@swiss-ai-hub/web 0.303.0 → 0.304.0

package/package.json

@@ -3,7 +3,7 @@
   "license": "AGPL-3.0-or-later",
   "author": "bbv Software Services AG (https://www.bbv.ch)",
   "type": "module",
-  "version": "0.303.0",
+  "version": "0.304.0",
   "description": "Swiss AI Hub - Admin & Management UI (Nuxt 3 layer)",
   "main": "./nuxt.config.ts",
   "repository": {

package/pages/[tenant]/service/roles.vue

@@ -34,6 +34,7 @@
           v-model:visible="createModalOpen"
           modal
           :header="t('role.create_new')"
+          :style="{ width: '50rem' }"
         >
           <RoleCreate
             @close="createModalOpen = false"

package/pages/[tenant]/service/users/[user_id].vue

@@ -57,55 +57,19 @@
           </div>
         </div>
       </Panel>
-      <div class="flex flex-col gap-8">
-        <div class="flex flex-col gap-3">
-          <h3 class="text-2xl">
-            Services
-          </h3>
-          <div class="flex flex-wrap gap-2">
-            <Tag
-              v-for="service in user.access.services"
-              :key="service.name"
-              v-tooltip.top="service.level === 2 ? 'Admin' : 'User'"
-              :value="service.name"
-              :icon="service.level === 2 ? 'pi pi-crown' : undefined"
-            />
-          </div>
-        </div>
-        <div class="flex flex-col gap-3">
-          <h3 class="text-2xl">
-            Agents
-          </h3>
-          <div class="flex flex-wrap gap-2">
-            <Tag
-              v-for="agent in user.access.agents"
-              :key="agent.name"
-              v-tooltip.top="agent.level === 2 ? 'Admin' : 'User'"
-              :value="agent.name"
-              :icon="agent.level === 2 ? 'pi pi-crown' : undefined"
-            />
-          </div>
-        </div>
-        <div class="flex flex-col gap-3">
-          <h3 class="text-2xl">
-            {{ t('process.title') }}
-          </h3>
-          <div class="flex flex-wrap gap-2">
-            <Tag
-              v-for="process in user.access.processes"
-              :key="process.name"
-              v-tooltip.top="process.level === 2 ? 'Admin' : 'User'"
-              :value="process.name"
-              :icon="process.level === 2 ? 'pi pi-crown' : undefined"
-            />
-          </div>
-        </div>
-      </div>
+      <AccessCapabilities
+        :rules="user.access_rules"
+        :is-sys-admin="user.is_sys_admin"
+        :restrict-to-tenant="!user.is_sys_admin"
+        readonly
+      />
     </div>
   </StructuralColumn>
 </template>
 
 <script setup lang="ts">
+import AccessCapabilities from '@/components/Role/AccessCapabilities.vue'
+
 const { user, userIsLoading } = useUser()
 const { t } = useI18n()
 </script>

package/sdk/client/index.ts

@@ -24,6 +24,8 @@ export {
   deleteRole,
   deleteUserMemory,
   generateImage,
+  getAccessCapabilities,
+  getAccessPresets,
   getAgentClass,
   getAgentClasses,
   getAgentClassInstances,
@@ -109,7 +111,10 @@ export {
 } from "./sdk.gen";
 export {
   type Access,
+  type AccessCapabilitiesRequest,
+  type AccessCapabilitiesResponse,
   AccessLevel,
+  type AccessPresetDto,
   type ActiveTenantDto,
   type AddAgentRequest,
   type AddAgentToThreadData,
@@ -191,6 +196,8 @@ export {
   type BulkUpdateNotificationRequest,
   type CacheControl,
   type CachePoint,
+  type Capability,
+  type CapabilityGroup,
   type CascadeSelect,
   type CascadeSelectWritable,
   type ChainEvent,
@@ -399,6 +406,14 @@ export {
   type GenerateImageErrors,
   type GenerateImageResponse,
   type GenerateImageResponses,
+  type GetAccessCapabilitiesData,
+  type GetAccessCapabilitiesError,
+  type GetAccessCapabilitiesErrors,
+  type GetAccessCapabilitiesResponse,
+  type GetAccessCapabilitiesResponses,
+  type GetAccessPresetsData,
+  type GetAccessPresetsResponse,
+  type GetAccessPresetsResponses,
   type GetAgentClassData,
   type GetAgentClassError,
   type GetAgentClassErrors,

package/sdk/client/schemas.gen.ts

@@ -34,6 +34,53 @@ export const AccessSchema = {
   title: "Access",
 } as const;
 
