@sanity-labs/client-fake-for-test 0.14.0 → 0.15.0

package/dist/index.d.cts

@@ -841,6 +841,12 @@ export declare type ReleaseType = "asap" | "scheduled" | "undecided";
 export declare interface ResourceAccess {
   roles?: NonNullable<CurrentUser["roles"]>;
   permissions?: string[];
+  /**
+   * The user's attributes in the organization, as an administrator or SAML
+   * sync set them; read on `"organization:<id>"` entries only. Served by
+   * `GET /organizations/<id>/users/me/attributes`.
+   */
+  attributes?: UserAttribute[];
 }
 
 /** Resource types `@sanity/client`'s `resource` config can name (the ones staging probed). */
@@ -1365,6 +1371,29 @@ declare interface UnsupportedEntry {
   workaround: string;
 }
 
+/**
+ * One user attribute: its key, its type, and its value from each source.
+ * The served row adds `activeSource` and `activeValue`: the Sanity value
+ * when there is one, else the SAML value.
+ */
+export declare interface UserAttribute {
+  key: string;
+  type: string;
+  values: {
+    saml?: UserAttributeValue;
+    sanity?: UserAttributeValue;
+  };
+}
+
+/** A value a user attribute can hold. */
+export declare type UserAttributeValue =
+  | string
+  | number
+  | boolean
+  | string[]
+  | number[]
+  | boolean[];
+
 export declare type VersionAction =
   | {
       actionType: "sanity.action.document.version.create";

package/dist/index.d.ts

@@ -841,6 +841,12 @@ export declare type ReleaseType = "asap" | "scheduled" | "undecided";
 export declare interface ResourceAccess {
   roles?: NonNullable<CurrentUser["roles"]>;
   permissions?: string[];
+  /**
+   * The user's attributes in the organization, as an administrator or SAML
+   * sync set them; read on `"organization:<id>"` entries only. Served by
+   * `GET /organizations/<id>/users/me/attributes`.
+   */
+  attributes?: UserAttribute[];
 }
 
 /** Resource types `@sanity/client`'s `resource` config can name (the ones staging probed). */
@@ -1365,6 +1371,29 @@ declare interface UnsupportedEntry {
   workaround: string;
 }
 
+/**
+ * One user attribute: its key, its type, and its value from each source.
+ * The served row adds `activeSource` and `activeValue`: the Sanity value
+ * when there is one, else the SAML value.
+ */
+export declare interface UserAttribute {
+  key: string;
+  type: string;
+  values: {
+    saml?: UserAttributeValue;
+    sanity?: UserAttributeValue;
+  };
+}
+
+/** A value a user attribute can hold. */
+export declare type UserAttributeValue =
+  | string
+  | number
+  | boolean
+  | string[]
+  | number[]
+  | boolean[];
+
 export declare type VersionAction =
   | {
       actionType: "sanity.action.document.version.create";

