@pareto4/pp-core 1.19.0 → 1.20.0

package/pp-core/bin/lib/discovery-access.cjs

@@ -0,0 +1,276 @@
+"use strict";
+/**
+ * Discovery access-model check (Discovery Sprint improvement plan, Batch 3).
+ *
+ * `.planning/discovery/_roles.md` is the register of roles and what each may
+ * do — Session 7 writes it in place of the old preset RBAC matrix. Three
+ * tables: `## Roles` (the role, what it is, its data scope, how it is
+ * recovered when its last holder leaves — the vault's role-recovery rule —
+ * and its source), `## Permissions` (role × operation × entity, with the
+ * condition that narrows it and the requirements it realises; one row per
+ * role-and-entity, operations as a list — never CRUD columns) and
+ * `## Screens` (which role may open which `SCR-` screen, the join the
+ * forbidden-path tests are written from). The build's planner reads the
+ * permissions by requirement ID. This module checks the structure:
+ *
+ *   - the three sections exist with the template's columns;
+ *   - every role is a Session 2 persona, an actor a step matrix names, or
+ *     `System`, when those sources are on file (a role nobody plays is a
+ *     role the build cannot test), and is listed once;
+ *   - every permission and screen row names a role of `## Roles`;
+ *   - every entity resolves against `_entities.md`, every screen against
+ *     `_screens.md`, every requirement against `_requirements.md`, when
+ *     those artifacts are on file and parseable;
+ *   - operations are a comma list of lowercase verbs.
+ *
+ * Posture (D-43/D-53): reports at Sessions 8 and 13; hard-blocks at
+ * `/pp-discovery-to-build`. Absent artifact → exit 0.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const io = require("./io.cjs");
+const { output, error, ERROR_REASON } = io;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const table = require("./discovery-table.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const rollup = require("./discovery-rollup.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const processes = require("./discovery-processes.cjs");
+// ─── Constants ────────────────────────────────────────────────────────────────
+const DISCOVERY_DIR = '.planning/discovery';
+const ROLES_FILE = `${DISCOVERY_DIR}/_roles.md`;
+const REQUIREMENTS_FILE = `${DISCOVERY_DIR}/_requirements.md`;
+const ENTITIES_FILE = `${DISCOVERY_DIR}/_entities.md`;
+const PROCESSES_FILE = `${DISCOVERY_DIR}/_processes.md`;
+const SCREENS_FILE = `${DISCOVERY_DIR}/_screens.md`;
+const SESSION_02_FILE = `${DISCOVERY_DIR}/session-02.md`;
+const ROLES_SECTION = 'Roles';
+const PERMISSIONS_SECTION = 'Permissions';
+const SCREENS_SECTION = 'Screens';
+const ROLES_HEADER = Object.freeze(['Role', 'Description', 'Scope', 'Recovery path', 'Source']);
+const PERMISSIONS_HEADER = Object.freeze(['Role', 'Entity', 'Operation', 'Condition', 'Requirements']);
+const SCREENS_HEADER = Object.freeze(['Role', 'Screen']);
+const SYSTEM_ACTOR = 'System';
+const ENTITY_NAME_RE = /^[A-Z][A-Za-z0-9]*$/;
+const OPERATION_RE = /^[a-z][a-z-]*$/;
+const SCREEN_ID_RE = /^SCR-\d{2}$/;
+const REQUIREMENT_ID_RE = /^[A-Z][A-Z0-9]*-\d+$/;
+const STEPS_ACTOR_COLUMN = 'Actor';
+const USAGE = 'Usage: pp-tools discovery roles-check';
+function readIfPresent(abs) {
+    if (!node_fs_1.default.existsSync(abs))
+        return { kind: 'absent' };
+    try {
+        return { kind: 'ok', content: node_fs_1.default.readFileSync(abs, 'utf-8') };
+    }
+    catch {
+        return { kind: 'unreadable' };
+    }
+}
+function sameHeader(actual, expected) {
+    return actual.length === expected.length && actual.every((c, i) => c.trim().toLowerCase() === expected[i].toLowerCase());
+}
+function splitList(cell) {
+    return cell.split(',').map((t) => t.trim()).filter(Boolean);
+}
+/** First-column values of the first table under a `## <heading>` of another artifact. */
+function firstColumnOf(content, heading) {
+    const section = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === heading);
+    if (!section)
+        return new Set();
+    const tables = table.parseTables(section.body);
+    if (tables.length === 0)
+        return new Set();
+    return new Set(tables[0].rows.map((r) => (r.cells[0] ?? '').trim()).filter(Boolean));
+}
+/** Every actor a step matrix of `_processes.md` § Steps names, by the `Actor` column. */
+function stepActors(content) {
+    const out = new Set();
+    const steps = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === 'Steps');
+    if (!steps)
+        return out;
+    for (const t of table.parseTables(steps.body)) {
