@morscherlab/mint-sdk 1.1.11 → 1.1.13

package/dist/permissions.d.ts

@@ -1,5 +1,5 @@
 export declare const ADMIN_ROLE = "admin";
-export declare const ADMIN_PANEL_PERMISSIONS: readonly ["users.view", "users.invite", "users.manage", "platform.configure", "platform.view_logs", "plugins.configure", "plugins.install"];
+export declare const ADMIN_PANEL_PERMISSIONS: readonly ["users.view", "users.invite", "users.manage", "platform.configure", "platform.view_logs", "plugins.configure", "plugins.install", "notices.publish"];
 export type AccessAudience = 'all' | 'admin' | 'user';
 export type AccessAudienceInput = AccessAudience | readonly AccessAudience[];
 export interface RoleInfo {

package/dist/permissions.js

@@ -7,7 +7,8 @@ var ADMIN_PANEL_PERMISSIONS = [
 	"platform.configure",
 	"platform.view_logs",
 	"plugins.configure",
-	"plugins.install"
+	"plugins.install",
+	"notices.publish"
 ];
 function getRoleInfo(user) {
 	return user?.roleObj ?? user?.role_obj ?? null;

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","names":[],"sources":["../src/permissions.ts"],"sourcesContent":["export const ADMIN_ROLE = 'admin'\n\nexport const ADMIN_PANEL_PERMISSIONS = [\n  'users.view',\n  'users.invite',\n  'users.manage',\n  'platform.configure',\n  'platform.view_logs',\n  'plugins.configure',\n  'plugins.install',\n] as const\n\nexport type AccessAudience = 'all' | 'admin' | 'user'\nexport type AccessAudienceInput = AccessAudience | readonly AccessAudience[]\n\nexport interface RoleInfo {\n  id?: number\n  slug: string\n  name?: string\n  color?: string\n  permissions?: readonly string[] | null\n  project_scope?: 'all' | 'assigned' | string\n  plugin_access?: readonly string[] | 'all' | null\n}\n\nexport interface PermissionUser {\n  role?: string | null\n  role_obj?: RoleInfo | null\n  roleObj?: RoleInfo | null\n  permissions?: readonly string[] | null\n}\n\nexport interface AccessPolicy {\n  audience?: AccessAudienceInput\n  visibleFor?: AccessAudienceInput\n  requiresAuth?: boolean\n  requiresAdmin?: boolean\n  permissions?: readonly string[]\n  anyPermissions?: readonly string[]\n  plugin?: string\n}\n\nexport interface AccessControlled {\n  access?: AccessPolicy\n  visibleFor?: AccessAudienceInput\n  requiresAdmin?: boolean\n  permissions?: readonly string[]\n  anyPermissions?: readonly string[]\n}\n\nexport function getRoleInfo(user: PermissionUser | null | undefined): RoleInfo | null {\n  return user?.roleObj ?? user?.role_obj ?? null\n}\n\nexport function isAdminRole(role: string | null | undefined): boolean {\n  return role === ADMIN_ROLE\n}\n\nexport function isAdminUser(user: PermissionUser | null | undefined): boolean {\n  return isAdminRole(user?.role) || getRoleInfo(user)?.slug === ADMIN_ROLE\n}\n\nexport function getAccessAudience(user: PermissionUser | null | undefined): Exclude<AccessAudience, 'all'> {\n  return isAdminUser(user) ? 