@things-factory/auth-base 10.1.6 → 10.1.16

package/dist-server/service/role-template/role-template-mutation.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateMutation = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const privilege_js_1 = require("../privilege/privilege.js");
+const role_js_1 = require("../role/role.js");
+const role_template_js_1 = require("./role-template.js");
+let RoleTemplateMutation = class RoleTemplateMutation {
+    /**
+     * Creates a role from a template — once per name.
+     *
+     * ── Why an existing name is used rather than replaced ────────────────────────
+     * Approval lines store a role's **id** (`worklist` resolves an approver of type `Role`
+     * by id). Creating a second QUALITY-INSPECTOR would leave every approval routed at the
+     * first one while the administrator edits the second, and nothing would report it: the
+     * screen shows two roles and the approvals go to the one nobody is looking at.
+     *
+     * So an existing role of that name is used as it stands. operato-plant's seed already
+     * behaves this way (`seed-demo-org.ts` looks the role up and only saves when absent);
+     * this is the same rule, stated once.
+     *
+     * ── Why privileges are added and never removed ───────────────────────────────
+     * Two applications may declare a template with the same role name on purpose, and the
+     * privileges are then the union — to a user "quality inspector" is one seat. The union
+     * only widens: if a template later drops a privilege it stays on roles already seeded,
+     * because the seed runs once and the role belongs to the administrator afterwards.
+     *
+     * A privilege that is no longer declared anywhere is already handled elsewhere and not
+     * here — `isDeprecatedPrivilege` marks it, the role screen strikes it through and refuses
+     * to switch it back on, and removing it is the administrator's call. Reclaiming it from
+     * this side would mean overwriting, and would be unable to tell a stale grant from one
+     * the administrator added on purpose.
+     */
+    async createRoleFromTemplate(templateId, name, context) {
+        const { domain, user, tx } = context.state;
+        const template = findTemplate(templateId);
+        if (!template) {
+            throw new Error(`There is no role template "${templateId}" in this installation.`);
+        }
+        const roleName = (name || template.name).trim();
+        if (!roleName) {
+            throw new Error('A role needs a name.');
+        }
+        const roleRepository = tx.getRepository(role_js_1.Role);
+        let role = await roleRepository.findOne({
+            where: { domain: { id: domain.id }, name: roleName },
+            relations: ['privileges']
+        });
+        if (!role) {
+            role = await roleRepository.save({
+                domain,
+                name: roleName,
+                description: template.description,
+                creator: user,
+                updater: user
+            });
+            role = await roleRepository.findOne({
+                where: { id: role.id },
+                relations: ['privileges']
+            });
+        }
+        const held = new Set((role.privileges || []).map(privilege => `${privilege.category} ${privilege.name}`));
+        const wanted = template.grants.flatMap(grant => grant.axes.map(axis => ({ category: grant.category, name: axis })));
+        /*
+         * Privileges have no domain — the whole server shares one set and what differs per
+         * domain is only which role holds them (`Privilege` has no domain column; auth-base's
+         * boot creates them by category and name alone). Filtering by domain finds nothing.
+         */
+        const privilegeRepository = tx.getRepository(privilege_js_1.Privilege);
+        const added = [];
+        for (const one of wanted) {
+            if (held.has(`${one.category} ${one.name}`)) {
+                continue;
+            }
+            const privilege = await privilegeRepository.findOne({ where: { category: one.category, name: one.name } });
+            /*
+             * A privilege this installation does not declare is skipped, never created. Creating
+             * it here would make a row no `@privilege` asks for: the role would look as if it
+             * had been granted something, and open nothing. Granted-but-closed is the worst of
+             * the three outcomes. `roleTemplates` reports these as `missingCount` before the
+             * administrator picks the template.
+             */
+            if (privilege) {
+                added.push(privilege);
+            }
+        }
+        /*
+         * Nothing records that this role came from a template.
+         *
+         * A `templateVersions` column stood here so a later change to the template could be
+         * reported. It bought less than it looked like: what an administrator needs is "these
+         * two privileges were added to the template", and that is the template's current
+         * grants against the role's current privileges — computed, not stored. Telling them
+         * apart from a privilege the administrator removed on purpose would take the seeded
+         * content itself, not a version of it, and no screen asks for either yet.
+         *
+         * So the seed ends here. If reporting template drift is designed later, what to store
+         * follows from that design rather than being guessed at now.