+        const col = t.header.findIndex((h) => h.trim().toLowerCase() === STEPS_ACTOR_COLUMN.toLowerCase());
+        if (col === -1)
+            continue;
+        for (const r of t.rows)
+            for (const a of splitList(r.cells[col] ?? ''))
+                out.add(a);
+    }
+    return out;
+}
+/** The first table under `## <heading>`, header-checked; faults are pushed and null returned. */
+function sectionTable(content, heading, expected, violations) {
+    const section = table.splitSections(content.split(/\r?\n/), 2).find((s) => s.heading === heading);
+    if (!section) {
+        violations.push({ artifact: ROLES_FILE, reason: 'missing_section', id: heading });
+        return null;
+    }
+    const tables = table.parseTables(section.body);
+    if (tables.length === 0) {
+        violations.push({ artifact: ROLES_FILE, reason: 'missing_section', line: section.line, id: heading });
+        return null;
+    }
+    if (!sameHeader(tables[0].header, expected)) {
+        violations.push({ artifact: ROLES_FILE, reason: 'bad_table_shape', line: tables[0].line, id: heading });
+        return null;
+    }
+    return tables[0];
+}
+// ─── Check ────────────────────────────────────────────────────────────────────
+function checkRoles(content, sources) {
+    const violations = [];
+    const roles = sectionTable(content, ROLES_SECTION, ROLES_HEADER, violations);
+    const permissions = sectionTable(content, PERMISSIONS_SECTION, PERMISSIONS_HEADER, violations);
+    const screens = sectionTable(content, SCREENS_SECTION, SCREENS_HEADER, violations);
+    const known = new Set();
+    if (roles) {
+        for (const row of roles.rows) {
+            const [role, description, scope, recovery] = row.cells.map((c) => c.trim());
+            if ((role ?? '') === '') {
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Role' });
+            }
+            else if (known.has(role)) {
+                violations.push({ artifact: ROLES_FILE, reason: 'duplicate_role', line: row.line, id: role.slice(0, 40) });
+            }
+            else {
+                known.add(role);
+                if (sources.actors !== null && role !== SYSTEM_ACTOR && !sources.actors.has(role))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_role', line: row.line, id: role.slice(0, 40) });
+            }
+            if ((description ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Description' });
+            if ((scope ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Scope' });
+            if ((recovery ?? '') === '')
+                violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line: row.line, id: 'Recovery path' });
+        }
+    }
+    const roleRef = (role, line) => {
+        if (role === '')
+            violations.push({ artifact: ROLES_FILE, reason: 'empty_cell', line, id: 'Role' });
+        else if (roles && !known.has(role))
+            violations.push({ artifact: ROLES_FILE, reason: 'unknown_role', line, id: role.slice(0, 40) });
+    };
+    if (permissions) {
+        for (const row of permissions.rows) {
+            const [role, entity, operation, , requirements] = row.cells.map((c) => c.trim());
+            roleRef(role ?? '', row.line);
+            if (!ENTITY_NAME_RE.test(entity ?? ''))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_entity', line: row.line });
+            else if (sources.entities !== null && !sources.entities.has(entity))
+                violations.push({ artifact: ROLES_FILE, reason: 'unknown_entity', line: row.line, id: entity });
+            const ops = splitList(operation ?? '');
+            if (ops.length === 0 || ops.some((o) => !OPERATION_RE.test(o)))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_operation', line: row.line });
+            const reqs = splitList(requirements ?? '');
+            if (reqs.length === 0)
+                violations.push({ artifact: ROLES_FILE, reason: 'no_requirement', line: row.line });
+            for (const r of reqs) {
+                if (!REQUIREMENT_ID_RE.test(r))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_requirement_id', line: row.line, id: r.slice(0, 40) });
+                else if (sources.requirementIds instanceof Set && !sources.requirementIds.has(r))
+                    violations.push({ artifact: ROLES_FILE, reason: 'unknown_requirement_id', line: row.line, id: r });
+            }
+        }
+    }
+    if (screens) {
+        for (const row of screens.rows) {
+            const [role, screen] = row.cells.map((c) => c.trim());
+            roleRef(role ?? '', row.line);
