@things-factory/auth-base 10.1.7 → 10.1.17

package/dist-server/service/role-template/role-template.js.map

@@ -1 +1 @@
-{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAmGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDAyCC;AAGD,4CAEC;AAWD,sDAMC;AAED,kEAYC;AA1OD,6CAA4C;AAoF5C,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH,MAAM,MAAM,GAAiB;QAC3B,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,QAAQ;QACd,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;KAC3H,CAAA;IAED;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,CAAC,MAAM,EAAE,aAAa,CAAC,CAAA;AAChC,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  const viewer: RoleTemplate = {\n    id: 'framework.viewer',\n    name: 'VIEWER',\n    grants: categories.filter(category => axesOf.get(category)!.has('query')).map(category => ({ category, axes: ['query'] }))\n  }\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return [viewer, administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}
+{"version":3,"file":"role-template.js","sourceRoot":"","sources":["../../../server/service/role-template/role-template.ts"],"names":[],"mappings":";;AAqGA,oDAwCC;AAED,sCAEC;AAED,4CAEC;AAUD,sDA2DC;AAGD,4CAEC;AAWD,sDAMC;AAED,kEAYC;AA9PD,6CAA4C;AAE5C,sEAAmF;AAoFnF,MAAM,QAAQ,GAAG,gBAAgB,CAAA;AAEjC,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAA;AAEtB,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,oBAAoB,CAAC,QAAsB;IACzD,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,iEAAiE;YAC5F,4FAA4F;YAC5F,wCAAwC,CAC3C,CAAA;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,CAAC,EAAE,oDAAoD;gBAC/E,oCAAoC,CACvC,CAAA;QACH,CAAC;QAED;;;;;WAKG;QACH,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACrE,YAAM,CAAC,IAAI,CACT,oBAAoB,QAAQ,CAAC,EAAE,YAAY,KAAK,CAAC,QAAQ,qBAAqB,KAAK,CAAC,QAAQ,UAAU;gBACpG,sEAAsE,CACzE,CAAA;QACH,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,kBAAkB,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAA;IACtE,CAAC;IAED,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAgB,gBAAgB,CAAC,EAAU;IACzC,OAAO,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;AACvB,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,qBAAqB;IACnC,MAAM,QAAQ,GAAuB,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAA;IAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE7C,KAAK,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,QAAQ,EAAE,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,CAAC,CAAA;QACjC,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IAE5C;;;;;;;OAOG;IACH;;;;;;;;;;;OAWG;IACH,MAAM,QAAQ,GAAG,IAAA,gCAAY,GAAE,CAAA;IAE/B,MAAM,MAAM,GAA6B,IAAA,wCAAoB,GAAE;QAC7D,CAAC,CAAC;YACE,EAAE,EAAE,kBAAkB;YACtB,IAAI,EAAE,QAAQ;YACd,MAAM,EAAE,UAAU;iBACf,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC3G,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC1C;QACH,CAAC,CAAC,SAAS,CAAA;IAEb;;;;;;OAMG;IACH,MAAM,aAAa,GAAiB;QAClC,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;KAC5F,CAAA;IAED,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;AAC3D,CAAC;AAED,yFAAyF;AACzF,SAAgB,gBAAgB;IAC9B,OAAO,CAAC,GAAG,qBAAqB,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,EAAE,CAAA;IAE5C,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CACrC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC,CAC3G,CAAA;AACH,CAAC;AAED,SAAgB,2BAA2B;IACzC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CACjD,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,EAAE,MAAM,KAAK,EAAE,CAAC,CAC1E,CAAA;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,YAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,CAAC,MAAM,+DAA+D;YAC9F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,4EAA4E;YACjG,gGAAgG,CACnG,CAAA;IACH,CAAC;AACH,CAAC","sourcesContent":["import { logger } from '@things-factory/env'\n\nimport { readOnlyAxes, readOnlyAxesAreKnown } from '../privilege/privilege-axis.js'\n\n/**\n * Role templates — the seeds an application offers so a new domain does not start with\n * zero roles.\n *\n * ── Why this is a boot registry and not a table ───────────────────────────────\n * A template is a declaration. Copying it into rows per domain gives 100 domains x 3\n * templates = 300 rows, and once the code changes the template there is nowhere to ask\n * which of the two is true: the declaration, or the row that was written from an older\n * one. `@privilege` lives in the boot registry for the same reason.\n *\n * ── What a template is not ───────────────────────────────────────────────────\n * It is a seed, not a role. Once it has been used the resulting role belongs to the\n * administrator: the template is never re-applied and never overwrites. Nothing is written\n * onto the role to remember where it came from — what an administrator would want from\n * that (\"the template gained two privileges, here they are\") is the template's current\n * grants against the role's current privileges, and that is computed rather than stored.