@sanity-labs/client-fake-for-test 0.14.0 → 0.15.0

package/README.md

@@ -199,11 +199,14 @@ await canvas.releases.create({ releaseId: "r1" }); // 404 Cannot POST /canvases/
 | Access API `…/user-permissions/me`, `…/me/check` | ✅ | ✅ | ✅ | ✅ |
 | Access API `…/users` | ✅ | ✅ | 403 | 403 |
 | Access API `…/users/<sanityUserId>` (served on `organization`, below) | 403 | 403 | 403 | 403 |
-| Access API `…/roles` | ✅ | 403 | 403 | 403 |
+| Access API `…/roles`, `…/roles/<roleName>` | ✅ | ✅ with `sanity.media-library.roles.read`, else 403 | 403 | 403 |
 | Org lookup | `/projects/<projectId>` | `GET /media-libraries/<id>` | `GET /canvases/<id>` | `GET /dashboards/<id>` |
 
 - **Access API.** Paths are `/access/<type>/<id>/…` with type `organization`, `project`, `media-library`, `canvas` or `dashboard`. An identity's `access` entries, keyed `"<type>:<id>"`, hold its `roles` there (membership) and the `permissions` the `user-permissions` endpoints report. Every identity is a project member with its project roles. A user row is `{ sanityUserId, profile: { id, displayName, email, provider, createdAt }, memberships: [{ resourceType, resourceId, roleNames }] }`; the fake does not model `provider` or `createdAt`, so they are always `"sanity"` and the epoch, and `email` is `""` where the identity seeds none. Listings come back on one page (`nextCursor: null`); users listings add `totalCount`. `includeImpliedRoles` is accepted and ignored: rows carry the seeded roles only, so seed an implied role explicitly when a test needs it. An unknown type answers 400 `Invalid resource type <type>`. An id the registry does not hold (never seeded, written or addressed) answers 404 `Media library not found` / `Canvas not found` / `Dashboard not found`, except `…/me/check`, which answers `false` as staging does. `…/users/<sanityUserId>` is served only on the organization, where the fake checks members read; elsewhere it answers 403 (the reference requires `sanity.<type>.members.read` for it; no type's single-user read was probed on staging, only the media-library listing). The other 403 cells were not proven on staging (no token could list them), so they answer the way the platform refuses a missing permission: `{ statusCode: 403, error: "Forbidden", message: "You do not have permission to access this resource" }`.
+- **Members.** Every member listing (`/projects/<projectId>`, `…/users`, `…/roles`) sees the registered identities plus, on a handle created with inline `accessControl`, that handle's own actor. Inline config belongs to its handle: a token sibling does not see it.
+- **Roles.** `…/roles` answers `{ data: [role], nextCursor: null }` and `…/roles/<roleName>` one role (404 `Role not found` for a name no member holds). A role is `{ name, title, description?, resourceType, resourceId, appliesToUsers, appliesToRobots, permissions }`, collected from the roles the members hold on the resource. The fake does not model role definitions, so `title` is the name where the seed gives none, both `appliesTo…` flags are `true` and `permissions` is `[]`. A media library serves its roles only to an actor whose `"media-library:<id>"` entry holds `sanity.media-library.roles.read` in `permissions`, else 403, as the reference requires.
 - **Organization.** `/access/organization/<organizationId>/users` and `…/users/<sanityUserId>` (one row, or 404 `User not found` for a non-member) serve the members of the client's `organizationId`: identities with roles in their `"organization:<id>"` entry. Each row lists the organization membership, then the member's roles on every resource the client holds (its libraries, canvases, dashboards and projects), as the platform's organization row does. Like the platform, it needs `sanity.organization.members.read` in the actor's `"organization:<id>"` `permissions` (the built-in `member` role grants it), else 403. Another organization id answers 404 `Organization not found`; `…/roles` answers 403.
+- **User attributes.** `GET /organizations/<organizationId>/users/me/attributes` answers the caller's own attributes there: `{ sanityUserId, organizationId, attributes: [{ type, key, values: { saml?, sanity? }, activeSource, activeValue }] }`, ordered by key. Seed them as `attributes: [{ key, type, values }]` on the identity's `"organization:<id>"` entry; the Sanity value takes precedence over the SAML one for `activeSource` and `activeValue`, as on the platform. No permission is needed. `limit` (default 50) and `cursor` (the last key of the previous page) page the list. A member with no seeded attributes gets `attributes: []`; a caller without roles in the organization gets 404 `User not found`, and another organization id 404 `Organization not found`.
 - **History.** Every committed write since the client was created is recorded per resource, authored by the acting identity; seeded documents can be read at their seeded `_rev`. A handle answers for its own resource, and hides documents its grants cannot read, as reads do (a transaction that also touched such a document is served without it). Events model `createLiveDocument` / `updateLiveDocument` only.
 - **Org lookup.** `createTestClient({ organizationId })` names the organization every resource of the client belongs to.
 - **Identity.** `@sanity/client` sends a `resource` client's requests to the global host, so `/users/me` answers `globalUser`.

