@quazardous/qdadm 2.21.0 → 2.22.1

package/src/components/editors/RoleGrantsEditor.vue

@@ -0,0 +1,355 @@
+<script setup lang="ts">
+/**
+ * RoleGrantsEditor — a role's composition, readable (#2313): the roles it inherits, the entity × action matrix and
+ * the named grants of the permission registry, and where every checked grant comes from (its own key, one of its
+ * wildcards, or an inherited role).
+ *
+ * It judges nothing. The roles to inherit from and what they bring (`inherited`) come from the app: computed by
+ * qdadm's roles provider (see `inheritedGrants`), or sent by the app's server. It emits the role's own composition.
+ */
+import { computed, inject } from 'vue'
+import {
+  composeGrants,
+  setGrant,
+  type GrantCell,
+  type GrantDefinition,
+  type GrantOrigin,
+  type GrantRow,
+  type InheritableRole,
+  type InheritedGrant,
+  type RoleComposition,
+} from '../../security/roleGrants'
+import { useI18n } from '../../i18n/useI18n'
+import PermissionEditor from './PermissionEditor.vue'
+
+const props = withDefaults(
+  defineProps<{
+    modelValue: RoleComposition
+    /** The grants to compose from. Default: the kernel's permission registry. */
+    grants?: GrantDefinition[] | null
+    /** The roles this one can inherit from. */
+    roles?: InheritableRole[]
+    /** What the inherited roles bring, with the role that declares each grant. */
+    inherited?: InheritedGrant[]
+    /** This role's name: left out of the roles to inherit from. */
+    self?: string | null
+    readonly?: boolean
+  }>(),
+  { grants: null, roles: () => [], inherited: () => [], self: null, readonly: false }
+)
+
+const emit = defineEmits<{ 'update:modelValue': [value: RoleComposition] }>()
+
+const { t } = useI18n()
+const registry = inject<{ getAll(): GrantDefinition[] } | null>('qdadmPermissionRegistry', null)
+
+const grantList = computed<GrantDefinition[]>(() => props.grants ?? registry?.getAll() ?? [])
+const inherits = computed<string[]>(() => props.modelValue?.inherits ?? [])
+const permissions = computed<string[]>(() => props.modelValue?.permissions ?? [])
+const model = computed(() =>
+  composeGrants({ grants: grantList.value, permissions: permissions.value, inherited: props.inherited })
+)
+
+const update = (next: Partial<RoleComposition>) =>
+  emit('update:modelValue', { inherits: [...inherits.value], permissions: [...permissions.value], ...next })
+const isOn = (event: Event) => (event.target as HTMLInputElement).checked
+
+function setPermission(key: string, on: boolean): void {
+  if (!props.readonly) update({ permissions: setGrant(permissions.value, key, on) })
+}
+
+function setInherit(role: string, on: boolean): void {
+  if (props.readonly) return
+  const current = inherits.value
+  update({ inherits: on ? (current.includes(role) ? current : [...current, role]) : current.filter((r) => r !== role) })
+}
+
+function addKeys(keys: string[]): void {
+  const added = keys.filter((k) => !permissions.value.includes(k))
+  if (!props.readonly && added.length > 0) update({ permissions: [...permissions.value, ...added] })
+}
+
+/** The roles to offer, plus any the role already inherits that the list does not know. */
+const roleList = computed<InheritableRole[]>(() => {
+  const listed = props.roles.filter((r) => r.name !== props.self)
+  const unknown = inherits.value.filter((name) => !listed.some((r) => r.name === name)).map((name) => ({ name }))
+  return [...listed, ...unknown]
+})
+const brings = (role: string) => props.inherited.filter((g) => g.via === role).length
+
+const checked = (origin: GrantOrigin) => origin.kind !== 'none'
+const editable = (origin: GrantOrigin) => !props.readonly && (origin.kind === 'own' || origin.kind === 'none')
+const viaOf = (origin: GrantOrigin) =>
+  origin.kind === 'wildcard' || origin.kind === 'inherited' ? t('core.roles.via', { origin: origin.via }) : ''
+const titleOf = (cell: GrantCell) => [cell.label, cell.description, viaOf(cell.origin)].filter(Boolean).join(' — ')
+const cellsOf = (row: GrantRow) => model.value.actions.map((action) => ({ action, cell: row.cells[action] ?? null }))
+const capitalize = (s: string) => s.charAt(0).toUpperCase() + s.slice(1)
+
+/** The same grants, in the shape PermissionEditor reads to suggest keys. */
+const editorRegistry = computed(() => {
+  const list = grantList.value.map((g) => ({ key: g.key, namespace: g.namespace, action: g.action, label: g.label || g.key }))
