@portaidentity/cli 1.7.3 → 1.8.0

package/dist/admin/rbac-service.js

@@ -0,0 +1,258 @@
+/** Validated SDK boundary for application roles, permissions, mappings, and user assignments. */
+import { PortaAuthenticationError, PortaConflictError, PortaForbiddenError, PortaValidationError, } from '@portaidentity/sdk';
+import { validateAdminAuthorityReduction, validateAdminPermission, validateAdminPermissionCollection, validateAdminRole, validateAdminRoleCollection, validateAdminRoleUpdate, } from './rbac-state.js';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Maps a read exception to one fixed safe result. */
+function readError(error) {
+    if (error instanceof PortaAuthenticationError)
+        return { kind: 'session-invalid' };
+    if (error instanceof PortaValidationError)
+        return { kind: 'failure', failure: 'validation' };
+    if (error instanceof PortaForbiddenError)
+        return { kind: 'failure', failure: 'unauthorized' };
+    if (error instanceof PortaConflictError)
+        return { kind: 'failure', failure: 'conflict' };
+    return { kind: 'failure', failure: 'unavailable' };
+}
+/** Maps a mutation exception without exposing its message. */
+function mutationError(error) {
+    if (error instanceof PortaAuthenticationError)
+        return { kind: 'session-invalid' };
+    if (error instanceof PortaValidationError)
+        return { kind: 'failure', failure: 'validation' };
+    if (error instanceof PortaForbiddenError)
+        return { kind: 'failure', failure: 'unauthorized' };
+    if (error instanceof PortaConflictError)
+        return { kind: 'failure', failure: 'conflict' };
+    return { kind: 'outcome-unknown' };
+}
+/** Returns a cancelled result before dispatching work owned by an aborted caller. */
+function isCancelled(signal) {
+    return signal?.aborted === true;
+}
+/** Validates one or more UUIDs used by collection mutations. */
+function validIdentifiers(...values) {
+    return values.length > 0 && values.every((value) => UUID.test(value));
+}
+/** Converts a rejected mutation to the matching reduction result union. */
+function reductionError(error) {
+    return mutationError(error);
+}
+/** Creates the small RBAC adapter over one lazy authenticated SDK domain bundle. */
+export function createAdminRbacOperations(domain) {
+    return {
+        async listRoles(applicationId, signal) {
+            if (!UUID.test(applicationId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'failure', failure: 'unavailable' };
+            try {
+                const roles = validateAdminRoleCollection(await domain().roles.list(applicationId), applicationId);
+                return roles
+                    ? { kind: 'success', value: roles }
+                    : { kind: 'failure', failure: 'invalid-response' };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async listPermissions(applicationId, signal) {
+            if (!UUID.test(applicationId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'failure', failure: 'unavailable' };
+            try {
+                const permissions = validateAdminPermissionCollection(await domain().permissions.list(applicationId), applicationId);
+                return permissions
+                    ? { kind: 'success', value: permissions }
+                    : { kind: 'failure', failure: 'invalid-response' };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async listRolePermissions(applicationId, roleId, signal) {
+            if (!validIdentifiers(applicationId, roleId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'failure', failure: 'unavailable' };
+            try {
+                const permissions = validateAdminPermissionCollection(await domain().roles.listPermissions(applicationId, roleId), applicationId);
+                return permissions
+                    ? { kind: 'success', value: permissions }
+                    : { kind: 'failure', failure: 'invalid-response' };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async createRole(applicationId, input, signal) {
+            if (!UUID.test(applicationId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const role = validateAdminRole(await domain().roles.create(applicationId, input), applicationId);
+                return role ? { kind: 'success', value: role } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async updateRole(applicationId, roleId, input, signal) {
+            if (!validIdentifiers(applicationId, roleId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const result = validateAdminRoleUpdate(await domain().roles.update(applicationId, roleId, input), applicationId);
+                return result
+                    ? {
+                        kind: 'success',
+                        value: result.role,
+                        reauthenticationRequired: result.reauthenticationRequired,
+                    }
+                    : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return reductionError(error);