+         */
+        role.privileges = [...(role.privileges || []), ...added];
+        role.updater = user;
+        return await roleRepository.save(role);
+    }
+};
+exports.RoleTemplateMutation = RoleTemplateMutation;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Directive)('@transaction'),
+    (0, type_graphql_1.Mutation)(returns => role_js_1.Role, { description: 'To create a role from a role template' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('templateId')),
+    tslib_1.__param(1, (0, type_graphql_1.Arg)('name', { nullable: true })),
+    tslib_1.__param(2, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateMutation.prototype, "createRoleFromTemplate", null);
+exports.RoleTemplateMutation = RoleTemplateMutation = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(role_js_1.Role)
+], RoleTemplateMutation);
+function findTemplate(id) {
+    return (0, role_template_js_1.roleTemplateById)(id) || (0, role_template_js_1.computedRoleTemplates)().find(template => template.id === id);
+}
+//# sourceMappingURL=role-template-mutation.js.map

package/dist-server/service/role-template/role-template-mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-mutation.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-mutation.ts"],"names":[],"mappings":";;;;AAAA,+CAAsE;AAItE,4DAAqD;AACrD,6CAAsC;AACtC,yDAAoG;AAG7F,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IAIG,AAAN,KAAK,CAAC,sBAAsB,CACP,UAAkB,EAUJ,IAAwB,EAClD,OAAwB;QAE/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAE1C,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAA;QAEzC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,8BAA8B,UAAU,yBAAyB,CAAC,CAAA;QACpF,CAAC;QAED,MAAM,QAAQ,GAAG,CAAC,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;QAE/C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAA;QACzC,CAAC;QAED,MAAM,cAAc,GAAG,EAAE,CAAC,aAAa,CAAC,cAAI,CAAC,CAAA;QAE7C,IAAI,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;YACtC,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACpD,SAAS,EAAE,CAAC,YAAY,CAAC;SAC1B,CAAC,CAAA;QAEF,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC;gBAC/B,MAAM;gBACN,IAAI,EAAE,QAAQ;gBACd,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,IAAI;aACP,CAAC,CAAA;YAET,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC;gBAClC,KAAK,EAAE,EAAE,EAAE,EAAE,IAAK,CAAC,EAAE,EAAE;gBACvB,SAAS,EAAE,CAAC,YAAY,CAAC;aAC1B,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,IAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QAC1G,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAEnH;;;;WAIG;QACH,MAAM,mBAAmB,GAAG,EAAE,CAAC,aAAa,CAAC,wBAAS,CAAC,CAAA;QACvD,MAAM,KAAK,GAAgB,EAAE,CAAA;QAE7B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC5C,SAAQ;YACV,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAE1G;;;;;;eAMG;YACH,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACvB,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,IAAK,CAAC,UAAU,GAAG,CAAC,GAAG,CAAC,IAAK,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAA;QAC1D,IAAK,CAAC,OAAO,GAAG,IAAI,CAAA;QAEpB,OAAO,MAAM,cAAc,CAAC,IAAI,CAAC,IAAK,CAAC,CAAA;IACzC,CAAC;CACF,CAAA;AA/HY,oDAAoB;AA6BzB;IAHL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,wBAAS,EAAC,cAAc,CAAC;IACzB,IAAA,uBAAQ,EAAC,OAAO,CAAC,EAAE,CAAC,cAAI,EAAE,EAAE,WAAW,EAAE,uCAAuC,EAAE,CAAC;IAEjF,mBAAA,IAAA,kBAAG,EAAC,YAAY,CAAC,CAAA;IAUjB,mBAAA,IAAA,kBAAG,EAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/B,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;kEAqFP;+BA9HU,oBAAoB;IADhC,IAAA,uBAAQ,EAAC,cAAI,CAAC;GACF,oBAAoB,CA+HhC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAA,mCAAgB,EAAC,EAAE,CAAC,IAAI,IAAA,wCAAqB,GAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7F,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Mutation, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Privilege } from '../privilege/privilege.js'\nimport { Role } from '../role/role.js'\nimport { roleTemplateById, computedRoleTemplates, RegisteredRoleTemplate } from './role-template.js'\n\n@Resolver(Role)\nexport class RoleTemplateMutation {\n  /**\n   * Creates a role from a template — once per name.\n   *\n   * ── Why an existing name is used rather than replaced ────────────────────────\n   * Approval lines store a role's **id** (`worklist` resolves an approver of type `Role`\n   * by id). Creating a second QUALITY-INSPECTOR would leave every approval routed at the\n   * first one while the administrator edits the second, and nothing would report it: the\n   * screen shows two roles and the approvals go to the one nobody is looking at.\n   *\n   * So an existing role of that name is used as it stands. operato-plant's seed already\n   * behaves this way (`seed-demo-org.ts` looks the role up and only saves when absent);\n   * this is the same rule, stated once.\n   *\n   * ── Why privileges are added and never removed ───────────────────────────────\n   * Two applications may declare a template with the same role name on purpose, and the\n   * privileges are then the union — to a user \"quality inspector\" is one seat. The union\n   * only widens: if a template later drops a privilege it stays on roles already seeded,\n   * because the seed runs once and the role belongs to the administrator afterwards.\n   *\n   * A privilege that is no longer declared anywhere is already handled elsewhere and not\n   * here — `isDeprecatedPrivilege` marks it, the role screen strikes it through and refuses\n   * to switch it back on, and removing it is the administrator's call. Reclaiming it from\n   * this side would mean overwriting, and would be unable to tell a stale grant from one\n   * the administrator added on purpose.