+  return { getAll: () => list, get: (key: string) => list.find((g) => g.key === key) }
+})
+</script>
+
+<template>
+  <div class="role-grants" :class="{ 'role-grants-readonly': readonly }">
+    <section class="role-grants-section">
+      <h4 class="role-grants-title">{{ t('core.roles.inherits') }}</h4>
+      <p v-if="roleList.length === 0" class="role-grants-hint">{{ t('core.roles.noRoles') }}</p>
+      <ul v-else class="role-grants-roles">
+        <li v-for="role in roleList" :key="role.name">
+          <label class="role-grants-role" :title="role.description">
+            <input
+              type="checkbox"
+              :data-inherit="role.name"
+              :checked="inherits.includes(role.name)"
+              :disabled="readonly"
+              @change="setInherit(role.name, isOn($event))"
+            />
+            <span class="role-grants-role-label">{{ role.label || role.name }}</span>
+            <code class="role-grants-key">{{ role.name }}</code>
+            <span v-if="inherits.includes(role.name)" class="role-grants-via">
+              {{ t('core.roles.brings', { count: brings(role.name) }) }}
+            </span>
+          </label>
+        </li>
+      </ul>
+      <p class="role-grants-hint">{{ t('core.roles.inheritsHint') }}</p>
+    </section>
+
+    <section v-if="model.rows.length > 0" class="role-grants-section">
+      <h4 class="role-grants-title">{{ t('core.roles.entities') }}</h4>
+      <div class="role-grants-scroll">
+        <table class="role-grants-matrix">
+          <thead>
+            <tr>
+              <th scope="col">{{ t('core.roles.entity') }}</th>
+              <th scope="col">{{ t('core.roles.all') }}</th>
+              <th v-for="action in model.actions" :key="action" scope="col">{{ capitalize(action) }}</th>
+            </tr>
+          </thead>
+          <tbody>
+            <tr v-for="row in model.rows" :key="row.namespace" :data-grant-row="row.namespace">
+              <th scope="row">
+                {{ row.entity }}<span v-if="row.ownRecords" class="role-grants-own"> ({{ t('core.roles.ownRecords') }})</span>
+              </th>
+              <td>
+                <label class="role-grants-cell" :title="viaOf(row.wildcardOrigin) || row.wildcard">
+                  <input
+                    type="checkbox"
+                    :data-grant="row.wildcard"
+                    :aria-label="`${row.entity}: ${t('core.roles.all')}`"
+                    :checked="checked(row.wildcardOrigin)"
+                    :disabled="!editable(row.wildcardOrigin)"
+                    @change="setPermission(row.wildcard, isOn($event))"
+                  />
+                  <span v-if="viaOf(row.wildcardOrigin)" class="role-grants-via">{{ viaOf(row.wildcardOrigin) }}</span>
+                </label>
+              </td>
+              <td v-for="{ action, cell } in cellsOf(row)" :key="action">
+                <label v-if="cell" class="role-grants-cell" :title="titleOf(cell)">
+                  <input
+                    type="checkbox"
+                    :data-grant="cell.key"
+                    :aria-label="cell.label"
+                    :checked="checked(cell.origin)"
+                    :disabled="!editable(cell.origin)"
+                    @change="setPermission(cell.key, isOn($event))"
+                  />
+                  <span v-if="viaOf(cell.origin)" class="role-grants-via">{{ viaOf(cell.origin) }}</span>
+                </label>
+              </td>
+            </tr>
+          </tbody>
+        </table>
+      </div>
+    </section>
+
+    <section
+      v-for="group in model.groups"
+      :key="group.namespace"
+      class="role-grants-section"
+      :data-grant-group="group.namespace"
+    >
+      <div class="role-grants-group-head">
+        <h4 class="role-grants-title"><code>{{ group.namespace }}</code></h4>
+        <label class="role-grants-cell role-grants-group-all" :title="group.wildcard">
+          <input
+            type="checkbox"
+            :data-grant="group.wildcard"
+            :aria-label="`${group.namespace}: ${t('core.roles.all')}`"
+            :checked="checked(group.wildcardOrigin)"
+            :disabled="!editable(group.wildcardOrigin)"
+            @change="setPermission(group.wildcard, isOn($event))"
+          />
+          <span>{{ t('core.roles.all') }}</span>
