@sanity-labs/client-fake-for-test 0.13.0 → 0.14.0

package/README.md

@@ -198,10 +198,12 @@ await canvas.releases.create({ releaseId: "r1" }); // 404 Cannot POST /canvases/
 | ACL `<data base>/acl` | ✅ | ✅ | ✅ | 404 `Cannot GET …` |
 | Access API `…/user-permissions/me`, `…/me/check` | ✅ | ✅ | ✅ | ✅ |
 | Access API `…/users` | ✅ | ✅ | 403 | 403 |
+| Access API `…/users/<sanityUserId>` (served on `organization`, below) | 403 | 403 | 403 | 403 |
 | Access API `…/roles` | ✅ | 403 | 403 | 403 |
 | Org lookup | `/projects/<projectId>` | `GET /media-libraries/<id>` | `GET /canvases/<id>` | `GET /dashboards/<id>` |
 
-- **Access API.** Paths are `/access/<type>/<id>/…` with type `project`, `media-library`, `canvas` or `dashboard`. An identity's `access` entries, keyed `"<type>:<id>"`, hold its `roles` there (non-dataset membership) and the `permissions` the `user-permissions` endpoints report. Every identity is a project member with its project roles. Listings come back on one page (`nextCursor: null`). An unknown type answers 400 `Invalid resource type <type>`. An id the registry does not hold (never seeded, written or addressed) answers 404 `Media library not found` / `Canvas not found` / `Dashboard not found`, except `…/me/check`, which answers `false` as staging does. The 403 cells were not proven on staging (no token could list them), so they answer the way the platform refuses a missing permission: `{ statusCode: 403, message: "You do not have permission to access this resource" }`.
+- **Access API.** Paths are `/access/<type>/<id>/…` with type `organization`, `project`, `media-library`, `canvas` or `dashboard`. An identity's `access` entries, keyed `"<type>:<id>"`, hold its `roles` there (membership) and the `permissions` the `user-permissions` endpoints report. Every identity is a project member with its project roles. A user row is `{ sanityUserId, profile: { id, displayName, email, provider, createdAt }, memberships: [{ resourceType, resourceId, roleNames }] }`; the fake does not model `provider` or `createdAt`, so they are always `"sanity"` and the epoch, and `email` is `""` where the identity seeds none. Listings come back on one page (`nextCursor: null`); users listings add `totalCount`. `includeImpliedRoles` is accepted and ignored: rows carry the seeded roles only, so seed an implied role explicitly when a test needs it. An unknown type answers 400 `Invalid resource type <type>`. An id the registry does not hold (never seeded, written or addressed) answers 404 `Media library not found` / `Canvas not found` / `Dashboard not found`, except `…/me/check`, which answers `false` as staging does. `…/users/<sanityUserId>` is served only on the organization, where the fake checks members read; elsewhere it answers 403 (the reference requires `sanity.<type>.members.read` for it; no type's single-user read was probed on staging, only the media-library listing). The other 403 cells were not proven on staging (no token could list them), so they answer the way the platform refuses a missing permission: `{ statusCode: 403, error: "Forbidden", message: "You do not have permission to access this resource" }`.
+- **Organization.** `/access/organization/<organizationId>/users` and `…/users/<sanityUserId>` (one row, or 404 `User not found` for a non-member) serve the members of the client's `organizationId`: identities with roles in their `"organization:<id>"` entry. Each row lists the organization membership, then the member's roles on every resource the client holds (its libraries, canvases, dashboards and projects), as the platform's organization row does. Like the platform, it needs `sanity.organization.members.read` in the actor's `"organization:<id>"` `permissions` (the built-in `member` role grants it), else 403. Another organization id answers 404 `Organization not found`; `…/roles` answers 403.
 - **History.** Every committed write since the client was created is recorded per resource, authored by the acting identity; seeded documents can be read at their seeded `_rev`. A handle answers for its own resource, and hides documents its grants cannot read, as reads do (a transaction that also touched such a document is served without it). Events model `createLiveDocument` / `updateLiveDocument` only.
 - **Org lookup.** `createTestClient({ organizationId })` names the organization every resource of the client belongs to.
 - **Identity.** `@sanity/client` sends a `resource` client's requests to the global host, so `/users/me` answers `globalUser`.