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Directive('@transaction')\n  @Mutation(returns => Role, { description: 'To create a role from a role template' })\n  async createRoleFromTemplate(\n    @Arg('templateId') templateId: string,\n    /**\n     * What this plant calls the seat. Defaults to the template's name.\n     *\n     * The template knows which seat exists in a factory running this product; it does not\n     * know what the people there call it. And because a role is also what an approval line\n     * points at, the same seat is sometimes needed twice — a day shift and a night shift\n     * inspector hold the same privileges and take different approvals. Without a name of\n     * their own a template could be used exactly once per domain.\n     */\n    @Arg('name', { nullable: true }) name: string | undefined,\n    @Ctx() context: ResolverContext\n  ): Promise<Role> {\n    const { domain, user, tx } = context.state\n\n    const template = findTemplate(templateId)\n\n    if (!template) {\n      throw new Error(`There is no role template \"${templateId}\" in this installation.`)\n    }\n\n    const roleName = (name || template.name).trim()\n\n    if (!roleName) {\n      throw new Error('A role needs a name.')\n    }\n\n    const roleRepository = tx.getRepository(Role)\n\n    let role = await roleRepository.findOne({\n      where: { domain: { id: domain.id }, name: roleName },\n      relations: ['privileges']\n    })\n\n    if (!role) {\n      role = await roleRepository.save({\n        domain,\n        name: roleName,\n        description: template.description,\n        creator: user,\n        updater: user\n      } as any)\n\n      role = await roleRepository.findOne({\n        where: { id: role!.id },\n        relations: ['privileges']\n      })\n    }\n\n    const held = new Set((role!.privileges || []).map(privilege => `${privilege.category} ${privilege.name}`))\n    const wanted = template.grants.flatMap(grant => grant.axes.map(axis => ({ category: grant.category, name: axis })))\n\n    /*\n     * Privileges have no domain — the whole server shares one set and what differs per\n     * domain is only which role holds them (`Privilege` has no domain column; auth-base's\n     * boot creates them by category and name alone). Filtering by domain finds nothing.\n     */\n    const privilegeRepository = tx.getRepository(Privilege)\n    const added: Privilege[] = []\n\n    for (const one of wanted) {\n      if (held.has(`${one.category} ${one.name}`)) {\n        continue\n      }\n\n      const privilege = await privilegeRepository.findOne({ where: { category: one.category, name: one.name } })\n\n      /*\n       * A privilege this installation does not declare is skipped, never created. Creating\n       * it here would make a row no `@privilege` asks for: the role would look as if it\n       * had been granted something, and open nothing. Granted-but-closed is the worst of\n       * the three outcomes. `roleTemplates` reports these as `missingCount` before the\n       * administrator picks the template.\n       */\n      if (privilege) {\n        added.push(privilege)\n      }\n    }\n\n    /*\n     * Nothing records that this role came from a template.\n     *\n     * A `templateVersions` column stood here so a later change to the template could be\n     * reported. It bought less than it looked like: what an administrator needs is \"these\n     * two privileges were added to the template\", and that is the template's current\n     * grants against the role's current privileges — computed, not stored. Telling them\n     * apart from a privilege the administrator removed on purpose would take the seeded\n     * content itself, not a version of it, and no screen asks for either yet.\n     *\n     * So the seed ends here. If reporting template drift is designed later, what to store\n     * follows from that design rather than being guessed at now.\n     */\n    role!.privileges = [...(role!.privileges || []), ...added]\n    role!.updater = user\n\n    return await roleRepository.save(role!)\n  }\n}\n\nfunction findTemplate(id: string): RegisteredRoleTemplate | undefined {\n  return roleTemplateById(id) || computedRoleTemplates().find(template => template.id === id)\n}\n"]}

package/dist-server/service/role-template/role-template-query.d.ts

@@ -0,0 +1,11 @@
+import { RoleTemplateView } from './role-template-types.js';
+export declare class RoleTemplateQuery {
+    /**
+     * The templates this domain can start a role from.
+     *
+     * Gated the same way role editing is: choosing a template creates a role, so whoever may
+     * do this is whoever may create roles.
+     */
+    roleTemplates(context: ResolverContext): Promise<RoleTemplateView[]>;
+    roleTemplate(id: string, context: ResolverContext): Promise<RoleTemplateView | null>;
+}

package/dist-server/service/role-template/role-template-query.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateQuery = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+const shell_1 = require("@things-factory/shell");
+const role_js_1 = require("../role/role.js");
+const role_template_js_1 = require("./role-template.js");
+const role_template_types_js_1 = require("./role-template-types.js");
+let RoleTemplateQuery = class RoleTemplateQuery {
+    /**
+     * The templates this domain can start a role from.
+     *
+     * Gated the same way role editing is: choosing a template creates a role, so whoever may
+     * do this is whoever may create roles.
+     */
+    async roleTemplates(context) {
+        const { domain } = context.state;
+        /*
+         * Read the existing role names once. The alternative — a field resolver asking per
+         * template — runs a query per row for an answer the list already has.
