@sanity-labs/client-fake-for-test 0.13.0 → 0.14.0

package/dist/index.d.cts

@@ -1183,8 +1183,8 @@ export declare interface TestClientAccessControl {
    */
   aclPath?: string;
   /**
-   * Access API entries, keyed `"<access type>:<id>"` — `"project:<projectId>"`,
-   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
+   * Access API entries, keyed `"<access type>:<id>"` — `"organization:<id>"`,
+   * `"project:<projectId>"`, `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
    */
   access?: Record<string, ResourceAccess>;
 }
@@ -1225,10 +1225,10 @@ export declare interface TestClientIdentity {
   /** Grants served at the ACL path and enforced on reads/writes. */
   grants: Grant[];
   /**
-   * Access API entries, keyed `"<access type>:<id>"` (`"media-library:<id>"`,
-   * `"canvas:<id>"`, `"dashboard:<id>"`, `"project:<projectId>"`). On a
-   * non-dataset resource, an entry with `roles` makes the identity a member
-   * there. Project membership needs no entry: every identity is a member of
+   * Access API entries, keyed `"<access type>:<id>"` (`"organization:<id>"`,
+   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`,
+   * `"project:<projectId>"`). On a non-project resource, an entry with
+   * `roles` makes the identity a member there. Project membership needs no entry: every identity is a member of
    * every project with its project-scoped roles.
    */
   access?: Record<string, ResourceAccess>;

package/dist/index.d.ts

@@ -1183,8 +1183,8 @@ export declare interface TestClientAccessControl {
    */
   aclPath?: string;
   /**
-   * Access API entries, keyed `"<access type>:<id>"` — `"project:<projectId>"`,
-   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
+   * Access API entries, keyed `"<access type>:<id>"` — `"organization:<id>"`,
+   * `"project:<projectId>"`, `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`. See {@link ResourceAccess}.
    */
   access?: Record<string, ResourceAccess>;
 }
@@ -1225,10 +1225,10 @@ export declare interface TestClientIdentity {
   /** Grants served at the ACL path and enforced on reads/writes. */
   grants: Grant[];
   /**
-   * Access API entries, keyed `"<access type>:<id>"` (`"media-library:<id>"`,
-   * `"canvas:<id>"`, `"dashboard:<id>"`, `"project:<projectId>"`). On a
-   * non-dataset resource, an entry with `roles` makes the identity a member
-   * there. Project membership needs no entry: every identity is a member of
+   * Access API entries, keyed `"<access type>:<id>"` (`"organization:<id>"`,
+   * `"media-library:<id>"`, `"canvas:<id>"`, `"dashboard:<id>"`,
+   * `"project:<projectId>"`). On a non-project resource, an entry with
+   * `roles` makes the identity a member there. Project membership needs no entry: every identity is a member of
    * every project with its project-scoped roles.
    */
   access?: Record<string, ResourceAccess>;