+          <span v-if="viaOf(group.wildcardOrigin)" class="role-grants-via">{{ viaOf(group.wildcardOrigin) }}</span>
+        </label>
+      </div>
+      <ul class="role-grants-list">
+        <li v-for="grant in group.grants" :key="grant.key">
+          <label class="role-grants-grant" :title="grant.key">
+            <input
+              type="checkbox"
+              :data-grant="grant.key"
+              :checked="checked(grant.origin)"
+              :disabled="!editable(grant.origin)"
+              @change="setPermission(grant.key, isOn($event))"
+            />
+            <span class="role-grants-grant-label">{{ grant.label }}</span>
+            <span v-if="grant.description" class="role-grants-hint">{{ grant.description }}</span>
+            <span v-if="viaOf(grant.origin)" class="role-grants-via">{{ viaOf(grant.origin) }}</span>
+          </label>
+        </li>
+      </ul>
+    </section>
+
+    <section class="role-grants-section">
+      <h4 class="role-grants-title">{{ t('core.roles.others') }}</h4>
+      <p class="role-grants-hint">{{ t('core.roles.othersHint') }}</p>
+      <ul v-if="model.others.length > 0" class="role-grants-list">
+        <li v-for="other in model.others" :key="other.key" class="role-grants-other" :data-grant-other="other.key">
+          <code class="role-grants-key">{{ other.key }}</code>
+          <span class="role-grants-via">
+            {{ other.covers > 0 ? t('core.roles.covers', { count: other.covers }) : t('core.roles.notRegistered') }}
+          </span>
+          <button
+            v-if="!readonly"
+            type="button"
+            class="role-grants-remove"
+            :aria-label="`${t('core.roles.remove')} ${other.key}`"
+            @click="setPermission(other.key, false)"
+          >
+            <i class="pi pi-times" />
+          </button>
+        </li>
+      </ul>
+      <PermissionEditor v-if="!readonly" :model-value="[]" :permission-registry="editorRegistry" @update:model-value="addKeys" />
+    </section>
+  </div>
+</template>
+
+<style scoped>
+.role-grants {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+.role-grants-section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  padding: 0.75rem;
+  border: 1px solid var(--p-surface-200);
+  border-radius: 0.5rem;
+  background: var(--p-surface-50);
+}
+.role-grants-title {
+  margin: 0;
+  font-size: 0.9rem;
+  font-weight: 600;
+}
+.role-grants-hint {
+  margin: 0;
+  color: var(--p-surface-500);
+  font-size: 0.8rem;
+}
+.role-grants-key {
+  font-family: monospace;
+  font-size: 0.8rem;
+  color: var(--p-surface-600);
+}
+.role-grants-via {
+  color: var(--p-primary-600, var(--p-surface-600));
+  font-size: 0.72rem;
+  font-style: italic;
+  white-space: nowrap;
+}
+.role-grants-roles,
+.role-grants-list {
+  display: flex;
+  flex-direction: column;
+  gap: 0.35rem;
+  margin: 0;
+  padding: 0;
+  list-style: none;
+}
+.role-grants-role,
+.role-grants-grant {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: baseline;
+  gap: 0.5rem;
+}
+.role-grants-role-label,
+.role-grants-grant-label {
+  font-weight: 500;
+}
+.role-grants-scroll {
+  overflow-x: auto;
+}
+.role-grants-matrix {
+  border-collapse: collapse;
+  width: 100%;
+}
+.role-grants-matrix th,
+.role-grants-matrix td {
+  padding: 0.35rem 0.6rem;
+  border-bottom: 1px solid var(--p-surface-200);
+  text-align: center;
+  vertical-align: top;
+}
+.role-grants-matrix th[scope='row'],
+.role-grants-matrix thead th:first-child {
+  text-align: left;
+  white-space: nowrap;
+}
+.role-grants-cell {
+  display: inline-flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.1rem;
+}
+.role-grants-own {
+  color: var(--p-surface-500);
+  font-weight: 400;
+}
+.role-grants-group-head {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+.role-grants-group-all {
+  flex-direction: row;
+  gap: 0.35rem;
+}
+.role-grants-other {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+.role-grants-remove {
+  padding: 0.1rem 0.3rem;
+  border: 0;
+  background: transparent;
+  color: var(--p-surface-500);
+  cursor: pointer;
+}
+.role-grants-remove:hover {
+  color: var(--p-red-500);
+}
+/* A box is a box, whatever layout surrounds it. */
+.role-grants input[type='checkbox'] {
+  display: inline-block;
+  flex: none;
+  width: auto;
+  height: auto;
+  margin: 0;
+}
+input[type='checkbox']:disabled {
+  cursor: not-allowed;
+}
+</style>

