@platform-mesh/portal-ui-lib 0.52.0 → 0.52.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@platform-mesh/portal-ui-lib",
-  "version": "0.52.0",
+  "version": "0.52.2",
   "repository": {
     "url": "git+https://github.com/platform-mesh/portal-ui-lib.git"
   },

package/types/platform-mesh-portal-ui-lib-models.d.ts

@@ -5,6 +5,45 @@ import { ObjectMeta, Condition } from 'kubernetes-types/meta/v1';
 declare const ALL_NAMESPACE = "-all-";
 declare const kcpRootOrgsPath = "root:orgs";
 
+interface AccountInfo {
+    metadata: ObjectMeta;
+    spec: {
+        account: {
+            originClusterId: string;
+        };
+        clusterInfo: {
+            ca: string;
+        };
+        organization: {
+            originClusterId: string;
+            name: string;
+        };
+        oidc: {
+            issuerUrl: string;
+            clients: {
+                kubectl: {
+                    clientId: string;
+                };
+            };
+        };
+    };
+}
+
+interface LogicalCluster {
+    status: {
+        phase: string;
+    };
+}
+
+interface Permission {
+    actions: string[];
+    resource: string;
+}
+interface InstancePermission extends Permission {
+    namespace?: string;
+    name?: string;
+}
+
 type PlatformMeshFieldDefinition = TableFieldDefinition & Omit<FormFieldDefinition, 'name' | 'label'> & {
     label?: string;
     dynamicValuesDefinition?: {
@@ -56,6 +95,13 @@ interface Resource extends GenericResource {
     isAvailable?: boolean;
     accessibleName?: string;
 }
+interface PermissionsDefinition {
+    group: string;
+    resource: string;
+    entityActions: string[];
+    resourceActions: string[];
+    entityContextKey: string;
+}
 interface ResourceDefinition {
     apiGroup?: string;
     version: string;
@@ -66,6 +112,7 @@ interface ResourceDefinition {
     namespace?: string;
     readyCondition?: PlatformMeshFieldDefinition;
     ui?: UIDefinition;
+    permissionsDefinition?: PermissionsDefinition;
 }
 declare const ResourceOperationTypeMap: {
     readonly ADDED: "ADDED";
@@ -89,35 +136,5 @@ interface ResourceListResult {
 }
 type KubernetesScope = 'Cluster' | 'Namespaced';
 
-interface AccountInfo {
-    metadata: ObjectMeta;
-    spec: {
-        account: {
-            originClusterId: string;
-        };
-        clusterInfo: {
-            ca: string;
-        };
-        organization: {
-            originClusterId: string;
-            name: string;
-        };
-        oidc: {
-            issuerUrl: string;
-            clients: {
-                kubectl: {
-                    clientId: string;
-                };
-            };
-        };
-    };
-}
-
-interface LogicalCluster {
-    status: {
-        phase: string;
-    };
-}
-
 export { ALL_NAMESPACE, ResourceOperationTypeMap, kcpRootOrgsPath };
-export type { AccountInfo, DetailView, KubernetesScope, ListView, LogicalCluster, PlatformMeshFieldDefinition, Resource, ResourceDefinition, ResourceListResult, ResourceMeta, ResourceOperationType, ResourcePagination, ResourceSpec, ResourceStatus, ResourceSubscriptionResult, UIDefinition, UiView };
+export type { AccountInfo, DetailView, InstancePermission, KubernetesScope, ListView, LogicalCluster, Permission, PermissionsDefinition, PlatformMeshFieldDefinition, Resource, ResourceDefinition, ResourceListResult, ResourceMeta, ResourceOperationType, ResourcePagination, ResourceSpec, ResourceStatus, ResourceSubscriptionResult, UIDefinition, UiView };

package/types/platform-mesh-portal-ui-lib-portal-options.d.ts

@@ -1,5 +1,5 @@
 import { NodeContext, LuigiNode, EntityDefinition, CustomGlobalNodesService, HeaderBarConfigService, HeaderBarConfig, LuigiExtendedGlobalContextConfigService, NavigationRedirectStrategy, NodeChangeHookConfigService, NodeContextProcessingService, RoutingConfigService, UserProfileConfigService, UserProfile, CustomMessageListener } from '@openmfp/portal-ui-lib';
-import { ResourceDefinition } from '@platform-mesh/portal-ui-lib/models';
+import { ResourceDefinition, Permission } from '@platform-mesh/portal-ui-lib/models';
 import * as i0 from '@angular/core';
 
