@northern.tech/store 0.2.1 → 0.3.0

package/dist/usersSlice/constants.cjs

@@ -0,0 +1,798 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/usersSlice/constants.ts
+var constants_exports = {};
+__export(constants_exports, {
+  OWN_USER_ID: () => OWN_USER_ID,
+  PermissionTypes: () => PermissionTypes,
+  READ_STATES: () => READ_STATES,
+  USER_LOGOUT: () => USER_LOGOUT,
+  checkPermissionsObject: () => checkPermissionsObject,
+  defaultPermissionSets: () => defaultPermissionSets,
+  itemUiPermissionsReducer: () => itemUiPermissionsReducer,
+  rolesById: () => rolesById,
+  rolesByName: () => rolesByName,
+  scopedPermissionAreas: () => scopedPermissionAreas,
+  serviceProviderRolesById: () => serviceProviderRolesById,
+  settingsKeys: () => settingsKeys,
+  twoFAStates: () => twoFAStates,
+  uiPermissionsByArea: () => uiPermissionsByArea,
+  uiPermissionsById: () => uiPermissionsById,
+  useradmApiUrl: () => useradmApiUrlv1,
+  useradmApiUrlv1: () => useradmApiUrlv1,
+  useradmApiUrlv2: () => useradmApiUrlv2
+});
+module.exports = __toCommonJS(constants_exports);
+
+// src/appSlice/constants.ts
+var import_icons_material = require("@mui/icons-material");
+var startingDeviceCount = {
+  os: "for first 50 devices",
+  professional: "for first 250 devices"
+};
+var apiRoot = "/api/management";
+var apiUrl = {
+  v1: `${apiRoot}/v1`,
+  v2: `${apiRoot}/v2`
+};
+var chartTypes = {
+  bar: { key: "bar", Icon: import_icons_material.BarChart },
+  pie: { key: "pie", Icon: import_icons_material.PieChartOutline }
+};
+var emptyChartSelection = { software: "", group: "", chartType: chartTypes.bar.key, attribute: "artifact_name" };
+var defaultReportType = "distribution";
+var defaultReports = [{ ...emptyChartSelection, group: null, attribute: "artifact_name", type: defaultReportType }];
+var PLANS = {
+  os: {
+    id: "os",
+    name: "Basic",
+    offer: true,
+    price: "$32/month",
+    deviceCount: startingDeviceCount.os,
+    offerprice: "$23/month for first 50 devices",
+    price2: "for first 6 months;\n$29/month thereafter",
+    features: ["Basic OTA features"]
+  },
+  professional: {
+    id: "professional",
+    name: "Professional",
+    offer: true,
+    price: "$269/month",
+    deviceCount: startingDeviceCount.professional,
+    offerprice: "$200/month for first 50 devices",
+    price2: "for first 6 months;\n$249/month thereafter",
+    features: ["+ Advanced OTA features", "+ Standard support"]
+  },
+  enterprise: {
+    id: "enterprise",
+    name: "Enterprise",
+    price: "Custom pricing",
+    deviceCount: "unlimited devices",
+    features: ["+ Enterprise-grade OTA features", "+ Premium support"]
+  }
+};
+var ADDONS = {
+  configure: {
+    id: "configure",
+    title: "Configure",
+    description: "Expand your plan with device configuration features",
+    needs: ["hasDeviceConfig"],
+    os: {
+      price: "$11/month",
+      deviceCount: startingDeviceCount.os
+    },
+    professional: {
+      price: "$65/month",
+      deviceCount: startingDeviceCount.professional
+    },
+    eligible: ["os", "professional", "enterprise"]
+  },
+  troubleshoot: {
+    id: "troubleshoot",
+    title: "Troubleshoot",
+    description: "Expand your plan with device troubleshooting features",
+    needs: ["hasDeviceConnect"],
+    os: {
+      price: "$27/month",
+      deviceCount: startingDeviceCount.os
+    },
+    professional: {
+      price: "$72/month",
+      deviceCount: startingDeviceCount.professional
+    },
+    eligible: ["os", "professional", "enterprise"]
+  },
+  monitor: {
+    id: "monitor",
+    title: "Monitor",
+    description: "Expand your plan with device monitoring features",
+    needs: ["hasMonitor"],
+    os: {
+      price: "-",
+      deviceCount: "-"
+    },
+    professional: {
+      price: "$86/month",
+      deviceCount: startingDeviceCount.professional