package/dist/index.cjs

@@ -292,8 +292,9 @@ const ACCESS_CAPABILITIES = {
     memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
   },
   "media-library": {
-    // Unproven on staging (no token held roles read): refused like a missing permission.
-    roles: noPermission,
+    // Staging refuses it only because no probe token held roles read.
+    roles: "served",
+    rolesPermission: "sanity.media-library.roles.read",
     users: "served",
     // Unproven on staging (only the listing was probed); refused as on `project`.
     user: noPermission,
@@ -332,7 +333,7 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, ACCESS_ROLE_PATH = /^\/roles\/([^/]+)$/, MY_ATTRIBUTES_PATH = /^\/organizations\/([^/]+)\/users\/me\/attributes$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
@@ -341,7 +342,12 @@ function usersPage(data) {
 }
 const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
-  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
+  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, myAttributes = path.match(MY_ATTRIBUTES_PATH);
+  if (myAttributes !== null) {
+    const organizationId = decodeURIComponent(myAttributes[1]);
+    return serveMyAttributes({ ctx, request, organizationId, query });
+  }
+  const access = path.match(ACCESS_PATH);
   if (access !== null) {
     const [, type, id, rest2] = access;
     return serveAccess({ ctx, request, type, id: decodeURIComponent(id), rest: rest2 ?? "", query });
@@ -423,11 +429,11 @@ function serveAccess(args) {
   }
   if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
     throw row.unknown.refusal(request);
-  const users = (capability, serve) => serveCapability(capability, request, () => {
-    if (row.usersPermission !== void 0 && !permissions.includes(row.usersPermission))
+  const gated = (capability, permission, serve) => serveCapability(capability, request, () => {
+    if (permission !== void 0 && !permissions.includes(permission))
       throw noPermission(request);
     return serve();
-  }), user = rest.match(ACCESS_USER_PATH);
+  }), users = (capability, serve) => gated(capability, row.usersPermission, serve), roles = () => rolesOn({ resource, identities: ctx.identities() }), user = rest.match(ACCESS_USER_PATH);
   if (user !== null)
     return users(row.user, () => {
       const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
@@ -436,11 +442,16 @@ function serveAccess(args) {
       if (record === void 0) throw notFound("User")(request);
       return { value: record };
     });
+  const role = rest.match(ACCESS_ROLE_PATH);
+  if (role !== null)
+    return gated(row.roles, row.rolesPermission, () => {
+      const name = decodeURIComponent(role[1]), record = roles().find((candidate) => candidate.name === name);
+      if (record === void 0) throw notFound("Role")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(row.roles, request, () => ({
-        value: page(rolesOn({ resource, identities: ctx.identities() }))
-      }));
+      return gated(row.roles, row.rolesPermission, () => ({ value: page(roles()) }));
     case "/users":
       return users(row.users, () => ({
         value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
@@ -463,6 +474,7 @@ function serveAccess(args) {
       return;
   }
 }
+const UNMODELLED_ROLE = { appliesToUsers: !0, appliesToRobots: !0 };
 function rolesOn(args) {
   const { resource } = args, byName = /* @__PURE__ */ new Map();
   for (const identity of args.identities) {
@@ -470,8 +482,12 @@ function rolesOn(args) {
     for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
-        ...role.title !== void 0 ? { title: role.title } : {},
-        ...role.description !== void 0 ? { description: role.description } : {}
+        title: role.title ?? role.name,
+        ...role.description !== void 0 ? { description: role.description } : {},
+        resourceType: resource.type,
+        resourceId: resource.id,
+        ...UNMODELLED_ROLE,
+        permissions: []
       });
   }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
@@ -509,12 +525,40 @@ function usersOn(args) {
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identities so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
   return [...bySanityUserId.values()];
