@theholocron/cli 5.0.0-alpha.188 → 5.0.0-alpha.189

package/dist/cli.mjs

@@ -2766,14 +2766,19 @@ async function provisionChannel(deps, spec) {
 	const channel = await notifications.ensureChannel({
 		name: spec.name,
 		...spec.category ? { category: spec.category } : {},
-		...spec.topic ? { topic: spec.topic } : {}
+		...spec.topic ? { topic: spec.topic } : {},
+		...spec.access ? { access: spec.access } : {}
 	});
-	print(`  ${(channel.created ? style.success : style.skip)(`${channel.created ? "created" : "exists "} channel ${spec.name}${where}`)}`);
-	if (tally) tally[channel.created ? "ok" : "skip"]++;
+	const changed = channel.created || (channel.updated?.length ?? 0) > 0;
+	const verb = channel.created ? "created" : changed ? "updated" : "exists ";
+	const what = channel.updated?.length ? `: ${channel.updated.join(", ")}` : "";
+	print(`  ${(changed ? style.success : style.skip)(`${verb} channel ${spec.name}${where}${what}`)}`);
+	if (tally) tally[changed ? "ok" : "skip"]++;
 	const outcome = {
 		name: spec.name,
 		...spec.category ? { category: spec.category } : {},
-		created: channel.created
+		created: channel.created,
+		...channel.updated?.length ? { updated: channel.updated } : {}
 	};
 	if (!webhookCfg) return outcome;
 	const hook = await notifications.ensureWebhook({
@@ -2893,11 +2898,6 @@ async function runNotificationsChannelAdd(input) {
 */
 /** Features not built yet, in the order of the table in holocron#1098. Move an entry into a real check when it lands. */
 const PLANNED_CHECKS = [
-	{
-		step: 8,
-		id: "permissions",
-		title: "channel and category permissions set"
-	},
 	{
 		step: 10,
 		id: "server-settings",
@@ -2935,7 +2935,11 @@ const PLANNED_CHECKS = [
 	}
 ];
 const same = (a, b) => a.toLowerCase() === b.toLowerCase();
+/** `everyone`, or the roles sorted and lower-cased, so order and case do not matter when comparing. */
+const accessKey = (v) => v === "everyone" ? "everyone" : JSON.stringify([...new Set(v.map((r) => r.toLowerCase()))].sort());
+const accessText = (v) => v === "everyone" ? "everyone" : v.length === 0 ? "nobody (bots and webhooks only)" : v.join(", ");
 const shown = (s) => sanitizeDetail(s);
+const ACCESS_TITLE = "channel and category access set";
 const ROLE_APPEARANCE_TITLE = "role colour, hoist and permissions set";
 const SECRETS_TITLE = "webhook URLs and role id stored as secrets";
 async function runDoctorNotifications(input) {
@@ -3053,7 +3057,8 @@ async function runDoctorNotifications(input) {
 			["channels", "channels in their category, with topics"],
 			["webhooks", "webhooks on their channels"],
 			["roles", "roles exist and are mentionable"],
-			["role-appearance", ROLE_APPEARANCE_TITLE]
+			["role-appearance", ROLE_APPEARANCE_TITLE],
+			["access", ACCESS_TITLE]
 		]) failed(id, title, "not checked: could not read the server");
 	} else {
 		const inspected = found;
@@ -3119,6 +3124,44 @@ async function runDoctorNotifications(input) {
 		}
 		const styled = roles.filter((r) => r.color !== void 0 || r.hoist !== void 0 || r.permissions !== void 0);
 		add("role-appearance", ROLE_APPEARANCE_TITLE, inspected.rolesError ? [`not checked: could not read the roles`] : appearance, styled.length === 0 ? "none declared" : `${styled.length} of ${styled.length} as declared`);
+		const accessProblems = [];
+		const compare = (label, want, have) => {
+			if (!have) {
+				accessProblems.push(`${label}: the provider did not report its access`);
+				return;
+			}
+			if (have === "custom") {
+				accessProblems.push(`${label}: has permission overwrites that are not an access the layout can state; re-run setup to replace them`);
+				return;
+			}
+			for (const field of ["view", "post"]) {
+				const wanted = want[field] ?? "everyone";
+				if (accessKey(wanted) !== accessKey(have[field])) accessProblems.push(`${label}: ${field} is ${accessText(have[field])} but the layout says ${accessText(wanted)}`);
+			}
+		};
+		let accessDeclared = 0;
+		for (const cat of categories) {
+			if (cat.access) {
+				accessDeclared++;
+				if (!inspected.categories.some((name) => same(name, cat.name))) accessProblems.push(`${shown(cat.name)}: not checked, the category is missing`);