 interface PortalContext extends Record<string, any> {
@@ -10,10 +10,6 @@ interface PortalEntityContext {
         id: string;
     };
 }
-interface Permission {
-    actions: string[];
-    resource: string;
-}
 interface PortalNodeContext extends NodeContext {
     portalContext: PortalContext;
     organizationId?: string;
@@ -85,11 +81,14 @@ declare class NodeChangeHookConfigServiceImpl implements NodeChangeHookConfigSer
 declare class NodeContextProcessingServiceImpl implements NodeContextProcessingService {
     private crdGatewayKcpPatchResolver;
     private accountInfoService;
+    private instancePermissionsService;
     private organizationReadyService;
     private errorHandlerService;
+    private luigiCoreService;
     processNodeContext(dynamicEntityId: string, entityNode: PortalLuigiNode, ctx: PortalNodeContext): Promise<void>;
     private addFieldsToContext;
     private addFieldsToContextFromAccountInfo;
+    private getEntityPermissions;
     private accamulatePortalPermissions;
     static ɵfac: i0.ɵɵFactoryDeclaration<NodeContextProcessingServiceImpl, never>;
     static ɵprov: i0.ɵɵInjectableDeclaration<NodeContextProcessingServiceImpl>;

package/types/platform-mesh-portal-ui-lib-services.d.ts

@@ -1,21 +1,25 @@
 import { NodeContext } from '@openmfp/portal-ui-lib';
-import { ResourceDefinition, ResourceOperationType, ResourcePagination, Resource, ResourceListResult, ResourceSubscriptionResult, AccountInfo, LogicalCluster } from '@platform-mesh/portal-ui-lib/models';
+import { ResourceDefinition, PermissionsDefinition, ResourceOperationType, ResourcePagination, Resource, ResourceListResult, ResourceSubscriptionResult, AccountInfo, LogicalCluster } from '@platform-mesh/portal-ui-lib/models';
 import * as apollo_angular from 'apollo-angular';
 import { Apollo } from 'apollo-angular';
 import * as i0 from '@angular/core';
-import { GenericResource } from '@openmfp/ngx';
 import { Observable } from 'rxjs';
+import { GenericResource } from '@openmfp/ngx';
 import { VariableOptions } from 'gql-query-builder';
 
 interface ResourceNodeContext extends Partial<NodeContext> {
     resourceDefinition?: ResourceDefinition;
     organization?: string;
+    accountPath?: string;
     entityName?: string;
     resourceId?: string;
     accountId?: string;
     kcpCA?: string;
     namespaceId?: string;
     namespaces?: string[];
+    portalPermissions?: {
+        [key: string]: string[];
+    };
     portalContext: {
         crdGatewayApiUrl: string;
         openSearchApiUrl?: string;
@@ -65,6 +69,40 @@ declare class GatewayService {
     static ɵprov: i0.ɵɵInjectableDeclaration<GatewayService>;
 }
 
+interface InstanceCheck {
+    resource: string;
+    group: string;
+    namespace?: string;
+    name: string;
+    actions: string[];
+}
+interface ResourceCheckRequest {
+    organization: string;
+    accountPath?: string;
+    checks: InstanceCheck[];
+}
+interface InstancePermissionResponse {
+    resource: string;
+    namespace?: string;
+    name?: string;
+    actions: string[];
+}
+declare class InstancePermissionsService {
+    private httpClient;
+    private luigiCoreService;
+    private requestChecks;
+    checkInstance(nodeContext: ResourceNodeContext, permissionsDefinition: PermissionsDefinition, instance: {
+        name: string;
+        namespace?: string;
+    }): Observable<InstancePermissionResponse[]>;
+    checkInstances(nodeContext: ResourceNodeContext, permissionsDefinition: PermissionsDefinition, instances: {
+        name: string;
+        namespace?: string;
+    }[]): Observable<InstancePermissionResponse[]>;
+    static ɵfac: i0.ɵɵFactoryDeclaration<InstancePermissionsService, never>;
+    static ɵprov: i0.ɵɵInjectableDeclaration<InstancePermissionsService>;
+}
+
 interface ReadResourcesParams {
     /** Free-text query — used by the OpenSearch implementation; ignored by ResourceService. */
     q?: string;
@@ -187,5 +225,5 @@ declare class OrganizationReadyService {
     static ɵprov: i0.ɵɵInjectableDeclaration<OrganizationReadyService>;
 }
 