\n *\n * ── A role is one thing seen from three sides ────────────────────────────────\n * operato-plant uses roles as privilege bundles; operato-twin uses them as the seat an\n * approval line points at (`worklist` resolves an approver of type `Role` by id). Those\n * are not two concepts. A role is a seat in the organisation: what it opens, who fills it,\n * and whether approvals route to it. Splitting them would put two QUALITY-INSPECTORs in\n * one plant and force every person into both.\n */\n\n/** One module and the axes this template grants on it. Axes are always enumerated. */\nexport type RoleTemplateGrant = {\n  /** `@privilege(category:)` — what is guarded, not the package name. */\n  category: string\n  /**\n   * `query` / `mutation` / ... — listed one by one.\n   *\n   * There is deliberately no `'all'`. A template written as \"everything\" would widen on\n   * its own the day a new axis is declared, with nobody having touched it. The single\n   * place that may widen is the framework-computed administrator template, which means\n   * \"whatever exists now\" by definition.\n   */\n  axes: string[]\n}\n\nexport type RoleTemplate = {\n  /** Declaration key, namespaced by the declaring app: `plant.quality-inspector`. */\n  id: string\n  /**\n   * The role name created in the domain: `QUALITY-INSPECTOR`.\n   *\n   * Two apps may declare the same name on purpose — that is one seat, and the privileges\n   * become the union. The name is also a stored identifier: approval lines hold the role's\n   * id, so renaming here creates a second role and leaves the approval line pointing at\n   * the first. Renaming is a migration, not a template edit.\n   */\n  name: string\n  /**\n   * Plain text, not an i18n key.\n   *\n   * `createRoleFromTemplate` copies this onto the role it seeds, and the role list draws\n   * the role's description as a value — so a key written here reaches the screen as\n   * `label.role-template.administrator`. That is exactly what the framework's own two\n   * templates did until 2026-09-11.\n   *\n   * operato-plant had it right from the start: \"검사 기준과 처분을 정하는 자리\".\n   */\n  description?: string\n  /**\n   * Required, and may be empty.\n   *\n   * `[]` is a statement: this seat opens nothing, it exists for approval routing. A\n   * missing `grants` is a different thing — someone forgot — and is rejected here, so the\n   * screen can tell \"opens nothing on purpose\" from \"nothing was written down\".\n   */\n  grants: RoleTemplateGrant[]\n}\n\n/**\n * Registered form of a template.\n *\n * Identical to the declaration today. It stays a separate name because the registry is\n * what every reader goes through, and giving it its own type keeps a later addition from\n * rippling into every call site.\n */\nexport type RegisteredRoleTemplate = RoleTemplate\n\nconst REGISTRY = 'ROLE_TEMPLATES'\n\nprocess[REGISTRY] = {}\n\nfunction registry(): Record<string, RegisteredRoleTemplate> {\n  return process[REGISTRY]\n}\n\n/**\n * Declares a role template. Call it from the application's server entry.\n *\n * Categories are not checked here: registration runs while modules load, before the\n * schema is built and therefore before `process['PRIVILEGES']` exists. The name check\n * happens at boot instead (`reportUnknownTemplateGrants`).\n */\nexport function registerRoleTemplate(template: RoleTemplate): void {\n  if (!template?.id || !template?.name) {\n    throw new Error('A role template needs both an id and a name.')\n  }\n\n  if (!Array.isArray(template.grants)) {\n    throw new Error(\n      `Role template \"${template.id}\" has no grants. Write \\`grants: []\\` if this seat is meant to ` +\n        'open nothing — leaving it out is indistinguishable from forgetting, and the screen cannot ' +\n        'tell an administrator which one it is.'\n    )\n  }\n\n  for (const grant of template.grants) {\n    if (!grant?.category || !Array.isArray(grant.axes) || grant.axes.length === 0) {\n      throw new Error(\n        `Role template \"${template.id}\" has a grant without a category or with no axes. ` +\n          'Axes are always listed one by one.'\n      )\n    }\n\n    /*\n     * Across the nine roles operato-plant declares, no role is granted `mutation` on a\n     * category without `query` on the same category — you cannot fix what you cannot see.\n     * A template that does so is almost certainly a slip, so say it out loud rather than\n     * silently granting a half-usable seat.\n     */\n    if (grant.axes.includes('mutation') && !grant.axes.includes('query')) {\n      logger.warn(\n        `[role-template] \"${template.id}\" grants ${grant.category}:mutation without ${grant.category}:query. ` +\n          'Someone who may change a thing but not see it can rarely use either.'