@things-factory/auth-base 10.1.6 → 10.1.7

package/dist-server/service/role-template/role-template-types.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoleTemplateView = exports.RoleTemplateGrantView = void 0;
+const tslib_1 = require("tslib");
+const type_graphql_1 = require("type-graphql");
+/**
+ * What a template looks like *to this installation*.
+ *
+ * The declared template and the offered template are not the same thing: an app declares
+ * grants across modules it expects to be installed, and a given installation has a subset.
+ * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47
+ * categories declared across the repository. So the answer has to say which parts of the
+ * template this installation can actually honour.
+ */
+let RoleTemplateGrantView = class RoleTemplateGrantView {
+};
+exports.RoleTemplateGrantView = RoleTemplateGrantView;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The privilege category — what is guarded.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateGrantView.prototype, "category", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'The privilege axes granted on that category.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGrantView.prototype, "axes", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [String], { description: 'Axes named by the template that this installation does not declare.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateGrantView.prototype, "missingAxes", void 0);
+exports.RoleTemplateGrantView = RoleTemplateGrantView = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'One module and the axes a role template grants on it.' })
+], RoleTemplateGrantView);
+let RoleTemplateView = class RoleTemplateView {
+};
+exports.RoleTemplateView = RoleTemplateView;
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Declaration key, namespaced by the declaring application.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "id", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'The role name this template creates in a domain.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "name", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ nullable: true, description: 'A description of the seat this template creates.' }),
+    tslib_1.__metadata("design:type", String)
+], RoleTemplateView.prototype, "description", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' }),
+    tslib_1.__metadata("design:type", Array)
+], RoleTemplateView.prototype, "grants", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges this template would actually grant here.' }),
+    tslib_1.__metadata("design:type", Number)
+], RoleTemplateView.prototype, "privilegeCount", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)(type => type_graphql_1.Int, { description: 'How many privileges the template names that this installation does not have.' }),
+    tslib_1.__metadata("design:type", Number)
+], RoleTemplateView.prototype, "missingCount", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: "Whether a role already carries this template's default name in the current domain." }),
+    tslib_1.__metadata("design:type", Boolean)
+], RoleTemplateView.prototype, "defaultNameTaken", void 0);
+tslib_1.__decorate([
+    (0, type_graphql_1.Field)({ description: 'Whether this template grants nothing on purpose, rather than by omission.' }),
+    tslib_1.__metadata("design:type", Boolean)
+], RoleTemplateView.prototype, "grantsNothingDeliberately", void 0);
+exports.RoleTemplateView = RoleTemplateView = tslib_1.__decorate([
+    (0, type_graphql_1.ObjectType)({ description: 'A role template offered by this installation.' })
+], RoleTemplateView);
+//# sourceMappingURL=role-template-types.js.map

package/dist-server/service/role-template/role-template-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template-types.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template-types.ts"],"names":[],"mappings":";;;;AAAA,+CAAqD;AAErD;;;;;;;;GAQG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAgBjC,CAAA;AAhBY,sDAAqB;AAEhC;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2CAA2C,EAAE,CAAC;;uDACpD;AAGhB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,8CAA8C,EAAE,CAAC;;mDAC3E;AAUd;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,qEAAqE,EAAE,CAAC;;0DAC3F;gCAfV,qBAAqB;IADjC,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;GACxE,qBAAqB,CAgBjC;AAGM,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;CA4C5B,CAAA;AA5CY,4CAAgB;AAE3B;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;;4CAC1E;AAGV;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;8CAC/D;AAGZ;IADC,IAAA,oBAAK,EAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,kDAAkD,EAAE,CAAC;;qDACvE;AAGpB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC,qBAAqB,CAAC,EAAE,EAAE,WAAW,EAAE,4CAA4C,EAAE,CAAC;;gDACvE;AAG/B;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8DAA8D,EAAE,CAAC;;wDAC9E;AAGtB;IADC,IAAA,oBAAK,EAAC,IAAI,CAAC,EAAE,CAAC,kBAAG,EAAE,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;;sDAChG;AAepB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,oFAAoF,EAAE,CAAC;;0DACpF;AAWzB;IADC,IAAA,oBAAK,EAAC,EAAE,WAAW,EAAE,2EAA2E,EAAE,CAAC;;mEAClE;2BA3CvB,gBAAgB;IAD5B,IAAA,yBAAU,EAAC,EAAE,WAAW,EAAE,+CAA+C,EAAE,CAAC;GAChE,gBAAgB,CA4C5B","sourcesContent":["import { Field, Int, ObjectType } from 'type-graphql'\n\n/**\n * What a template looks like *to this installation*.