+            }
+        },
+        async deleteRole(applicationId, roleId, signal) {
+            if (!validIdentifiers(applicationId, roleId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const result = validateAdminAuthorityReduction(await domain().roles.delete(applicationId, roleId));
+                return result ? { kind: 'success', ...result } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return reductionError(error);
+            }
+        },
+        async createPermission(applicationId, input, signal) {
+            if (!UUID.test(applicationId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const permission = validateAdminPermission(await domain().permissions.create(applicationId, input), applicationId);
+                return permission ? { kind: 'success', value: permission } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async updatePermission(applicationId, permissionId, input, signal) {
+            if (!validIdentifiers(applicationId, permissionId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const permission = validateAdminPermission(await domain().permissions.update(applicationId, permissionId, input), applicationId);
+                return permission ? { kind: 'success', value: permission } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async deletePermission(applicationId, permissionId, signal) {
+            if (!validIdentifiers(applicationId, permissionId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const result = validateAdminAuthorityReduction(await domain().permissions.delete(applicationId, permissionId));
+                return result ? { kind: 'success', ...result } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return reductionError(error);
+            }
+        },
+        async assignPermissions(applicationId, roleId, permissionIds, signal) {
+            if (!validIdentifiers(applicationId, roleId, ...permissionIds)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                await domain().roles.assignPermissions(applicationId, roleId, [...permissionIds]);
+                return { kind: 'success' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async removePermissions(applicationId, roleId, permissionIds, signal) {
+            if (!validIdentifiers(applicationId, roleId, ...permissionIds)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const result = validateAdminAuthorityReduction(await domain().roles.removePermissions(applicationId, roleId, [...permissionIds]));
+                return result ? { kind: 'success', ...result } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return reductionError(error);
+            }
+        },
+        async listUserRoles(organizationId, userId, signal) {
+            if (!validIdentifiers(organizationId, userId))
+                return { kind: 'failure', failure: 'validation' };
+            if (isCancelled(signal))
+                return { kind: 'failure', failure: 'unavailable' };
+            try {
+                const rawRoles = await domain().userRoles.list(organizationId, userId);
+                if (!Array.isArray(rawRoles))
+                    return { kind: 'failure', failure: 'invalid-response' };
+                const roles = [];
+                for (const rawRole of rawRoles) {
+                    if (!rawRole ||
+                        typeof rawRole !== 'object' ||
+                        typeof rawRole.applicationId !== 'string') {
+                        return { kind: 'failure', failure: 'invalid-response' };
+                    }
+                    const role = validateAdminRole(rawRole, rawRole.applicationId);
+                    if (!role)
+                        return { kind: 'failure', failure: 'invalid-response' };
+                    roles.push(role);
+                }
+                return { kind: 'success', value: Object.freeze(roles) };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async assignUserRoles(organizationId, userId, roleIds, signal) {
+            if (!validIdentifiers(organizationId, userId, ...roleIds)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                await domain().userRoles.assign(organizationId, userId, [...roleIds]);
+                return { kind: 'success' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async removeUserRoles(organizationId, userId, roleIds, signal) {
+            if (!validIdentifiers(organizationId, userId, ...roleIds)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            if (isCancelled(signal))
+                return { kind: 'cancelled' };
+            try {
+                const result = validateAdminAuthorityReduction(await domain().userRoles.remove(organizationId, userId, [...roleIds]));
+                return result ? { kind: 'success', ...result } : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return reductionError(error);
+            }
+        },
+    };
+}
+//# sourceMappingURL=rbac-service.js.map