package/dist/index.js

@@ -290,8 +290,9 @@ const ACCESS_CAPABILITIES = {
     memberRoles: ({ identity, id }) => (identity.usersByProject?.[id] ?? identity.user).roles ?? []
   },
   "media-library": {
-    // Unproven on staging (no token held roles read): refused like a missing permission.
-    roles: noPermission,
+    // Staging refuses it only because no probe token held roles read.
+    roles: "served",
+    rolesPermission: "sanity.media-library.roles.read",
     users: "served",
     // Unproven on staging (only the listing was probed); refused as on `project`.
     user: noPermission,
@@ -330,7 +331,7 @@ function dataUrl(args) {
   const base = `/${operation}/${dataset}`;
   return `/data${path !== void 0 ? `${base}/${path}` : base}`.replace(/\/($|\?)/, "$1");
 }
-const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
+const ACCESS_PATH = /^\/access\/([^/]+)\/([^/]+)(\/.*)?$/, ACCESS_USER_PATH = /^\/users\/([^/]+)$/, ACCESS_ROLE_PATH = /^\/roles\/([^/]+)$/, MY_ATTRIBUTES_PATH = /^\/organizations\/([^/]+)\/users\/me\/attributes$/, DATA_HISTORY_PATH = /^\/data\/history\/([^/]+)(\/.*)$/;
 function page(data) {
   return { data, nextCursor: null };
 }
@@ -339,7 +340,12 @@ function usersPage(data) {
 }
 const UNMODELLED_PROFILE = { provider: "sanity", createdAt: (/* @__PURE__ */ new Date(0)).toISOString() };
 async function servePlatformRequest(ctx, url) {
-  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, access = path.match(ACCESS_PATH);
+  const queryStart = url.indexOf("?"), path = queryStart === -1 ? url : url.slice(0, queryStart), query = new URLSearchParams(queryStart === -1 ? "" : url.slice(queryStart + 1)), request = { method: "GET", path }, myAttributes = path.match(MY_ATTRIBUTES_PATH);
+  if (myAttributes !== null) {
+    const organizationId = decodeURIComponent(myAttributes[1]);
+    return serveMyAttributes({ ctx, request, organizationId, query });
+  }
+  const access = path.match(ACCESS_PATH);
   if (access !== null) {
     const [, type, id, rest2] = access;
     return serveAccess({ ctx, request, type, id: decodeURIComponent(id), rest: rest2 ?? "", query });
@@ -421,11 +427,11 @@ function serveAccess(args) {
   }
   if (row.unknown !== void 0 && !row.unknown.holds(registry, id))
     throw row.unknown.refusal(request);
-  const users = (capability, serve) => serveCapability(capability, request, () => {
-    if (row.usersPermission !== void 0 && !permissions.includes(row.usersPermission))
+  const gated = (capability, permission, serve) => serveCapability(capability, request, () => {
+    if (permission !== void 0 && !permissions.includes(permission))
       throw noPermission(request);
     return serve();
-  }), user = rest.match(ACCESS_USER_PATH);
+  }), users = (capability, serve) => gated(capability, row.usersPermission, serve), roles = () => rolesOn({ resource, identities: ctx.identities() }), user = rest.match(ACCESS_USER_PATH);
   if (user !== null)
     return users(row.user, () => {
       const sanityUserId = decodeURIComponent(user[1]), record = usersOn({ resource, registry, identities: ctx.identities() }).find(
@@ -434,11 +440,16 @@ function serveAccess(args) {
       if (record === void 0) throw notFound("User")(request);
       return { value: record };
     });
+  const role = rest.match(ACCESS_ROLE_PATH);
+  if (role !== null)
+    return gated(row.roles, row.rolesPermission, () => {
+      const name = decodeURIComponent(role[1]), record = roles().find((candidate) => candidate.name === name);
+      if (record === void 0) throw notFound("Role")(request);
+      return { value: record };
+    });
   switch (rest) {
     case "/roles":
-      return serveCapability(row.roles, request, () => ({
-        value: page(rolesOn({ resource, identities: ctx.identities() }))
-      }));
+      return gated(row.roles, row.rolesPermission, () => ({ value: page(roles()) }));
     case "/users":
       return users(row.users, () => ({
         value: usersPage(usersOn({ resource, registry, identities: ctx.identities() }))
@@ -461,6 +472,7 @@ function serveAccess(args) {
       return;
   }
 }
+const UNMODELLED_ROLE = { appliesToUsers: !0, appliesToRobots: !0 };
 function rolesOn(args) {
   const { resource } = args, byName = /* @__PURE__ */ new Map();
   for (const identity of args.identities) {
@@ -468,8 +480,12 @@ function rolesOn(args) {
     for (const role of roles ?? [])
       byName.set(role.name, {
         name: role.name,
-        ...role.title !== void 0 ? { title: role.title } : {},
-        ...role.description !== void 0 ? { description: role.description } : {}
+        title: role.title ?? role.name,
+        ...role.description !== void 0 ? { description: role.description } : {},
+        resourceType: resource.type,
+        resourceId: resource.id,
+        ...UNMODELLED_ROLE,
+        permissions: []
       });
   }
   return [...byName.values()].toSorted((a, b) => a.name.localeCompare(b.name));
@@ -507,12 +523,40 @@ function usersOn(args) {
     }, existing = bySanityUserId.get(record.sanityUserId);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to user "${record.sanityUserId}" on ${resource.type} "${resource.id}" with different records. Fix the identities so duplicate ids carry identical records.`
       );
     bySanityUserId.set(record.sanityUserId, record);
   }
   return [...bySanityUserId.values()];
 }
+const DEFAULT_ATTRIBUTES_LIMIT = 50;
+function serveMyAttributes(args) {