 }
+const DEFAULT_ATTRIBUTES_LIMIT = 50;
+function serveMyAttributes(args) {
+  const { ctx, request, organizationId, query } = args, organization = ACCESS_CAPABILITIES.organization, registry = { organizationId: ctx.organizationId, resources: ctx.resources };
+  if (organization.unknown !== void 0 && !organization.unknown.holds(registry, organizationId))
+    throw organization.unknown.refusal(request);
+  const entry = ctx.actorAccess()?.[accessKey("organization", organizationId)];
+  if (entry?.roles === void 0) throw notFound("User")(request);
+  const limit = attributesLimit(query), cursor = query.get("cursor"), attributes = (entry.attributes ?? []).map(attributeRecord).toSorted((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).filter((attribute) => cursor === null || attribute.key > cursor).slice(0, limit);
+  return { value: { sanityUserId: ctx.actorUser().id, organizationId, attributes } };
+}
+function attributesLimit(query) {
+  const raw = query.get("limit");
+  if (raw === null) return DEFAULT_ATTRIBUTES_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1)
+    throw fakeError(
+      `request(): users/me/attributes got limit=${JSON.stringify(raw)}; the fake serves positive integer limits only (the platform's answer to others is not simulated).`
+    );
+  return limit;
+}
+function attributeRecord(attribute) {
+  const { key, type, values } = attribute, activeSource = values.sanity !== void 0 ? "sanity" : "saml", activeValue = values[activeSource];
+  if (activeValue === void 0)
+    throw fakeError(
+      `request(): user attribute "${key}" is seeded with no value; give it a \`saml\` or \`sanity\` value.`
+    );
+  return { type, key, values: { ...values }, activeSource, activeValue };
+}
 class WriteAccessDeniedError extends Error {
   documentId;
   permission;
@@ -586,7 +630,7 @@ function consistentProjectRecords(args) {
     const existing = byId.get(record.id);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identities so duplicate ids carry identical records.`
       );
     byId.set(record.id, record);
   }
@@ -671,7 +715,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users[/<id>] | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles[/<name>] | users[/<id>] | user-permissions/me[/check]") and the caller's attributes ("/organizations/<id>/users/me/attributes"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -1734,7 +1778,17 @@ function makeHandle(handleArgs) {
     if (access === void 0)
       throw fakeError("this handle has no acting identity (no token or accessControl bound).");
     return access;
-  }, capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
+  }, members = () => [
+    ...backend.identities.values(),
+    ...token === void 0 && accessControl !== void 0 ? [
+      {
+        user: accessControl.currentUser,
+        ...accessControl.globalUser !== void 0 ? { globalUser: accessControl.globalUser } : {},
+        grants: accessControl.grants,
+        ...accessControl.access !== void 0 ? { access: accessControl.access } : {}
+      }
+    ] : []
+  ], capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
     const access = activeAccess();
     if (access !== void 0)
       return capabilities.identity === "global" ? (access.globalUser ?? access.currentUser).id : access.currentUser.id;
@@ -2090,7 +2144,7 @@ function makeHandle(handleArgs) {
         // client to the global API host.
         useProjectHostname: useProjectHostname && resource === void 0,
         organizationId: backend.organizationId,
-        listIdentities: () => [...backend.identities.values()],
+        listIdentities: members,
         platform: {
           projectId,
           organizationId: backend.organizationId,
@@ -2100,8 +2154,12 @@ function makeHandle(handleArgs) {
             history,
             canRead
           } : void 0,
+          actorUser: () => {
+            const access = requireActiveAccess();
+            return access.globalUser ?? access.currentUser;
+          },
           actorAccess: () => requireActiveAccess().access,
-          identities: () => [...backend.identities.values()],
+          identities: members,
           resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })