@sanity-labs/client-fake-for-test 0.10.0 → 0.12.0

package/dist/index.js

@@ -62,6 +62,28 @@ function defaultAclPath(projectId, dataset) {
 function projectUserOf(identity, projectId) {
   return identity.usersByProject?.[projectId] ?? identity.user;
 }
+function consistentProjectRecords(args) {
+  const byId = /* @__PURE__ */ new Map();
+  for (const record of args.records) {
+    const existing = byId.get(record.id);
+    if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
+      throw fakeError(
+        `request(): two registered identities resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
+      );
+    byId.set(record.id, record);
+  }
+  return byId;
+}
+function canonicalProjectRoles(roles) {
+  return roles.map((role) => ({
+    name: role.name,
+    ...role.title !== void 0 ? { title: role.title } : {},
+    ...role.description !== void 0 ? { description: role.description } : {}
+  })).toSorted((left, right) => {
+    const leftKey = JSON.stringify(left), rightKey = JSON.stringify(right);
+    return leftKey < rightKey ? -1 : leftKey > rightKey ? 1 : 0;
+  });
+}
 function serveProjectUsers(args) {
   const { requestedIds, pathProjectId, identities } = args, toRecord = (identity) => {
     const projectUser = projectUserOf(identity, pathProjectId);
@@ -71,43 +93,37 @@ function serveProjectUsers(args) {
       displayName: projectUser.name ?? projectUser.id,
       ...projectUser.email !== void 0 ? { email: projectUser.email } : {}
     };
-  }, byId = /* @__PURE__ */ new Map();
-  for (const identity of identities) {
-    const resolvedId = projectUserOf(identity, pathProjectId).id, existing = byId.get(resolvedId);
-    if (existing !== void 0 && JSON.stringify(toRecord(existing)) !== JSON.stringify(toRecord(identity)))
-      throw fakeError(
-        `request(): two registered identities resolve to project user "${resolvedId}" in project "${pathProjectId}" with different records. The directory cannot answer unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
-      );
-    byId.set(resolvedId, identity);
-  }
-  const ids = requestedIds.split(","), [firstId] = ids;
+  }, byId = consistentProjectRecords({
+    projectId: pathProjectId,
+    records: identities.map(toRecord)
+  }), ids = requestedIds.split(","), [firstId] = ids;
   if (ids.length === 1 && firstId !== void 0) {
-    const identity = byId.get(firstId);
-    if (identity === void 0)
+    const record = byId.get(firstId);
+    if (record === void 0)
       throw Object.assign(
         fakeError(
           `request(): no registered identity resolves to project user "${firstId}" in project "${pathProjectId}". Register it via createTestClient({ identities }) or addIdentity().`
         ),
         { statusCode: 404 }
       );
-    return toRecord(identity);
+    return record;
   }
   return ids.flatMap((id) => {
-    const identity = byId.get(id);
-    return identity === void 0 ? [] : [toRecord(identity)];
+    const record = byId.get(id);
+    return record === void 0 ? [] : [record];
   });
 }
 const PROJECT_USERS_PATH = /^\/projects\/([^/]+)\/users\/([^/]+)$/, PROJECT_PATH = /^\/projects\/([^/]+)$/;
 function serveProject(args) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const identity of args.identities)
-    ids.add(projectUserOf(identity, args.pathProjectId).id);
-  return {
-    members: [...ids].map((id) => ({
-      id,
-      ...id.startsWith("p-") ? { isRobot: !0 } : {}
-    }))
-  };
+  const records = args.identities.map((identity) => {
+    const projectUser = projectUserOf(identity, args.pathProjectId);
+    return {
+      id: projectUser.id,
+      ...projectUser.id.startsWith("p-") ? { isRobot: !0 } : {},
+      ...projectUser.roles !== void 0 ? { roles: canonicalProjectRoles(projectUser.roles) } : {}
+    };
+  });
+  return { members: [...consistentProjectRecords({ projectId: args.pathProjectId, records }).values()] };
 }
 function makeRequestImpl(ctx) {
   const { getAccess, projectId, dataset, useProjectHostname, listIdentities } = ctx;
@@ -135,6 +151,48 @@ function makeRequestImpl(ctx) {
     );
   };
 }
+class GuardDeniedError extends Error {
+  statusCode = 403;
+  type = "guardDeniedError";
+  denials;
+  details;
+  response;
+  constructor(denials) {
