@pikku/core 0.12.106 → 0.12.111

package/src/wirings/role/role.test.ts

@@ -1,104 +0,0 @@
-import { describe, test } from 'node:test'
-import assert from 'node:assert/strict'
-
-import {
-  flattenSystemRoleDefinitions,
-  validateAndBuildSystemRoleDefinitionsMeta,
-} from './validate-role-definitions.js'
-import type { SystemRoleDefinitions } from './role.types.js'
-
-const defs = (...d: SystemRoleDefinitions): SystemRoleDefinitions => d
-
-describe('system role validation', () => {
-  test('keys definitions by name', () => {
-    const meta = validateAndBuildSystemRoleDefinitionsMeta(
-      defs(
-        { name: 'buyer', scopes: ['orders:create'], description: 'Buys' },
-        { name: 'admin', scopes: ['admin'] }
-      )
-    )
-    assert.deepEqual(Object.keys(meta), ['buyer', 'admin'])
-    assert.equal(meta.buyer?.description, 'Buys')
-  })
-
-  test('a name containing the scope separator is refused', () => {
-    assert.throws(
-      () =>
-        validateAndBuildSystemRoleDefinitionsMeta(
-          defs({ name: 'admin:billing', scopes: [] })
-        ),
-      /contains the ':' separator/
-    )
-  })
-
-  test('an empty name is refused', () => {
-    assert.throws(
-      () =>
-        validateAndBuildSystemRoleDefinitionsMeta(
-          defs({ name: '', scopes: [] })
-        ),
-      /empty name/
-    )
-  })
-
-  // An addon and its host both declaring `admin` is legitimate; the second is
-  // redundant rather than conflicting, so long as it says the same thing.
-  test('an identical redeclaration is allowed', () => {
-    const meta = validateAndBuildSystemRoleDefinitionsMeta(
-      defs(
-        { name: 'admin', scopes: ['admin'], sourceFile: 'a.ts' },
-        { name: 'admin', scopes: ['admin'], sourceFile: 'b.ts' }
-      )
-    )
-    assert.equal(Object.keys(meta).length, 1)
-    assert.equal(meta.admin?.sourceFile, 'a.ts')
-  })
-
-  test('scope order does not make two declarations different', () => {
-    assert.doesNotThrow(() =>
-      validateAndBuildSystemRoleDefinitionsMeta(
-        defs(
-          { name: 'buyer', scopes: ['a', 'b'], sourceFile: 'a.ts' },
-          { name: 'buyer', scopes: ['b', 'a'], sourceFile: 'b.ts' }
-        )
-      )
-    )
-  })
-
-  test('a conflicting redeclaration names both files', () => {
-    assert.throws(
-      () =>
-        validateAndBuildSystemRoleDefinitionsMeta(
-          defs(
-            { name: 'buyer', scopes: ['a'], sourceFile: 'a.ts' },
-            { name: 'buyer', scopes: ['a', 'b'], sourceFile: 'b.ts' }
-          )
-        ),
-      /a\.ts[\s\S]*b\.ts/
-    )
-  })
-})
-
-describe('flattening', () => {
-  test('deduplicates by name, keeping the first', () => {
-    const flat = flattenSystemRoleDefinitions(
-      defs(
-        { name: 'admin', scopes: ['admin'], description: 'first' },
-        { name: 'admin', scopes: ['admin'], description: 'second' },
-        { name: 'buyer', scopes: [] }
-      )
-    )
-    assert.deepEqual(
-      flat.map((r) => r.name),
-      ['admin', 'buyer']
-    )
-    assert.equal(flat[0]?.description, 'first')
-  })
-
-  test('copies the scope array rather than aliasing the declaration', () => {
-    const definition = { name: 'buyer', scopes: ['a'] }
-    const flat = flattenSystemRoleDefinitions(defs(definition))
-    flat[0]!.scopes.push('b')
-    assert.deepEqual(definition.scopes, ['a'])
-  })
-})