+    },
+    eligible: ["professional", "enterprise"]
+  }
+};
+var BENEFITS = {
+  auditlog: { id: "auditlog", benefit: "trace change across your devices and access troubleshooting session replay", requiredPlan: PLANS.professional.id },
+  dashboard: { id: "dashboard", benefit: "actionable insights into the devices you are updating with Mender", requiredPlan: PLANS.enterprise.id },
+  deltaGeneration: {
+    id: "deltaGeneration",
+    benefit: "automatic delta artifacts generation to minimize data transfer and improve the update delivery",
+    requiredPlan: PLANS.enterprise.id
+  },
+  deviceConfiguration: { id: "deviceConfiguration", benefit: "device configuration features", requiredAddon: ADDONS.configure.id },
+  deviceMonitor: { id: "deviceMonitor", benefit: "device monitoring features", requiredAddon: ADDONS.monitor.id, requiredPlan: PLANS.professional.id },
+  deviceTroubleshoot: { id: "deviceTroubleshoot", benefit: "device troubleshooting features", requiredAddon: ADDONS.troubleshoot.id },
+  dynamicGroups: { id: "dynamicGroups", benefit: "create dynamic groups to ease device management", requiredPlan: PLANS.enterprise.id },
+  fullFiltering: { id: "fullFiltering", benefit: "filtering by multiple attributes to improve the device overview", requiredPlan: PLANS.professional.id },
+  gateway: { id: "gateway", benefit: "see devices connected to your gateway device for easy access", requiredPlans: PLANS.professional.id },
+  pausedDeployments: {
+    id: "pausedDeployments",
+    benefit: "granular control about update rollout to allow synchronization across your fleet",
+    requiredPlan: PLANS.enterprise.id
+  },
+  phasedDeployments: { id: "phasedDeployments", benefit: "choose to roll out deployments in multiple phases", requiredPlan: PLANS.enterprise.id },
+  rbac: { id: "rbac", benefit: "granular role based access control", requiredPlan: PLANS.enterprise.id },
+  retryDeployments: { id: "retryDeployments", benefit: "optional retries for failed rollout attempts", requiredPlan: PLANS.professional.id },
+  scheduledDeployments: {
+    id: "scheduledDeployments",
+    benefit: "scheduled deployments to steer the distribution of your updates.",
+    requiredPlan: PLANS.professional.id
+  },
+  webhookEvents: {
+    id: "webhookEvents",
+    benefit: "receive inventory events and select which type(s) of events the webhook will receive",
+    requiredPlan: PLANS.professional.id
+  },
+  default: { id: "default", benefit: "gain access to this feature", requiredPlan: PLANS.enterprise.id }
+};
+
+// src/commonConstants.tsx
+var import_js = require("@mdi/js");
+var import_jsx_runtime = require("react/jsx-runtime");
+var timeUnits = {
+  days: "days",
+  minutes: "minutes",
+  hours: "hours"
+};
+var ALL_DEVICES = "All devices";
+var DEVICE_FILTERING_OPTIONS = {
+  $eq: { key: "$eq", title: "equals", shortform: "=" },
+  $ne: { key: "$ne", title: "not equal", shortform: "!=" },
+  $gt: {
+    key: "$gt",
+    title: ">",
+    shortform: ">",
+    help: 'The "greater than" operator can work both on numbers and strings. In the latter case, the operator applies the lexicographical order to the value strings.'
+  },
+  $gte: {
+    title: ">=",
+    shortform: ">=",
+    help: 'The "greater than or equal" operator can work both on numbers and strings. In the latter case, the operator applies the lexicographical order to the value strings.'
+  },
+  $lt: {
+    key: "$lt",
+    title: "<",
+    shortform: "<",
+    help: 'The "lesser than" operator can work both on numbers and strings. In the latter case, the operator applies the lexicographical order to the value strings.'
+  },
+  $lte: {
+    title: "<=",
+    shortform: "<=",
+    help: 'The "lesser than or equal" operator can work both on numbers and strings. In the latter case, the operator applies the lexicographical order to the value strings.'