+    const unique = uniqueDenials(denials);
+    super(`Mutation denied by guard(s) [${unique.map((denial) => denial.guardID).join(", ")}]`), this.name = "GuardDeniedError", this.denials = unique, this.details = { type: this.type, denials: unique }, this.response = {
+      body: { error: this.details },
+      url: "memory://client-fake-for-test/data/mutate",
+      method: "POST",
+      headers: {},
+      statusCode: this.statusCode,
+      statusMessage: "Forbidden"
+    };
+  }
+}
+function uniqueDenials(denials) {
+  const seen = /* @__PURE__ */ new Set();
+  return denials.filter((denial) => seen.has(denial.guardID) ? !1 : (seen.add(denial.guardID), !0));
+}
+function mutationContext(images) {
+  const { before, after } = images;
+  if (before !== after)
+    return before === void 0 ? { action: "create", before: null, after: after ?? null } : after === void 0 ? { action: "delete", before, after: null } : { action: "update", before, after };
+}
+function mutationContexts(images) {
+  return [...images].flatMap((image) => {
+    const context = mutationContext(image);
+    return context === void 0 ? [] : [context];
+  });
+}
+async function enforceMutationGuards(guard, contexts) {
+  if (guard === void 0) return;
+  const denials = [];
+  for (const context of contexts) {
+    const denied = await guard(context);
+    denied !== void 0 && denials.push(...denied);
+  }
+  if (denials.length > 0) throw new GuardDeniedError(denials);
+}
 function describeType(value) {
   return value === null ? "null" : Array.isArray(value) ? "an array" : `a ${typeof value}`;
 }
@@ -668,7 +726,7 @@ async function applyAction(store, action, hooks) {
       const published = store.get(action.publishedId);
       requireRevisionMatch(action.draftId, draft._rev, action.ifDraftRevisionId), requireRevisionMatch(action.publishedId, published?._rev, action.ifPublishedRevisionId);
       const promoted = promote({ ...draft, _id: action.publishedId });
-      return published !== void 0 && (promoted._createdAt = published._createdAt), await hooks?.gate?.(promoted, published === void 0 ? "create" : "update"), await hooks?.guard?.("publish", published ?? null, promoted), store.put(promoted), store.remove(action.draftId), { transactionId: cryptoRandomKey() };
+      return published !== void 0 && (promoted._createdAt = published._createdAt), await hooks?.gate?.(promoted, published === void 0 ? "create" : "update"), store.put(promoted), store.remove(action.draftId), { transactionId: cryptoRandomKey() };
     }
     case "sanity.action.document.unpublish": {
       requireDraftOf(action);
@@ -677,7 +735,7 @@ async function applyAction(store, action, hooks) {
         throw fakeError(
           `Cannot unpublish "${action.publishedId}": no published document with that _id exists. document.unpublish retracts a live published document into "${action.draftId}".`
         );
-      if (await hooks?.gate?.(published, "update"), await hooks?.guard?.("unpublish", published, null), store.get(action.draftId) === void 0) {
+      if (await hooks?.gate?.(published, "update"), store.get(action.draftId) === void 0) {
         const draft = promote({ ...published, _id: action.draftId });
         draft._createdAt = published._createdAt, store.put(draft);
       }
@@ -698,7 +756,7 @@ function requireRevisionMatch(documentId, actualRev, expectedRev) {
     );
 }
 async function applyActions(store, actions, hooks) {
-  const list = Array.isArray(actions) ? actions : [actions], snapshot = /* @__PURE__ */ new Map(), remember = (id) => {
+  const list = Array.isArray(actions) ? actions : [actions], snapshot = /* @__PURE__ */ new Map(), guardedIds = /* @__PURE__ */ new Set(), remember = (id) => {
     snapshot.has(id) || snapshot.set(id, store.get(id));
   };
   try {
@@ -734,13 +792,18 @@ async function applyActions(store, actions, hooks) {
           remember(a.versionId);
           break;
         case "sanity.action.document.publish":
+          remember(a.draftId), remember(a.publishedId), guardedIds.add(a.publishedId), guardedIds.add(a.draftId);
+          break;
         case "sanity.action.document.unpublish":
-          remember(a.draftId), remember(a.publishedId);