package/src/components/index.ts

@@ -51,6 +51,7 @@ export { default as KeyValueEditor } from './editors/KeyValueEditor.vue'
 export { default as LanguageEditor } from './editors/LanguageEditor.vue'
 export { default as ScopeEditor } from './editors/ScopeEditor.vue'
 export { default as PermissionEditor } from './editors/PermissionEditor.vue'
+export { default as RoleGrantsEditor } from './editors/RoleGrantsEditor.vue'
 export { default as JsonEditorFoldable } from './editors/JsonEditorFoldable.vue'
 export { default as JsonViewer } from './editors/JsonViewer.vue'
 

package/src/components/layout/AppLayout.vue

@@ -19,7 +19,7 @@ import { useNavigation, type NavSection } from '../../composables/useNavigation'
 import { prettifyRole } from '../../utils/formatters'
 import { useApp } from '../../composables/useApp'
 import { useAuth } from '../../composables/useAuth'
-import { useGuardDialog } from '../../composables/useGuardStore'
+import { useGuardDialog, GUARD_DIALOG_HOST } from '../../composables/useGuardStore'
 import { useNavContext, type BreadcrumbItem, type NavLinkItem } from '../../composables/useNavContext'
 import QdButton from '../base/QdButton.vue'
 import Breadcrumb from 'primevue/breadcrumb'
@@ -56,6 +56,8 @@ const homeRoute = inject<string>('qdadmHomeRoute', 'home')
 
 // Guard dialog from shared store (registered by useBareForm/useEntityItemFormPage when a form is active)
 const guardDialog = useGuardDialog()
+// This layout renders it: pages below do not render their own (#2267)
+provide(GUARD_DIALOG_HOST, true)
 
 const router = useRouter()
 const route = useRoute()

package/src/components/layout/BaseLayout.vue

@@ -35,7 +35,7 @@ import { RouterView } from 'vue-router'
 import ConfirmDialog from 'primevue/confirmdialog'
 import Zone from './Zone.vue'
 import { LAYOUT_ZONES } from '../../zones/zones'
-import { useGuardDialog } from '../../composables/useGuardStore'
+import { useGuardDialog, GUARD_DIALOG_HOST } from '../../composables/useGuardStore'
 import UnsavedChangesDialog from '../dialogs/UnsavedChangesDialog.vue'
 import type { BreadcrumbItem, NavLinkItem } from '../../composables/useNavContext'
 