\n *\n * The declared template and the offered template are not the same thing: an app declares\n * grants across modules it expects to be installed, and a given installation has a subset.\n * operato-plant declares 14 categories; the plant app running on :4000 sees 33 of the 47\n * categories declared across the repository. So the answer has to say which parts of the\n * template this installation can actually honour.\n */\n@ObjectType({ description: 'One module and the axes a role template grants on it.' })\nexport class RoleTemplateGrantView {\n  @Field({ description: 'The privilege category — what is guarded.' })\n  category: string\n\n  @Field(type => [String], { description: 'The privilege axes granted on that category.' })\n  axes: string[]\n\n  /**\n   * Axes this installation does not declare.\n   *\n   * Dropping them quietly would hand the administrator a role that does not match the\n   * template's name, with no way to tell. They are reported instead, and the screen says\n   * \"not present in this installation\".\n   */\n  @Field(type => [String], { description: 'Axes named by the template that this installation does not declare.' })\n  missingAxes: string[]\n}\n\n@ObjectType({ description: 'A role template offered by this installation.' })\nexport class RoleTemplateView {\n  @Field({ description: 'Declaration key, namespaced by the declaring application.' })\n  id: string\n\n  @Field({ description: 'The role name this template creates in a domain.' })\n  name: string\n\n  @Field({ nullable: true, description: 'A description of the seat this template creates.' })\n  description?: string\n\n  @Field(type => [RoleTemplateGrantView], { description: 'The modules and axes this template grants.' })\n  grants: RoleTemplateGrantView[]\n\n  @Field(type => Int, { description: 'How many privileges this template would actually grant here.' })\n  privilegeCount: number\n\n  @Field(type => Int, { description: 'How many privileges the template names that this installation does not have.' })\n  missingCount: number\n\n  /**\n   * Whether a role already carries this template's default name in the current domain.\n   *\n   * The screen warns before creating one, because seeding onto an existing name does not\n   * make a second role — approval lines hold a role's id, so a duplicate would leave the\n   * approval routed to the role nobody edits. The existing role is used as it stands and\n   * the template's privileges are added to it.\n   *\n   * It says \"default name\" rather than \"seeded\" because the administrator may give the\n   * role a name of their own, and then nothing here can tell whether this template was\n   * used. That is deliberate: provenance is not stored.\n   */\n  @Field({ description: \"Whether a role already carries this template's default name in the current domain.\" })\n  defaultNameTaken: boolean\n\n  /**\n   * True when the template deliberately opens nothing.\n   *\n   * A seat that only receives approvals is legitimate — operato-twin declares seven roles\n   * with no privileges at all, used as the target an approval line points at. The screen\n   * must not draw that as \"0 privileges, something is wrong\", so the distinction is\n   * carried here rather than inferred from an empty list.\n   */\n  @Field({ description: 'Whether this template grants nothing on purpose, rather than by omission.' })\n  grantsNothingDeliberately: boolean\n}\n"]}

package/dist-server/service/role-template/role-template.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Role templates — the seeds an application offers so a new domain does not start with
+ * zero roles.
+ *
+ * ── Why this is a boot registry and not a table ───────────────────────────────
+ * A template is a declaration. Copying it into rows per domain gives 100 domains x 3
+ * templates = 300 rows, and once the code changes the template there is nowhere to ask
+ * which of the two is true: the declaration, or the row that was written from an older
+ * one. `@privilege` lives in the boot registry for the same reason.
+ *
+ * ── What a template is not ───────────────────────────────────────────────────
+ * It is a seed, not a role. Once it has been used the resulting role belongs to the
+ * administrator: the template is never re-applied and never overwrites. Nothing is written
+ * onto the role to remember where it came from — what an administrator would want from
+ * that ("the template gained two privileges, here they are") is the template's current
+ * grants against the role's current privileges, and that is computed rather than stored.
+ *
+ * ── A role is one thing seen from three sides ────────────────────────────────
+ * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an
+ * approval line points at (`worklist` resolves an approver of type `Role` by id). Those
+ * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,
+ * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in
+ * one plant and force every person into both.
+ */
+/** One module and the axes this template grants on it. Axes are always enumerated. */
+export type RoleTemplateGrant = {
+    /** `@privilege(category:)` — what is guarded, not the package name. */
+    category: string;
+    /**
+     * `query` / `mutation` / ... — listed one by one.