+          remember(a.draftId), remember(a.publishedId), guardedIds.add(a.draftId), guardedIds.add(a.publishedId);
           break;
       }
       last = await applyAction(store, a, hooks);
     }
-    return last;
+    const contexts = mutationContexts(
+      [...guardedIds].map((id) => ({ before: snapshot.get(id), after: store.get(id) }))
+    );
+    return await hooks?.guard?.(contexts), last;
   } catch (err) {
     for (const [id, doc] of snapshot)
       doc === void 0 ? store.remove(id) : store.put(doc);
@@ -1171,11 +1234,17 @@ function makeHandle(handleArgs) {
     access !== void 0 && await enforceWriteAccess({
       document,
       grants: access.grants,
-      permission,
+      permission: document._id !== void 0 && isSystemId(document._id) ? "manage" : permission,
       userId: access.currentUser.id
     });
-  }, guardGate = async (action, before, after) => {
-    mutationGuard !== void 0 && await mutationGuard({ action, before, after, identity: activeAccess()?.currentUser.id });
+  }, guardGate = async (contexts) => {
+    const identity = activeAccess()?.currentUser.id;
+    await enforceMutationGuards(
+      mutationGuard,
+      contexts.map((context) => ({ ...context, identity }))
+    );
+  }, guardOne = async (action, before, after) => {
+    await guardGate([{ action, before, after }]);
   }, canRead = async (document) => {
     const access = activeAccess();
     return access === void 0 ? !0 : canAccess({
@@ -1184,7 +1253,7 @@ function makeHandle(handleArgs) {
       permission: "read",
       userId: access.currentUser.id
     });
-  }, applyPatch = async (documentId, ops, ifRev) => {
+  }, applyPatch = async (documentId, ops, ifRev, options = {}) => {
     const existing = store.get(documentId);
     if (existing === void 0)
       throw fakeError(
@@ -1196,7 +1265,7 @@ function makeHandle(handleArgs) {
       _rev: cryptoRandomKey(),
       _updatedAt: now
     };
-    return await guardGate("update", existing, next), store.put(next), next;
+    return options.evaluateGuard !== !1 && await guardOne("update", existing, next), store.put(next), next;
   }, applyTransaction = async (mutations, txnOptions) => {
     const transactionId = txnOptions?.transactionId ?? cryptoRandomKey(), snapshot = /* @__PURE__ */ new Map(), touchedIds = [], operations = [], remember = (id) => {
       snapshot.has(id) || snapshot.set(id, store.get(id));
@@ -1211,17 +1280,13 @@ function makeHandle(handleArgs) {
               throw fakeError(
                 `create() failed: a document with _id "${promoted._id}" already exists in dataset "${projectId}:${dataset}". Use createOrReplace() to overwrite it, or createIfNotExists() to leave the existing one untouched.`
               );
-            await gate(promoted, "create"), await guardGate("create", null, promoted), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
+            await gate(promoted, "create"), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
             break;
           }
           case "createOrReplace": {
             remember(mut.doc._id);
             const promoted = promote2(mut.doc), existing = store.get(promoted._id);
-            await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardGate(
-              existing !== void 0 ? "update" : "create",
-              existing ?? null,
-              promoted
-            );
+            await gate(existing ?? promoted, existing !== void 0 ? "update" : "create");
             const wasPresent = existing !== void 0;
             store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: wasPresent ? "update" : "create" });
             break;
@@ -1229,21 +1294,25 @@ function makeHandle(handleArgs) {
           case "createIfNotExists": {
             if (remember(mut.doc._id), store.get(mut.doc._id) === void 0) {
               const promoted = promote2(mut.doc);
-              await gate(promoted, "create"), await guardGate("create", null, promoted), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
+              await gate(promoted, "create"), store.put(promoted), touchedIds.push(promoted._id), operations.push({ id: promoted._id, operation: "create" });
             }
             break;
           }
           case "delete": {
             remember(mut.id);