+  },
+  $ltne: {
+    key: "$ltne",
+    title: "$ltne",
+    shortform: "ltne",
+    help: 'The "lesser than or does not exist" operator can work both on numbers and strings. In the latter case, the operator applies the lexicographical order to the value strings.'
+  },
+  $in: {
+    key: "$in",
+    title: "in",
+    shortform: "in",
+    help: 'The "in" operator accepts a list of comma-separated values. It matches if the selected field is equal to one of the specified values.'
+  },
+  $nin: {
+    key: "$nin",
+    title: "not in",
+    shortform: "not in",
+    help: `The "not in" operator accepts a list of comma-separated values. It matches if the selected field's value is not equal to any of the specified options.`
+  },
+  $exists: {
+    key: "$exists",
+    title: "exists",
+    shortform: "exists",
+    value: true,
+    help: `The "exists" operator matches if the selected field's value has a value. No value needs to be provided for this operator.`
+  },
+  $nexists: {
+    key: "$nexists",
+    title: `doesn't exist`,
+    shortform: `doesn't exist`,
+    value: true,
+    help: `The "doesn't exist" operator matches if the selected field's value has no value. No value needs to be provided for this operator.`
+  },
+  $regex: {
+    key: "$regex",
+    title: `matches regular expression`,
+    shortform: `matches`,
+    help: `The "regular expression" operator matches the selected field's value with a Perl compatible regular expression (PCRE), automatically anchored by ^. If the regular expression is not valid, the filter will produce no results. If you need to specify options and flags, you can provide the full regex in the format of /regex/flags, for example.`
+  }
+};
+var DEVICE_ISSUE_OPTIONS = {
+  issues: {
+    isCategory: true,
+    key: "issues",
+    title: "Devices with issues",
+    filterRule: {}
+  },
+  offline: {
+    issueCategory: "issues",
+    key: "offline",
+    needsFullFiltering: true,
+    needsMonitor: false,
+    needsReporting: false,
+    filterRule: {
+      scope: "system",
+      key: "check_in_time",
+      operator: DEVICE_FILTERING_OPTIONS.$ltne.key,
+      value: ({ offlineThreshold }) => offlineThreshold
+    },
+    title: "Offline devices"
+  },
+  failedLastUpdate: {
+    issueCategory: "issues",
+    key: "failedLastUpdate",
+    needsFullFiltering: false,
+    needsMonitor: false,
+    needsReporting: true,
+    filterRule: { scope: "monitor", key: "failed_last_update", operator: DEVICE_FILTERING_OPTIONS.$eq.key, value: true },
+    title: "Deployment failed"
+  },
+  monitoring: {
+    issueCategory: "issues",
+    key: "monitoring",
+    needsFullFiltering: false,
+    needsMonitor: true,
+    needsReporting: false,
+    filterRule: { scope: "monitor", key: "alerts", operator: DEVICE_FILTERING_OPTIONS.$eq.key, value: true },
+    title: "Monitoring alert"
+  },
+  authRequests: {
+    key: "authRequests",
+    needsFullFiltering: false,
+    needsMonitor: false,
+    needsReporting: true,
+    filterRule: { scope: "monitor", key: "auth_requests", operator: DEVICE_FILTERING_OPTIONS.$gt.key, value: 1 },
+    title: "Devices with new authentication requests"
+  },
+  gatewayDevices: {
+    key: "gatewayDevices",
+    needsFullFiltering: false,
+    needsMonitor: false,
+    needsReporting: true,
+    filterRule: { scope: "inventory", key: "mender_is_gateway", operator: DEVICE_FILTERING_OPTIONS.$eq.key, value: "true" },
+    title: "Gateway devices"
+  }
+};
+var oneSecond = 1e3;
+var TIMEOUTS = {
+  debounceDefault: 700,
+  debounceShort: 300,
+  halfASecond: 0.5 * oneSecond,
+  oneSecond,
+  twoSeconds: 2 * oneSecond,
+  threeSeconds: 3 * oneSecond,
+  fiveSeconds: 5 * oneSecond,
+  refreshDefault: 10 * oneSecond,