+				else {
+					const have = Object.entries(inspected.categoryAccess ?? {}).find(([n]) => same(n, cat.name))?.[1];
+					compare(shown(cat.name), cat.access, have);
+				}
+			}
+			for (const channel of cat.channels ?? []) {
+				if (!cat.access && !channel.access) continue;
+				accessDeclared++;
+				const want = {
+					...cat.access,
+					...channel.access
+				};
+				const { match } = pick(channel.name, cat.name);
+				if (!match) accessProblems.push(`#${shown(channel.name)}: not checked, the channel is missing`);
+				else compare(`#${shown(channel.name)}`, want, match.access);
+			}
+		}
+		add("access", ACCESS_TITLE, inspected.rolesError && accessDeclared > 0 ? ["not checked: could not read the roles"] : accessProblems, accessDeclared === 0 ? "none declared" : `${accessDeclared} of ${accessDeclared} as declared`);
 	}
 	const wanted = [...declaredChannels.filter(({ channel }) => channel.webhook).map(({ channel }) => channel.webhook !== true && channel.webhook && channel.webhook.secret ? channel.webhook.secret : defaultSecretName(channel.name)), ...(layout.roles ?? []).flatMap((r) => r.secret ? [r.secret] : [])];
 	if (wanted.length === 0) checks.push({
@@ -3779,6 +3822,44 @@ async function runNew(input) {
 * Run it from ONE repo per server — a layout is org-level, and putting it in a
 * shared preset would apply it from every repo.
 */
+/** A channel's access: its category's, with any field the channel states itself laid over it. */
+function effectiveAccess(category, channel) {
+	if (!category && !channel) return void 0;
+	return {
+		...category,
+		...channel
+	};
+}
+/** The first role an `access` names that the layout does not declare, or undefined. */
+function accessRoleProblem(layout) {
+	const declared = new Set((layout.roles ?? []).map((r) => r.name.toLowerCase()));
+	const check = (where, access) => {
+		for (const field of ["view", "post"]) {
+			const value = access?.[field];
+			if (!Array.isArray(value)) continue;
+			const unknown = value.find((name) => !declared.has(name.toLowerCase()));
+			if (unknown !== void 0) return `${where}: \`access.${field}\` names the role \`${unknown}\`, which is not in the layout's roles`;
+		}
+	};
+	const cannotSee = (where, access) => {
+		if (!Array.isArray(access?.view) || !Array.isArray(access?.post)) return void 0;
+		const seen = new Set(access.view.map((r) => r.toLowerCase()));
+		const stuck = access.post.find((r) => !seen.has(r.toLowerCase()));
+		return stuck === void 0 ? void 0 : `${where}: the role \`${stuck}\` may post but is not in \`view\`, so it could not see the channel`;
+	};
+	for (const category of layout.categories ?? []) {
+		const problem = check(`category \`${category.name}\``, category.access);
+		if (problem) return problem;
+		const stuckCategory = cannotSee(`category \`${category.name}\``, category.access);
+		if (stuckCategory) return stuckCategory;
+		for (const channel of category.channels ?? []) {
+			const found = check(`channel \`${channel.name}\``, channel.access);
+			if (found) return found;
+			const stuck = cannotSee(`channel \`${channel.name}\``, effectiveAccess(category.access, channel.access));
+			if (stuck) return stuck;
+		}
+	}
+}
 async function runNotificationsSetup(input) {
 	const print = input.print ?? ((line) => console.log(line));
 	const logger = input.logger ?? getLogger();
@@ -3832,6 +3913,10 @@ async function runNotificationsSetup(input) {
 	}
 	const secretProblem = layoutSecretProblem(layout);
 	if (secretProblem) return refuse(secretProblem);
+	const accessProblem = accessRoleProblem(layout);
+	if (accessProblem) return refuse(accessProblem);
+	const needsCategories = (layout.categories ?? []).find((c) => c.access);
+	if (needsCategories && !notifications.ensureCategory) return refuse(`category \`${needsCategories.name}\` declares \`access\`, but the \`${notifications.providerName}\` provider cannot manage categories`);
 	const providerProblem = notifications.validateLayout?.(layout);
 	if (providerProblem) return refuse(providerProblem);
 	const tally = {
@@ -3842,6 +3927,7 @@ async function runNotificationsSetup(input) {
