@peanut-admin/admin 0.1.0-alpha.4 → 0.1.0-alpha.6

package/admin-core/src/access/permission-policy.ts

@@ -0,0 +1,37 @@
+import { hasPermission } from './access'
+import { defineAdminOverrideSlot } from '../runtime/overrides'
+
+export type PermissionEvaluator = (
+  permissions: ReadonlySet<string>,
+  permission: string,
+) => boolean
+
+export const PERMISSION_EVALUATOR_OVERRIDE_KEY =
+  'authorization.permission.service.evaluator' as const
+
+const isPermissionEvaluator = (candidate: unknown): candidate is PermissionEvaluator => (
+  typeof candidate === 'function'
+)
+
+export const permissionEvaluatorSlot = defineAdminOverrideSlot({
+  key: PERMISSION_EVALUATOR_OVERRIDE_KEY,
+  kind: 'service' as const,
+  contractVersion: '1.0.0',
+  defaultValue: hasPermission as PermissionEvaluator,
+  validate: isPermissionEvaluator,
+})
+
+export const evaluateRequiredPermissions = (
+  requiredPermissions: string | string[],
+  grantedPermissions: readonly string[],
+  evaluator: PermissionEvaluator,
+): boolean => {
+  const required = (Array.isArray(requiredPermissions) ? requiredPermissions : [requiredPermissions])
+    .filter(Boolean)
+  if (required.length === 0) return true
+
+  const permissionSet = new Set(grantedPermissions)
+  return permissionSet.has('*') || required.some(
+    permission => permission !== '*' && evaluator(permissionSet, permission),
+  )
+}

package/admin-core/src/auth/tenant-session.ts

@@ -0,0 +1,32 @@
+export interface TenantChoice {
+  tenant_id: number
+  tenant_code: string
+  tenant_name: string
+  member_id: number
+  member_display_name: string
+}
+
+export interface TenantSelection {
+  state: 'tenant_selection_required'
+  challenge_token: string
+  expires_at: string
+  tenants: TenantChoice[]
+}
+
+export interface TenantAuthentication {
+  state: 'authenticated'
+  access_token: string
+  token_type: 'Bearer'
+  expires_in: number
+  context: {
+    tenant_id: string
+    account_id: string
+    tenant_member_id: string
+  }
+}
+
+export type TenantSessionOutcome = TenantSelection | TenantAuthentication
+
+export const isMultiTenantDeployment = (value: unknown): boolean => value === 'multi-tenant'
+
+export const isTenantAccessToken = (token: string | null): boolean => token?.startsWith('pa_tat_') === true

package/admin-core/src/index.ts

@@ -14,6 +14,12 @@ export { isProblemCode, parseProblemDetails } from './api/problem'
 export type { ProblemDetails, ProblemFieldError } from './api/problem'
 export { hasAllPermissions, hasPermission, useAccess } from './access/access'
 export type { AccessHints } from './access/access'
+export {
+  evaluateRequiredPermissions,
+  permissionEvaluatorSlot,
+  PERMISSION_EVALUATOR_OVERRIDE_KEY,
+} from './access/permission-policy'
+export type { PermissionEvaluator } from './access/permission-policy'
 export {
   usePlatformAuth,
   usePlatformContext,
@@ -21,10 +27,19 @@ export {
   useTenantContext,
 } from './auth/stores'
 export type { PlatformContextData, TenantContextData } from './auth/stores'
+export { isMultiTenantDeployment, isTenantAccessToken } from './auth/tenant-session'
+export type {
+  TenantAuthentication,
+  TenantChoice,
+  TenantSelection,
+  TenantSessionOutcome,
+} from './auth/tenant-session'
 export { disposeTenantState, registerTenantDisposer } from './lifecycle/tenant'
 export { createTenantLifecycle } from './lifecycle/tenant'
 export type { TenantDisposer, TenantLifecycle, TenantLifecycleTicket } from './lifecycle/tenant'
 export { createMenuRouteRegistry, defineAdminModule } from './module/contribution'
+export { collectPluginContributions, routesForTenantModules } from './module/plugin-contribution-policy'
+export { enabledTenantModulesFromRoutes } from './module/tenant-modules'
 export type {
   AdminModuleContribution,
   AdminModuleLocaleContribution,
@@ -35,6 +50,8 @@ export type {
   AdminRouteAccess,
   MenuRouteRegistry,
 } from './module/contribution'
+export type { PluginFrontendContribution, PluginFrontendRoute } from './module/plugin-contribution-policy'
+export type { TenantModuleRoute } from './module/tenant-modules'
 export { defineAdminHostConfig } from './runtime/config'
 export type { AdminAudienceHostConfig, AdminHostConfig } from './runtime/config'
 export { mapAdminRuntimeError } from './runtime/errors'