@@ -52,6 +52,8 @@ const hasMainSlot: boolean = !!slots.main
 
 // Guard dialog from shared store (registered by useBareForm/useEntityItemFormPage when a form is active)
 const guardDialog = useGuardDialog()
+// This layout renders it: pages below do not render their own (#2267)
+provide(GUARD_DIALOG_HOST, true)
 
 // Provide breadcrumb/navlinks override mechanism for child pages
 const breadcrumbOverride = ref<BreadcrumbItem[] | null>(null)

package/src/components/show/ShowPage.vue

@@ -313,15 +313,17 @@ type ShowFieldValue = string | number | boolean | Date | Record<string, unknown>
   display: block;
 }
 
+/* minmax(0, 1fr), not 1fr: a bare 1fr track grows to its longest unbreakable
+   content (a URL, a <pre>) and pushes the card past its container (#2245). */
 .show-content--with-media {
   display: grid;
-  grid-template-columns: var(--media-width, 200px) 1fr;
+  grid-template-columns: var(--media-width, 200px) minmax(0, 1fr);
   gap: 2rem;
 }
 
 @media (max-width: 768px) {
   .show-content--with-media {
-    grid-template-columns: 1fr;
+    grid-template-columns: minmax(0, 1fr);
   }
 }
 

package/src/composables/confirmDelete.ts

@@ -0,0 +1,35 @@
+/**
+ * The delete confirmations of the list, form and show pages (#2269).
+ *
+ * PrimeVue's ConfirmDialog closes on Escape only when the confirmation itself says so. Escape hides the
+ * dialog: `accept` never runs, so nothing is deleted.
+ */
+
+export interface DeleteConfirmation {
+  message: string
+  header: string
+  accept: () => void
+}
+
+/** The part of PrimeVue's confirm service a delete confirmation uses. */
+export interface ConfirmRequire {
+  require: (options: {
+    message: string
+    header: string
+    icon: string
+    acceptClass?: string
+    closeOnEscape?: boolean
+    accept: () => void
+  }) => void
+}
+
+export function requireDeleteConfirmation(confirm: ConfirmRequire, { message, header, accept }: DeleteConfirmation): void {
+  confirm.require({
+    message,
+    header,
+    icon: 'pi pi-exclamation-triangle',
+    acceptClass: 'p-button-danger',
+    closeOnEscape: true,
+    accept,
+  })
+}

package/src/composables/index.ts

@@ -50,6 +50,7 @@ export {
 export { usePageTitle, type UsePageTitleReturn, type TitleParts, type TitleInput } from './usePageTitle'
 export { useApp, type UseAppReturn } from './useApp'
 export { useAuth, type UseAuthReturn } from './useAuth'
+export { useSecurity, type UseSecurityReturn } from './useSecurity'
 export {
   useEntityItemPage,
   type UseEntityItemPageOptions,

package/src/composables/useEntityItemFormPage.ts

@@ -27,6 +27,7 @@
 import { ref, computed, watch, onMounted, onUnmounted, provide, type Ref } from 'vue'
 import { useRouter, useRoute } from 'vue-router'
 import { useConfirm } from 'primevue/useconfirm'
+import { requireDeleteConfirmation } from './confirmDelete'
 import { useDirtyState } from './useDirtyState'
 import { useUnsavedChangesGuard, type GuardDialogState } from './useUnsavedChangesGuard'
 import { useBreadcrumb } from './useBreadcrumb'
@@ -384,11 +385,9 @@ export function useEntityItemFormPage<T extends Record<string, unknown> = Record
 
