigger",
+    "SelectValue",
+    "Skeleton",
+    "Stat",
+    "Switch",
+    "Tabs",
+    "TabsContent",
+    "TabsList",
+    "TabsTrigger",
+    "Textarea",
+    "Toaster"
+  ],
+  "hooks": [
+    "useAuth",
+    "useChangeHistory",
+    "useImportActions",
+    "useImportDescribe",
+    "useImportJob",
+    "useKarniClient",
+    "usePermission",
+    "useResourceItem",
+    "useResourceList",
+    "useResourceMutations",
+    "useSchema",
+    "useToast"
+  ],
+  "roles": {
+    "async-select": "ResourceSelect",
+    "auth-guard": "AuthGuard",
+    "change-history": "ChangeHistory",
+    "chart": "DataChart",
+    "data-table": "ResourceTable",
+    "detail-view": "ResourceDetail",
+    "empty-state": "EmptyState",
+    "file-upload": "FileUpload",
+    "layout-shell": "Layout",
+    "login-form": "LoginForm",
+    "modal": "Modal",
+    "page-shell": "Page",
+    "resource-form": "ResourceForm",
+    "resource-import": "ResourceImport",
+    "stat": "Stat",
+    "toast": "Toaster"
+  }
+}

package/dist/mockServiceWorker.js

@@ -0,0 +1,361 @@
+/* eslint-disable */
+/* tslint:disable */
+
+/**
+ * Mock Service Worker.
+ * @see https://github.com/mswjs/msw
+ * - Please do NOT modify this file.
+ */
+
+const PACKAGE_VERSION = '2.15.0'
+const INTEGRITY_CHECKSUM = '03cb67ac84128e63d7cd722a6e5b7f1e'
+const IS_MOCKED_RESPONSE = Symbol('isMockedResponse')
+const activeClientIds = new Set()
+
+addEventListener('install', function () {
+  self.skipWaiting()
+})
+
+addEventListener('activate', function (event) {
+  event.waitUntil(self.clients.claim())
+})
+
+addEventListener('message', async function (event) {
+  const clientId = Reflect.get(event.source || {}, 'id')
+
+  if (!clientId || !self.clients) {
+    return
+  }
+
+  const client = await self.clients.get(clientId)
+
+  if (!client) {
+    return
+  }
+
+  const allClients = await self.clients.matchAll({
+    type: 'window',
+  })
+
+  switch (event.data) {
+    case 'KEEPALIVE_REQUEST': {
+      sendToClient(client, {
+        type: 'KEEPALIVE_RESPONSE',
+      })
+      break
+    }
+
+    case 'INTEGRITY_CHECK_REQUEST': {
+      sendToClient(client, {
+        type: 'INTEGRITY_CHECK_RESPONSE',
+        payload: {
+          packageVersion: PACKAGE_VERSION,
+          checksum: INTEGRITY_CHECKSUM,
+        },
+      })
+      break
+    }
+
+    case 'MOCK_ACTIVATE': {
+      activeClientIds.add(clientId)
+
+      sendToClient(client, {
+        type: 'MOCKING_ENABLED',
+        payload: {
+          client: {
+            id: client.id,
+            frameType: client.frameType,
+          },
+        },
+      })
+      break
+    }
+
+    case 'CLIENT_CLOSED': {
+      activeClientIds.delete(clientId)
+
+      const remainingClients = allClients.filter((client) => {
+        return client.id !== clientId
+      })
+
+      // Unregister itself when there are no more clients
+      if (remainingClients.length === 0) {
+        self.registration.unregister()
+      }
+
+      break
+    }
+  }
+})
+
+addEventListener('fetch', function (event) {
+  const requestInterceptedAt = Date.now()
+
+  // Bypass navigation requests.
+  if (event.request.mode === 'navigate') {
+    return
+  }
+
+  // Opening the DevTools triggers the "only-if-cached" request
+  // that cannot be handled by the worker. Bypass such requests.
+  if (
+    event.request.cache === 'only-if-cached' &&
+    event.request.mode !== 'same-origin'
+  ) {
+    return
+  }
+
+  // Bypass all requests when there are no active clients.
+  // Prevents the self-unregistered worked from handling requests
+  // after it's been terminated (still remains active until the next reload).
+  if (activeClientIds.size === 0) {
+    return
+  }
+
+  const requestId = crypto.randomUUID()
+  event.respondWith(handleRequest(event, requestId, requestInterceptedAt))
+})
+
+/**
+ * @param {FetchEvent} event
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ */
+async function handleRequest(event, requestId, requestInterceptedAt) {
+  const client = await resolveMainClient(event)
+  const requestCloneForEvents = event.request.clone()
+  const response = await getResponse(
+    event,
+    client,
+    requestId,
+    requestInterceptedAt,
+  )
+
+  // Send back the response clone for the "response:*" life-cycle events.
+  // Ensure MSW is active and ready to handle the message, otherwise
+  // this message will pend indefinitely.
+  if (client && activeClientIds.has(client.id)) {
+    const serializedRequest = await serializeRequest(requestCloneForEvents)
+
+    // Omit the body of server-sent event stream responses.
+    // Cloning such responses would prevent client-side stream cancelations
+    // from reaching the original stream (a teed stream only cancels its
+    // source once both of its branches cancel) and would buffer the
+    // entire stream into the unconsumed clone indefinitely.
+    const isEventStreamResponse = response.headers
+      .get('content-type')
+      ?.toLowerCase()
+      .startsWith('text/event-stream')
+
+    // Clone the response so both the client and the library could consume it.
+    const responseClone = isEventStreamResponse ? null : response.clone()
+
+    sendToClient(
+      client,
+      {
+        type: 'RESPONSE',
+        payload: {
+          isMockedResponse: IS_MOCKED_RESPONSE in response,
+          request: {
+            id: requestId,
+            ...serializedRequest,
+          },
+          response: {
+            type: response.type,