+         */
+        const existing = new Set((await (0, shell_1.getRepository)(role_js_1.Role)
+            .createQueryBuilder('ROLE')
+            .select('ROLE.name')
+            .where('ROLE.domain = :domain', { domain: domain.id })
+            .getMany()).map(role => role.name));
+        return (0, role_template_js_1.allRoleTemplates)().map(template => view(template, existing));
+    }
+    async roleTemplate(id, context) {
+        const templates = await this.roleTemplates(context);
+        return templates.find(template => template.id === id) || null;
+    }
+};
+exports.RoleTemplateQuery = RoleTemplateQuery;
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => [role_template_types_js_1.RoleTemplateView], { description: 'To fetch the role templates this installation offers' }),
+    tslib_1.__param(0, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateQuery.prototype, "roleTemplates", null);
+tslib_1.__decorate([
+    (0, type_graphql_1.Directive)('@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true, superUserGranted: true)'),
+    (0, type_graphql_1.Query)(returns => role_template_types_js_1.RoleTemplateView, { nullable: true, description: 'To fetch one role template by id' }),
+    tslib_1.__param(0, (0, type_graphql_1.Arg)('id')),
+    tslib_1.__param(1, (0, type_graphql_1.Ctx)()),
+    tslib_1.__metadata("design:type", Function),
+    tslib_1.__metadata("design:paramtypes", [String, Object]),
+    tslib_1.__metadata("design:returntype", Promise)
+], RoleTemplateQuery.prototype, "roleTemplate", null);
+exports.RoleTemplateQuery = RoleTemplateQuery = tslib_1.__decorate([
+    (0, type_graphql_1.Resolver)(role_template_types_js_1.RoleTemplateView)
+], RoleTemplateQuery);
+function view(template, existing) {
+    const declared = process['PRIVILEGES'] || {};
+    const grants = template.grants.map(grant => {
+        const present = grant.axes.filter(axis => declared[`${grant.category} ${axis}`]);
+        const missingAxes = grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]);
+        return { category: grant.category, axes: present, missingAxes };
+    });
+    return {
+        id: template.id,
+        name: template.name,
+        description: template.description,
+        grants,
+        privilegeCount: grants.reduce((count, grant) => count + grant.axes.length, 0),
+        missingCount: grants.reduce((count, grant) => count + grant.missingAxes.length, 0),
+        defaultNameTaken: existing.has(template.name),
+        /*
+         * Declared with no grants at all — an approval seat. Distinct from a template whose
+         * grants all went missing in this installation, which is a defect and shows a
+         * `missingCount` instead.
+         */
+        grantsNothingDeliberately: template.grants.length === 0
+    };
+}
+//# sourceMappingURL=role-template-query.js.map

package/dist-server/service/role-template/role-template-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-query.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-query.ts"],"names":[],"mappings":";;;;AAAA,+CAAmE;AAEnE,iDAAqD;AAErD,6CAAsC;AACtC,yDAA6E;AAC7E,qEAA2D;AAGpD,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B;;;;;OAKG;IAGG,AAAN,KAAK,CAAC,aAAa,CAAQ,OAAwB;QACjD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAA;QAEhC;;;WAGG;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CACE,MAAM,IAAA,qBAAa,EAAC,cAAI,CAAC;aACtB,kBAAkB,CAAC,MAAM,CAAC;aAC1B,MAAM,CAAC,WAAW,CAAC;aACnB,KAAK,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;aACrD,OAAO,EAAE,CACb,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CACzB,CAAA;QAED,OAAO,IAAA,mCAAgB,GAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACrE,CAAC;IAIK,AAAN,KAAK,CAAC,YAAY,CAAY,EAAU,EAAS,OAAwB;QACvE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;QAEnD,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,IAAI,CAAA;IAC/D,CAAC;CACF,CAAA;AApCY,8CAAiB;AAStB;IAFL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,CAAC,yCAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,sDAAsD,EAAE,CAAC;IACzF,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;sDAkBzB;AAIK;IAFL,IAAA,wBAAS,EAAC,uGAAuG,CAAC;IAClH,IAAA,oBAAK,EAAC,OAAO,CAAC,EAAE,CAAC,yCAAgB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IACpF,mBAAA,IAAA,kBAAG,EAAC,IAAI,CAAC,CAAA;IAAc,mBAAA,IAAA,kBAAG,GAAE,CAAA;;;;qDAI/C;4BAnCU,iBAAiB;IAD7B,IAAA,uBAAQ,EAAC,yCAAgB,CAAC;GACd,iBAAiB,CAoC7B;AAED,SAAS,IAAI,CAAC,QAAgC,EAAE,QAAqB;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACzC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QAChF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAA;QAErF,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,MAAM;QACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC7E,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;QAClF,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7C;;;;WAIG;QACH,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;KACxD,CAAA;AACH,CAAC","sourcesContent":["import { Arg, Ctx, Directive, Query, Resolver } from 'type-graphql'\n\nimport { getRepository } from '@things-factory/shell'\n\nimport { Role } from '../role/role.js'\nimport { allRoleTemplates, RegisteredRoleTemplate } from './role-template.js'\nimport { RoleTemplateView } from './role-template-types.js'\n\n@Resolver(RoleTemplateView)\nexport class RoleTemplateQuery {\n  /**\n   * The templates this domain can start a role from.\n   *\n   * Gated the same way role editing is: choosing a template creates a role, so whoever may\n   * do this is whoever may create roles.