package/dist/admin/rbac-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-service.js","sourceRoot":"","sources":["../../src/admin/rbac-service.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAW5B,OAAO,EACL,+BAA+B,EAC/B,uBAAuB,EACvB,iCAAiC,EACjC,iBAAiB,EACjB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAWzB,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAiH/E,sDAAsD;AACtD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClF,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC7F,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9F,IAAI,KAAK,YAAY,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACrD,CAAC;AAED,8DAA8D;AAC9D,SAAS,aAAa,CACpB,KAAc;IAEd,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClF,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC7F,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9F,IAAI,KAAK,YAAY,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,MAAoB;IACvC,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC;AAED,gEAAgE;AAChE,SAAS,gBAAgB,CAAC,GAAG,MAAyB;IACpD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,yBAAyB,CAAC,MAA8B;IACtE,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM;YACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACjF,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,2BAA2B,CACvC,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,EACxC,aAAa,CACd,CAAC;gBACF,OAAO,KAAK;oBACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE;oBACnC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,MAAM;YACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACjF,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,iCAAiC,CACnD,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,EAC9C,aAAa,CACd,CAAC;gBACF,OAAO,WAAW;oBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM;YACrD,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,WAAW,GAAG,iCAAiC,CACnD,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,aAAa,EAAE,MAAM,CAAC,EAC3D,aAAa,CACd,CAAC;gBACF,OAAO,WAAW;oBAChB,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE;oBACzC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACjF,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,iBAAiB,CAC5B,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,EACjD,aAAa,CACd,CAAC;gBACF,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;YACnD,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,uBAAuB,CACpC,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,EACzD,aAAa,CACd,CAAC;gBACF,OAAO,MAAM;oBACX,CAAC,CAAC;wBACE,IAAI,EAAE,SAAS;wBACf,KAAK,EAAE,MAAM,CAAC,IAAI;wBAClB,wBAAwB,EAAE,MAAM,CAAC,wBAAwB;qBAC1D;oBACH,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM;YAC5C,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,+BAA+B,CAC5C,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CACnD,CAAC;gBACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM;YACjD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACjF,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,uBAAuB,CACxC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,EACvD,aAAa,CACd,CAAC;gBACF,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM;YAC/D,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,CAAC;gBAChD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,uBAAuB,CACxC,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,EAAE,KAAK,CAAC,EACrE,aAAa,CACd,CAAC;gBACF,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC3F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,EAAE,MAAM;YACxD,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,YAAY,CAAC;gBAChD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,+BAA+B,CAC5C,MAAM,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC,CAC/D,CAAC;gBACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;YAClE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAAC;gBAClF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM;YAClE,IAAI,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC;gBAC/D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,+BAA+B,CAC5C,MAAM,MAAM,EAAE,CAAC,KAAK,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,CAClF,CAAC;gBACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,aAAa,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM;YAChD,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC;gBAC3C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;gBACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;oBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;gBACtF,MAAM,KAAK,GAAgB,EAAE,CAAC;gBAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;oBAC/B,IACE,CAAC,OAAO;wBACR,OAAO,OAAO,KAAK,QAAQ;wBAC3B,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ,EACzC,CAAC;wBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;oBAC1D,CAAC;oBACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;oBAC/D,IAAI,CAAC,IAAI;wBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;oBACnE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;YAC3D,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;gBACtE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;YAC7B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;YAC3D,IAAI,CAAC,gBAAgB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;gBAC1D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,WAAW,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,+BAA+B,CAC5C,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CACtE,CAAC;gBACF,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/rbac-state.d.ts