   function confirmDelete(): void {
     const label = manager.getEntityLabel(data.value) || entityId.value
-    confirm.require({
+    requireDeleteConfirmation(confirm, {
       message: `Delete ${entityName} "${label}"?`,
       header: 'Confirm Delete',
-      icon: 'pi pi-exclamation-triangle',
-      acceptClass: 'p-button-danger',
       accept: remove,
     })
   }

package/src/composables/useEntityItemFormPage.types.ts

@@ -159,6 +159,7 @@ export interface ConfirmService {
     header: string
     icon: string
     acceptClass?: string
+    closeOnEscape?: boolean
     accept: () => void
   }) => void
 }

package/src/composables/useEntityItemShowPage.ts

@@ -36,6 +36,7 @@
 import { ref, computed, type Ref, type ComputedRef } from 'vue'
 import { useRouter, type Router } from 'vue-router'
 import { useConfirm } from 'primevue/useconfirm'
+import { requireDeleteConfirmation } from './confirmDelete'
 import {
   useEntityItemPage,
   type ParentConfig,
@@ -254,6 +255,7 @@ interface ConfirmService {
     header: string
     icon: string
     acceptClass?: string
+    closeOnEscape?: boolean
     accept: () => void
   }) => void
 }
@@ -411,11 +413,9 @@ export function useEntityItemShowPage<T = Record<string, unknown>>(
       severity: 'danger',
       onClick: () => {
         if (confirmDelete) {
-          confirm.require({
+          requireDeleteConfirmation(confirm, {
             message: `Are you sure you want to delete this ${manager.label || entity}?`,
             header: 'Confirm Delete',
-            icon: 'pi pi-exclamation-triangle',
-            acceptClass: 'p-button-danger',
             accept: () => deleteEntity(),
           })
         } else {

package/src/composables/useGuardStore.ts

@@ -5,7 +5,13 @@
  * and parent components (AppLayout) to render it.
  */
 
-import { shallowRef, type ShallowRef, type Ref } from 'vue'
+import { shallowRef, type InjectionKey, type ShallowRef, type Ref } from 'vue'
+
+/**
+ * Provided by a layout that renders the registered guard dialog (#2267). FormPage renders its own dialog only
+ * without one above it, so a dirty form never shows the dialog twice.
+ */
+export const GUARD_DIALOG_HOST: InjectionKey<boolean> = Symbol('qdadm.guardDialogHost')
 
 /**
  * Guard dialog interface

package/src/composables/useListPage.ts

@@ -36,6 +36,7 @@ import {
   type RouteStatePersister,
 } from '../routeState'
 import { useConfirm } from 'primevue/useconfirm'
+import { requireDeleteConfirmation } from './confirmDelete'
 import { useHooks } from './useHooks.js'
 import { useEntityItemPage, type ParentConfig, type UseEntityItemPageReturn } from './useEntityItemPage.js'
 import { useActiveStack } from '../chain/useActiveStack.js'
@@ -1050,11 +1051,9 @@ export function useListPage<T = unknown>(config: UseListPageOptions<T>): UseList
 
   function confirmDelete(item: unknown, labelField = 'name'): void {
     const itemRecord = item as Record<string, unknown>
-    confirm.require({
+    requireDeleteConfirmation(confirm, {
       message: `Delete ${entityName} "${itemRecord[labelField] || itemRecord[resolvedDataKey]}"?`,
       header: 'Confirm Delete',
-      icon: 'pi pi-exclamation-triangle',
-      acceptClass: 'p-button-danger',
       accept: () => deleteItem(item, labelField),
     })
   }
@@ -1103,11 +1102,9 @@ export function useListPage<T = unknown>(config: UseListPageOptions<T>): UseList
 