+            status: response.status,
+            statusText: response.statusText,
+            headers: Object.fromEntries(response.headers.entries()),
+            body: responseClone ? responseClone.body : null,
+          },
+        },
+      },
+      responseClone && responseClone.body
+        ? [serializedRequest.body, responseClone.body]
+        : [],
+    )
+  }
+
+  return response
+}
+
+/**
+ * Resolve the main client for the given event.
+ * Client that issues a request doesn't necessarily equal the client
+ * that registered the worker. It's with the latter the worker should
+ * communicate with during the response resolving phase.
+ * @param {FetchEvent} event
+ * @returns {Promise<Client | undefined>}
+ */
+async function resolveMainClient(event) {
+  const client = await self.clients.get(event.clientId)
+
+  if (activeClientIds.has(event.clientId)) {
+    return client
+  }
+
+  if (client?.frameType === 'top-level') {
+    return client
+  }
+
+  const allClients = await self.clients.matchAll({
+    type: 'window',
+  })
+
+  return allClients
+    .filter((client) => {
+      // Get only those clients that are currently visible.
+      return client.visibilityState === 'visible'
+    })
+    .find((client) => {
+      // Find the client ID that's recorded in the
+      // set of clients that have registered the worker.
+      return activeClientIds.has(client.id)
+    })
+}
+
+/**
+ * @param {FetchEvent} event
+ * @param {Client | undefined} client
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ * @returns {Promise<Response>}
+ */
+async function getResponse(event, client, requestId, requestInterceptedAt) {
+  // Clone the request because it might've been already used
+  // (i.e. its body has been read and sent to the client).
+  const requestClone = event.request.clone()
+
+  function passthrough() {
+    // Cast the request headers to a new Headers instance
+    // so the headers can be manipulated with.
+    const headers = new Headers(requestClone.headers)
+
+    // Remove the "accept" header value that marked this request as passthrough.
+    // This prevents request alteration and also keeps it compliant with the
+    // user-defined CORS policies.
+    const acceptHeader = headers.get('accept')
+    if (acceptHeader) {
+      const values = acceptHeader.split(',').map((value) => value.trim())
+      const filteredValues = values.filter(
+        (value) => value !== 'msw/passthrough',
+      )
+
+      if (filteredValues.length > 0) {
+        headers.set('accept', filteredValues.join(', '))
+      } else {
+        headers.delete('accept')
+      }
+    }
+
+    return fetch(requestClone, { headers })
+  }
+
+  // Bypass mocking when the client is not active.
+  if (!client) {
+    return passthrough()
+  }
+
+  // Bypass initial page load requests (i.e. static assets).
+  // The absence of the immediate/parent client in the map of the active clients
+  // means that MSW hasn't dispatched the "MOCK_ACTIVATE" event yet
+  // and is not ready to handle requests.
+  if (!activeClientIds.has(client.id)) {
+    return passthrough()
+  }
+
+  // Notify the client that a request has been intercepted.
+  const serializedRequest = await serializeRequest(event.request)
+  const clientMessage = await sendToClient(
+    client,
+    {
+      type: 'REQUEST',
+      payload: {
+        id: requestId,
+        interceptedAt: requestInterceptedAt,
+        ...serializedRequest,
+      },
+    },
+    [serializedRequest.body],
+  )
+
+  switch (clientMessage.type) {
+    case 'MOCK_RESPONSE': {
+      return respondWithMock(clientMessage.data)
+    }
+
+    case 'PASSTHROUGH': {
+      return passthrough()
+    }
+  }
+
+  return passthrough()
+}
+
+/**
+ * @param {Client} client
+ * @param {any} message
+ * @param {Array<Transferable>} transferrables
+ * @returns {Promise<any>}
+ */
+function sendToClient(client, message, transferrables = []) {
+  return new Promise((resolve, reject) => {
+    const channel = new MessageChannel()
+
+    channel.port1.onmessage = (event) => {
+      if (event.data && event.data.error) {
+        return reject(event.data.error)
+      }
+
+      resolve(event.data)
+    }
+
+    client.postMessage(message, [
+      channel.port2,
+      ...transferrables.filter(Boolean),
+    ])
+  })
+}
+
+/**
+ * @param {Response} response
+ * @returns {Response}
+ */
+function respondWithMock(response) {
+  // Setting response status code to 0 is a no-op.
+  // However, when responding with a "Response.error()", the produced Response
+  // instance will have status code set to 0. Since it's not possible to create
+  // a Response instance with status code 0, handle that use-case separately.
+  if (response.status === 0) {
+    return Response.error()
+  }
+
+  const mockedResponse = new Response(response.body, response)
+
+  Reflect.defineProperty(mockedResponse, IS_MOCKED_RESPONSE, {
+    value: true,
+    enumerable: true,
+  })
+
+  return mockedResponse
+}
+
+/**
+ * @param {Request} request
+ */
+async function serializeRequest(request) {
+  return {
+    url: request.url,
+    mode: request.mode,
+    method: request.method,
+    headers: Object.fromEntries(request.headers.entries()),
+    cache: request.cache,
+    credentials: request.credentials,
+    destination: request.destination,
+    integrity: request.integrity,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    body: await request.arrayBuffer(),
+    keepalive: request.keepalive,
+  }
+}

