@things-factory/auth-base 10.1.79 → 10.1.107

package/dist-server/ai-entry/access-entry-targets.js

@@ -0,0 +1,196 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH_ACCESS_REQUEST = exports.AUTH_ACCESS_DECISION = void 0;
+exports.requestLabel = requestLabel;
+exports.requestsNamed = requestsNamed;
+exports.rolesNamed = rolesNamed;
+exports.decisionOf = decisionOf;
+exports.issuesOf = issuesOf;
+exports.accessDecisionEntryTarget = accessDecisionEntryTarget;
+exports.accessRequestEntryTarget = accessRequestEntryTarget;
+exports.accessEntryTargets = accessEntryTargets;
+exports.AUTH_ACCESS_DECISION = 'auth.access-decision';
+exports.AUTH_ACCESS_REQUEST = 'auth.access-request';
+const PENDING_REQUESTS = 'query ($filters: [Filter!], $pagination: Pagination) { accessRequests(filters: $filters, pagination: $pagination) { items { id category privilege state requester { name email } } } }';
+const ROLES_NAMED = 'query ($filters: [Filter!], $pagination: Pagination) { roles(filters: $filters, pagination: $pagination) { items { id name } } }';
+/** "김○○ · warehouse:mutation" - how a request is named on the card. */
+function requestLabel(request) {
+    const who = request?.requester?.name || request?.requester?.email || '';
+    return [who, request?.category && request?.privilege ? `${request.category}:${request.privilege}` : ''].filter(Boolean).join(' · ');
+}
+/** The pending requests the said text names - by the requester's name or e-mail, or the privilege. Several stay several. */
+function requestsNamed(items, said) {
+    const text = (said || '').trim().toLowerCase();
+    if (!text)
+        return [];
+    return (items || [])
+        .filter(item => item?.state === 'PENDING')
+        .filter(item => {
+        if (item.id === said.trim())
+            return true;
+        const names = [item.requester?.name, item.requester?.email, `${item.category}:${item.privilege}`, requestLabel(item)];
+        return names.some(name => typeof name === 'string' && name.toLowerCase().includes(text));
+    })
+        .map(item => ({ id: item.id, label: requestLabel(item) }));
+}
+/** A role named exactly - a near name is not taken. */
+function rolesNamed(items, said) {
+    const text = (said || '').trim().toLowerCase();
+    return (items || []).filter(item => typeof item?.name === 'string' && item.name.toLowerCase() === text).map(item => ({ id: item.id, label: item.name }));
+}
+const DECISION_FIELDS = [
+    {
+        name: 'request',
+        type: 'reference',
+        required: true,
+        labelKey: 'access-request.field.request',
+        description: "the pending access request, by the requester's name and the privilege asked for",
+        reference: {
+            query: PENDING_REQUESTS,
+            variables: () => ({ filters: [{ name: 'state', operator: 'eq', value: 'PENDING' }], pagination: { page: 1, limit: 500 } }),
+            recordsOf: (data, said) => requestsNamed(data?.accessRequests?.items ?? [], said)
+        }
+    },
+    {
+        name: 'decision',
+        type: 'enum',
+        required: true,
+        values: ['GRANT', 'DENY'],
+        labelKey: 'access-request.field.decision',
+        valueKeyPrefix: 'access-request.decision.',
+        description: 'GRANT puts the requester into a role; DENY refuses with a reason'
+    },
+    {
+        name: 'role',
+        type: 'reference',
+        labelKey: 'access-request.field.granted role',
+        description: 'the role to put the requester into, by its exact name - only for GRANT. Prefer the role with the fewest privileges that still holds the one asked for; the review names a smaller one when there is.',
+        reference: {
+            query: ROLES_NAMED,
+            variables: (said) => ({ filters: [{ name: 'name', operator: 'eq', value: said.trim() }], pagination: { page: 1, limit: 20 } }),
+            recordsOf: (data, said) => rolesNamed(data?.roles?.items ?? [], said)
+        }
+    },
+    {
+        name: 'reason',
+        type: 'text',
+        labelKey: 'access-request.field.decision reason',
+        description: 'why - required for DENY. Never written by the model: ask the person.'