   function confirmBulkDelete(): void {
     const count = selected.value.length
-    confirm.require({
+    requireDeleteConfirmation(confirm, {
       message: `Delete ${count} ${count > 1 ? entityNamePlural : entityName}?`,
       header: 'Confirm Bulk Delete',
-      icon: 'pi pi-exclamation-triangle',
-      acceptClass: 'p-button-danger',
       accept: bulkDelete,
     })
   }

package/src/composables/useListPage.types.ts

@@ -53,6 +53,7 @@ export interface ConfirmService {
     header: string
     icon: string
     acceptClass?: string
+    closeOnEscape?: boolean
     accept: () => void
   }) => void
 }

package/src/composables/useSecurity.ts

@@ -0,0 +1,41 @@
+/**
+ * useSecurity - ask for a permission from a component (#2242).
+ *
+ * `isGranted(attribute, subject?)` gives the entity managers' own verdict:
+ * the application's `security.grant` judge first (#2225), then the role
+ * matrix. With no security configured it grants, as managers do — a page
+ * must never disagree with the list actions next to it.
+ *
+ * Nothing is cached: every call asks. The app remounts on `security:changed`
+ * (and on login and logout), so a `v-if="isGranted('…')"` shows new answers
+ * without any listener.
+ *
+ * Hiding is a convenience, not the protection: the server still decides.
+ *
+ * Usage:
+ *   const { isGranted } = useSecurity()
+ *   <ReplyBox v-if="isGranted('offers:debug:write')" />
+ */
+
+import { getCurrentInstance, inject } from 'vue'
+import type { SecurityChecker } from '../entity/auth/SecurityChecker'
+
+export interface UseSecurityReturn {
+  /** The verdict for a permission or a `ROLE_*`, optionally about `subject` (a record). */
+  isGranted: (attribute: string, subject?: unknown) => boolean
+}
+
+export function useSecurity(): UseSecurityReturn {
+  if (!getCurrentInstance()) {
+    throw new Error(
+      '[qdadm] useSecurity() must be called within component setup() — outside a component, a module asks ctx.security.isGranted()'
+    )
+  }
+
+  // null default: an app without security logs no "injection not found" warning.
+  const checker = inject<SecurityChecker | null>('qdadmSecurityChecker', null)
+
+  return {
+    isGranted: (attribute, subject = null) => (checker ? checker.isGranted(attribute, subject) : true),
+  }
+}

package/src/i18n/defaults/DefaultCoreProvider.ts

@@ -1,6 +1,8 @@
 /**
- * Default core provider — ships qdadm's `core.*` defaults (EN + FR) as a
- * `LazyTranslationProvider` configured with a YAML loader.
+ * Default core provider — ships qdadm's own defaults (EN + FR) as a
+ * `LazyTranslationProvider` configured with a YAML loader: the `core.*` tree,
+ * plus the `breadcrumb.*` keys the breadcrumb's View↔Edit toggle reads (#2270).
+ * It comes first in the provider chain, so an app's own translations win.
  *
  * The YAML text is imported from `core.<locale>.generated.ts` — plain TS
  * modules that `export default` the raw YAML string, generated from the

package/src/i18n/defaults/__tests__/generated-sync.test.ts

@@ -39,4 +39,13 @@ describe('i18n default providers — generated/.yml sync', () => {
     expect(en.core.actions.save).toBe('Save')
     expect(fr.core.actions.save).toBe('Enregistrer')
   })
+
+  it('ships the breadcrumb View↔Edit labels next to core.* (#2270)', async () => {
+    type BreadcrumbBundle = { breadcrumb: { view: string; edit: string } }
+    const provider = createDefaultCoreProvider()
+    const en = (await provider.load('en')) as BreadcrumbBundle
+    const fr = (await provider.load('fr')) as BreadcrumbBundle
+    expect(en.breadcrumb).toEqual({ view: 'View', edit: 'Edit' })
+    expect(fr.breadcrumb).toEqual({ view: 'Voir', edit: 'Modifier' })
+  })
 })