\n   */\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => [RoleTemplateView], { description: 'To fetch the role templates this installation offers' })\n  async roleTemplates(@Ctx() context: ResolverContext): Promise<RoleTemplateView[]> {\n    const { domain } = context.state\n\n    /*\n     * Read the existing role names once. The alternative — a field resolver asking per\n     * template — runs a query per row for an answer the list already has.\n     */\n    const existing = new Set(\n      (\n        await getRepository(Role)\n          .createQueryBuilder('ROLE')\n          .select('ROLE.name')\n          .where('ROLE.domain = :domain', { domain: domain.id })\n          .getMany()\n      ).map(role => role.name)\n    )\n\n    return allRoleTemplates().map(template => view(template, existing))\n  }\n\n  @Directive('@privilege(category: \"user\", privilege: \"mutation\", domainOwnerGranted: true, superUserGranted: true)')\n  @Query(returns => RoleTemplateView, { nullable: true, description: 'To fetch one role template by id' })\n  async roleTemplate(@Arg('id') id: string, @Ctx() context: ResolverContext): Promise<RoleTemplateView | null> {\n    const templates = await this.roleTemplates(context)\n\n    return templates.find(template => template.id === id) || null\n  }\n}\n\nfunction view(template: RegisteredRoleTemplate, existing: Set<string>): RoleTemplateView {\n  const declared = process['PRIVILEGES'] || {}\n\n  const grants = template.grants.map(grant => {\n    const present = grant.axes.filter(axis => declared[`${grant.category} ${axis}`])\n    const missingAxes = grant.axes.filter(axis => !declared[`${grant.category} ${axis}`])\n\n    return { category: grant.category, axes: present, missingAxes }\n  })\n\n  return {\n    id: template.id,\n    name: template.name,\n    description: template.description,\n    grants,\n    privilegeCount: grants.reduce((count, grant) => count + grant.axes.length, 0),\n    missingCount: grants.reduce((count, grant) => count + grant.missingAxes.length, 0),\n    defaultNameTaken: existing.has(template.name),\n    /*\n     * Declared with no grants at all — an approval seat. Distinct from a template whose\n     * grants all went missing in this installation, which is a defect and shows a\n     * `missingCount` instead.\n     */\n    grantsNothingDeliberately: template.grants.length === 0\n  }\n}\n"]}

package/dist-server/service/role-template/role-template-types.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What a template looks like *to this installation*.
+ *
+ * The declared template and the offered template are not the same thing: an app declares
+ * grants across modules it expects to be installed, and a given installation has a subset.
+ * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47
+ * categories declared across the repository. So the answer has to say which parts of the
+ * template this installation can actually honour.
+ */
+export declare class RoleTemplateGrantView {
+    category: string;
+    axes: string[];
+    /**
+     * Axes this installation does not declare.
+     *
+     * Dropping them quietly would hand the administrator a role that does not match the
+     * template's name, with no way to tell. They are reported instead, and the screen says
+     * "not present in this installation".
+     */
+    missingAxes: string[];
+}
+export declare class RoleTemplateView {
+    id: string;
+    name: string;
+    description?: string;
+    grants: RoleTemplateGrantView[];
+    privilegeCount: number;
+    missingCount: number;
+    /**
+     * Whether a role already carries this template's default name in the current domain.
+     *
+     * The screen warns before creating one, because seeding onto an existing name does not
+     * make a second role — approval lines hold a role's id, so a duplicate would leave the
+     * approval routed to the role nobody edits. The existing role is used as it stands and
+     * the template's privileges are added to it.
+     *
+     * It says "default name" rather than "seeded" because the administrator may give the
+     * role a name of their own, and then nothing here can tell whether this template was
+     * used. That is deliberate: provenance is not stored.
+     */
+    defaultNameTaken: boolean;
+    /**
+     * True when the template deliberately opens nothing.
+     *
+     * A seat that only receives approvals is legitimate — operato-twin declares seven roles
+     * with no privileges at all, used as the target an approval line points at. The screen
+     * must not draw that as "0 privileges, something is wrong", so the distinction is
+     * carried here rather than inferred from an empty list.
+     */
+    grantsNothingDeliberately: boolean;
+}

package/dist-server/service/role-template/role-template-types.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateView = exports.RoleTemplateGrantView = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+/**
+ * What a template looks like *to this installation*.
+ *
+ * The declared template and the offered template are not the same thing: an app declares
+ * grants across modules it expects to be installed, and a given installation has a subset.
+ * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47
+ * categories declared across the repository. So the answer has to say which parts of the
+ * template this installation can actually honour.