'admin' : 'user'\n}\n\nexport function getUserPermissions(user: PermissionUser | null | undefined): string[] {\n  const rolePermissions = getRoleInfo(user)?.permissions\n  if (rolePermissions?.length) return [...rolePermissions]\n  return [...(user?.permissions ?? [])]\n}\n\nexport function hasAllPermissions(\n  user: PermissionUser | null | undefined,\n  permissions: readonly string[] = [],\n): boolean {\n  if (permissions.length === 0) return true\n  if (isAdminUser(user)) return true\n  const granted = new Set(getUserPermissions(user))\n  return permissions.every(permission => granted.has(permission))\n}\n\nexport function hasAnyPermission(\n  user: PermissionUser | null | undefined,\n  permissions: readonly string[] = [],\n): boolean {\n  if (permissions.length === 0) return true\n  if (isAdminUser(user)) return true\n  const granted = new Set(getUserPermissions(user))\n  return permissions.some(permission => granted.has(permission))\n}\n\nexport function canAccessAdmin(user: PermissionUser | null | undefined): boolean {\n  return isAdminUser(user) || hasAnyPermission(user, ADMIN_PANEL_PERMISSIONS)\n}\n\nexport function canAccessPlugin(\n  user: PermissionUser | null | undefined,\n  pluginName: string | null | undefined,\n): boolean {\n  if (!pluginName) return true\n  const access = getRoleInfo(user)?.plugin_access\n  if (!access || access === 'all') return true\n  return Array.isArray(access) && access.includes(pluginName)\n}\n\nexport function normalizeAccessPolicy(rule: AccessControlled | AccessPolicy | undefined): AccessPolicy {\n  if (!rule) return {}\n  const { access: nested, ...direct } = rule as AccessPolicy & { access?: AccessPolicy }\n  return {\n    ...(nested ?? {}),\n    ...direct,\n    ...('visibleFor' in rule && rule.visibleFor !== undefined ? { visibleFor: rule.visibleFor } : {}),\n    ...('requiresAdmin' in rule && rule.requiresAdmin !== undefined ? { requiresAdmin: rule.requiresAdmin } : {}),\n    ...('permissions' in rule && rule.permissions !== undefined ? { permissions: rule.permissions } : {}),\n    ...('anyPermissions' in rule && rule.anyPermissions !== undefined ? { anyPermissions: rule.anyPermissions } : {}),\n  }\n}\n\nexport function canAccessByPolicy(\n  user: PermissionUser | null | undefined,\n  rule: AccessControlled | AccessPolicy | undefined,\n  isAuthenticated = user !== null && user !