@@ -0,0 +1,129 @@
+/** Immutable role and permission values retained by the terminal administration application. */
+/** Allowlisted application role safe for terminal presentation. */
+export interface AdminRole {
+    /** Stable role UUID. */
+    readonly id: string;
+    /** Application that owns the role. */
+    readonly applicationId: string;
+    /** Human-readable role name. */
+    readonly name: string;
+    /** Stable role key. */
+    readonly slug: string;
+    /** Optional multiline explanation. */
+    readonly description: string | null;
+    /** Creation timestamp. */
+    readonly createdAt: string;
+    /** Most recent update timestamp. */
+    readonly updatedAt: string;
+}
+/** Allowlisted application permission safe for terminal presentation. */
+export interface AdminPermission {
+    /** Stable permission UUID. */
+    readonly id: string;
+    /** Application that owns the permission. */
+    readonly applicationId: string;
+    /** Optional application module that groups the permission. */
+    readonly moduleId: string | null;
+    /** Human-readable permission name. */
+    readonly name: string;
+    /** Exact permission claim value expected by the application. */
+    readonly slug: string;
+    /** Optional multiline explanation. */
+    readonly description: string | null;
+    /** Creation timestamp. */
+    readonly createdAt: string;
+}
+/** Fixed RBAC failure categories safe to display. */
+export type AdminRbacFailureKind = 'validation' | 'unauthorized' | 'conflict' | 'unavailable' | 'invalid-response';
+/** Sanitized result returned by an RBAC read. */
+export type AdminRbacReadResult<T> = {
+    readonly kind: 'success';
+    readonly value: T;
+} | {
+    readonly kind: 'session-invalid';
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminRbacFailureKind;
+};
+/** Sanitized result returned by a mutation with no authority-reduction contract. */
+export type AdminRbacMutationResult<T = void> = ({
+    readonly kind: 'success';
+} & (T extends void ? object : {
+    readonly value: T;
+})) | {
+    readonly kind: 'session-invalid';
+} | {
+    readonly kind: 'cancelled';
+} | {
+    readonly kind: 'outcome-unknown';
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminRbacFailureKind;
+};
+/** Sanitized committed result returned by an authority-reducing mutation. */
+export type AdminRbacReductionResult<T = void> = ({
+    readonly kind: 'success';
+    readonly reauthenticationRequired: boolean;
+} & (T extends void ? object : {
+    readonly value: T;
+})) | {
+    readonly kind: 'session-invalid';
+} | {
+    readonly kind: 'cancelled';
+} | {
+    readonly kind: 'outcome-unknown';
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminRbacFailureKind;
+};
+/** Complete validated RBAC collection for one selected application. */
+export interface AdminApplicationRbacReadyProjection {
+    /** Ready-state discriminator. */
+    readonly kind: 'ready';
+    /** Application that owns every retained row. */
+    readonly applicationId: string;
+    /** Complete role collection. */
+    readonly roles: readonly AdminRole[];
+    /** Complete permission collection. */
+    readonly permissions: readonly AdminPermission[];
+    /** Permissions assigned to the role currently being managed. */
+    readonly assignedPermissions?: readonly AdminPermission[];
+    /** Permissions not assigned to the role currently being managed. */
+    readonly availablePermissions?: readonly AdminPermission[];
+}
+/** Validated RBAC state that may remain visible during recovery. */
+export type AdminApplicationRbacProjection = AdminApplicationRbacReadyProjection;
+/** Complete Application-owned RBAC controller state. */
+export type AdminApplicationRbacViewState = {
+    readonly kind: 'closed';
+} | {
+    readonly kind: 'loading';
+    readonly previous?: AdminApplicationRbacProjection;
+} | AdminApplicationRbacProjection | {
+    readonly kind: 'indeterminate';
+    readonly previous?: AdminApplicationRbacProjection;
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminRbacFailureKind;
+    readonly previous?: AdminApplicationRbacProjection;
+};
+/** Validates a normalized permission claim value without importing server-only code. */
+export declare function isAdminPermissionSlug(value: unknown): value is string;
+/** Projects one role and verifies its application owner. */
+export declare function validateAdminRole(value: unknown, applicationId: string): AdminRole | undefined;
+/** Projects one permission and verifies its application owner. */
+export declare function validateAdminPermission(value: unknown, applicationId: string): AdminPermission | undefined;
+/** Projects a complete role collection without retaining partial or duplicate data. */
+export declare function validateAdminRoleCollection(value: unknown, applicationId: string): readonly AdminRole[] | undefined;
+/** Projects a complete permission collection without retaining partial or duplicate data. */
+export declare function validateAdminPermissionCollection(value: unknown, applicationId: string): readonly AdminPermission[] | undefined;
+/** Reads the fixed authority-reduction flag from an untrusted response. */
+export declare function validateAdminAuthorityReduction(value: unknown): {
+    readonly reauthenticationRequired: boolean;
+} | undefined;
+/** Reads a role update and its fixed authority-reduction flag from an untrusted response. */
+export declare function validateAdminRoleUpdate(value: unknown, applicationId: string): {
+    readonly role: AdminRole;
+    readonly reauthenticationRequired: boolean;
+} | undefined;
+//# sourceMappingURL=rbac-state.d.ts.map