             const existing = store.get(mut.id);
-            existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardGate("delete", existing, null), store.remove(mut.id) && (touchedIds.push(mut.id), operations.push({ id: mut.id, operation: "delete" }));
+            existing !== void 0 && await gate(existing, "update"), store.remove(mut.id) && (touchedIds.push(mut.id), operations.push({ id: mut.id, operation: "delete" }));
             break;
           }
           case "patch": {
-            remember(mut.documentId), await applyPatch(mut.documentId, mut.ops, mut.ifRev), touchedIds.push(mut.documentId), operations.push({ id: mut.documentId, operation: "update" });
+            remember(mut.documentId), await applyPatch(mut.documentId, mut.ops, mut.ifRev, { evaluateGuard: !1 }), touchedIds.push(mut.documentId), operations.push({ id: mut.documentId, operation: "update" });
             break;
           }
         }
+      const contexts = mutationContexts(
+        [...snapshot].map(([id, before]) => ({ before, after: store.get(id) }))
+      );
+      await guardGate(contexts);
     } catch (error) {
       for (const [id, doc] of snapshot)
         doc === void 0 ? store.remove(id) : store.put(doc);
@@ -1308,7 +1377,7 @@ function makeHandle(handleArgs) {
           `create() failed: a document with _id "${doc._id}" already exists in dataset "${projectId}:${dataset}". Use createOrReplace() to overwrite it, or createIfNotExists() to leave the existing one untouched.`
         );
       const promoted = promote2(doc);
-      await gate(promoted, "create"), await guardGate("create", null, promoted);
+      await gate(promoted, "create"), await guardOne("create", null, promoted);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       return opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "create", doc }], opts?.tag)), writeResult(
         [promoted],
@@ -1320,7 +1389,7 @@ function makeHandle(handleArgs) {
     createOrReplace: (doc, opts) => serializeWrite(backend, async () => {
       checkRevision(doc._id, opts?.ifRevisionId);
       const promoted = promote2(doc), existing = store.get(doc._id);
-      await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardGate(existing !== void 0 ? "update" : "create", existing ?? null, promoted);
+      await gate(existing ?? promoted, existing !== void 0 ? "update" : "create"), await guardOne(existing !== void 0 ? "update" : "create", existing ?? null, promoted);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createOrReplace", doc }], opts?.tag));
       const operation = existing !== void 0 ? "update" : "create";
@@ -1342,7 +1411,7 @@ function makeHandle(handleArgs) {
           opts
         );
       const promoted = promote2(doc);
-      return await gate(promoted, "create"), await guardGate("create", null, promoted), opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createIfNotExists", doc }], opts?.tag)), writeResult(
+      return await gate(promoted, "create"), await guardOne("create", null, promoted), opts?.dryRun !== !0 && (store.put(promoted), record(transactionId, [{ kind: "createIfNotExists", doc }], opts?.tag)), writeResult(
         [promoted],
         [{ id: promoted._id, operation: "create" }],
         transactionId,
@@ -1352,7 +1421,7 @@ function makeHandle(handleArgs) {
     delete: (id, opts) => serializeWrite(backend, async () => {
       checkRevision(id, opts?.ifRevisionId);
       const existing = store.get(id);
-      existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardGate("delete", existing, null);
+      existing !== void 0 && await gate(existing, "update"), existing !== void 0 && await guardOne("delete", existing, null);
       const transactionId = opts?.transactionId ?? cryptoRandomKey();
       let removed = existing;
       return opts?.dryRun !== !0 && (removed = store.remove(id), removed !== void 0 && record(transactionId, [{ kind: "delete", id }], opts?.tag)), opts?.returnDocuments === void 0 && opts?.returnFirst === void 0 ? removed !== void 0 ? { _id: id } : null : formatMutationResult(
@@ -1503,6 +1572,7 @@ function makeHandle(handleArgs) {
 }
 export {
   ERR_PREFIX,
+  GuardDeniedError,
   SUPPORTED_SURFACE,
   UNSUPPORTED_MEMBERS,
   WriteAccessDeniedError,