+ */
+let RoleTemplateGrantView = class RoleTemplateGrantView {
+};
+exports.RoleTemplateGrantView = RoleTemplateGrantView;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The privilege category — what is guarded.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateGrantView.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'The privilege axes granted on that category.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGrantView.prototype, "axes", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'Axes named by the template that this installation does not declare.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGrantView.prototype, "missingAxes", void 0);
+exports.RoleTemplateGrantView = RoleTemplateGrantView = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'One module and the axes a role template grants on it.' })
+], RoleTemplateGrantView);
+let RoleTemplateView = class RoleTemplateView {
+};
+exports.RoleTemplateView = RoleTemplateView;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Declaration key, namespaced by the declaring application.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role name this template creates in a domain.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "name", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'A description of the seat this template creates.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateView.prototype, "grants", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges this template would actually grant here.' }),
+    tslib_1.__metadata("design:type", Number)
+], RoleTemplateView.prototype, "privilegeCount", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges the template names that this installation does not have.' }),
+    tslib_1.__metadata("design:type", Number)
+], RoleTemplateView.prototype, "missingCount", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "Whether a role already carries this template's default name in the current domain." }),
+    tslib_1.__metadata("design:type", Boolean)
+], RoleTemplateView.prototype, "defaultNameTaken", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Whether this template grants nothing on purpose, rather than by omission.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], RoleTemplateView.prototype, "grantsNothingDeliberately", void 0);
+exports.RoleTemplateView = RoleTemplateView = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A role template offered by this installation.' })
+], RoleTemplateView);
+//# sourceMappingURL=role-template-types.js.map

package/dist-server/service/role-template/role-template-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-types.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAgBjC,CAAA;AAhBY,sDAAqB;AAEhC;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACpD;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;mDAC3E;AAUd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;0DAC3F;gCAfV,qBAAqB;IADjC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;GACxE,qBAAqB,CAgBjC;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CA4C5B,CAAA;AA5CY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;;4CAC1E;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;8CAC/D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;qDACvE;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;gDACvE;AAG/B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;wDAC9E;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;;sDAChG;AAepB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;0DACpF;AAWzB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;mEAClE;2BA3CvB,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;GAChE,gBAAgB,CA4C5B","sourcesContent":["import { Field, Int, ObjectType } from 'type-graphql'\n\n/**\n * What a template looks like *to this installation*.\n *\n * The declared template and the offered template are not the same thing: an app declares\n * grants across modules it expects to be installed, and a given installation has a subset.\n * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47\n * categories declared across the repository. So the answer has to say which parts of the\n * template this installation can actually honour.\n */\n@ObjectType({ description: 'One module and the axes a role template grants on it.' })\nexport class RoleTemplateGrantView {\n  @Field({ description: 'The privilege category — what is guarded.' })\n  category: string\n\n  @Field(type => [String], { description: 'The privilege axes granted on that category.' })\n  axes: string[]\n\n  /**\n   * Axes this installation does not declare.\n   *\n   * Dropping them quietly would hand the administrator a role that does not match the\n   * template's name, with no way to tell. They are reported instead, and the screen says\n   * \"not present in this installation\".\n   */\n  @Field(type => [String], { description: 'Axes named by the template that this installation does not declare.' })\n  missingAxes: string[]\n}\n\n@ObjectType({ description: 'A role template offered by this installation.' })\nexport class RoleTemplateView {\n  @Field({ description: 'Declaration key, namespaced by the declaring application.' })\n  id: string\n\n  @Field({ description: 'The role name this template creates in a domain.' })\n  name: string\n\n  @Field({ nullable: true, description: 'A description of the seat this template creates.' })\n  description?: string\n\n  @Field(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' })\n  grants: RoleTemplateGrantView[]\n\n  @Field(type => Int, { description: 'How many privileges this template would actually grant here.' })\n  privilegeCount: number\n\n  @Field(type => Int, { description: 'How many privileges the template names that this installation does not have.' })\n  missingCount: number\n\n  /**\n   * Whether a role already carries this template's default name in the current domain.\n   *\n   * The screen warns before creating one, because seeding onto an existing name does not\n   * make a second role — approval lines hold a role's id, so a duplicate would leave the\n   * approval routed to the role nobody edits. The existing role is used as it stands and\n   * the template's privileges are added to it.\n   *\n   * It says \"default name\" rather than \"seeded\" because the administrator may give the\n   * role a name of their own, and then nothing here can tell whether this template was\n   * used. That is deliberate: provenance is not stored.\n   */\n  @Field({ description: \"Whether a role already carries this template's default name in the current domain.\" })\n  defaultNameTaken: boolean\n\n  /**\n   * True when the template deliberately opens nothing.\n   *\n   * A seat that only receives approvals is legitimate — operato-twin declares seven roles\n   * with no privileges at all, used as the target an approval line points at. The screen\n   * must not draw that as \"0 privileges, something is wrong\", so the distinction is\n   * carried here rather than inferred from an empty list.\n   */\n  @Field({ description: 'Whether this template grants nothing on purpose, rather than by omission.' })\n  grantsNothingDeliberately: boolean\n}\n"]}

package/dist-server/service/role-template/role-template.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Role templates — the seeds an application offers so a new domain does not start with
+ * zero roles.
+ *
+ * ── Why this is a boot registry and not a table ───────────────────────────────
+ * A template is a declaration. Copying it into rows per domain gives 100 domains x 3
+ * templates = 300 rows, and once the code changes the template there is nowhere to ask
+ * which of the two is true: the declaration, or the row that was written from an older
+ * one. `@privilege` lives in the boot registry for the same reason.