package/dist/admin/rbac-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-state.d.ts","sourceRoot":"","sources":["../../src/admin/rbac-state.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAKhG,mEAAmE;AACnE,MAAM,WAAW,SAAS;IACxB,wBAAwB;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,uBAAuB;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,oCAAoC;IACpC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,yEAAyE;AACzE,MAAM,WAAW,eAAe;IAC9B,8BAA8B;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,0BAA0B;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,qDAAqD;AACrD,MAAM,MAAM,oBAAoB,GAC9B,YAAY,GAAG,cAAc,GAAG,UAAU,GAAG,aAAa,GAAG,kBAAkB,CAAC;AAElF,iDAAiD;AACjD,MAAM,MAAM,mBAAmB,CAAC,CAAC,IAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC/C;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEzE,oFAAoF;AACpF,MAAM,MAAM,uBAAuB,CAAC,CAAC,GAAG,IAAI,IACxC,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,IAAI,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,GAClF;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEzE,6EAA6E;AAC7E,MAAM,MAAM,wBAAwB,CAAC,CAAC,GAAG,IAAI,IACzC,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,IAAI,GACvF,MAAM,GACN;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC,CAAC,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACpC;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEzE,uEAAuE;AACvE,MAAM,WAAW,mCAAmC;IAClD,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,sCAAsC;IACtC,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAC;IACjD,gEAAgE;IAChE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC1D,oEAAoE;IACpE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC5D;AAED,oEAAoE;AACpE,MAAM,MAAM,8BAA8B,GAAG,mCAAmC,CAAC;AAEjF,wDAAwD;AACxD,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAA;CAAE,GAChF,8BAA8B,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAA;CAAE,GACtF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,8BAA8B,CAAC;CACpD,CAAC;AA2CN,wFAAwF;AACxF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAErE;AAED,4DAA4D;AAC5D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,CA0B9F;AAED,kEAAkE;AAClE,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,GACpB,eAAe,GAAG,SAAS,CA4B7B;AAED,uFAAuF;AACvF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,GACpB,SAAS,SAAS,EAAE,GAAG,SAAS,CAWlC;AAED,6FAA6F;AAC7F,wBAAgB,iCAAiC,CAC/C,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,GACpB,SAAS,eAAe,EAAE,GAAG,SAAS,CAWxC;AAED,2EAA2E;AAC3E,wBAAgB,+BAA+B,CAC7C,KAAK,EAAE,OAAO,GACb;IAAE,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAK5D;AAED,6FAA6F;AAC7F,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,OAAO,EACd,aAAa,EAAE,MAAM,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAA;CAAE,GAAG,SAAS,CAMtF"}