package/dist/src/auth/AuthGuard.d.ts

@@ -0,0 +1,12 @@
+import { ReactElement, ReactNode } from 'react';
+export interface AuthGuardProps {
+    /** Grant access when the user holds AT LEAST ONE of these role names. */
+    roles?: string[];
+    /** Rendered for anonymous users and role mismatches; default nothing. */
+    fallback?: ReactNode;
+    /** Rendered while the auth status is still "loading"; default nothing. */
+    loading?: ReactNode;
+    children?: ReactNode;
+}
+/** Renders its children only for a signed-in user, optionally with one of the given roles; otherwise its `fallback`. */
+export declare function AuthGuard({ roles, fallback, loading, children, }: AuthGuardProps): ReactElement | null;

package/dist/src/auth/LoginForm.d.ts

@@ -0,0 +1,29 @@
+import { KarniUser } from './types';
+/**
+ * LoginForm — the sign-in form every app needs (contract: auth).
+ *
+ * Email + password against `useAuth().login`, with the error inline. On
+ * success it calls `onSuccess(user)` (navigate there). When the backend's
+ * 2FA gate fires, `on2FA` receives the ephemeral token so the app can render
+ * its code step (`POST <authBasePath>/2fa/login/`); without a handler the
+ * form explains that a code is required. Render it inside `AuthProvider`,
+ * e.g. as `AuthGuard`'s `fallback`.
+ */
+import * as React from "react";
+export interface LoginFormProps {
+    /** Called with the signed-in user; navigate from here. */
+    onSuccess?: (user: KarniUser) => void;
+    /** Called when the account needs a second factor (the token completes it). */
+    on2FA?: (ephemeralToken: string) => void;
+    /** Heading above the fields; `null` renders none. Default "Sign in". */
+    title?: React.ReactNode;
+    /** Text under the heading (demo logins, a signup link, ...). */
+    description?: React.ReactNode;
+    /** The submit button's label. Default "Sign in". */
+    submitLabel?: React.ReactNode;
+    /** Shown while the auth status is "loading" is irrelevant here; this disables the form. */
+    disabled?: boolean;
+    className?: string;
+}
+/** Email and password sign-in form with inline errors and a callback for the two-factor step. */
+export declare function LoginForm({ onSuccess, on2FA, title, description, submitLabel, disabled, className, }: LoginFormProps): React.JSX.Element;