+ *
+ * ── What a template is not ───────────────────────────────────────────────────
+ * It is a seed, not a role. Once it has been used the resulting role belongs to the
+ * administrator: the template is never re-applied and never overwrites. Nothing is written
+ * onto the role to remember where it came from — what an administrator would want from
+ * that ("the template gained two privileges, here they are") is the template's current
+ * grants against the role's current privileges, and that is computed rather than stored.
+ *
+ * ── A role is one thing seen from three sides ────────────────────────────────
+ * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an
+ * approval line points at (`worklist` resolves an approver of type `Role` by id). Those
+ * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,
+ * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in
+ * one plant and force every person into both.
+ */
+/** One module and the axes this template grants on it. Axes are always enumerated. */
+export type RoleTemplateGrant = {
+    /** `@privilege(category:)` — what is guarded, not the package name. */
+    category: string;
+    /**
+     * `query` / `mutation` / ... — listed one by one.
+     *
+     * There is deliberately no `'all'`. A template written as "everything" would widen on
+     * its own the day a new axis is declared, with nobody having touched it. The single
+     * place that may widen is the framework-computed administrator template, which means
+     * "whatever exists now" by definition.
+     */
+    axes: string[];
+};
+export type RoleTemplate = {
+    /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */
+    id: string;
+    /**
+     * The role name created in the domain: `QUALITY-INSPECTOR`.
+     *
+     * Two apps may declare the same name on purpose — that is one seat, and the privileges
+     * become the union. The name is also a stored identifier: approval lines hold the role's
+     * id, so renaming here creates a second role and leaves the approval line pointing at
+     * the first. Renaming is a migration, not a template edit.
+     */
+    name: string;
+    /**
+     * Plain text, not an i18n key.
+     *
+     * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws
+     * the role's description as a value — so a key written here reaches the screen as
+     * `label.role-template.administrator`. That is exactly what the framework's own two
+     * templates did until 2026-09-11.
+     *
+     * operato-plant had it right from the start: "검사 기준과 처분을 정하는 자리".
+     */
+    description?: string;
+    /**
+     * Required, and may be empty.
+     *
+     * `[]` is a statement: this seat opens nothing, it exists for approval routing. A
+     * missing `grants` is a different thing — someone forgot — and is rejected here, so the
+     * screen can tell "opens nothing on purpose" from "nothing was written down".
+     */
+    grants: RoleTemplateGrant[];
+};
+/**
+ * Registered form of a template.
+ *
+ * Identical to the declaration today. It stays a separate name because the registry is
+ * what every reader goes through, and giving it its own type keeps a later addition from
+ * rippling into every call site.
+ */
+export type RegisteredRoleTemplate = RoleTemplate;
+/**
+ * Declares a role template. Call it from the application's server entry.
+ *
+ * Categories are not checked here: registration runs while modules load, before the
+ * schema is built and therefore before `process['PRIVILEGES']` exists. The name check
+ * happens at boot instead (`reportUnknownTemplateGrants`).
+ */
+export declare function registerRoleTemplate(template: RoleTemplate): void;
+export declare function roleTemplates(): RegisteredRoleTemplate[];
+export declare function roleTemplateById(id: string): RegisteredRoleTemplate | undefined;
+/**
+ * The two templates the framework can build without knowing a single category name.
+ *
+ * Everything else has to be declared by an application: a job title spans modules
+ * (a production lead uses worklist *and* order *and* ops-master) and no one package knows
+ * that. These two are different — they are defined over whatever is declared, so they can
+ * be computed from the registry `@privilege` fills.
+ */
+export declare function computedRoleTemplates(): RegisteredRoleTemplate[];
+/** Every template this installation offers — declared by apps, plus the computed two. */
+export declare function allRoleTemplates(): RegisteredRoleTemplate[];
+/**
+ * Names a template mentions that this installation does not declare.
+ *
+ * A template that survives a category rename becomes a role that grants nothing, and that
+ * is the quietest way this design can fail — the administrator picks "quality inspector",
+ * gets a role, and it opens no doors. operato-plant's seed already does this for its own
+ * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same
+ * check moved to where templates are declared.
+ */
+export declare function unknownTemplateGrants(template: RoleTemplate): string[];
+export declare function reportUnknownTemplateGrants(): void;

package/dist-server/service/role-template/role-template.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRoleTemplate = registerRoleTemplate;
+exports.roleTemplates = roleTemplates;
+exports.roleTemplateById = roleTemplateById;
+exports.computedRoleTemplates = computedRoleTemplates;
+exports.allRoleTemplates = allRoleTemplates;
+exports.unknownTemplateGrants = unknownTemplateGrants;
+exports.reportUnknownTemplateGrants = reportUnknownTemplateGrants;
+const env_1 = require("@things-factory/env");
+const privilege_axis_js_1 = require("../privilege/privilege-axis.js");
+const REGISTRY = 'ROLE_TEMPLATES';
+process[REGISTRY] = {};
+function registry() {
+    return process[REGISTRY];
+}
+/**
+ * Declares a role template. Call it from the application's server entry.
+ *
+ * Categories are not checked here: registration runs while modules load, before the
+ * schema is built and therefore before `process['PRIVILEGES']` exists. The name check
+ * happens at boot instead (`reportUnknownTemplateGrants`).