package/dist/admin/rbac-state.js

@@ -0,0 +1,136 @@
+/** Immutable role and permission values retained by the terminal administration application. */
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const ISO_TIMESTAMP = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/;
+/** Returns true when text contains a terminal control other than an allowed line ending. */
+function containsTerminalControl(value, allowLineEndings = false) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (allowLineEndings && (codePoint === 0x0a || codePoint === 0x0d))
+            continue;
+        if (codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f))
+            return true;
+    }
+    return false;
+}
+/** Validates bounded terminal-safe text. */
+function isText(value, maximum, minimum = 0, allowLineEndings = false) {
+    return (typeof value === 'string' &&
+        value.length >= minimum &&
+        value.length <= maximum &&
+        !containsTerminalControl(value, allowLineEndings));
+}
+/** Validates an ISO timestamp used for presentation. */
+function isTimestamp(value) {
+    if (!isText(value, 40, 20) || !ISO_TIMESTAMP.test(value))
+        return false;
+    const parsed = new Date(value);
+    return (Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 19) === value.slice(0, 19));
+}
+/** Returns an object-shaped untrusted value. */
+function objectValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+/** Validates a normalized permission claim value without importing server-only code. */
+export function isAdminPermissionSlug(value) {
+    return isText(value, 150, 1) && value === value.trim();
+}
+/** Projects one role and verifies its application owner. */
+export function validateAdminRole(value, applicationId) {
+    const candidate = objectValue(value);
+    if (!UUID.test(applicationId) ||
+        !candidate ||
+        !isText(candidate.id, 36, 36) ||
+        !UUID.test(candidate.id) ||
+        candidate.applicationId !== applicationId ||
+        !isText(candidate.name, 255, 1) ||
+        !isText(candidate.slug, 100, 1) ||
+        candidate.slug !== candidate.slug.trim() ||
+        !(candidate.description === null || isText(candidate.description, 1_000, 0, true)) ||
+        !isTimestamp(candidate.createdAt) ||
+        !isTimestamp(candidate.updatedAt)) {
+        return undefined;
+    }
+    return Object.freeze({
+        id: candidate.id,
+        applicationId,
+        name: candidate.name,
+        slug: candidate.slug,
+        description: candidate.description,
+        createdAt: candidate.createdAt,
+        updatedAt: candidate.updatedAt,
+    });
+}
+/** Projects one permission and verifies its application owner. */
+export function validateAdminPermission(value, applicationId) {
+    const candidate = objectValue(value);
+    if (!UUID.test(applicationId) ||
+        !candidate ||
+        !isText(candidate.id, 36, 36) ||
+        !UUID.test(candidate.id) ||
+        candidate.applicationId !== applicationId ||
+        !(candidate.moduleId === null ||
+            (isText(candidate.moduleId, 36, 36) && UUID.test(candidate.moduleId))) ||
+        !isText(candidate.name, 255, 1) ||
+        !isAdminPermissionSlug(candidate.slug) ||
+        !(candidate.description === null || isText(candidate.description, 1_000, 0, true)) ||
+        !isTimestamp(candidate.createdAt)) {
+        return undefined;
+    }
+    return Object.freeze({
+        id: candidate.id,
+        applicationId,
+        moduleId: candidate.moduleId,
+        name: candidate.name,
+        slug: candidate.slug,
+        description: candidate.description,
+        createdAt: candidate.createdAt,
+    });
+}
+/** Projects a complete role collection without retaining partial or duplicate data. */
+export function validateAdminRoleCollection(value, applicationId) {
+    if (!Array.isArray(value))
+        return undefined;
+    const roles = [];
+    const ids = new Set();
+    for (const entry of value) {
+        const role = validateAdminRole(entry, applicationId);
+        if (!role || ids.has(role.id))
+            return undefined;
+        ids.add(role.id);
+        roles.push(role);
+    }
+    return Object.freeze(roles);
+}
+/** Projects a complete permission collection without retaining partial or duplicate data. */
+export function validateAdminPermissionCollection(value, applicationId) {
+    if (!Array.isArray(value))
+        return undefined;
+    const permissions = [];
+    const ids = new Set();
+    for (const entry of value) {
+        const permission = validateAdminPermission(entry, applicationId);
+        if (!permission || ids.has(permission.id))
+            return undefined;
+        ids.add(permission.id);
+        permissions.push(permission);
+    }
+    return Object.freeze(permissions);
+}
+/** Reads the fixed authority-reduction flag from an untrusted response. */
+export function validateAdminAuthorityReduction(value) {
+    const candidate = objectValue(value);
+    return candidate && typeof candidate.reauthenticationRequired === 'boolean'
+        ? Object.freeze({ reauthenticationRequired: candidate.reauthenticationRequired })
+        : undefined;
+}
+/** Reads a role update and its fixed authority-reduction flag from an untrusted response. */
+export function validateAdminRoleUpdate(value, applicationId) {
+    const candidate = objectValue(value);
+    const role = candidate ? validateAdminRole(candidate.role, applicationId) : undefined;
+    return role && typeof candidate?.reauthenticationRequired === 'boolean'
+        ? Object.freeze({ role, reauthenticationRequired: candidate.reauthenticationRequired })
+        : undefined;
+}
+//# sourceMappingURL=rbac-state.js.map