== undefined,\n): boolean {\n  const policy = normalizeAccessPolicy(rule)\n  if (policy.requiresAuth && !isAuthenticated) return false\n  if (policy.requiresAdmin && !isAdminUser(user)) return false\n  if (!audienceAllowsUser(policy.visibleFor ?? policy.audience, user)) return false\n  if (!hasAllPermissions(user, policy.permissions)) return false\n  if (!hasAnyPermission(user, policy.anyPermissions)) return false\n  if (policy.plugin && !canAccessPlugin(user, policy.plugin)) return false\n  return true\n}\n\nfunction audienceAllowsUser(\n  audience: AccessAudienceInput | undefined,\n  user: PermissionUser | null | undefined,\n): boolean {\n  if (audience === undefined) return true\n  const allowed = Array.isArray(audience) ? audience : [audience]\n  if (allowed.includes('all')) return true\n  return allowed.includes(getAccessAudience(user))\n}\n"],"mappings":";AAAA,IAAa,aAAa;AAE1B,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAwCD,SAAgB,YAAY,MAA0D;AACpF,QAAO,MAAM,WAAW,MAAM,YAAY;;AAG5C,SAAgB,YAAY,MAA0C;AACpE,QAAO,SAAS;;AAGlB,SAAgB,YAAY,MAAkD;AAC5E,QAAO,YAAY,MAAM,KAAK,IAAI,YAAY,KAAK,EAAE,SAAA;;AAGvD,SAAgB,kBAAkB,MAAyE;AACzG,QAAO,YAAY,KAAK,GAAG,UAAU;;AAGvC,SAAgB,mBAAmB,MAAmD;CACpF,MAAM,kBAAkB,YAAY,KAAK,EAAE;AAC3C,KAAI,iBAAiB,OAAQ,QAAO,CAAC,GAAG,gBAAgB;AACxD,QAAO,CAAC,GAAI,MAAM,eAAe,EAAE,CAAE;;AAGvC,SAAgB,kBACd,MACA,cAAiC,EAAE,EAC1B;AACT,KAAI,YAAY,WAAW,EAAG,QAAO;AACrC,KAAI,YAAY,KAAK,CAAE,QAAO;CAC9B,MAAM,UAAU,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACjD,QAAO,YAAY,OAAM,eAAc,QAAQ,IAAI,WAAW,CAAC;;AAGjE,SAAgB,iBACd,MACA,cAAiC,EAAE,EAC1B;AACT,KAAI,YAAY,WAAW,EAAG,QAAO;AACrC,KAAI,YAAY,KAAK,CAAE,QAAO;CAC9B,MAAM,UAAU,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACjD,QAAO,YAAY,MAAK,eAAc,QAAQ,IAAI,WAAW,CAAC;;AAGhE,SAAgB,eAAe,MAAkD;AAC/E,QAAO,YAAY,KAAK,IAAI,iBAAiB,MAAM,wBAAwB;;AAG7E,SAAgB,gBACd,MACA,YACS;AACT,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,SAAS,YAAY,KAAK,EAAE;AAClC,KAAI,CAAC,UAAU,WAAW,MAAO,QAAO;AACxC,QAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,SAAS,WAAW;;AAG7D,SAAgB,sBAAsB,MAAiE;AACrG,KAAI,CAAC,KAAM,QAAO,EAAE;CACpB,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW;AACtC,QAAO;EACL,GAAI,UAAU,EAAE;EAChB,GAAG;EACH,GAAI,gBAAgB,QAAQ,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;EAChG,GAAI,mBAAmB,QAAQ,KAAK,kBAAkB,KAAA,IAAY,EAAE,eAAe,KAAK,eAAe,GAAG,EAAE;EAC5G,GAAI,iBAAiB,QAAQ,KAAK,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,aAAa,GAAG,EAAE;EACpG,GAAI,oBAAoB,QAAQ,KAAK,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,EAAE;EACjH;;AAGH,SAAgB,kBACd,MACA,MACA,kBAAkB,SAAS,QAAQ,SAAS,KAAA,GACnC;CACT,MAAM,SAAS,sBAAsB,KAAK;AAC1C,KAAI,OAAO,gBAAgB,CAAC,gBAAiB,QAAO;AACpD,KAAI,OAAO,iBAAiB,CAAC,YAAY,KAAK,CAAE,QAAO;AACvD,KAAI,CAAC,mBAAmB,OAAO,cAAc,OAAO,UAAU,KAAK,CAAE,QAAO;AAC5E,KAAI,CAAC,kBAAkB,MAAM,OAAO,YAAY,CAAE,QAAO;AACzD,KAAI,CAAC,iBAAiB,MAAM,OAAO,eAAe,CAAE,QAAO;AAC3D,KAAI,OAAO,UAAU,CAAC,gBAAgB,MAAM,OAAO,OAAO,CAAE,QAAO;AACnE,QAAO;;AAGT,SAAS,mBACP,UACA,MACS;AACT,KAAI,aAAa,KAAA,EAAW,QAAO;CACnC,MAAM,UAAU,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS;AAC/D,KAAI,QAAQ,SAAS,MAAM,CAAE,QAAO;AACpC,QAAO,QAAQ,SAAS,kBAAkB,KAAK,CAAC"}