+  refreshLong: 60 * oneSecond
+};
+var DEVICE_ONLINE_CUTOFF = { interval: 1, intervalName: timeUnits.days };
+var ATTRIBUTE_SCOPES = {
+  inventory: "inventory",
+  identity: "identity",
+  monitor: "monitor",
+  system: "system",
+  tags: "tags"
+};
+var defaultIdAttribute = Object.freeze({ attribute: "id", scope: ATTRIBUTE_SCOPES.identity });
+var credentialTypes = {
+  aws: "aws",
+  http: "http",
+  sas: "sas",
+  x509: "x509"
+};
+var EXTERNAL_PROVIDER = {
+  "iot-core": {
+    credentialsType: credentialTypes.aws,
+    icon: import_js.mdiAws,
+    title: "AWS IoT Core",
+    twinTitle: "Device Shadow",
+    provider: "iot-core",
+    enabled: true,
+    deviceTwin: true,
+    configHint: /* @__PURE__ */ (0, import_jsx_runtime.jsx)(import_jsx_runtime.Fragment, { children: "For help finding your AWS IoT Core connection string, check the AWS IoT documentation." })
+  },
+  "iot-hub": {
+    credentialsType: credentialTypes.sas,
+    icon: import_js.mdiMicrosoftAzure,
+    title: "Azure IoT Hub",
+    twinTitle: "Device Twin",
+    provider: "iot-hub",
+    enabled: true,
+    deviceTwin: true,
+    configHint: /* @__PURE__ */ (0, import_jsx_runtime.jsxs)("span", { children: [
+      "For help finding your Azure IoT Hub connection string, look under 'Shared access policies' in the Microsoft Azure UI as described",
+      " ",
+      /* @__PURE__ */ (0, import_jsx_runtime.jsx)(
+        "a",
+        {
+          href: "https://devblogs.microsoft.com/iotdev/understand-different-connection-strings-in-azure-iot-hub/#iothubconn",
+          target: "_blank",
+          rel: "noopener noreferrer",
+          children: "here"
+        }
+      ),
+      "."
+    ] })
+  },
+  webhook: {
+    credentialsType: credentialTypes.http,
+    deviceTwin: false,
+    // disable the webhook provider here, since it is treated different than other integrations, with a custom configuration & management view, etc.
+    enabled: false,
+    provider: "webhook"
+  }
+};
+var ALL_RELEASES = "All releases";
+var emptyUiPermissions = Object.freeze({
+  auditlog: [],
+  deployments: [],
+  groups: Object.freeze({}),
+  releases: Object.freeze({}),
+  tenantManagement: [],
+  userManagement: []
+});
+var emptyRole = Object.freeze({
+  name: void 0,
+  description: "",
+  permissions: [],
+  uiPermissions: Object.freeze({ ...emptyUiPermissions })
+});
+
+// src/usersSlice/constants.ts
+var useradmApiUrlv1 = `${apiUrl.v1}/useradm`;
+var useradmApiUrlv2 = `${apiUrl.v2}/useradm`;
+var staticRolesByName = {
+  admin: "RBAC_ROLE_PERMIT_ALL",
+  readOnly: "RBAC_ROLE_OBSERVER",
+  ci: "RBAC_ROLE_CI",
+  deploymentsManager: "RBAC_ROLE_DEPLOYMENTS_MANAGER",
+  terminalAccess: "RBAC_ROLE_REMOTE_TERMINAL"
+};
+var PermissionTypes = {
+  Any: "any",
+  Get: "GET",
+  Post: "POST",
+  Put: "PUT",
+  Delete: "DELETE",
+  Patch: "PATCH",
+  DeviceGroup: "DEVICE_GROUP",
+  DeviceId: "DEVICE_ID"
+};
+var permissionSetIds = {
+  Basic: "Basic",
+  ConfigureDevices: "ConfigureDevices",
+  ConnectToDevices: "ConnectToDevices",
+  DeployToDevices: "DeployToDevices",
+  ManageDevices: "ManageDevices",
+  ManageReleases: "ManageReleases",
+  ManageTenants: "ManageTenants",
+  ManageUsers: "ManageUsers",
+  ReadAuditLogs: "ReadAuditLogs",
+  ReadDevices: "ReadDevices",
+  ReadReleases: "ReadReleases",
+  ReadTenants: "ReadTenants",
+  ReadUsers: "ReadUsers",
+  SuperUser: "SuperUser",
+  UploadArtifacts: "UploadArtifacts"
+};
+var uiPermissionsById = {
+  configure: {
+    explanations: { groups: `'Configure' allows the user to use mender-configure features and apply configurations.` },
+    permissionLevel: 2,
+    permissionSets: { groups: permissionSetIds.ConfigureDevices },
+    title: "Configure",
+    value: "configure",