-export { AccountInfoService, ApolloFactory, ErrorHandlerService, GatewayService, LogicalClusterService, OrganizationReadyService, ResourceService };
-export type { ListOptions, ReadResources, ReadResourcesPagination, ReadResourcesParams, ReadResourcesResult, ReadResourcesSubscriptionResult, ResourceNodeContext, ResourceRequestParams };
+export { AccountInfoService, ApolloFactory, ErrorHandlerService, GatewayService, InstancePermissionsService, LogicalClusterService, OrganizationReadyService, ResourceService };
+export type { InstanceCheck, InstancePermissionResponse, ListOptions, ReadResources, ReadResourcesPagination, ReadResourcesParams, ReadResourcesResult, ReadResourcesSubscriptionResult, ResourceCheckRequest, ResourceNodeContext, ResourceRequestParams };

package/types/platform-mesh-portal-ui-lib-utils.d.ts

@@ -1,4 +1,4 @@
-import { PlatformMeshFieldDefinition, Resource, ResourceSubscriptionResult, PropertyField } from '@platform-mesh/portal-ui-lib/models';
+import { PlatformMeshFieldDefinition, InstancePermission, Resource, ResourceSubscriptionResult, PropertyField } from '@platform-mesh/portal-ui-lib/models';
 import { NodeContext } from '@openmfp/portal-ui-lib';
 
 declare function buildGraphQLInputTypeName(apiGroup: string | undefined, version: string | undefined, entity: string): string;
@@ -13,6 +13,8 @@ declare const generateGraphQLFields: (uiFields: PlatformMeshFieldDefinition[]) =
 
 declare const getValueByPath: <T extends object, R = unknown>(obj: T, path: string) => R | undefined;
 
+declare const permissionKey: (instance: Partial<Omit<InstancePermission, "actions">>) => string;
+
 declare const isLocalSetup: () => boolean;
 
 declare function isNamespacedResource(nodeContext: Partial<NodeContext>): boolean;
@@ -25,6 +27,18 @@ declare function mergeListWithSubscriptionResult<T>(items: T[], subscriptionResu
 
 declare const parseRawGqlQueryToFields: (s: string) => any[];
 
+/**
+ * Tier-1 resource-level permission check (fail-open).
+ *
+ * Returns true when the verb is granted for the resource, OR when no
+ * permissions were fetched for the resource at all (no entry in
+ * portalPermissions → we don't gate). Returns false ONLY when permissions
+ * WERE fetched for the resource and the verb is absent.
+ */
+declare const resourceActionAllowed: (portalPermissions: {
+    [key: string]: string[];
+} | undefined, resource: string | undefined, verb: string) => boolean;
+
 declare const getResourceValueByJsonPath: <T>(resource: T, field: {
     jsonPathExpression?: string;
     property?: string | string[];
@@ -37,5 +51,5 @@ declare function stripTypename<T>(value: T): T;
 
 declare function setPropertyByPath<T extends Record<string, any>>(object: T, path: string, value: unknown): T;
 
-export { buildGraphQLInputTypeName, buildResourcePath, decodeBase64, encodeBase64, generateGraphQLFields, getResourceValueByJsonPath, getValueByPath, isLocalSetup, isNamespacedResource, mergeListWithSubscriptionResult, parseRawGqlQueryToFields, setPropertyByPath, stripTypename };
+export { buildGraphQLInputTypeName, buildResourcePath, decodeBase64, encodeBase64, generateGraphQLFields, getResourceValueByJsonPath, getValueByPath, isLocalSetup, isNamespacedResource, mergeListWithSubscriptionResult, parseRawGqlQueryToFields, permissionKey, resourceActionAllowed, setPropertyByPath, stripTypename };
 export type { MergeListWithSubscriptionResultOptions };