+{"version":3,"file":"permissions.js","names":[],"sources":["../src/permissions.ts"],"sourcesContent":["export const ADMIN_ROLE = 'admin'\n\nexport const ADMIN_PANEL_PERMISSIONS = [\n  'users.view',\n  'users.invite',\n  'users.manage',\n  'platform.configure',\n  'platform.view_logs',\n  'plugins.configure',\n  'plugins.install',\n  'notices.publish',\n] as const\n\nexport type AccessAudience = 'all' | 'admin' | 'user'\nexport type AccessAudienceInput = AccessAudience | readonly AccessAudience[]\n\nexport interface RoleInfo {\n  id?: number\n  slug: string\n  name?: string\n  color?: string\n  permissions?: readonly string[] | null\n  project_scope?: 'all' | 'assigned' | string\n  plugin_access?: readonly string[] | 'all' | null\n}\n\nexport interface PermissionUser {\n  role?: string | null\n  role_obj?: RoleInfo | null\n  roleObj?: RoleInfo | null\n  permissions?: readonly string[] | null\n}\n\nexport interface AccessPolicy {\n  audience?: AccessAudienceInput\n  visibleFor?: AccessAudienceInput\n  requiresAuth?: boolean\n  requiresAdmin?: boolean\n  permissions?: readonly string[]\n  anyPermissions?: readonly string[]\n  plugin?: string\n}\n\nexport interface AccessControlled {\n  access?: AccessPolicy\n  visibleFor?: AccessAudienceInput\n  requiresAdmin?: boolean\n  permissions?: readonly string[]\n  anyPermissions?: readonly string[]\n}\n\nexport function getRoleInfo(user: PermissionUser | null | undefined): RoleInfo | null {\n  return user?.roleObj ?? user?.role_obj ?? null\n}\n\nexport function isAdminRole(role: string | null | undefined): boolean {\n  return role === ADMIN_ROLE\n}\n\nexport function isAdminUser(user: PermissionUser | null | undefined): boolean {\n  return isAdminRole(user?.role) || getRoleInfo(user)?.slug === ADMIN_ROLE\n}\n\nexport function getAccessAudience(user: PermissionUser | null | undefined): Exclude<AccessAudience, 'all'> {\n  return isAdminUser(user) ? 'admin' : 'user'\n}\n\nexport function getUserPermissions(user: PermissionUser | null | undefined): string[] {\n  const rolePermissions = getRoleInfo(user)?.permissions\n  if (rolePermissions?.length) return [...rolePermissions]\n  return [...(user?.permissions ?? [])]\n}\n\nexport function hasAllPermissions(\n  user: PermissionUser | null | undefined,\n  permissions: readonly string[] = [],\n): boolean {\n  if (permissions.length === 0) return true\n  if (isAdminUser(user)) return true\n  const granted = new Set(getUserPermissions(user))\n  return permissions.every(permission => granted.has(permission))\n}\n\nexport function hasAnyPermission(\n  user: PermissionUser | null | undefined,\n  permissions: readonly string[] = [],\n): boolean {\n  if (permissions.length === 0) return true\n  if (isAdminUser(user)) return true\n  const granted = new Set(getUserPermissions(user))\n  return permissions.some(permission => granted.has(permission))\n}\n\nexport function