+export const AccessCapabilitiesRequestSchema = {
+  properties: {
+    access_rules: {
+      items: {
+        type: "string",
+      },
+      type: "array",
+      title: "Access Rules",
+      description:
+        "Draft access rules to evaluate the capability catalog against.",
+    },
+    restrict_to_tenant: {
+      type: "boolean",
+      title: "Restrict To Tenant",
+      description:
+        "Hide capabilities the acting tenant's ceiling cannot grant (role editor). Set false when editing the tenant ceiling itself (sysadmin).",
+      default: true,
+    },
+    is_sys_admin: {
+      type: "boolean",
+      title: "Is Sys Admin",
+      description:
+        "Evaluate the catalog as a platform sysadmin (AIHubSysAdmin), who holds admin on every resource regardless of rules — the user page passes the viewed user's flag. False for rule editing.",
+      default: false,
+    },
+  },
+  type: "object",
+  required: ["access_rules"],
+  title: "AccessCapabilitiesRequest",
+} as const;
+
+export const AccessCapabilitiesResponseSchema = {
+  properties: {
+    groups: {
+      items: {
+        $ref: "#/components/schemas/CapabilityGroup",
+      },
+      type: "array",
+      title: "Groups",
+      description: "Top-level groups, one per controller/service.",
+    },
+  },
+  type: "object",
+  required: ["groups"],
+  title: "AccessCapabilitiesResponse",
+} as const;
+
 export const AccessLevelSchema = {
   type: "integer",
   enum: [0, 1, 2],
@@ -41,6 +88,34 @@ export const AccessLevelSchema = {
   description: "Defines the possible outcomes of a permission check.",
 } as const;
 
+export const AccessPresetDTOSchema = {
+  properties: {
+    rule: {
+      type: "string",
+      title: "Rule",
+      description: "The access rule string this preset adds.",
+    },
+    name: {
+      type: "string",
+      title: "Name",
+      description: "Short, human-readable name for the preset.",
+    },
+    description: {
+      type: "string",
+      title: "Description",
+      description: "What this preset grants.",
+    },
+    category: {
+      type: "string",
+      title: "Category",
+      description: "Stable category key for grouping in the UI.",
+    },
+  },
+  type: "object",
+  required: ["rule", "name", "description", "category"],
+  title: "AccessPresetDTO",
+} as const;
+
 export const ActiveTenantDTOSchema = {
   properties: {
     id: {
@@ -2437,6 +2512,116 @@ export const CachePointSchema = {
     "Used to set the point to cache up to, if the LLM supports caching.",
 } as const;
 
+export const CapabilitySchema = {
+  properties: {
+    key: {
+      type: "string",
+      title: "Key",
+      description: "Stable identifier for this capability.",
+    },
+    label: {
+      type: "string",
+      title: "Label",
+      description: "Short human-readable action label.",
+    },
+    description: {
+      type: "string",
+      title: "Description",
+      description: "What holding this capability lets the user do.",
+    },
+    rule: {
+      anyOf: [
+        {
+          type: "string",
+        },
+        {
+          type: "null",
+        },
+      ],
+      title: "Rule",
+      description:
+        "Exact access rule that grants this capability, or null for read-only capabilities.",
+    },
+    granted: {
+      type: "boolean",
+      title: "Granted",
+      description: "Whether the draft rules grant this capability.",
+    },
+    locked: {
+      type: "boolean",
+      title: "Locked",
+      description:
+        "Granted via a broader rule (e.g. a wildcard preset) and so cannot be toggled off here.",
+    },
+    toggleable: {
+      type: "boolean",
+      title: "Toggleable",
+      description:
+        "Whether ticking the box can add a rule. False for ?-wildcard guards with no concrete grant.",
+    },
+  },
+  type: "object",
+  required: [
+    "key",
+    "label",
+    "description",
+    "rule",
+    "granted",
+    "locked",
+    "toggleable",
+  ],
+  title: "Capability",
+} as const;
+
+export const CapabilityGroupSchema = {
+  properties: {
+    key: {
+      type: "string",
+      title: "Key",
+      description:
+        "Stable identifier (a controller/service, a class, an instance, ...).",
+    },
+    label: {
+      type: "string",
+      title: "Label",
+      description: "Display title for the group.",
+    },
+    icon: {
+      anyOf: [
+        {
+          type: "string",
+        },
+        {
+          type: "null",
+        },
+      ],
+      title: "Icon",
+      description: "Iconify icon for the group (service or class), if any.",
+    },
+    capabilities: {
+      items: {
+        $ref: "#/components/schemas/Capability",
+      },
+      type: "array",
+      title: "Capabilities",
+      description: "Capabilities directly on this group.",
+      default: [],
+    },
+    groups: {
+      items: {
+        $ref: "#/components/schemas/CapabilityGroup",
+      },
+      type: "array",
+      title: "Groups",
+      description: "Nested groups (e.g. classes, then instances).",
+      default: [],
+    },
+  },
+  type: "object",
+  required: ["key", "label"],
+  title: "CapabilityGroup",
+} as const;
+
 export const CascadeSelectSchema = {
   properties: {
     is_formkit_element: {
@@ -22585,11 +22770,11 @@ export const UserAccessSchema = {
       type: "string",
       title: "Name",
       description:
-        "Name of the service/agent/process to which user has access to",
+        "Name of the service/agent/process to which access is evaluated",
     },
     level: {
       $ref: "#/components/schemas/AccessLevel",
-      description: "Users access level to service/agent/process",
+      description: "Access level to the service/agent/process",
     },
   },
   type: "object",
@@ -22897,9 +23082,18 @@ export const UserWithAccessDTOSchema = {
       $ref: "#/components/schemas/Access",
       description: "User access levels",
     },
+    access_rules: {
+      items: {
+        type: "string",
+      },
+      type: "array",
+      title: "Access Rules",
+      description:
+        "The user's resolved access rules (union of their roles), to drive the capability view.",
+    },
   },
   type: "object",
-  required: ["id", "name", "email", "access"],
+  required: ["id", "name", "email", "access", "access_rules"],
   title: "UserWithAccessDTO",
 } as const;
 