+     *
+     * There is deliberately no `'all'`. A template written as "everything" would widen on
+     * its own the day a new axis is declared, with nobody having touched it. The single
+     * place that may widen is the framework-computed administrator template, which means
+     * "whatever exists now" by definition.
+     */
+    axes: string[];
+};
+export type RoleTemplate = {
+    /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */
+    id: string;
+    /**
+     * The role name created in the domain: `QUALITY-INSPECTOR`.
+     *
+     * Two apps may declare the same name on purpose — that is one seat, and the privileges
+     * become the union. The name is also a stored identifier: approval lines hold the role's
+     * id, so renaming here creates a second role and leaves the approval line pointing at
+     * the first. Renaming is a migration, not a template edit.
+     */
+    name: string;
+    /**
+     * Plain text, not an i18n key.
+     *
+     * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws
+     * the role's description as a value — so a key written here reaches the screen as
+     * `label.role-template.administrator`. That is exactly what the framework's own two
+     * templates did until 2026-09-11.
+     *
+     * operato-plant had it right from the start: "검사 기준과 처분을 정하는 자리".
+     */
+    description?: string;
+    /**
+     * Required, and may be empty.
+     *
+     * `[]` is a statement: this seat opens nothing, it exists for approval routing. A
+     * missing `grants` is a different thing — someone forgot — and is rejected here, so the
+     * screen can tell "opens nothing on purpose" from "nothing was written down".
+     */
+    grants: RoleTemplateGrant[];
+};
+/**
+ * Registered form of a template.
+ *
+ * Identical to the declaration today. It stays a separate name because the registry is
+ * what every reader goes through, and giving it its own type keeps a later addition from
+ * rippling into every call site.
+ */
+export type RegisteredRoleTemplate = RoleTemplate;
+/**
+ * Declares a role template. Call it from the application's server entry.
+ *
+ * Categories are not checked here: registration runs while modules load, before the
+ * schema is built and therefore before `process['PRIVILEGES']` exists. The name check
+ * happens at boot instead (`reportUnknownTemplateGrants`).
+ */
+export declare function registerRoleTemplate(template: RoleTemplate): void;
+export declare function roleTemplates(): RegisteredRoleTemplate[];
+export declare function roleTemplateById(id: string): RegisteredRoleTemplate | undefined;
+/**
+ * The two templates the framework can build without knowing a single category name.
+ *
+ * Everything else has to be declared by an application: a job title spans modules
+ * (a production lead uses worklist *and* order *and* ops-master) and no one package knows
+ * that. These two are different — they are defined over whatever is declared, so they can
+ * be computed from the registry `@privilege` fills.
+ */
+export declare function computedRoleTemplates(): RegisteredRoleTemplate[];
+/** Every template this installation offers — declared by apps, plus the computed two. */
+export declare function allRoleTemplates(): RegisteredRoleTemplate[];
+/**
+ * Names a template mentions that this installation does not declare.
+ *
+ * A template that survives a category rename becomes a role that grants nothing, and that
+ * is the quietest way this design can fail — the administrator picks "quality inspector",
+ * gets a role, and it opens no doors. operato-plant's seed already does this for its own
+ * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same
+ * check moved to where templates are declared.
+ */
+export declare function unknownTemplateGrants(template: RoleTemplate): string[];
+export declare function reportUnknownTemplateGrants(): void;

package/dist-server/service/role-template/role-template.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerRoleTemplate = registerRoleTemplate;
+exports.roleTemplates = roleTemplates;
+exports.roleTemplateById = roleTemplateById;
+exports.computedRoleTemplates = computedRoleTemplates;
+exports.allRoleTemplates = allRoleTemplates;
+exports.unknownTemplateGrants = unknownTemplateGrants;
+exports.reportUnknownTemplateGrants = reportUnknownTemplateGrants;
+const env_1 = require("@things-factory/env");
+const REGISTRY = 'ROLE_TEMPLATES';
+process[REGISTRY] = {};
+function registry() {
+    return process[REGISTRY];
+}
+/**
+ * Declares a role template. Call it from the application's server entry.
+ *
+ * Categories are not checked here: registration runs while modules load, before the
+ * schema is built and therefore before `process['PRIVILEGES']` exists. The name check
+ * happens at boot instead (`reportUnknownTemplateGrants`).