canAccessAdmin(user: PermissionUser | null | undefined): boolean {\n  return isAdminUser(user) || hasAnyPermission(user, ADMIN_PANEL_PERMISSIONS)\n}\n\nexport function canAccessPlugin(\n  user: PermissionUser | null | undefined,\n  pluginName: string | null | undefined,\n): boolean {\n  if (!pluginName) return true\n  const access = getRoleInfo(user)?.plugin_access\n  if (!access || access === 'all') return true\n  return Array.isArray(access) && access.includes(pluginName)\n}\n\nexport function normalizeAccessPolicy(rule: AccessControlled | AccessPolicy | undefined): AccessPolicy {\n  if (!rule) return {}\n  const { access: nested, ...direct } = rule as AccessPolicy & { access?: AccessPolicy }\n  return {\n    ...(nested ?? {}),\n    ...direct,\n    ...('visibleFor' in rule && rule.visibleFor !== undefined ? { visibleFor: rule.visibleFor } : {}),\n    ...('requiresAdmin' in rule && rule.requiresAdmin !== undefined ? { requiresAdmin: rule.requiresAdmin } : {}),\n    ...('permissions' in rule && rule.permissions !== undefined ? { permissions: rule.permissions } : {}),\n    ...('anyPermissions' in rule && rule.anyPermissions !== undefined ? { anyPermissions: rule.anyPermissions } : {}),\n  }\n}\n\nexport function canAccessByPolicy(\n  user: PermissionUser | null | undefined,\n  rule: AccessControlled | AccessPolicy | undefined,\n  isAuthenticated = user !== null && user !== undefined,\n): boolean {\n  const policy = normalizeAccessPolicy(rule)\n  if (policy.requiresAuth && !isAuthenticated) return false\n  if (policy.requiresAdmin && !isAdminUser(user)) return false\n  if (!audienceAllowsUser(policy.visibleFor ?? policy.audience, user)) return false\n  if (!hasAllPermissions(user, policy.permissions)) return false\n  if (!hasAnyPermission(user, policy.anyPermissions)) return false\n  if (policy.plugin && !canAccessPlugin(user, policy.plugin)) return false\n  return true\n}\n\nfunction audienceAllowsUser(\n  audience: AccessAudienceInput | undefined,\n  user: PermissionUser | null | undefined,\n): boolean {\n  if (audience === undefined) return true\n  const allowed = Array.isArray(audience) ? audience : [audience]\n  if (allowed.includes('all')) return true\n  return allowed.includes(getAccessAudience(user))\n}\n"],"mappings":";AAAA,IAAa,aAAa;AAE1B,IAAa,0BAA0B;CACrC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAwCD,SAAgB,YAAY,MAA0D;AACpF,QAAO,MAAM,WAAW,MAAM,YAAY;;AAG5C,SAAgB,YAAY,MAA0C;AACpE,QAAO,SAAS;;AAGlB,SAAgB,YAAY,MAAkD;AAC5E,QAAO,YAAY,MAAM,KAAK,IAAI,YAAY,KAAK,EAAE,SAAA;;AAGvD,SAAgB,kBAAkB,MAAyE;AACzG,QAAO,YAAY,KAAK,GAAG,UAAU;;AAGvC,SAAgB,mBAAmB,MAAmD;CACpF,MAAM,kBAAkB,YAAY,KAAK,EAAE;AAC3C,KAAI,iBAAiB,OAAQ,QAAO,CAAC,GAAG,gBAAgB;AACxD,QAAO,CAAC,GAAI,MAAM,eAAe,EAAE,CAAE;;AAGvC,SAAgB,kBACd,MACA,cAAiC,EAAE,EAC1B;AACT,KAAI,YAAY,WAAW,EAAG,QAAO;AACrC,KAAI,YAAY,KAAK,CAAE,QAAO;CAC9B,MAAM,UAAU,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACjD,QAAO,YAAY,OAAM,eAAc,QAAQ,IAAI,WAAW,CAAC;;AAGjE,SAAgB,iBACd,MACA,cAAiC,EAAE,EAC1B;AACT,KAAI,YAAY,WAAW,EAAG,QAAO;AACrC,KAAI,YAAY,KAAK,CAAE,QAAO;CAC9B,MAAM,UAAU,IAAI,IAAI,mBAAmB,KAAK,CAAC;AACjD,QAAO,YAAY,MAAK,eAAc,QAAQ,IAAI,WAAW,CAAC;;AAGhE,SAAgB,eAAe,MAAkD;AAC/E,QAAO,YAAY,KAAK,IAAI,iBAAiB,MAAM,wBAAwB;;AAG7E,SAAgB,gBACd,MACA,YACS;AACT,KAAI,CAAC,WAAY,QAAO;CACxB,MAAM,SAAS,YAAY,KAAK,EAAE;AAClC,KAAI,CAAC,UAAU,WAAW,MAAO,QAAO;AACxC,QAAO,MAAM,QAAQ,OAAO,IAAI,OAAO,SAAS,WAAW;;AAG7D,SAAgB,sBAAsB,MAAiE;AACrG,KAAI,CAAC,KAAM,QAAO,EAAE;CACpB,MAAM,EAAE,QAAQ,QAAQ,GAAG,WAAW;AACtC,QAAO;EACL,GAAI,UAAU,EAAE;EAChB,GAAG;EACH,GAAI,gBAAgB,QAAQ,KAAK,eAAe,KAAA,IAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;EAChG,GAAI,mBAAmB,QAAQ,KAAK,kBAAkB,KAAA,IAAY,EAAE,eAAe,KAAK,eAAe,GAAG,EAAE;EAC5G,GAAI,iBAAiB,QAAQ,KAAK,gBAAgB,KAAA,IAAY,EAAE,aAAa,KAAK,aAAa,GAAG,EAAE;EACpG,GAAI,oBAAoB,QAAQ,KAAK,mBAAmB,KAAA,IAAY,EAAE,gBAAgB,KAAK,gBAAgB,GAAG,EAAE;EACjH;;AAGH,SAAgB,kBACd,MACA,MACA,kBAAkB,SAAS,QAAQ,SAAS,KAAA,GACnC;CACT,MAAM,SAAS,sBAAsB,KAAK;AAC1C,KAAI,OAAO,gBAAgB,CAAC,gBAAiB,QAAO;AACpD,KAAI,OAAO,iBAAiB,CAAC,YAAY,KAAK,CAAE,QAAO;AACvD,KAAI,CAAC,mBAAmB,OAAO,cAAc,OAAO,UAAU,KAAK,CAAE,QAAO;AAC5E,KAAI,CAAC,kBAAkB,MAAM,OAAO,YAAY,CAAE,QAAO;AACzD,KAAI,CAAC,iBAAiB,MAAM,OAAO,eAAe,CAAE,QAAO;AAC3D,KAAI,OAAO,UAAU,CAAC,gBAAgB,MAAM,OAAO,OAAO,CAAE,QAAO;AACnE,QAAO;;AAGT,SAAS,mBACP,UACA,MACS;AACT,KAAI,aAAa,KAAA,EAAW,QAAO;CACnC,MAAM,UAAU,MAAM,QAAQ,SAAS,GAAG,WAAW,CAAC,SAAS;AAC/D,KAAI,QAAQ,SAAS,MAAM,CAAE,QAAO;AACpC,QAAO,QAAQ,SAAS,kBAAkB,KAAK,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@morscherlab/mint-sdk",
-  "version": "1.1.11",
+  "version": "1.1.13",
   "description": "MINT Platform SDK — Vue 3 components, composables, and types for plugin development. MINT = Mass-spec INtegrated Toolkit.",
   "type": "module",
   "main": "./dist/index.js",

package/src/__tests__/utils/permissions.test.ts

@@ -39,6 +39,18 @@ describe('permission helpers', () => {
     expect(canAccessPlugin(member, 'reports')).toBe(false)
   })
 
+  it('allows notice publishers to enter the admin panel', () => {
+    const publisher = {
+      role: 'notice-publisher',
+      role_obj: {
+        slug: 'notice-publisher',
+        permissions: ['notices.publish'],
+      },
+    }
+
+    expect(canAccessAdmin(publisher)).toBe(true)
+  })
+
   it('evaluates access policies consistently', () => {
     expect(canAccessByPolicy(member, { visibleFor: 'user' })).toBe(true)
     expect(canAccessByPolicy(member, { visibleFor: 'admin' })).toBe(false)

package/src/permissions.ts

@@ -8,6 +8,7 @@ export const ADMIN_PANEL_PERMISSIONS = [
   'platform.view_logs',
   'plugins.configure',
   'plugins.install',
+  'notices.publish',
 ] as const
 
 export type AccessAudience = 'all' | 'admin' | 'user'