+    verbs: [PermissionTypes.Get, PermissionTypes.Put, PermissionTypes.Post]
+  },
+  connect: {
+    explanations: { groups: `'Connect' allows the user to use mender-connect features and Troubleshoot add-ons.` },
+    permissionLevel: 2,
+    permissionSets: { groups: permissionSetIds.ConnectToDevices },
+    title: "Connect",
+    value: "connect",
+    verbs: [PermissionTypes.Get, PermissionTypes.Put]
+  },
+  deploy: {
+    explanations: { groups: `'Deploy' allows the user to deploy software or configuration updates to devices.` },
+    permissionLevel: 2,
+    permissionSets: { deployments: permissionSetIds.DeployToDevices, groups: permissionSetIds.DeployToDevices },
+    title: "Deploy",
+    value: "deploy",
+    verbs: [PermissionTypes.Post]
+  },
+  manage: {
+    explanations: {
+      groups: `'Manage' allows the user to edit device name, notes, and manage authentication status. For 'All devices' it also allows the user to edit and create device groups.`,
+      releases: `'Manage' allows the user to upload new artifacts, edit release descriptions and remove artifacts.`
+    },
+    permissionLevel: 2,
+    permissionSets: {
+      groups: permissionSetIds.ManageDevices,
+      releases: permissionSetIds.ManageReleases,
+      tenantManagement: permissionSetIds.ManageTenants,
+      userManagement: permissionSetIds.ManageUsers
+    },
+    title: "Manage",
+    value: "manage",
+    verbs: [PermissionTypes.Post, PermissionTypes.Put, PermissionTypes.Patch]
+  },
+  read: {
+    explanations: { groups: `'Read' allows the user to view devices.` },
+    permissionLevel: 1,
+    permissionSets: {
+      auditlog: permissionSetIds.ReadAuditLogs,
+      groups: permissionSetIds.ReadDevices,
+      releases: permissionSetIds.ReadReleases,
+      tenantManagement: permissionSetIds.ReadTenants,
+      userManagement: permissionSetIds.ReadUsers
+    },
+    title: "Read",
+    value: "read",
+    verbs: [PermissionTypes.Get, PermissionTypes.Post]
+  },
+  upload: {
+    explanations: { groups: `'Upload' allows the user to upload new Artifacts.` },
+    unscopedOnly: { releases: true },
+    permissionLevel: 1,
+    permissionSets: { releases: permissionSetIds.UploadArtifacts },
+    title: "Upload",
+    value: "upload",
+    verbs: [PermissionTypes.Post, PermissionTypes.Put, PermissionTypes.Patch]
+  }
+};
+var scopedPermissionAreas = {
+  groups: { key: "groups", excessiveAccessSelector: ALL_DEVICES, scopeType: "DeviceGroups" },
+  releases: { key: "releases", excessiveAccessSelector: ALL_RELEASES, scopeType: "Releases" }
+};
+var uiPermissionsByArea = {
+  auditlog: {
+    endpoints: [{ path: /\/(auditlog)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.read] }],
+    explanation: "Granting access to the audit log will allow tracing changes to devices, releases and user accounts, as well as providing information about deployments.",
+    key: "auditlog",
+    uiPermissions: [uiPermissionsById.read],
+    title: "System audit log"
+  },
+  deployments: {
+    endpoints: [
+      { path: /\/(deployments\/deployments)/i, types: [PermissionTypes.Post, PermissionTypes.Put], uiPermissions: [uiPermissionsById.deploy] },
+      { path: /\/(deployments\/deployments)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.read] },
+      { path: /\/(deployments\/config)/i, types: [PermissionTypes.Get, PermissionTypes.Put], uiPermissions: [uiPermissionsById.manage] }
+    ],
+    explanation: "Providing deploy permissions will allow deployments to be created using the releases and devices a user has access to.",
+    key: "deployments",
+    uiPermissions: [uiPermissionsById.read, uiPermissionsById.deploy],
+    title: "Deployments"
+  },
+  groups: {
+    endpoints: [
+      {