package/sdk/client/sdk.gen.ts

@@ -11,6 +11,7 @@ import { client } from "./client.gen";
 import {
   createDatasetResponseTransformer,
   createTokenEndpointResponseTransformer,
+  getAccessCapabilitiesResponseTransformer,
   getAgentEventTimeseriesResponseTransformer,
   getDatasetResponseTransformer,
   getDatasetsResponseTransformer,
@@ -86,6 +87,11 @@ import type {
   GenerateImageData,
   GenerateImageError,
   GenerateImageResponse,
+  GetAccessCapabilitiesData,
+  GetAccessCapabilitiesError,
+  GetAccessCapabilitiesResponse,
+  GetAccessPresetsData,
+  GetAccessPresetsResponse,
   GetAgentClassData,
   GetAgentClassError,
   GetAgentClassesData,
@@ -2172,6 +2178,72 @@ export const createRole = <
     },
   });
 
+/**
+ * Evaluate Access Capabilities
+ *
+ * Returns the catalog of concrete capabilities (per service, agent and process), each with its exact access rule and whether the supplied draft rules grant it.
+ */
+export const getAccessCapabilities = <
+  TComposable extends Composable = "$fetch",
+  DefaultT extends GetAccessCapabilitiesResponse =
+    GetAccessCapabilitiesResponse,
+>(
+  options: Options<
+    TComposable,
+    GetAccessCapabilitiesData,
+    GetAccessCapabilitiesResponse,
+    DefaultT
+  >,
+) =>
+  (options.client ?? client).post<
+    TComposable,
+    GetAccessCapabilitiesResponse | DefaultT,
+    GetAccessCapabilitiesError,
+    DefaultT
+  >({
+    responseTransformer: getAccessCapabilitiesResponseTransformer,
+    security: [
+      { scheme: "bearer", type: "http" },
+      { scheme: "bearer", type: "http" },
+    ],
+    url: "/{tenant_id}/access/capabilities",
+    ...options,
+    headers: {
+      "Content-Type": "application/json",
+      ...options.headers,
+    },
+  });
+
+/**
+ * List Access Presets
+ *
+ * Returns a curated, described library of common access rules for one-click authoring.
+ */
+export const getAccessPresets = <
+  TComposable extends Composable = "$fetch",
+  DefaultT extends GetAccessPresetsResponse = GetAccessPresetsResponse,
+>(
+  options: Options<
+    TComposable,
+    GetAccessPresetsData,
+    GetAccessPresetsResponse,
+    DefaultT
+  >,
+) =>
+  (options.client ?? client).get<
+    TComposable,
+    GetAccessPresetsResponse | DefaultT,
+    unknown,
+    DefaultT
+  >({
+    security: [
+      { scheme: "bearer", type: "http" },
+      { scheme: "bearer", type: "http" },
+    ],
+    url: "/{tenant_id}/access/presets",
+    ...options,
+  });
+
 /**
  * List Models
  *

package/sdk/client/transformers.gen.ts

@@ -3,6 +3,7 @@
 import type {
   CreateDatasetResponse,
   CreateTokenEndpointResponse,
+  GetAccessCapabilitiesResponse,
   GetAgentEventTimeseriesResponse,
   GetDatasetResponse,
   GetDatasetsResponse,
@@ -59,6 +60,29 @@ export const createTokenEndpointResponseTransformer = async (
   return data;
 };
 
+const capabilityGroupSchemaResponseTransformer = (data: any) => {
+  if (data.groups) {
+    data.groups = data.groups.map((item: any) =>
+      capabilityGroupSchemaResponseTransformer(item),
+    );
+  }
+  return data;
+};
+
+const accessCapabilitiesResponseSchemaResponseTransformer = (data: any) => {
+  data.groups = data.groups.map((item: any) =>
+    capabilityGroupSchemaResponseTransformer(item),
+  );
+  return data;
+};
+
+export const getAccessCapabilitiesResponseTransformer = async (
+  data: any,
+): Promise<GetAccessCapabilitiesResponse> => {
+  data = accessCapabilitiesResponseSchemaResponseTransformer(data);
+  return data;
+};
+
 const minimalDatasetSchemaResponseTransformer = (data: any) => {
   if (data.created_at) {
     data.created_at = new Date(data.created_at);