package/dist/index.cjs

@@ -104,7 +104,7 @@ function accessApiError(args) {
     ...request,
     statusCode,
     statusMessage,
-    body: { statusCode, message }
+    body: { statusCode, error: statusMessage, message }
   });
 }
 const noPermission = (request) => accessApiError({
@@ -187,14 +187,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: {},
-    access: {
-      type: "project",
-      id: (id) => datasetParts(id).projectId,
-      roles: "served",
-      users: "served",
-      // Every registered identity is a member of every project, with its project roles.
-      memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
-    }
+    access: { type: "project", id: (id) => datasetParts(id).projectId }
   },
   "media-library": {
     label: (id) => `media library "${id}"`,
@@ -206,15 +199,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: { "sanity.action.release.create": releaseLimitExceeded },
-    access: {
-      type: "media-library",
-      id: (id) => id,
-      // Unproven on staging (no token held roles read): refused like a missing permission.
-      roles: noPermission,
-      users: "served",
-      unknownId: notFound("Media library"),
-      memberRoles: accessEntryRoles("media-library")
-    }
+    access: { type: "media-library", id: (id) => id }
   },
   canvas: {
     label: (id) => `canvas "${id}"`,
@@ -226,15 +211,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "canvas",
-      id: (id) => id,
-      // Unproven on staging (no canvas roles/members permission exists to grant).
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Canvas"),
-      memberRoles: accessEntryRoles("canvas")
-    }
+    access: { type: "canvas", id: (id) => id }
   },
   dashboard: {
     label: (id) => `dashboard "${id}"`,
@@ -246,19 +223,11 @@ const RESOURCE_CAPABILITIES = {
     history: notMounted,
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "dashboard",
-      id: (id) => id,
-      // Unproven on staging, as for canvas.
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Dashboard"),
-      memberRoles: accessEntryRoles("dashboard")
-    }
+    access: { type: "dashboard", id: (id) => id }
   }
 };
 function capabilitiesOf(type) {
-  const row = RESOURCE_CAPABILITIES[type];
+  const row = Object.hasOwn(RESOURCE_CAPABILITIES, type) ? RESOURCE_CAPABILITIES[type] : void 0;
   if (row === void 0)
     throw fakeError(
       `Unsupported resource type ${JSON.stringify(type)}. The fake serves ${Object.keys(RESOURCE_CAPABILITIES).map((t) => `"${t}"`).join(", ")}.`
@@ -280,9 +249,76 @@ function matchResourcePath(path) {
       return { resource: { type, id: match.id }, rest: match.rest };
   }
 }
-function capabilitiesForAccessType(type) {
-  for (const [resourceType, row] of Object.entries(RESOURCE_CAPABILITIES))
-    if (row.access.type === type) return { resourceType, row };
+function accessResourceOf(resource) {
+  const { access } = capabilitiesOf(resource.type);
+  return { type: access.type, id: access.id(resource.id) };
+}
+function holdsResource(type) {
+  return (registry, id) => registry.resources().some((resource) => {
+    const access = accessResourceOf(resource);
+    return access.type === type && access.id === id;
+  });
+}
+const ACCESS_CAPABILITIES = {
+  organization: {
+    // Proven on staging, but outside what the fake serves: refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    user: "served",
+    // Granted by the built-in organization `member` role.
+    usersPermission: "sanity.organization.members.read",
+    unknown: {
+      holds: (registry, id) => id === registry.organizationId,
+      refusal: notFound("Organization")
+    },
+    memberRoles: accessEntryRoles("organization"),
+    // Every resource of the family belongs to its organization (see `organizationId`).
+    owns: (registry) => {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const resource of registry.resources()) {
+        const access = accessResourceOf(resource);
+        byKey.set(accessKey(access.type, access.id), access);
+      }
+      return [...byKey.values()];
+    }
+  },
+  project: {
+    roles: "served",
+    users: "served",
+    // Single-user reads are served only where the fake checks members read (the
+    // organization); elsewhere they refuse rather than answer unchecked.
+    user: noPermission,
+    // Every registered identity is a member of every project, with its project roles.
+    memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
+  },
+  "media-library": {
+    // Unproven on staging (no token held roles read): refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    // Unproven on staging (only the listing was probed); refused as on `project`.
+    user: noPermission,
+    unknown: { holds: holdsResource("media-library"), refusal: notFound("Media library") },
+    memberRoles: accessEntryRoles("media-library")
+  },
+  canvas: {
+    // Unproven on staging (no canvas roles/members permission exists to grant).
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("canvas"), refusal: notFound("Canvas") },
+    memberRoles: accessEntryRoles("canvas")
+  },
+  dashboard: {
+    // Unproven on staging, as for canvas.
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("dashboard"), refusal: notFound("Dashboard") },
+    memberRoles: accessEntryRoles("dashboard")
+  }
+};
+function accessCapabilitiesOf(type) {
+  return Object.hasOwn(ACCESS_CAPABILITIES, type) ? ACCESS_CAPABILITIES[type] : void 0;
 }
 function dataUrl(args) {
   const { resource, dataset, operation, path } = args;
@@ -296,10 +332,14 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
+function usersPage(data) {
+  return { ...page(data), totalCount: data.length };
+}
+const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
   const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
   if (access !== null) {
@@ -369,20 +409,41 @@ async function readHistory(args) {
     };
 }