+        path: /\/(devauth|inventory|deviceconfig|devicemonitor|deviceconnect\/devices)/i,
+        types: [PermissionTypes.Get],
+        uiPermissions: [uiPermissionsById.read]
+      },
+      { path: /\/(devauth|inventory)/i, types: [PermissionTypes.Put, PermissionTypes.Post], uiPermissions: [uiPermissionsById.manage] },
+      { path: /\/(deviceconfig)/i, types: [PermissionTypes.Get, PermissionTypes.Put, PermissionTypes.Post], uiPermissions: [uiPermissionsById.configure] },
+      { path: /\/(deviceconnect\/devices)/i, types: [PermissionTypes.Get, PermissionTypes.Post], uiPermissions: [uiPermissionsById.connect] }
+    ],
+    explanation: "Device group management permissions control the degree to which devices in a group can be accessed and moved to other groups.",
+    key: "groups",
+    scope: scopedPermissionAreas.groups.scopeType,
+    uiPermissions: [uiPermissionsById.read, uiPermissionsById.manage, uiPermissionsById.deploy, uiPermissionsById.configure, uiPermissionsById.connect],
+    title: "Group Management"
+  },
+  releases: {
+    endpoints: [
+      { path: /\/(deployments\/artifacts|deployments\/deployments\/releases)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.read] },
+      {
+        path: /\/(deployments\/artifacts|deployments\/deployments\/releases)/i,
+        types: [PermissionTypes.Post, PermissionTypes.Put],
+        uiPermissions: [uiPermissionsById.read, uiPermissionsById.upload]
+      },
+      {
+        path: /\/(deployments\/artifacts|deployments\/deployments\/releases)/i,
+        types: [PermissionTypes.Delete],
+        uiPermissions: [uiPermissionsById.read, uiPermissionsById.manage]
+      }
+    ],
+    explanation: "Release permissions can be granted to allow artifact & release modifications, as well as the creation of new releases.",
+    key: "releases",
+    scope: "ReleaseTags",
+    uiPermissions: [uiPermissionsById.read, uiPermissionsById.manage, uiPermissionsById.upload],
+    title: "Release Management"
+  },
+  tenantManagement: {
+    endpoints: [
+      { path: /\/(tenantadm\/tenants)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.read] },
+      { path: /\/(tenantadm\/tenants)/i, types: [PermissionTypes.Post, PermissionTypes.Put], uiPermissions: [uiPermissionsById.manage] },
+      { path: /\/(users\/exists)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.manage] }
+    ],
+    explanation: "Tenant management permissions allow listing, creating and modifying child tenants",
+    key: "tenantManagement",
+    uiPermissions: [uiPermissionsById.read, uiPermissionsById.manage],
+    title: "Tenant Management"
+  },
+  userManagement: {
+    endpoints: [
+      { path: /\/(useradm)/i, types: [PermissionTypes.Get], uiPermissions: [uiPermissionsById.read] },
+      { path: /\/(useradm)/i, types: [PermissionTypes.Post], uiPermissions: [uiPermissionsById.manage] }
+    ],
+    explanation: "User management permissions should be granted carefully, as these allow privilege increases for any users managed by a user with user management permissions",
+    key: "userManagement",
+    uiPermissions: [uiPermissionsById.read, uiPermissionsById.manage],
+    title: "User Management"
+  }
+};
+var permissionMapper = (permission) => permission.value;
+var itemUiPermissionsReducer = (accu, { item, uiPermissions }) => item ? { ...accu, [item]: uiPermissions } : accu;
+var checkSinglePermission = (permission, requiredPermission) => requiredPermission === permission || uiPermissionsById[permission].permissionLevel > uiPermissionsById[requiredPermission].permissionLevel;
+var checkPermissionsObject = (permissions, requiredPermission, scopedAccess, superAccess) => permissions[superAccess]?.some((permission) => checkSinglePermission(permission, requiredPermission)) || permissions[scopedAccess]?.some((permission) => checkSinglePermission(permission, requiredPermission));