package/src/wirings/role/role.types.ts

@@ -1,47 +0,0 @@
-/**
- * A system role: a named set of scopes that ships with the product.
- *
- * System roles are declared in code, which is what separates them from the
- * roles an admin composes in the console. The distinction is the one AWS draws
- * between managed and customer-managed policies — a system role is part of the
- * application's surface, so the console may show and grant it but must not
- * rename, re-scope or delete it.
- */
-export type CoreSystemRole = {
-  /** Short human-readable name, e.g. "Buyer". */
-  displayName?: string
-  /** Longer-form description, surfaced in the console when granting. */
-  description?: string
-  /**
-   * The scopes this role grants. Every id must be declared with
-   * `defineScope` — the inspector fails the build otherwise, so a role cannot
-   * quietly grant a scope that no function checks.
-   */
-  scopes: string[]
-}
-
-/**
- * System roles to declare, keyed by name. A key must be non-empty and must not
- * contain `:` — that separator belongs to scopes, and a role that looks like a
- * scope id is a role nobody reads correctly.
- */
-export type CoreSystemRoles = Record<string, CoreSystemRole>
-
-export type SystemRoleDefinitionMeta = {
-  name: string
-  displayName?: string
-  description?: string
-  scopes: string[]
-  sourceFile?: string
-}
-
-export type SystemRoleDefinitions = SystemRoleDefinitionMeta[]
-export type SystemRoleDefinitionsMeta = Record<string, SystemRoleDefinitionMeta>
-
-/** A declared system role, ready to sync into a scope store. */
-export type SystemRole = {
-  name: string
-  displayName?: string
-  description?: string
-  scopes: string[]
-}

package/src/wirings/role/validate-role-definitions.ts

@@ -1,93 +0,0 @@
-import type {
-  SystemRole,
-  SystemRoleDefinitions,
-  SystemRoleDefinitionsMeta,
-} from './role.types.js'
-
-const SEPARATOR = ':'
-
-const assertRoleName = (name: string): void => {
-  if (name.length === 0) {
-    throw new Error('A system role is declared with an empty name.')
-  }
-  if (name.includes(SEPARATOR)) {
-    throw new Error(
-      `System role '${name}' contains the '${SEPARATOR}' separator. ` +
-        `'${SEPARATOR}' delimits scope ids; a role named like a scope reads as one.`
-    )
-  }
-}
-
-/**
- * The declared roles as a flat list, deduplicated by name.
- *
- * A role may legitimately be declared more than once — an addon and its host
- * app both contributing `admin`, say — and
- * {@link validateAndBuildSystemRoleDefinitionsMeta} has already guaranteed
- * those declarations are identical, so the second is redundant rather than
- * conflicting. Collapsing here keeps codegen (which emits an object literal
- * keyed by name) and a ScopeService (which syncs one row per role) honest.
- */
-export const flattenSystemRoleDefinitions = (
-  definitions: SystemRoleDefinitions
-): SystemRole[] => {
-  const seen = new Set<string>()
-  const out: SystemRole[] = []
-  for (const def of definitions) {
-    if (seen.has(def.name)) {
-      continue
-    }
-    seen.add(def.name)
-    out.push({
-      name: def.name,
-      displayName: def.displayName,
-      description: def.description,
-      scopes: [...def.scopes],
-    })
-  }
-  return out
-}
-
-/**
- * Validates declared system roles and keys them by name.
- *
- * Definitions sharing a name must grant the same scope set; a conflicting
- * redeclaration is a hard error naming both source files. Order within
- * `scopes` is not significant — two declarations listing the same scopes
- * differently are the same role.
- */
-export function validateAndBuildSystemRoleDefinitionsMeta(
-  definitions: SystemRoleDefinitions
-): SystemRoleDefinitionsMeta {
-  const meta: SystemRoleDefinitionsMeta = {}
-
-  for (const def of definitions) {
-    assertRoleName(def.name)
-
-    const existing = meta[def.name]
-    if (existing) {
-      const sameScopes =
-        JSON.stringify([...existing.scopes].sort()) ===
-        JSON.stringify([...def.scopes].sort())
-      if (!sameScopes) {
-        throw new Error(
-          `System role '${def.name}' is declared with different scopes.\n` +
-            `  First declaration: ${existing.sourceFile ?? 'unknown'}\n` +
-            `  Second declaration: ${def.sourceFile ?? 'unknown'}\n` +
-            `Roles sharing a name must grant the same scopes.`
-        )
-      }
-      continue
-    }
-
-    meta[def.name] = {
-      name: def.name,
-      displayName: def.displayName,
-      description: def.description,
-      scopes: [...def.scopes],
-      sourceFile: def.sourceFile,
-    }
-  }
-
-  return meta
-}

package/src/wirings/rpc/index.ts

@@ -1,8 +0,0 @@
-export {
-  PikkuRPCService,
-  rpcService,
-  RPCNotFoundError,
-  RemoteAddonConfigError,
-  RemoteAddonRequestError,
-} from './rpc-runner.js'
-export type { PikkuRPC, RPCMeta } from './rpc-types.js'