package/admin-core/src/module/plugin-contribution-policy.ts

@@ -0,0 +1,51 @@
+import type { PermissionEvaluator } from '../access/permission-policy'
+import { evaluateRequiredPermissions } from '../access/permission-policy'
+
+/**
+ * Minimal router contract shared by host applications without coupling to a
+ * particular Vue Router major version.
+ */
+export interface PluginFrontendRoute {
+  path: string
+  name?: unknown
+  component?: unknown
+  meta?: {
+    requiredPermissions?: string | string[]
+    [key: string]: unknown
+  }
+  children?: PluginFrontendRoute[]
+}
+
+export interface PluginFrontendContribution<T extends PluginFrontendRoute = PluginFrontendRoute> {
+  moduleKey: string
+  routes: T[]
+}
+
+export const collectPluginContributions = (
+  modules: Record<string, { default?: PluginFrontendContribution }>,
+): PluginFrontendContribution[] => Object.keys(modules)
+  .sort()
+  .map(path => modules[path]?.default)
+  .filter((contribution): contribution is PluginFrontendContribution => (
+    typeof contribution?.moduleKey === 'string'
+      && contribution.moduleKey.length > 0
+      && Array.isArray(contribution.routes)
+  ))
+
+/** Deployment presence alone never exposes a Tenant Module route. */
+export const routesForTenantModules = <T extends PluginFrontendRoute>(
+  contributions: PluginFrontendContribution<T>[],
+  enabledModules: readonly string[],
+  grantedPermissions: readonly string[],
+  evaluator: PermissionEvaluator,
+): T[] => {
+  const enabled = new Set(enabledModules)
+  return contributions.flatMap((contribution) => {
+    if (!enabled.has(contribution.moduleKey)) return []
+    return contribution.routes.filter((route) => {
+      const required = route.meta?.requiredPermissions
+      return (typeof required === 'string' || Array.isArray(required))
+        && evaluateRequiredPermissions(required, grantedPermissions, evaluator)
+    })
+  })
+}

package/admin-core/src/module/tenant-modules.ts

@@ -0,0 +1,20 @@
+/** Minimal route shape needed to derive Tenant module availability. */
+export interface TenantModuleRoute {
+  meta?: {
+    tenantModuleKey?: unknown
+  }
+  children?: readonly TenantModuleRoute[]
+}
+
+/**
+ * Derive the distinct Tenant module keys exposed by a server-authorized route
+ * tree. The host owns fetching and route-to-component resolution.
+ */
+export const enabledTenantModulesFromRoutes = (
+  routes: readonly TenantModuleRoute[],
+): string[] => Array.from(new Set(
+  routes
+    .flatMap(route => [route, ...(route.children ?? [])])
+    .map(route => route.meta?.tenantModuleKey)
+    .filter((key): key is string => typeof key === 'string'),
+))

package/admin-shell/src/deployment-mode.ts

@@ -0,0 +1,36 @@
+export type DeploymentMode = 'standalone' | 'multi-tenant'
+
+/**
+ * Minimal router contract shared by host applications without coupling to a
+ * particular Vue Router major version.
+ */
+export interface DeploymentRoute {
+  meta?: {
+    controlPlane?: unknown
+    instanceTool?: boolean
+    [key: string]: unknown
+  }
+  children?: DeploymentRoute[]
+}
+
+export const deploymentMode = (value: unknown): DeploymentMode => (
+  value === 'multi-tenant' ? 'multi-tenant' : 'standalone'
+)
+
+export const allowsInstanceTools = (value: unknown): boolean => value === 'standalone'
+
+export const routesForDeployment = <T extends DeploymentRoute>(
+  routes: T[],
+  mode: DeploymentMode,
+  instanceToolsAllowed = mode === 'standalone',
+): T[] => routes.reduce<T[]>((visible, route) => {
+  if (mode !== 'multi-tenant' && route.meta?.controlPlane !== undefined) return visible
+  if (!instanceToolsAllowed && route.meta?.instanceTool === true) return visible
+  visible.push({
+    ...route,
+    children: route.children
+      ? routesForDeployment(route.children, mode, instanceToolsAllowed)
+      : route.children,
+  } as T)
+  return visible
+}, [])

package/admin-shell/src/index.ts

@@ -29,6 +29,10 @@ export { TargetScopeSummary, TargetSelector } from './targets'
 export type { TargetScopeMode } from './targets'
 export { SHELL_THEME_TOKENS } from './theme'
 export type { ShellSlotName, ShellThemeToken } from './theme'
+export { allowsInstanceTools, deploymentMode, routesForDeployment } from './deployment-mode'
+export type { DeploymentMode, DeploymentRoute } from './deployment-mode'
+export { tabFromRoute } from './tabs'
+export type { ShellTab, ShellTabRoute, ShellTabState } from './tabs'
 export {
   ADMIN_SHELL_OVERRIDE_SLOTS,
   resolveWorkspaceShell,

package/admin-shell/src/tabs.ts

@@ -0,0 +1,31 @@
+/** Framework-neutral route data required by an admin workspace tab. */
+export interface ShellTabRoute {
+  name: unknown
+  fullPath: string
+  query?: any
+  meta?: {
+    locale?: string
+    ignoreCache?: boolean | undefined
+  }
+}
+
+export interface ShellTab {
+  title: string
+  name: string
+  fullPath: string
+  query?: any
+  ignoreCache?: boolean | undefined
+}
+
+export interface ShellTabState {
+  tagList: ShellTab[]
+  cacheTabList: Set<string>
+}
+
+export const tabFromRoute = (route: ShellTabRoute): ShellTab => ({
+  title: route.meta?.locale || '',
+  name: String(route.name),
+  fullPath: route.fullPath,
+  query: route.query,
+  ignoreCache: route.meta?.ignoreCache,
+})

package/package.json

@@ -1,9 +1,13 @@
 {
   "name": "@peanut-admin/admin",
-  "version": "0.1.0-alpha.4",
+  "version": "0.1.0-alpha.6",
   "description": "Reusable Peanut Admin Web services and module contributions",
   "type": "module",
   "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/peanut-opensource/peanut-admin-core"
+  },
   "sideEffects": ["*.vue"],
   "files": [
     "admin-core/src",
@@ -117,7 +121,8 @@
   "peerDependencies": {
     "element-plus": "^2.14.3",
     "pinia": ">=2.0.23 <5",
-    "vue": "^3.4.21"
+    "vue": "^3.4.21",
+    "vue-router": ">=4.0.0 <6"
   },
   "peerDependenciesMeta": {
     "element-plus": {