+var rolesById = Object.freeze({
+  [staticRolesByName.admin]: {
+    name: "Admin",
+    value: staticRolesByName.admin,
+    description: "Full access",
+    permissions: [],
+    // permissions refers to the values returned from the backend
+    uiPermissions: {
+      ...emptyUiPermissions,
+      auditlog: uiPermissionsByArea.auditlog.uiPermissions.map(permissionMapper),
+      deployments: uiPermissionsByArea.deployments.uiPermissions.map(permissionMapper),
+      groups: { [ALL_DEVICES]: uiPermissionsByArea.groups.uiPermissions.map(permissionMapper) },
+      releases: { [ALL_RELEASES]: uiPermissionsByArea.releases.uiPermissions.map(permissionMapper) },
+      userManagement: uiPermissionsByArea.userManagement.uiPermissions.map(permissionMapper)
+    }
+  },
+  [staticRolesByName.readOnly]: {
+    name: "Read Access",
+    value: staticRolesByName.readOnly,
+    description: "",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      deployments: [uiPermissionsById.read.value],
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value] },
+      releases: { [ALL_RELEASES]: [uiPermissionsById.read.value] },
+      userManagement: [uiPermissionsById.read.value]
+    }
+  },
+  [staticRolesByName.ci]: {
+    name: "Releases Manager",
+    value: staticRolesByName.ci,
+    description: "",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      releases: { [ALL_RELEASES]: uiPermissionsByArea.releases.uiPermissions.map(permissionMapper) }
+    }
+  },
+  [staticRolesByName.deploymentsManager]: {
+    name: "Deployments Manager",
+    value: staticRolesByName.deploymentsManager,
+    description: "",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      deployments: uiPermissionsByArea.deployments.uiPermissions.map(permissionMapper),
+      groups: { [ALL_DEVICES]: [uiPermissionsById.deploy.value, uiPermissionsById.read.value] },
+      releases: { [ALL_RELEASES]: [uiPermissionsById.read.value] }
+    }
+  },
+  [staticRolesByName.terminalAccess]: {
+    name: "Troubleshooting",
+    value: staticRolesByName.terminalAccess,
+    description: "Access to the troubleshooting features: Remote Terminal, File Transfer, Port Forwarding",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      groups: { [ALL_DEVICES]: [uiPermissionsById.connect.value] }
+    }
+  }
+});
+var serviceProviderRolesById = {
+  admin: {
+    name: "Admin",
+    value: staticRolesByName.admin,
+    description: "Full access",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      auditlog: uiPermissionsByArea.auditlog.uiPermissions.map(permissionMapper),
+      userManagement: uiPermissionsByArea.userManagement.uiPermissions.map(permissionMapper),
+      tenantManagement: uiPermissionsByArea.tenantManagement.uiPermissions.map(permissionMapper)
+    }
+  },
+  readOnly: {
+    name: "Read access",
+    value: staticRolesByName.admin,
+    description: "This role can see all linked organizations but cannot make any changes",
+    permissions: [],
+    uiPermissions: {
+      ...emptyUiPermissions,
+      auditlog: [uiPermissionsById.read.value],
+      userManagement: [uiPermissionsById.read.value],
+      tenantManagement: [uiPermissionsById.read.value]
+    }
+  }
+};
+var defaultPermissionSets = {
+  [permissionSetIds.Basic]: {
+    name: permissionSetIds.Basic,
+    result: {
+      // this is needed to prevent the detailed permissions of the basic permission set from being interpreted as allowing read & management access to user endpoints
+      userManagement: [uiPermissionsById.read.value]
+    }
+  },
+  [permissionSetIds.SuperUser]: {
+    name: permissionSetIds.SuperUser,
