@platform-mesh/portal-ui-lib 0.52.0 → 0.52.1

package/types/platform-mesh-portal-ui-lib-portal-options.d.ts

@@ -1,5 +1,5 @@
 import { NodeContext, LuigiNode, EntityDefinition, CustomGlobalNodesService, HeaderBarConfigService, HeaderBarConfig, LuigiExtendedGlobalContextConfigService, NavigationRedirectStrategy, NodeChangeHookConfigService, NodeContextProcessingService, RoutingConfigService, UserProfileConfigService, UserProfile, CustomMessageListener } from '@openmfp/portal-ui-lib';
-import { ResourceDefinition } from '@platform-mesh/portal-ui-lib/models';
+import { ResourceDefinition, Permission } from '@platform-mesh/portal-ui-lib/models';
 import * as i0 from '@angular/core';
 
 interface PortalContext extends Record<string, any> {
@@ -10,10 +10,6 @@ interface PortalEntityContext {
         id: string;
     };
 }
-interface Permission {
-    actions: string[];
-    resource: string;
-}
 interface PortalNodeContext extends NodeContext {
     portalContext: PortalContext;
     organizationId?: string;
@@ -85,11 +81,14 @@ declare class NodeChangeHookConfigServiceImpl implements NodeChangeHookConfigSer
 declare class NodeContextProcessingServiceImpl implements NodeContextProcessingService {
     private crdGatewayKcpPatchResolver;
     private accountInfoService;
+    private instancePermissionsService;
     private organizationReadyService;
     private errorHandlerService;
+    private luigiCoreService;
     processNodeContext(dynamicEntityId: string, entityNode: PortalLuigiNode, ctx: PortalNodeContext): Promise<void>;
     private addFieldsToContext;
     private addFieldsToContextFromAccountInfo;
+    private getEntityPermissions;
     private accamulatePortalPermissions;
     static ɵfac: i0.ɵɵFactoryDeclaration<NodeContextProcessingServiceImpl, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<NodeContextProcessingServiceImpl>;

package/types/platform-mesh-portal-ui-lib-services.d.ts

@@ -1,21 +1,25 @@
 import { NodeContext } from '@openmfp/portal-ui-lib';
-import { ResourceDefinition, ResourceOperationType, ResourcePagination, Resource, ResourceListResult, ResourceSubscriptionResult, AccountInfo, LogicalCluster } from '@platform-mesh/portal-ui-lib/models';
+import { ResourceDefinition, PermissionsDefinition, ResourceOperationType, ResourcePagination, Resource, ResourceListResult, ResourceSubscriptionResult, AccountInfo, LogicalCluster } from '@platform-mesh/portal-ui-lib/models';
 import * as apollo_angular from 'apollo-angular';
 import { Apollo } from 'apollo-angular';
 import * as i0 from '@angular/core';
-import { GenericResource } from '@openmfp/ngx';
 import { Observable } from 'rxjs';
+import { GenericResource } from '@openmfp/ngx';
 import { VariableOptions } from 'gql-query-builder';
 
 interface ResourceNodeContext extends Partial<NodeContext> {
     resourceDefinition?: ResourceDefinition;
     organization?: string;
+    accountPath?: string;
     entityName?: string;
     resourceId?: string;
     accountId?: string;
     kcpCA?: string;
     namespaceId?: string;
     namespaces?: string[];
+    portalPermissions?: {
+        [key: string]: string[];
+    };
     portalContext: {
         crdGatewayApiUrl: string;
         openSearchApiUrl?: string;
@@ -65,6 +69,40 @@ declare class GatewayService {
     static ɵprov: i0.ɵɵInjectableDeclaration<GatewayService>;
 }
 
+interface InstanceCheck {
+    resource: string;
+    group: string;
+    namespace?: string;
+    name: string;
+    actions: string[];
+}
+interface ResourceCheckRequest {
+    organization: string;
+    accountPath?: string;
+    checks: InstanceCheck[];
+}
+interface InstancePermissionResponse {
+    resource: string;
+    namespace?: string;
+    name?: string;
+    actions: string[];
+}
+declare class InstancePermissionsService {
+    private httpClient;
+    private luigiCoreService;
+    private requestChecks;
+    checkInstance(nodeContext: ResourceNodeContext, permissionsDefinition: PermissionsDefinition, instance: {
+        name: string;
+        namespace?: string;
+    }): Observable<InstancePermissionResponse[]>;
+    checkInstances(nodeContext: ResourceNodeContext, permissionsDefinition: PermissionsDefinition, instances: {
+        name: string;
+        namespace?: string;
+    }[]): Observable<InstancePermissionResponse[]>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<InstancePermissionsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<InstancePermissionsService>;
+}
+
 interface ReadResourcesParams {
     /** Free-text query — used by the OpenSearch implementation; ignored by ResourceService. */
     q?: string;
@@ -187,5 +225,5 @@ declare class OrganizationReadyService {
     static ɵprov: i0.ɵɵInjectableDeclaration<OrganizationReadyService>;
 }
 