package/dist/index.js

@@ -102,7 +102,7 @@ function accessApiError(args) {
     ...request,
     statusCode,
     statusMessage,
-    body: { statusCode, message }
+    body: { statusCode, error: statusMessage, message }
   });
 }
 const noPermission = (request) => accessApiError({
@@ -185,14 +185,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: {},
-    access: {
-      type: "project",
-      id: (id) => datasetParts(id).projectId,
-      roles: "served",
-      users: "served",
-      // Every registered identity is a member of every project, with its project roles.
-      memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
-    }
+    access: { type: "project", id: (id) => datasetParts(id).projectId }
   },
   "media-library": {
     label: (id) => `media library "${id}"`,
@@ -204,15 +197,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: "served",
     refusedActions: { "sanity.action.release.create": releaseLimitExceeded },
-    access: {
-      type: "media-library",
-      id: (id) => id,
-      // Unproven on staging (no token held roles read): refused like a missing permission.
-      roles: noPermission,
-      users: "served",
-      unknownId: notFound("Media library"),
-      memberRoles: accessEntryRoles("media-library")
-    }
+    access: { type: "media-library", id: (id) => id }
   },
   canvas: {
     label: (id) => `canvas "${id}"`,
@@ -224,15 +209,7 @@ const RESOURCE_CAPABILITIES = {
     history: "served",
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "canvas",
-      id: (id) => id,
-      // Unproven on staging (no canvas roles/members permission exists to grant).
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Canvas"),
-      memberRoles: accessEntryRoles("canvas")
-    }
+    access: { type: "canvas", id: (id) => id }
   },
   dashboard: {
     label: (id) => `dashboard "${id}"`,
@@ -244,19 +221,11 @@ const RESOURCE_CAPABILITIES = {
     history: notMounted,
     actions: notMounted,
     refusedActions: {},
-    access: {
-      type: "dashboard",
-      id: (id) => id,
-      // Unproven on staging, as for canvas.
-      roles: noPermission,
-      users: noPermission,
-      unknownId: notFound("Dashboard"),
-      memberRoles: accessEntryRoles("dashboard")
-    }
+    access: { type: "dashboard", id: (id) => id }
   }
 };
 function capabilitiesOf(type) {
-  const row = RESOURCE_CAPABILITIES[type];
+  const row = Object.hasOwn(RESOURCE_CAPABILITIES, type) ? RESOURCE_CAPABILITIES[type] : void 0;
   if (row === void 0)
     throw fakeError(
       `Unsupported resource type ${JSON.stringify(type)}. The fake serves ${Object.keys(RESOURCE_CAPABILITIES).map((t) => `"${t}"`).join(", ")}.`
@@ -278,9 +247,76 @@ function matchResourcePath(path) {
       return { resource: { type, id: match.id }, rest: match.rest };
   }
 }
-function capabilitiesForAccessType(type) {
-  for (const [resourceType, row] of Object.entries(RESOURCE_CAPABILITIES))
-    if (row.access.type === type) return { resourceType, row };
+function accessResourceOf(resource) {
+  const { access } = capabilitiesOf(resource.type);
+  return { type: access.type, id: access.id(resource.id) };
+}
+function holdsResource(type) {
+  return (registry, id) => registry.resources().some((resource) => {
+    const access = accessResourceOf(resource);
+    return access.type === type && access.id === id;
+  });
+}
+const ACCESS_CAPABILITIES = {
+  organization: {
+    // Proven on staging, but outside what the fake serves: refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    user: "served",
+    // Granted by the built-in organization `member` role.
+    usersPermission: "sanity.organization.members.read",
+    unknown: {
+      holds: (registry, id) => id === registry.organizationId,
+      refusal: notFound("Organization")
+    },
+    memberRoles: accessEntryRoles("organization"),
+    // Every resource of the family belongs to its organization (see `organizationId`).
+    owns: (registry) => {
+      const byKey = /* @__PURE__ */ new Map();
+      for (const resource of registry.resources()) {
+        const access = accessResourceOf(resource);
+        byKey.set(accessKey(access.type, access.id), access);
+      }
+      return [...byKey.values()];
+    }
+  },
+  project: {
+    roles: "served",
+    users: "served",
+    // Single-user reads are served only where the fake checks members read (the
+    // organization); elsewhere they refuse rather than answer unchecked.
+    user: noPermission,
+    // Every registered identity is a member of every project, with its project roles.
+    memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
+  },
+  "media-library": {
+    // Unproven on staging (no token held roles read): refused like a missing permission.
+    roles: noPermission,
+    users: "served",
+    // Unproven on staging (only the listing was probed); refused as on `project`.
+    user: noPermission,
+    unknown: { holds: holdsResource("media-library"), refusal: notFound("Media library") },
+    memberRoles: accessEntryRoles("media-library")
+  },
+  canvas: {
+    // Unproven on staging (no canvas roles/members permission exists to grant).
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("canvas"), refusal: notFound("Canvas") },
+    memberRoles: accessEntryRoles("canvas")
+  },
+  dashboard: {
+    // Unproven on staging, as for canvas.
+    roles: noPermission,
+    users: noPermission,
+    user: noPermission,
+    unknown: { holds: holdsResource("dashboard"), refusal: notFound("Dashboard") },
+    memberRoles: accessEntryRoles("dashboard")
+  }
+};
+function accessCapabilitiesOf(type) {
+  return Object.hasOwn(ACCESS_CAPABILITIES, type) ? ACCESS_CAPABILITIES[type] : void 0;
 }
 function dataUrl(args) {
   const { resource, dataset, operation, path } = args;
@@ -294,10 +330,14 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
+function usersPage(data) {
+  return { ...page(data), totalCount: data.length };
+}
+const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
   const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