+            if (!SCREEN_ID_RE.test(screen ?? ''))
+                violations.push({ artifact: ROLES_FILE, reason: 'bad_screen', line: row.line });
+            else if (sources.screens !== null && !sources.screens.has(screen))
+                violations.push({ artifact: ROLES_FILE, reason: 'unknown_screen', line: row.line, id: screen });
+        }
+    }
+    if (sources.requirementIds === 'unparseable')
+        violations.push({ artifact: REQUIREMENTS_FILE, reason: 'requirements_unparseable' });
+    return {
+        ok: violations.length === 0,
+        roles: known.size,
+        permissions: permissions ? permissions.rows.length : 0,
+        screens: screens ? screens.rows.length : 0,
+        violations,
+    };
+}
+function checkProjectRoles(cwd) {
+    const read = readIfPresent(node_path_1.default.join(cwd, ROLES_FILE));
+    if (read.kind === 'absent')
+        return null;
+    if (read.kind === 'unreadable')
+        return { ok: false, file: ROLES_FILE, roles: 0, permissions: 0, screens: 0, violations: [{ artifact: ROLES_FILE, reason: 'artifact_unreadable' }] };
+    const extra = [];
+    const sources = { actors: null, entities: null, screens: null, requirementIds: null };
+    const s2 = readIfPresent(node_path_1.default.join(cwd, SESSION_02_FILE));
+    if (s2.kind === 'unreadable')
+        extra.push({ artifact: SESSION_02_FILE, reason: 'artifact_unreadable' });
+    const personas = s2.kind === 'ok' ? processes.personasFrom(s2.content) : null;
+    const proc = readIfPresent(node_path_1.default.join(cwd, PROCESSES_FILE));
+    if (proc.kind === 'unreadable')
+        extra.push({ artifact: PROCESSES_FILE, reason: 'artifact_unreadable' });
+    const actors = proc.kind === 'ok' ? stepActors(proc.content) : null;
+    if (personas !== null || actors !== null)
+        sources.actors = new Set([...(personas ?? []), ...(actors ?? [])]);
+    const ent = readIfPresent(node_path_1.default.join(cwd, ENTITIES_FILE));
+    if (ent.kind === 'unreadable')
+        extra.push({ artifact: ENTITIES_FILE, reason: 'artifact_unreadable' });
+    if (ent.kind === 'ok')
+        sources.entities = firstColumnOf(ent.content, 'Entities');
+    const scr = readIfPresent(node_path_1.default.join(cwd, SCREENS_FILE));
+    if (scr.kind === 'unreadable')
+        extra.push({ artifact: SCREENS_FILE, reason: 'artifact_unreadable' });
+    if (scr.kind === 'ok')
+        sources.screens = firstColumnOf(scr.content, 'Screens');
+    const req = readIfPresent(node_path_1.default.join(cwd, REQUIREMENTS_FILE));
+    if (req.kind === 'unreadable')
+        extra.push({ artifact: REQUIREMENTS_FILE, reason: 'artifact_unreadable' });
+    if (req.kind === 'ok') {
+        const parsed = rollup.parseRequirementsArtifact(req.content);
+        sources.requirementIds = parsed.ok ? new Set(parsed.rows.map((r) => r.id)) : 'unparseable';
+    }
+    const result = checkRoles(read.content, sources);
+    result.violations.push(...extra);
+    result.ok = result.violations.length === 0;
+    return { file: ROLES_FILE, ...result };
+}
+function formatViolation(v) {
+    const where = v.line !== undefined ? `:${v.line}` : '';
+    const what = v.id !== undefined ? ` (${v.id})` : '';
+    return `  - ${v.artifact}${where}: ${v.reason}${what}`;
+}
+// ─── CLI adapter ──────────────────────────────────────────────────────────────
+/** `pp-tools discovery roles-check` (dotted `query discovery.roles-check`). Absent artifact → exit 0, `present: false`. */
+function cmdDiscoveryRolesCheck(cwd, args, raw) {
+    if (args.length > 2) {
+        error(USAGE, ERROR_REASON.USAGE);
+        return; // unreachable
+    }
+    const result = checkProjectRoles(cwd);
+    if (result === null) {
+        output({ ok: true, present: false, file: ROLES_FILE }, raw);
+        return;
+    }
+    const payload = { ok: result.ok, present: true, file: result.file, roles: result.roles, permissions: result.permissions, screens: result.screens };
+    if (!result.ok) {
+        output({ ...payload, violations: result.violations.length }, raw);
+        error(`discovery roles-check: ${result.violations.length} violation(s):\n` + result.violations.map(formatViolation).join('\n'), ERROR_REASON.DISCOVERY_ROLES_CHECK_FAILED);
+        return; // unreachable
+    }
+    output(payload, raw);
+}
+module.exports = {
+    ROLES_FILE,
+    ROLES_HEADER,
+    PERMISSIONS_HEADER,
+    SCREENS_HEADER,
+    ROLES_CHECK_FAILED: ERROR_REASON.DISCOVERY_ROLES_CHECK_FAILED,
+    stepActors,
+    checkRoles,
+    checkProjectRoles,
+    cmdDiscoveryRolesCheck,
+};