 	const attempt = async (step, fn) => {
 		try {
 			await fn();
+			return true;
 		} catch (err) {
 			const message = describeProviderError(err);
 			print(`  ${style.fail(`${step}: ${message}`)}`);
@@ -3849,43 +3935,9 @@ async function runNotificationsSetup(input) {
 				step,
 				message
 			});
+			return false;
 		}
 	};
-	for (const category of layout.categories ?? []) {
-		print(`\n${style.header(category.name)}`);
-		report.categories.push(category.name);
-		await attempt(`category ${category.name}`, async () => {
-			if (!notifications.ensureCategory) return;
-			if (dryRun) {
-				print(`  ${style.skip(`would ensure category ${category.name}`)}`);
-				tally.skip++;
-				return;
-			}
-			const result = await notifications.ensureCategory(category.name);
-			print(`  ${(result.created ? style.success : style.skip)(`${result.created ? "created" : "exists "} category ${category.name}`)}`);
-			made(result.created);
-		});
-		for (const channel of category.channels ?? []) await attempt(`channel ${channel.name}`, async () => {
-			const outcome = await provisionChannel({
-				notifications,
-				...secrets ? { secrets } : {},
-				scope: scope ?? { kind: "repo" },
-				dryRun,
-				print,
-				tally
-			}, {
-				name: channel.name,
-				category: category.name,
-				...channel.topic ? { topic: channel.topic } : {},
-				...channel.webhook ? { webhook: channel.webhook === true ? {} : channel.webhook } : {}
-			});
-			report.channels.push(outcome);
-			if (outcome.webhook && !outcome.webhook.stored) report.failures.push({
-				step: `webhook ${outcome.webhook.name}`,
-				message: outcome.webhook.note
-			});
-		});
-	}
 	if ((layout.roles ?? []).length > 0) print(`\n${style.header("Roles")}`);
 	for (const role of layout.roles ?? []) await attempt(`role ${role.name}`, async () => {
 		if (!notifications.ensureRole) throw new Error(`\`${notifications.providerName}\` cannot manage roles`);
@@ -3925,6 +3977,51 @@ async function runNotificationsSetup(input) {
 			tally.ok++;
 		}
 	});
+	for (const category of layout.categories ?? []) {
+		print(`\n${style.header(category.name)}`);
+		report.categories.push(category.name);
+		const categoryOk = await attempt(`category ${category.name}`, async () => {
+			if (!notifications.ensureCategory) return;
+			if (dryRun) {
+				print(`  ${style.skip(`would ensure category ${category.name}`)}`);
+				tally.skip++;
+				return;
+			}
+			const result = await notifications.ensureCategory(category.name, { ...category.access ? { access: category.access } : {} });
+			const changed = result.created || (result.updated?.length ?? 0) > 0;
+			const verb = result.created ? "created" : changed ? "updated" : "exists ";
+			const what = result.updated?.length ? `: ${result.updated.join(", ")}` : "";
+			print(`  ${(changed ? style.success : style.skip)(`${verb} category ${category.name}${what}`)}`);
+			made(changed);
+		});
+		const channels = category.channels ?? [];
+		if (!categoryOk && channels.length > 0) {
+			print(`  ${style.skip(`skipped ${channels.length} channel${channels.length === 1 ? "" : "s"}: the category failed`)}`);
+			tally.skip += channels.length;
+			continue;
+		}
+		for (const channel of channels) await attempt(`channel ${channel.name}`, async () => {
+			const outcome = await provisionChannel({
+				notifications,
+				...secrets ? { secrets } : {},
+				scope: scope ?? { kind: "repo" },
+				dryRun,
+				print,
+				tally
+			}, {
+				name: channel.name,
+				category: category.name,
+				...channel.topic ? { topic: channel.topic } : {},
+				...effectiveAccess(category.access, channel.access) ? { access: effectiveAccess(category.access, channel.access) } : {},
+				...channel.webhook ? { webhook: channel.webhook === true ? {} : channel.webhook } : {}
+			});
+			report.channels.push(outcome);
+			if (outcome.webhook && !outcome.webhook.stored) report.failures.push({
+				step: `webhook ${outcome.webhook.name}`,
+				message: outcome.webhook.note
+			});
+		});
+	}
 	if (report.failures.length > 0) report.status = "fail";
 	else if (dryRun) report.status = "dry-run";
 	print("");