   if (access !== null) {
@@ -367,20 +407,41 @@ async function readHistory(args) {
     };
 }
 function serveAccess(args) {
-  const { ctx, request, type, id, rest, query } = args, found = capabilitiesForAccessType(type);
-  if (found === void 0) throw invalidAccessType(request, type);
-  const accessType = found.row.access.type, { unknownId } = found.row.access;
-  if (unknownId !== void 0 && rest !== "/user-permissions/me/check" && !ctx.exists({ type: found.resourceType, id }))
-    throw unknownId(request);
-  const permissions = ctx.actorAccess()?.[accessKey(accessType, id)]?.permissions ?? [];
+  const { ctx, request, type, id, rest, query } = args, row = accessCapabilitiesOf(type);
+  if (row === void 0) throw invalidAccessType(request, type);
+  const resource = { type, id }, registry = {
+    organizationId: ctx.organizationId,
+    resources: ctx.resources
+  }, permissions = ctx.actorAccess()?.[accessKey(resource.type, id)]?.permissions ?? [];
+  if (rest === "/user-permissions/me/check") {
+    const requested = query.getAll("permissions").flatMap((value) => value.split(","));
+    return {
+      value: { data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)])) }
+    };
+  }
+  if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
+    throw row.unknown.refusal(request);
+  const users = (capability, serve) => serveCapability(capability, request, () => {
+    if (row.usersPermission !== void 0 && !permissions.includes(row.usersPermission))
+      throw noPermission(request);
+    return serve();
+  }), user = rest.match(ACCESS_USER_PATH);
+  if (user !== null)
+    return users(row.user, () => {
+      const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
+        (candidate) => candidate.sanityUserId === sanityUserId
+      );
+      if (record === void 0) throw notFound("User")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(found.row.access.roles, request, () => ({
-        value: page(rolesOn({ row: found.row, id, identities: ctx.identities() }))
+      return serveCapability(row.roles, request, () => ({
+        value: page(rolesOn({ resource, identities: ctx.identities() }))
       }));
     case "/users":
-      return serveCapability(found.row.access.users, request, () => ({
-        value: page(usersOn({ row: found.row, id, identities: ctx.identities() }))
+      return users(row.users, () => ({
+        value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
       }));
     case "/user-permissions/me":
       return {
@@ -389,58 +450,64 @@ function serveAccess(args) {
             const dot = permission.lastIndexOf(".");
             return {
               type: permission.slice(0, dot),
-              resourceType: accessType,
+              resourceType: resource.type,
               resourceId: id,
               action: permission.slice(dot + 1)
             };
           })
         )
       };
-    case "/user-permissions/me/check": {
-      const requested = query.getAll("permissions").flatMap((value) => value.split(","));
-      return {
-        value: {
-          data: Object.fromEntries(requested.map((p) => [p, permissions.includes(p)]))
-        }
-      };
-    }
     default:
       return;
   }
 }
 function rolesOn(args) {
-  const byName = /* @__PURE__ */ new Map();
-  for (const identity of args.identities)
-    for (const role of args.row.access.memberRoles({ identity, id: args.id }) ?? [])
+  const { resource } = args, byName = /* @__PURE__ */ new Map();
+  for (const identity of args.identities) {
+    const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+    for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
         ...role.title !== void 0 ? { title: role.title } : {},
         ...role.description !== void 0 ? { description: role.description } : {}
       });
+  }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
 }
+function membershipOn(identity, resource) {
+  const roles = ACCESS_CAPABILITIES[resource.type].memberRoles({ identity, id: resource.id });
+  if (roles !== void 0)
+    return {
+      resourceType: resource.type,
+      resourceId: resource.id,
+      roleNames: roles.map((role) => role.name).toSorted()
+    };
+}
 function usersOn(args) {
-  const { row, id, identities } = args, bySanityUserId = /* @__PURE__ */ new Map();
+  const { resource, registry, identities } = args, owned = ACCESS_CAPABILITIES[resource.type].owns?.(registry) ?? [], bySanityUserId = /* @__PURE__ */ new Map();
   for (const identity of identities) {
-    const roles = row.access.memberRoles({ identity, id });
-    if (roles === void 0) continue;
+    const own = membershipOn(identity, resource);
+    if (own === void 0) continue;
     const user = identity.globalUser ?? identity.user, record = {
       sanityUserId: user.id,
       profile: {
+        id: user.id,
         displayName: user.name ?? user.id,
-        ...user.email !== void 0 ? { email: user.email } : {}
+        email: user.email ?? "",
+        ...UNMODELLED_PROFILE
       },
       memberships: [
-        {
-          resourceType: row.access.type,
-          resourceId: id,
-          roleNames: roles.map((role) => role.name).toSorted()
-        }
+        own,
+        // A user is part of a resource only through a role on it.
+        ...owned.flatMap((child) => {
+          const membership = membershipOn(identity, child);
+          return membership === void 0 || membership.roleNames.length === 0 ? [] : [membership];
+        })
       ]
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${row.access.type} "${id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
@@ -602,7 +669,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users[/<id>] | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -2033,7 +2100,7 @@ function makeHandle(handleArgs) {
           } : void 0,
           actorAccess: () => requireActiveAccess().access,
           identities: () => [...backend.identities.values()],
-          exists: (asked) => registry.has(registryKey(asked))
+          resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })
     } : {},