 function serveAccess(args) {
-  const { ctx, request, type, id, rest, query } = args, found = capabilitiesForAccessType(type);
-  if (found === void 0) throw invalidAccessType(request, type);
-  const accessType = found.row.access.type, { unknownId } = found.row.access;
-  if (unknownId !== void 0 && rest !== "/user-permissions/me/check" && !ctx.exists({ type: found.resourceType, id }))
-    throw unknownId(request);
-  const permissions = ctx.actorAccess()?.[accessKey(accessType, id)]?.permissions ?? [];
+  const { ctx, request, type, id, rest, query } = args, row = accessCapabilitiesOf(type);
+  if (row === void 0) throw invalidAccessType(request, type);
+  const resource = { type, id }, registry = {
+    organizationId: ctx.organizationId,
+    resources: ctx.resources
+  }, permissions = ctx.actorAccess()?.[accessKey(resource.type, id)]?.permissions ?? [];
+  if (rest === "/user-permissions/me/check") {
+    const requested = query.getAll("permissions").flatMap((value) => value.split(","));
+    return {
+      value: { data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)])) }
+    };
+  }
+  if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
+    throw row.unknown.refusal(request);
+  const users = (capability, serve) => serveCapability(capability, request, () => {
+    if (row.usersPermission !== void 0 && !permissions.includes(row.usersPermission))
+      throw noPermission(request);
+    return serve();
+  }), user = rest.match(ACCESS_USER_PATH);
+  if (user !== null)
+    return users(row.user, () => {
+      const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
+        (candidate) => candidate.sanityUserId === sanityUserId
+      );
+      if (record === void 0) throw notFound("User")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(found.row.access.roles, request, () => ({
-        value: page(rolesOn({ row: found.row, id, identities: ctx.identities() }))
+      return serveCapability(row.roles, request, () => ({
+        value: page(rolesOn({ resource, identities: ctx.identities() }))
       }));
     case "/users":
-      return serveCapability(found.row.access.users, request, () => ({
-        value: page(usersOn({ row: found.row, id, identities: ctx.identities() }))
+      return users(row.users, () => ({
+        value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
       }));
     case "/user-permissions/me":
       return {
@@ -391,58 +452,64 @@ function serveAccess(args) {
             const dot = permission.lastIndexOf(".");
             return {
               type: permission.slice(0, dot),
-              resourceType: accessType,
+              resourceType: resource.type,
               resourceId: id,
               action: permission.slice(dot + 1)
             };
           })
         )
       };
-    case "/user-permissions/me/check": {
-      const requested = query.getAll("permissions").flatMap((value) => value.split(","));
-      return {
-        value: {
-          data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)]))
-        }
-      };
-    }
     default:
       return;
   }
 }
 function rolesOn(args) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const identity of args.identities)
-    for (const role of args.row.access.memberRoles({ identity, id: args.id }) ?? [])
+  const { resource } = args, byName = /* @__PURE__ */ new Map();
+  for (const identity of args.identities) {
+    const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+    for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
         ...role.title !== void 0 ? { title: role.title } : {},
         ...role.description !== void 0 ? { description: role.description } : {}
       });
+  }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
 }
+function membershipOn(identity, resource) {
+  const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+  if (roles !== void 0)
+    return {
+      resourceType: resource.type,
+      resourceId: resource.id,
+      roleNames: roles.map((role) => role.name).toSorted()
+    };
+}
 function usersOn(args) {
-  const { row, id, identities } = args, bySanityUserId = /* @__PURE__ */ new Map();
+  const { resource, registry, identities } = args, owned = ACCESS_CAPABILITIES[resource.type].owns?.(registry) ?? [], bySanityUserId = /* @__PURE__ */ new Map();
   for (const identity of identities) {
-    const roles = row.access.memberRoles({ identity, id });
-    if (roles === void 0) continue;
+    const own = membershipOn(identity, resource);
+    if (own === void 0) continue;
     const user = identity.globalUser ?? identity.user, record = {
       sanityUserId: user.id,
       profile: {
+        id: user.id,
         displayName: user.name ?? user.id,
-        ...user.email !== void 0 ? { email: user.email } : {}
+        email: user.email ?? "",
+        ...UNMODELLED_PROFILE
       },
       memberships: [
-        {
-          resourceType: row.access.type,
-          resourceId: id,
-          roleNames: roles.map((role) => role.name).toSorted()
-        }
+        own,
+        // A user is part of a resource only through a role on it.
+        ...owned.flatMap((child) => {
+          const membership = membershipOn(identity, child);
+          return membership === void 0 || membership.roleNames.length === 0 ? [] : [membership];
+        })
       ]
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${row.access.type} "${id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
@@ -604,7 +671,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users[/<id>] | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -2035,7 +2102,7 @@ function makeHandle(handleArgs) {
           } : void 0,
           actorAccess: () => requireActiveAccess().access,
           identities: () => [...backend.identities.values()],
-          exists: (asked) => registry.has(registryKey(asked))
+          resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })
     } : {},