+ */
+function registerRoleTemplate(template) {
+    if (!template?.id || !template?.name) {
+        throw new Error('A role template needs both an id and a name.');
+    }
+    if (!Array.isArray(template.grants)) {
+        throw new Error(`Role template "${template.id}" has no grants. Write \`grants: []\` if this seat is meant to ` +
+            'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +
+            'tell an administrator which one it is.');
+    }
+    for (const grant of template.grants) {
+        if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {
+            throw new Error(`Role template "${template.id}" has a grant without a category or with no axes. ` +
+                'Axes are always listed one by one.');
+        }
+        /*
+         * Across the nine roles operato-plant declares, no role is granted `mutation` on a
+         * category without `query` on the same category — you cannot fix what you cannot see.
+         * A template that does so is almost certainly a slip, so say it out loud rather than
+         * silently granting a half-usable seat.
+         */
+        if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {
+            env_1.logger.warn(`[role-template] "${template.id}" grants ${grant.category}:mutation without ${grant.category}:query. ` +
+                'Someone who may change a thing but not see it can rarely use either.');
+        }
+    }
+    if (registry()[template.id]) {
+        throw new Error(`Role template "${template.id}" is declared twice.`);
+    }
+    registry()[template.id] = { ...template };
+}
+function roleTemplates() {
+    return Object.values(registry());
+}
+function roleTemplateById(id) {
+    return registry()[id];
+}
+/**
+ * The two templates the framework can build without knowing a single category name.
+ *
+ * Everything else has to be declared by an application: a job title spans modules
+ * (a production lead uses worklist *and* order *and* ops-master) and no one package knows
+ * that. These two are different — they are defined over whatever is declared, so they can
+ * be computed from the registry `@privilege` fills.
+ */
+function computedRoleTemplates() {
+    const declared = Object.values(process['PRIVILEGES'] || {});
+    const axesOf = new Map();
+    for (const [category, axis] of declared) {
+        if (!axesOf.has(category)) {
+            axesOf.set(category, new Set());
+        }
+        axesOf.get(category).add(axis);
+    }
+    const categories = [...axesOf.keys()].sort();
+    /*
+     * No description on either of these.
+     *
+     * They carried i18n keys, which the seeding path stored verbatim onto the role and the
+     * list then drew as the description. And a static sentence would be worse than what the
+     * screen already computes from `grants` — "opens 30 things across 30 modules" is exact
+     * and moves when the installation does.
+     */
+    /*
+     * VIEWER is only offered when someone has said which axes are read-only.
+     *
+     * This used to match the literal word `query`, which is right in this house and wrong in
+     * dssp, where the read axis is spelled `read` and `kpi` has no `query` at all — VIEWER
+     * would have quietly dropped that installation's main module.
+     *
+     * And when nobody has said, the template is **not offered at all** rather than offered
+     * empty. An empty VIEWER is the quiet failure this whole design is built to avoid: an
+     * administrator picks it, gets a role, no door opens, and the list counts the zero
+     * correctly. "We do not know" is not "there are none".
+     */
+    const readOnly = (0, privilege_axis_js_1.readOnlyAxes)();
+    const viewer = (0, privilege_axis_js_1.readOnlyAxesAreKnown)()
+        ? {
+            id: 'framework.viewer',
+            name: 'VIEWER',
+            grants: categories
+                .map(category => ({ category, axes: [...axesOf.get(category)].filter(axis => readOnly.has(axis)).sort() }))
+                .filter(grant => grant.axes.length > 0)
+        }
+        : undefined;
+    /*
+     * The one place that widens on purpose.
+     *
+     * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is
+     * declared. Here "everything that exists" is the meaning of the template, so picking up
+     * a newly declared axis is correct rather than accidental.
+     */
+    const administrator = {
+        id: 'framework.administrator',
+        name: 'ADMINISTRATOR',
+        grants: categories.map(category => ({ category, axes: [...axesOf.get(category)].sort() }))
+    };
+    return viewer ? [viewer, administrator] : [administrator];
+}
+/** Every template this installation offers — declared by apps, plus the computed two. */
+function allRoleTemplates() {
+    return [...computedRoleTemplates(), ...roleTemplates()];
+}
+/**
+ * Names a template mentions that this installation does not declare.
+ *
+ * A template that survives a category rename becomes a role that grants nothing, and that
+ * is the quietest way this design can fail — the administrator picks "quality inspector",
+ * gets a role, and it opens no doors. operato-plant's seed already does this for its own
+ * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same
+ * check moved to where templates are declared.
+ */
+function unknownTemplateGrants(template) {
+    const declared = process['PRIVILEGES'] || {};
+    return template.grants.flatMap(grant => grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`));
+}
+function reportUnknownTemplateGrants() {
+    const unknown = roleTemplates().flatMap(template => unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`));
+    if (unknown.length) {
+        env_1.logger.warn(`[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +
+            `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +
+            'is not installed here or the name has moved. A role seeded from such a template opens nothing.');
+    }
+}
+//# sourceMappingURL=role-template.js.map