-export { AccountInfoService, ApolloFactory, ErrorHandlerService, GatewayService, LogicalClusterService, OrganizationReadyService, ResourceService };
-export type { ListOptions, ReadResources, ReadResourcesPagination, ReadResourcesParams, ReadResourcesResult, ReadResourcesSubscriptionResult, ResourceNodeContext, ResourceRequestParams };
+export { AccountInfoService, ApolloFactory, ErrorHandlerService, GatewayService, InstancePermissionsService, LogicalClusterService, OrganizationReadyService, ResourceService };
+export type { InstanceCheck, InstancePermissionResponse, ListOptions, ReadResources, ReadResourcesPagination, ReadResourcesParams, ReadResourcesResult, ReadResourcesSubscriptionResult, ResourceCheckRequest, ResourceNodeContext, ResourceRequestParams };

package/types/platform-mesh-portal-ui-lib-utils.d.ts

@@ -1,4 +1,4 @@
-import { PlatformMeshFieldDefinition, Resource, ResourceSubscriptionResult, PropertyField } from '@platform-mesh/portal-ui-lib/models';
+import { PlatformMeshFieldDefinition, InstancePermission, Resource, ResourceSubscriptionResult, PropertyField } from '@platform-mesh/portal-ui-lib/models';
 import { NodeContext } from '@openmfp/portal-ui-lib';
 
 declare function buildGraphQLInputTypeName(apiGroup: string | undefined, version: string | undefined, entity: string): string;
@@ -13,6 +13,8 @@ declare const generateGraphQLFields: (uiFields: PlatformMeshFieldDefinition[]) =
 
 declare const getValueByPath: <T extends object, R = unknown>(obj: T, path: string) => R | undefined;
 
+declare const permissionKey: (instance: Partial<Omit<InstancePermission, "actions">>) => string;
+
 declare const isLocalSetup: () => boolean;
 
 declare function isNamespacedResource(nodeContext: Partial<NodeContext>): boolean;
@@ -25,6 +27,18 @@ declare function mergeListWithSubscriptionResult<T>(items: T[], subscriptionResu
 
 declare const parseRawGqlQueryToFields: (s: string) => any[];
 
+/**
+ * Tier-1 resource-level permission check (fail-open).
+ *
+ * Returns true when the verb is granted for the resource, OR when no
+ * permissions were fetched for the resource at all (no entry in
+ * portalPermissions → we don't gate). Returns false ONLY when permissions
+ * WERE fetched for the resource and the verb is absent.
+ */
+declare const resourceActionAllowed: (portalPermissions: {
+    [key: string]: string[];
+} | undefined, resource: string | undefined, verb: string) => boolean;
+
 declare const getResourceValueByJsonPath: <T>(resource: T, field: {
     jsonPathExpression?: string;
     property?: string | string[];
@@ -37,5 +51,5 @@ declare function stripTypename<T>(value: T): T;
 
 declare function setPropertyByPath<T extends Record<string, any>>(object: T, path: string, value: unknown): T;
 
-export { buildGraphQLInputTypeName, buildResourcePath, decodeBase64, encodeBase64, generateGraphQLFields, getResourceValueByJsonPath, getValueByPath, isLocalSetup, isNamespacedResource, mergeListWithSubscriptionResult, parseRawGqlQueryToFields, setPropertyByPath, stripTypename };
+export { buildGraphQLInputTypeName, buildResourcePath, decodeBase64, encodeBase64, generateGraphQLFields, getResourceValueByJsonPath, getValueByPath, isLocalSetup, isNamespacedResource, mergeListWithSubscriptionResult, parseRawGqlQueryToFields, permissionKey, resourceActionAllowed, setPropertyByPath, stripTypename };
 export type { MergeListWithSubscriptionResultOptions };