package/dist/admin/rbac-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac-state.js","sourceRoot":"","sources":["../../src/admin/rbac-state.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAEhG,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,aAAa,GAAG,sDAAsD,CAAC;AAiG7E,4FAA4F;AAC5F,SAAS,uBAAuB,CAAC,KAAa,EAAE,gBAAgB,GAAG,KAAK;IACtE,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,gBAAgB,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI,CAAC;YAAE,SAAS;QAC7E,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4CAA4C;AAC5C,SAAS,MAAM,CACb,KAAc,EACd,OAAe,EACf,OAAO,GAAG,CAAC,EACX,gBAAgB,GAAG,KAAK;IAExB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,OAAO;QACvB,KAAK,CAAC,MAAM,IAAI,OAAO;QACvB,CAAC,uBAAuB,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAClD,CAAC;AACJ,CAAC;AAED,wDAAwD;AACxD,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,gDAAgD;AAChD,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,OAAO,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,CAAC;AACzD,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,iBAAiB,CAAC,KAAc,EAAE,aAAqB;IACrE,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACzB,CAAC,SAAS;QACV,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,aAAa,KAAK,aAAa;QACzC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE;QACxC,CAAC,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAClF,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,aAAa;QACb,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,aAAqB;IAErB,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,IACE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QACzB,CAAC,SAAS;QACV,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAC7B,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,aAAa,KAAK,aAAa;QACzC,CAAC,CACC,SAAS,CAAC,QAAQ,KAAK,IAAI;YAC3B,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CACtE;QACD,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC;QACtC,CAAC,CAAC,SAAS,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAClF,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,aAAa;QACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,2BAA2B,CACzC,KAAc,EACd,aAAqB;IAErB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,iCAAiC,CAC/C,KAAc,EACd,aAAqB;IAErB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,WAAW,GAAsB,EAAE,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACjE,IAAI,CAAC,UAAU,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5D,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,+BAA+B,CAC7C,KAAc;IAEd,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,SAAS,IAAI,OAAO,SAAS,CAAC,wBAAwB,KAAK,SAAS;QACzE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,SAAS,CAAC,wBAAwB,EAAE,CAAC;QACjF,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,KAAc,EACd,aAAqB;IAErB,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACtF,OAAO,IAAI,IAAI,OAAO,SAAS,EAAE,wBAAwB,KAAK,SAAS;QACrE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,SAAS,CAAC,wBAAwB,EAAE,CAAC;QACvF,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC"}

package/dist/admin/selectable-read-only-input.d.ts

@@ -0,0 +1,18 @@
+/** Selectable single-line values that must never be edited by the Admin UI. */
+import { Input } from '@jsvision/ui';
+import type { DispatchEvent } from '@jsvision/ui';
+/**
+ * Presents an immutable value with the selection and clipboard behavior of a normal input.
+ *
+ * Navigation and copying remain available. Any typing, deletion, cut, or paste gesture is allowed
+ * to complete normally and then the original value is restored immediately.
+ */
+export declare class SelectableReadOnlyInput extends Input {
+    /** Exact immutable value restored after every input event. */
+    protected readonly originalValue: string;
+    /** Creates a selectable field containing one immutable value. */
+    constructor(value: string);
+    /** Allows selection and copying while discarding every mutation. */
+    onEvent(event: DispatchEvent): void;
+}
+//# sourceMappingURL=selectable-read-only-input.d.ts.map

package/dist/admin/selectable-read-only-input.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectable-read-only-input.d.ts","sourceRoot":"","sources":["../../src/admin/selectable-read-only-input.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,KAAK,EAAU,MAAM,cAAc,CAAC;AAC7C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,8DAA8D;IAC9D,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAEzC,iEAAiE;IACjE,YAAY,KAAK,EAAE,MAAM,EAGxB;IAED,oEAAoE;IAC3D,OAAO,CAAC,KAAK,EAAE,aAAa,GAAG,IAAI,CAG3C;CACF"}

package/dist/admin/selectable-read-only-input.js

@@ -0,0 +1,24 @@
+/** Selectable single-line values that must never be edited by the Admin UI. */
+import { Input, signal } from '@jsvision/ui';
+/**
+ * Presents an immutable value with the selection and clipboard behavior of a normal input.
+ *
+ * Navigation and copying remain available. Any typing, deletion, cut, or paste gesture is allowed
+ * to complete normally and then the original value is restored immediately.
+ */
+export class SelectableReadOnlyInput extends Input {
+    /** Exact immutable value restored after every input event. */
+    originalValue;
+    /** Creates a selectable field containing one immutable value. */
+    constructor(value) {
+        super({ value: signal(value), maxLength: value.length });
+        this.originalValue = value;
+    }
+    /** Allows selection and copying while discarding every mutation. */
+    onEvent(event) {
+        super.onEvent(event);
+        if (this.value.peek() !== this.originalValue)
+            this.value.set(this.originalValue);
+    }
+}
+//# sourceMappingURL=selectable-read-only-input.js.map

package/dist/admin/selectable-read-only-input.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectable-read-only-input.js","sourceRoot":"","sources":["../../src/admin/selectable-read-only-input.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAE/E,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG7C;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,8DAA8D;IAC3C,aAAa,CAAS;IAEzC,iEAAiE;IACjE,YAAY,KAAa;QACvB,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,oEAAoE;IAC3D,OAAO,CAAC,KAAoB;QACnC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,aAAa;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACnF,CAAC;CACF"}