\n      )\n    }\n  }\n\n  if (registry()[template.id]) {\n    throw new Error(`Role template \"${template.id}\" is declared twice.`)\n  }\n\n  registry()[template.id] = { ...template }\n}\n\nexport function roleTemplates(): RegisteredRoleTemplate[] {\n  return Object.values(registry())\n}\n\nexport function roleTemplateById(id: string): RegisteredRoleTemplate | undefined {\n  return registry()[id]\n}\n\n/**\n * The two templates the framework can build without knowing a single category name.\n *\n * Everything else has to be declared by an application: a job title spans modules\n * (a production lead uses worklist *and* order *and* ops-master) and no one package knows\n * that. These two are different — they are defined over whatever is declared, so they can\n * be computed from the registry `@privilege` fills.\n */\nexport function computedRoleTemplates(): RegisteredRoleTemplate[] {\n  const declared: [string, string][] = Object.values(process['PRIVILEGES'] || {})\n  const axesOf = new Map<string, Set<string>>()\n\n  for (const [category, axis] of declared) {\n    if (!axesOf.has(category)) {\n      axesOf.set(category, new Set())\n    }\n    axesOf.get(category)!.add(axis)\n  }\n\n  const categories = [...axesOf.keys()].sort()\n\n  /*\n   * No description on either of these.\n   *\n   * They carried i18n keys, which the seeding path stored verbatim onto the role and the\n   * list then drew as the description. And a static sentence would be worse than what the\n   * screen already computes from `grants` — \"opens 30 things across 30 modules\" is exact\n   * and moves when the installation does.\n   */\n  /*\n   * VIEWER is only offered when someone has said which axes are read-only.\n   *\n   * This used to match the literal word `query`, which is right in this house and wrong in\n   * dssp, where the read axis is spelled `read` and `kpi` has no `query` at all — VIEWER\n   * would have quietly dropped that installation's main module.\n   *\n   * And when nobody has said, the template is **not offered at all** rather than offered\n   * empty. An empty VIEWER is the quiet failure this whole design is built to avoid: an\n   * administrator picks it, gets a role, no door opens, and the list counts the zero\n   * correctly. \"We do not know\" is not \"there are none\".\n   */\n  const readOnly = readOnlyAxes()\n\n  const viewer: RoleTemplate | undefined = readOnlyAxesAreKnown()\n    ? {\n        id: 'framework.viewer',\n        name: 'VIEWER',\n        grants: categories\n          .map(category => ({ category, axes: [...axesOf.get(category)!].filter(axis => readOnly.has(axis)).sort() }))\n          .filter(grant => grant.axes.length > 0)\n      }\n    : undefined\n\n  /*\n   * The one place that widens on purpose.\n   *\n   * Everywhere else an unenumerated axis is a defect waiting for the day a new axis is\n   * declared. Here \"everything that exists\" is the meaning of the template, so picking up\n   * a newly declared axis is correct rather than accidental.\n   */\n  const administrator: RoleTemplate = {\n    id: 'framework.administrator',\n    name: 'ADMINISTRATOR',\n    grants: categories.map(category => ({ category, axes: [...axesOf.get(category)!].sort() }))\n  }\n\n  return viewer ? [viewer, administrator] : [administrator]\n}\n\n/** Every template this installation offers — declared by apps, plus the computed two. */\nexport function allRoleTemplates(): RegisteredRoleTemplate[] {\n  return [...computedRoleTemplates(), ...roleTemplates()]\n}\n\n/**\n * Names a template mentions that this installation does not declare.\n *\n * A template that survives a category rename becomes a role that grants nothing, and that\n * is the quietest way this design can fail — the administrator picks \"quality inspector\",\n * gets a role, and it opens no doors. operato-plant's seed already does this for its own\n * table (`seed-demo-org.ts` warns about grants it could not attach); this is the same\n * check moved to where templates are declared.\n */\nexport function unknownTemplateGrants(template: RoleTemplate): string[] {\n  const declared = process['PRIVILEGES'] || {}\n\n  return template.grants.flatMap(grant =>\n    grant.axes.filter(axis => !declared[`${grant.category} ${axis}`]).map(axis => `${grant.category}:${axis}`)\n  )\n}\n\nexport function reportUnknownTemplateGrants(): void {\n  const unknown = roleTemplates().flatMap(template =>\n    unknownTemplateGrants(template).map(grant => `${template.id} → ${grant}`)\n  )\n\n  if (unknown.length) {\n    logger.warn(\n      `[role-template] ${unknown.length} grants name privileges this installation does not declare — ` +\n        `${unknown.join(', ')}. Privilege definitions come from @privilege at boot, so either the query ` +\n        'is not installed here or the name has moved. A role seeded from such a template opens nothing.'\n    )\n  }\n}\n"]}