package/dist/src/auth/engine.d.ts

@@ -0,0 +1,99 @@
+import { KarniClient } from '../schema/client';
+import { TokenStorage } from './storage';
+import { AuthStatus, KarniUser, LoginResult } from './types';
+export type AuthMode = "jwt" | "session";
+export interface AuthEngineOptions {
+    client: KarniClient;
+    tokenStorage: TokenStorage;
+    /** Skips schema-based mode detection entirely when set. */
+    modeOverride?: AuthMode;
+    /** Session-mode CSRF cookie name (A4 pin). Default "csrftoken". */
+    csrfCookieName?: string;
+    /** Session-mode CSRF header name (A4 pin). Default "X-CSRFToken". */
+    csrfHeaderName?: string;
+    /** Path prefix of the auth endpoints, relative to the client's baseUrl. */
+    authBasePath?: string;
+    /**
+     * Reads whatever the schema loader cached under karniKeys.schema() —
+     * consulted (shape-guarded) for `authMode` before fetching the document.
+     */
+    readCachedSchema?: () => unknown;
+}
+export interface AuthSnapshot {
+    readonly status: AuthStatus;
+    readonly user: KarniUser | null;
+    readonly mode: AuthMode | null;
+}
+/**
+ * Reads the auth mode out of either a ParsedSchema (`authMode`) or a raw
+ * OpenAPI document (root `x-karni-auth-mode`), shape-guarded.
+ */
+export declare function readAuthMode(value: unknown): AuthMode | undefined;
+/** Validates/normalizes a `me` payload into a KarniUser (roles default []). */
+export declare function normalizeUser(value: unknown): KarniUser | null;
+export declare class AuthEngine {
+    private readonly client;
+    private readonly tokenStorage;
+    private readonly modeOverride;
+    private readonly csrfCookieName;
+    private readonly csrfHeaderName;
+    private readonly authBasePath;
+    private readonly readCachedSchema;
+    private mode;
+    private accessToken;
+    private refreshPromise;
+    private initPromise;
+    private readonly listeners;
+    private state;
+    constructor(options: AuthEngineOptions);
+    /** Registers the D6 hook points on the client. Idempotent. */
+    attach(): void;
+    /**
+     * Clears every hook this engine registered (including a `getAccessToken`
+     * the app passed to createKarniClient — an unmounted AuthProvider leaves
+     * the client fully unauthenticated by design).
+     */
+    detach(): void;
+    private csrfHeaders;
+    /**
+     * The client calls this at most once per 401-ing request (D6). Returning
+     * true makes the client retry that request exactly once with
+     * freshly-injected credentials; the retry's outcome is always surfaced.
+     */
+    private handleUnauthorized;
+    readonly subscribe: (listener: () => void) => (() => void);
+    readonly getSnapshot: () => AuthSnapshot;
+    private setState;
+    /** Idempotent: the first call kicks off mode resolution + session restore. */
+    ensureInitialized(): Promise<void>;
+    private initialize;
+    private fetchSchemaAuthMode;
+    /** Fetches `/me/` and mirrors the result; any failure means anonymous. */
+    private syncUser;
+    /**
+     * Reads the CSRF cookie, bootstrapping it via `GET <authBasePath>/csrf/`
+     * when absent (A4). Returns null when the cookie stays unreadable (e.g.
+     * CSRF_COOKIE_HTTPONLY) — requests then go out without the header and the
+     * backend's 403 surfaces, which is the honest failure mode.
+     */
+    private ensureCsrfToken;
+    /** ONE shared in-flight refresh; resolves true on success. */
+    private ensureRefresh;
+    private performRefresh;
+    login(email: string, password: string): Promise<LoginResult>;
+    private fetchMe;
+    /** Best-effort server logout, then always clears local state (anonymous). */
+    logout(): Promise<void>;
+    /**
+     * Adopts tokens issued out of band — what `@karni/impersonation-ui` does
+     * when a support user starts or stops impersonating (the backend answers
+     * with tokens for the other identity). JWT mode only; in session mode the
+     * server-side session already changed, so this just re-syncs `/me/`.
+     */
+    adoptTokens(access: string | null, refresh: string | null): Promise<void>;
+    /**
+     * Re-syncs the session: rotates the tokens in JWT mode (A3: /refresh/ is
+     * 405 in session mode, so session mode only re-fetches /me/).
+     */
+    refresh(): Promise<void>;
+}