+ */
+function registerRoleTemplate(template) {
+    if (!template?.id || !template?.name) {
+        throw new Error('A role template needs both an id and a name.');
+    }
+    if (!Array.isArray(template.grants)) {
+        throw new Error(`Role template "${template.id}" has no grants. Write \`grants: []\` if this seat is meant to ` +
+            'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +
+            'tell an administrator which one it is.');
+    }
+    for (const grant of template.grants) {
+        if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {
+            throw new Error(`Role template "${template.id}" has a grant without a category or with no axes. ` +
+                'Axes are always listed one by one.');
+        }
+        /*
+         * Across the nine roles operato-plant declares, no role is granted `mutation` on a
+         * category without `query` on the same category — you cannot fix what you cannot see.
+         * A template that does so is almost certainly a slip, so say it out loud rather than
+         * silently granting a half-usable seat.
+         */
+        if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {
+            env_1.logger.warn(`[role-template] "${template.id}" grants ${grant.category}:mutation without ${grant.category}:query. ` +
+                'Someone who may change a thing but not see it can rarely use either.');
+        }
+    }
+    if (registry()[template.id]) {
+        throw new Error(`Role template "${template.id}" is declared twice.`);
+    }
+    registry()[template.id] = { ...template };
+}
+function roleTemplates() {
+    return Object.values(registry());
+}
+function roleTemplateById(id) {
+    return registry()[id];
+}
+/**
+ * The two templates the framework can build without knowing a single category name.
+ *
+ * Everything else has to be declared by an application: a job title spans modules
+ * (a production lead uses worklist *and* order *and* ops-master) and no one package knows
+ * that. These two are different — they are defined over whatever is declared, so they can
+ * be computed from the registry `@privilege` fills.
+ */
+function computedRoleTemplates() {
+    const declared = Object.values(process['PRIVILEGES'] || {});
+    const axesOf = new Map();
+    for (const [category, axis] of declared) {
+        if (!axesOf.has(category)) {
+            axesOf.set(category, new Set());
+        }
+        axesOf.get(category).add(axis);
+    }
+    const categories = [...axesOf.keys()].sort();
+    /*
+     * No description on either of these.
+     *
+     * They carried i18n keys, which the seeding path stored verbatim onto the role and the
+     * list then drew as the description. And a static sentence would be worse than what the
+     * screen already computes from `grants` — "opens 30 things across 30 modules" is exact
+     * and moves when the installation does.
+     */
+    const viewer = {
+        id: 'framework.viewer',
+        name: 'VIEWER',
+        grants: categories.filter(category => axesOf.get(category).has('query')).map(category => ({ category, axes: ['query'] }))
+    };
+    /*
+     * The one place that widens on purpose.
+     *
+     * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is
+     * declared. Here "everything that exists" is the meaning of the template, so picking up
+     * a newly declared axis is correct rather than accidental.
+     */
+    const administrator = {
+        id: 'framework.administrator',
+        name: 'ADMINISTRATOR',
+        grants: categories.map(category => ({ category, axes: [...axesOf.get(category)].sort() }))
+    };
+    return [viewer, administrator];
+}
+/** Every template this installation offers — declared by apps, plus the computed two. */
+function allRoleTemplates() {
+    return [...computedRoleTemplates(), ...roleTemplates()];
+}
+/**
+ * Names a template mentions that this installation does not declare.
+ *
+ * A template that survives a category rename becomes a role that grants nothing, and that
+ * is the quietest way this design can fail — the administrator picks "quality inspector",
+ * gets a role, and it opens no doors. operato-plant's seed already does this for its own
+ * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same
+ * check moved to where templates are declared.
+ */
+function unknownTemplateGrants(template) {
+    const declared = process['PRIVILEGES'] || {};
+    return template.grants.flatMap(grant => grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`));
+}
+function reportUnknownTemplateGrants() {
+    const unknown = roleTemplates().flatMap(template => unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`));
+    if (unknown.length) {
+        env_1.logger.warn(`[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +
+            `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +
+            'is not installed here or the name has moved. A role seeded from such a template opens nothing.');
+    }
+}
+//# sourceMappingURL=role-template.js.map

package/dist-server/service/role-template/role-template.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAmGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDAyCC;AAGD,4CAEC;AAWD,sDAMC;AAED,kEAYC;AA1OD,6CAA4C;AAoF5C,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3H,CAAA;IAED;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  const viewer: RoleTemplate = {\n    id: 'framework.viewer',\n    name: 'VIEWER',\n    grants: categories.filter(category => axesOf.get(category)!.has('query')).map(category => ({ category, axes: ['query'] }))\n  }\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return [viewer, administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}