+    result: {
+      ...rolesById[staticRolesByName.admin].uiPermissions
+    }
+  },
+  [permissionSetIds.ManageUsers]: {
+    name: permissionSetIds.ManageUsers,
+    result: {
+      userManagement: [uiPermissionsById.manage.value]
+    }
+  },
+  [permissionSetIds.ReadAuditLogs]: {
+    name: permissionSetIds.ReadAuditLogs,
+    result: {
+      auditlog: [uiPermissionsById.read.value]
+    }
+  },
+  [permissionSetIds.ReadReleases]: {
+    name: permissionSetIds.ReadReleases,
+    result: {
+      releases: { [ALL_RELEASES]: [uiPermissionsById.read.value] }
+    }
+  },
+  [permissionSetIds.ReadTenants]: {
+    name: permissionSetIds.ReadTenants,
+    result: {
+      tenantManagement: [uiPermissionsById.read.value]
+    }
+  },
+  [permissionSetIds.ManageTenants]: {
+    name: permissionSetIds.ManageTenants,
+    result: {
+      tenantManagement: [uiPermissionsById.manage.value]
+    }
+  },
+  [permissionSetIds.ReadUsers]: {
+    name: permissionSetIds.ReadUsers,
+    result: {
+      userManagement: [uiPermissionsById.read.value]
+    }
+  },
+  [permissionSetIds.UploadArtifacts]: {
+    name: permissionSetIds.UploadArtifacts,
+    result: {
+      releases: { [ALL_RELEASES]: [uiPermissionsById.upload.value] }
+    }
+  },
+  [permissionSetIds.ManageReleases]: {
+    name: permissionSetIds.ManageReleases,
+    result: {
+      releases: { [ALL_RELEASES]: [uiPermissionsById.manage.value] }
+    }
+  },
+  [permissionSetIds.ConfigureDevices]: {
+    name: permissionSetIds.ConfigureDevices,
+    result: {
+      deployments: [uiPermissionsById.read.value, uiPermissionsById.deploy.value],
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value, uiPermissionsById.configure.value] }
+    }
+  },
+  [permissionSetIds.ConnectToDevices]: {
+    name: permissionSetIds.ConnectToDevices,
+    result: {
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value, uiPermissionsById.connect.value] }
+    }
+  },
+  [permissionSetIds.DeployToDevices]: {
+    name: permissionSetIds.DeployToDevices,
+    result: {
+      deployments: [uiPermissionsById.deploy.value, uiPermissionsById.manage.value, uiPermissionsById.read.value],
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value, uiPermissionsById.deploy.value] }
+    }
+  },
+  [permissionSetIds.ManageDevices]: {
+    name: permissionSetIds.ManageDevices,
+    result: {
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value, uiPermissionsById.manage.value] }
+    }
+  },
+  [permissionSetIds.ReadDevices]: {
+    name: permissionSetIds.ReadDevices,
+    result: {
+      groups: { [ALL_DEVICES]: [uiPermissionsById.read.value] }
+    }
+  }
+};
+var USER_LOGOUT = "USER_LOGOUT";
+var OWN_USER_ID = "me";
+var rolesByName = {
+  ...staticRolesByName,
+  deploymentCreation: { action: "CREATE_DEPLOYMENT", object: { type: "DEVICE_GROUP", value: void 0 } },
+  groupAccess: { action: "VIEW_DEVICE", object: { type: "DEVICE_GROUP", value: void 0 } },
+  userManagement: { action: "http", object: { type: "any", value: `${useradmApiUrlv1}/.*` } }
+};
+var twoFAStates = {
+  enabled: "enabled",
+  disabled: "disabled",
+  unverified: "unverified"
+};
+var settingsKeys = { initialized: "settings-initialized" };
+var READ_STATES = {
+  read: "read",
+  seen: "seen",
+  unread: "unread"
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  OWN_USER_ID,
+  PermissionTypes,
+  READ_STATES,
+  USER_LOGOUT,
+  checkPermissionsObject,
+  defaultPermissionSets,
+  itemUiPermissionsReducer,
+  rolesById,
+  rolesByName,
+  scopedPermissionAreas,
+  serviceProviderRolesById,
+  settingsKeys,
+  twoFAStates,
+  uiPermissionsByArea,
+  uiPermissionsById,
+  useradmApiUrl,
+  useradmApiUrlv1,
+  useradmApiUrlv2
+});
+//# sourceMappingURL=constants.cjs.map