package/dist/src/auth/provider.d.ts

@@ -0,0 +1,43 @@
+import { ReactElement, ReactNode } from 'react';
+import { TokenStorage } from './storage';
+import { AuthStatus, KarniUser, LoginResult } from './types';
+export interface AuthProviderProps {
+    /**
+     * "jwt" | "session"; when omitted, the mode comes from the schema root's
+     * x-karni-auth-mode (D6), falling back to "jwt" when the schema does not
+     * declare one.
+     */
+    mode?: "jwt" | "session";
+    /** JWT mode refresh-token storage; default localStorage adapter. */
+    tokenStorage?: TokenStorage;
+    /** Session mode CSRF cookie name; default "csrftoken" (D6/A4). */
+    csrfCookieName?: string;
+    /** Session mode CSRF header name; default "X-CSRFToken" (D6/A4). */
+    csrfHeaderName?: string;
+    /** Path prefix of the auth endpoints relative to baseUrl; default "/auth". */
+    authBasePath?: string;
+    children?: ReactNode;
+}
+export interface AuthContextValue {
+    user: KarniUser | null;
+    roles: string[];
+    status: AuthStatus;
+    login(email: string, password: string): Promise<LoginResult>;
+    logout(): Promise<void>;
+    refresh(): Promise<void>;
+    /**
+     * Adopts tokens issued out of band (JWT mode; session mode re-syncs `/me/`),
+     * e.g. after starting or stopping an impersonated session.
+     */
+    adoptTokens(access: string | null, refresh: string | null): Promise<void>;
+}
+/**
+ * The React mirror of the auth engine's state. Exported for advanced
+ * composition (stories, tests, custom providers); application code should
+ * use <AuthProvider> + useAuth().
+ */
+export declare const AuthContext: import('react').Context<AuthContextValue | null>;
+/** Holds the signed-in user and attaches credentials (JWT or session) to every request; render it inside `KarniProvider`. */
+export declare function AuthProvider({ mode, tokenStorage, csrfCookieName, csrfHeaderName, authBasePath, children, }: AuthProviderProps): ReactElement;
+/** Returns the signed-in user, auth status, `login` and `logout`; throws a descriptive error outside `AuthProvider`. */
+export declare function useAuth(): AuthContextValue;

package/dist/src/auth/storage.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Pluggable refresh-token storage for JWT mode (contract "Hooks + auth").
+ *
+ * The default adapter is `localStorage`: it survives reloads and is the
+ * simplest thing that works, but any XSS on your page can read it. Stricter
+ * setups use `createMemoryTokenStorage()` (logout on reload) or implement
+ * the three-method `TokenStorage` interface themselves (e.g. backed by a
+ * worker, or by an HttpOnly-cookie BFF). Session mode needs no storage.
+ */
+export interface TokenStorage {
+    get(): string | null;
+    set(token: string): void;
+    clear(): void;
+}
+/**
+ * Keeps the refresh token in localStorage; the default storage. `key` defaults to "karni.refreshToken". Every storage
+ * access is guarded: when localStorage is unavailable (SSR, private windows,
+ * blocked site data) the adapter degrades to a no-op that returns `null`
+ * instead of throwing.
+ */
+export declare function createLocalStorageTokenStorage(key?: string): TokenStorage;
+/**
+ * In-memory adapter: most secure (nothing persisted anywhere), but a page
+ * reload logs the user out.
+ */
+export declare function createMemoryTokenStorage(): TokenStorage;

package/dist/src/auth/types.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Public auth types (contract "Hooks + auth" + D6, accounts contract A15).
+ */
+/**
+ * Shape of the `/api/auth/me/` response. The accounts contract (A15)
+ * guarantees `roles: string[]` on MeSerializer; every other field the
+ * backend's user serializer exposes rides along via the index signature.
+ */
+export interface KarniUser {
+    id: string | number;
+    email: string;
+    roles: string[];
+    [extra: string]: unknown;
+}
+/**
+ * "loading" while the initial session restore runs, then "authenticated" or
+ * "anonymous". A failed token refresh always lands on "anonymous" (D6).
+ */
+export type AuthStatus = "loading" | "authenticated" | "anonymous";
+/**
+ * Discriminated login result (D6). When the backend's 2FA gate fires
+ * (accounts A6), `login()` resolves `{ requires2fa, ephemeralToken }` —
+ * the 2FA UI is out of scope in v0.1, so consumers exchange the ephemeral
+ * token themselves via `POST /api/auth/2fa/login/`.
+ */
+export type LoginResult = {
+    ok: true;
+    user: KarniUser;
+} | {
+    requires2fa: true;
+    ephemeralToken: string;
+};