+  const { ctx, request, organizationId, query } = args, organization = ACCESS_CAPABILITIES.organization, registry = { organizationId: ctx.organizationId, resources: ctx.resources };
+  if (organization.unknown !== void 0 && !organization.unknown.holds(registry, organizationId))
+    throw organization.unknown.refusal(request);
+  const entry = ctx.actorAccess()?.[accessKey("organization", organizationId)];
+  if (entry?.roles === void 0) throw notFound("User")(request);
+  const limit = attributesLimit(query), cursor = query.get("cursor"), attributes = (entry.attributes ?? []).map(attributeRecord).toSorted((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0).filter((attribute) => cursor === null || attribute.key > cursor).slice(0, limit);
+  return { value: { sanityUserId: ctx.actorUser().id, organizationId, attributes } };
+}
+function attributesLimit(query) {
+  const raw = query.get("limit");
+  if (raw === null) return DEFAULT_ATTRIBUTES_LIMIT;
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1)
+    throw fakeError(
+      `request(): users/me/attributes got limit=${JSON.stringify(raw)}; the fake serves positive integer limits only (the platform's answer to others is not simulated).`
+    );
+  return limit;
+}
+function attributeRecord(attribute) {
+  const { key, type, values } = attribute, activeSource = values.sanity !== void 0 ? "sanity" : "saml", activeValue = values[activeSource];
+  if (activeValue === void 0)
+    throw fakeError(
+      `request(): user attribute "${key}" is seeded with no value; give it a \`saml\` or \`sanity\` value.`
+    );
+  return { type, key, values: { ...values }, activeSource, activeValue };
+}
 class WriteAccessDeniedError extends Error {
   documentId;
   permission;
@@ -584,7 +628,7 @@ function consistentProjectRecords(args) {
     const existing = byId.get(record.id);
     if (existing !== void 0 && JSON.stringify(existing) !== JSON.stringify(record))
       throw fakeError(
-        `request(): two registered identities resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identity registrations so duplicate ids carry identical records.`
+        `request(): two identities (registered, or the handle's inline accessControl) resolve to project user "${record.id}" in project "${args.projectId}" with different records. The project records cannot be served unambiguously \u2014 fix the identities so duplicate ids carry identical records.`
       );
     byId.set(record.id, record);
   }
@@ -669,7 +713,7 @@ function makeRequestImpl(ctx) {
     const served = path === void 0 ? void 0 : await servePlatformRequest(platform, path);
     if (served !== void 0) return served.value;
     throw fakeError(
-      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles | users[/<id>] | user-permissions/me[/check]"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
+      `request(): no handler for path "${path}". With access control configured, the fake serves "/users/me", the handle's ACL ("<data base>/acl"), "/projects/<projectId>" (members), "/projects/<projectId>/users/<ids>", the History API (client.getDataUrl("history", \u2026)), resource lookup ("/media-libraries/<id>", "/canvases/<id>", "/dashboards/<id>") and the Access API ("/access/<type>/<id>/roles[/<name>] | users[/<id>] | user-permissions/me[/check]") and the caller's attributes ("/organizations/<id>/users/me/attributes"). For any other endpoint, register a stub (client.stub("request", fn)) or intercept the HTTP call with a tool like MSW.`
     );
   };
 }
@@ -1732,7 +1776,17 @@ function makeHandle(handleArgs) {
     if (access === void 0)
       throw fakeError("this handle has no acting identity (no token or accessControl bound).");
     return access;
-  }, capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
+  }, members = () => [
+    ...backend.identities.values(),
+    ...token === void 0 && accessControl !== void 0 ? [
+      {
+        user: accessControl.currentUser,
+        ...accessControl.globalUser !== void 0 ? { globalUser: accessControl.globalUser } : {},
+        grants: accessControl.grants,
+        ...accessControl.access !== void 0 ? { access: accessControl.access } : {}
+      }
+    ] : []
+  ], capabilities = capabilitiesOf(target.type), targetLabel = capabilities.label(target.id), { store, history } = ensureEntry(registry, target), concurrentEditKey = (id) => registryKey(target) + " " + id, actorId = () => {
     const access = activeAccess();
     if (access !== void 0)
       return capabilities.identity === "global" ? (access.globalUser ?? access.currentUser).id : access.currentUser.id;
@@ -2088,7 +2142,7 @@ function makeHandle(handleArgs) {
         // client to the global API host.
         useProjectHostname: useProjectHostname && resource === void 0,
         organizationId: backend.organizationId,
-        listIdentities: () => [...backend.identities.values()],
+        listIdentities: members,
         platform: {
           projectId,
           organizationId: backend.organizationId,
@@ -2098,8 +2152,12 @@ function makeHandle(handleArgs) {
             history,
             canRead
           } : void 0,
+          actorUser: () => {
+            const access = requireActiveAccess();
+            return access.globalUser ?? access.currentUser;
+          },
           actorAccess: () => requireActiveAccess().access,
-          identities: () => [...backend.identities.values()],
+          identities: members,
           resources: () => [...registry.values()].map((entry) => entry.resource)
         }
       })