+    }
+];
+const idOf = (value) => (value && typeof value === 'object' && typeof value.id === 'string' ? value.id : undefined);
+/** A row as the decision door takes it. */
+function decisionOf(row) {
+    const decision = row.values.decision === 'DENY' ? 'DENY' : 'GRANT';
+    return {
+        requestId: idOf(row.values.request),
+        decision,
+        roleId: decision === 'GRANT' ? idOf(row.values.role) : undefined,
+        reason: typeof row.values.reason === 'string' ? row.values.reason : undefined
+    };
+}
+/** The review's findings as the card's issues - the words are the screen's (`access-request.issue.<code>`). */
+function issuesOf(findings) {
+    return findings.map(finding => ({
+        ...(finding.field && finding.field !== 'decision' ? { field: finding.field } : {}),
+        code: finding.code,
+        messageKey: `access-request.issue.${finding.code}`,
+        params: finding.params,
+        blocking: finding.blocking
+    }));
+}
+function accessDecisionEntryTarget() {
+    return {
+        key: exports.AUTH_ACCESS_DECISION,
+        labelKey: 'access-request.title.decision draft',
+        description: 'one decision on a pending access request: which request, grant or deny, the role to grant with, and the reason to deny.',
+        mutation: 'mutation ($decision: AccessDecisionInput!) { decideAccessRequest(decision: $decision) { id state } }',
+        fields: DECISION_FIELDS,
+        maxRows: 50,
+        variables: row => ({ decision: decisionOf(row) }),
+        appliedOf: (data, row) => ({ id: data?.decideAccessRequest?.id, label: row.values.request?.label }),
+        check: async (rows, { state }) => {
+            const { reviewDecision } = await Promise.resolve().then(() => __importStar(require('../controllers/access-request.js')));
+            const out = [];
+            for (const row of rows) {
+                const decision = decisionOf(row);
+                out.push(decision.requestId ? issuesOf(await reviewDecision(decision, { state })) : []);
+            }
+            return out;
+        }
+    };
+}
+const REQUEST_FIELDS = [
+    { name: 'category', type: 'string', required: true, labelKey: 'access-request.field.category', description: 'the category of the privilege, as the refusal named it' },
+    { name: 'privilege', type: 'string', required: true, labelKey: 'access-request.field.privilege', description: 'the privilege, as the refusal named it - query, mutation, ...' },
+    { name: 'reason', type: 'text', required: true, labelKey: 'access-request.field.reason', description: "why the person needs it, in the person's words - ask them; never write it yourself" }
+];
+function accessRequestEntryTarget() {
+    return {
+        key: exports.AUTH_ACCESS_REQUEST,
+        labelKey: 'access-request.title.request draft',
+        description: 'one request for a privilege the person was refused for want of a role.',
+        mutation: 'mutation ($request: NewAccessRequest!) { requestAccess(request: $request) { id count } }',
+        fields: REQUEST_FIELDS,
+        maxRows: 10,
+        variables: row => ({ request: { category: row.values.category, privilege: row.values.privilege, reason: row.values.reason } }),
+        appliedOf: data => ({ id: data?.requestAccess?.id }),
+        /* What the door would refuse - asked before the card, so the person is not offered a request that cannot stand. */
+        check: async (rows, { state }) => {
+            const { judgePermission } = await Promise.resolve().then(() => __importStar(require('../utils/check-permission.js')));
+            const out = [];
+            for (const row of rows) {
+                const category = String(row.values.category ?? '');
+                const privilege = String(row.values.privilege ?? '');
+                if (!category || !privilege) {
+                    out.push([]);
+                    continue;
+                }
+                const judgement = await judgePermission({ category, privilege }, state?.user, state?.domain, state?.unsafeIP, state?.prohibitedPrivileges);
+                out.push(judgement.permitted === true
+                    ? [{ code: 'already-holds', messageKey: 'access-request.issue.already-holds', blocking: true }]
+                    : judgement.because !== 'role'
+                        ? [{ code: 'not-by-role', messageKey: 'access-request.issue.not-by-role', params: { because: judgement.because }, blocking: true }]
+                        : []);
+            }
+            return out;
+        }
+    };
+}
+function accessEntryTargets() {
+    return [accessDecisionEntryTarget(), accessRequestEntryTarget()];
+}
+//# sourceMappingURL=access-entry-targets.js.map

package/dist-server/ai-entry/access-entry-targets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-entry-targets.js","sourceRoot":"","sources":["../../server/ai-entry/access-entry-targets.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,oCAGC;AAGD,sCAWC;AAGD,gCAGC;AA+CD,gCAQC;AAGD,4BAQC;AAED,8DAsBC;AAQD,4DAkCC;AAED,gDAEC;AAzKY,QAAA,oBAAoB,GAAG,sBAAsB,CAAA;AAC7C,QAAA,mBAAmB,GAAG,qBAAqB,CAAA;AAExD,MAAM,gBAAgB,GACpB,wLAAwL,CAAA;AAE1L,MAAM,WAAW,GACf,kIAAkI,CAAA;AAEpI,uEAAuE;AACvE,SAAgB,YAAY,CAAC,OAAY;IACvC,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,IAAI,OAAO,EAAE,SAAS,EAAE,KAAK,IAAI,EAAE,CAAA;IACvE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACrI,CAAC;AAED,4HAA4H;AAC5H,SAAgB,aAAa,CAAC,KAAY,EAAE,IAAY;IACtD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;SACjB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,SAAS,CAAC;SACzC,MAAM,CAAC,IAAI,CAAC,EAAE;QACb,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,IAAI,CAAA;QACxC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;QACrH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC1F,CAAC,CAAC;SACD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,uDAAuD;AACvD,SAAgB,UAAU,CAAC,KAAY,EAAE,IAAY;IACnD,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAC9C,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AAC1J,CAAC;AAED,MAAM,eAAe,GAAiB;IACpC;QACE,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,IAAI;QACd,QAAQ,EAAE,8BAA8B;QACxC,WAAW,EAAE,iFAAiF;QAC9F,SAAS,EAAE;YACT,KAAK,EAAE,gBAAgB;YACvB,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;YAC1H,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC;SAClF;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,EAAE,+BAA+B;QACzC,cAAc,EAAE,0BAA0B;QAC1C,WAAW,EAAE,kEAAkE;KAChF;IACD;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,mCAAmC;QAC7C,WAAW,EACT,sMAAsM;QACxM,SAAS,EAAE;YACT,KAAK,EAAE,WAAW;YAClB,SAAS,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;YACtI,SAAS,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC;SACtE;KACF;IACD;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,MAAM;QACZ,QAAQ,EAAE,sCAAsC;QAChD,WAAW,EAAE,sEAAsE;KACpF;CACF,CAAA;AAED,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAQ,KAAa,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAa,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AAE9I,2CAA2C;AAC3C,SAAgB,UAAU,CAAC,GAAa;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAClE,OAAO;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC;QACnC,QAAQ;QACR,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAChE,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAC9E,CAAA;AACH,CAAC;AAED,+GAA+G;AAC/G,SAAgB,QAAQ,CAAC,QAAiG;IACxH,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9B,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU,EAAE,wBAAwB,OAAO,CAAC,IAAI,EAAE;QAClD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC,CAAA;AACL,CAAC;AAED,SAAgB,yBAAyB;IACvC,OAAO;QACL,GAAG,EAAE,4BAAoB;QACzB,QAAQ,EAAE,qCAAqC;QAC/C,WAAW,EACT,yHAAyH;QAC3H,QAAQ,EAAE,sGAAsG;QAChH,MAAM,EAAE,eAAe;QACvB,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACjD,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,KAAK,EAAG,GAAG,CAAC,MAAM,CAAC,OAAe,EAAE,KAAK,EAAE,CAAC;QAE5G,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,EAAE,cAAc,EAAE,GAAG,wDAAa,kCAAkC,GAAC,CAAA;YAC3E,MAAM,GAAG,GAAmB,EAAE,CAAA;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;gBAChC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,QAAe,EAAE,EAAE,KAAK,EAAS,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACvG,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,cAAc,GAAiB;IACnC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,+BAA+B,EAAE,WAAW,EAAE,wDAAwD,EAAE;IACtK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,gCAAgC,EAAE,WAAW,EAAE,+DAA+D,EAAE;IAC/K,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,6BAA6B,EAAE,WAAW,EAAE,oFAAoF,EAAE;CAC7L,CAAA;AAED,SAAgB,wBAAwB;IACtC,OAAO;QACL,GAAG,EAAE,2BAAmB;QACxB,QAAQ,EAAE,oCAAoC;QAC9C,WAAW,EAAE,wEAAwE;QACrF,QAAQ,EAAE,0FAA0F;QACpG,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9H,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAEpD,mHAAmH;QACnH,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;YAC/B,MAAM,EAAE,eAAe,EAAE,GAAG,wDAAa,8BAA8B,GAAC,CAAA;YACxE,MAAM,GAAG,GAAmB,EAAE,CAAA;YAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;gBAClD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAA;gBACpD,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;oBAC5B,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;oBACZ,SAAQ;gBACV,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAA;gBAC1I,GAAG,CAAC,IAAI,CACN,SAAS,CAAC,SAAS,KAAK,IAAI;oBAC1B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,UAAU,EAAE,oCAAoC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;oBAC/F,CAAC,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM;wBAC5B,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,UAAU,EAAE,kCAAkC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;wBACnI,CAAC,CAAC,EAAE,CACT,CAAA;YACH,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAgB,kBAAkB;IAChC,OAAO,CAAC,yBAAyB,EAAE,EAAE,wBAAwB,EAAE,CAAC,CAAA;AAClE,CAAC","sourcesContent":["/*\n * AI 입력 targets of the access request (ADR-0103 decision 4, docs/design/access-request.md §6).\n *\n * Plain declarations: this package does not depend on @things-factory/ai-assistant. An application that runs\n * the assistant passes them to `registerEntryTarget` and names their keys in a mode.\n *\n * ── The model drafts; a person decides ───────────────────────────────────\n * The model is given a tool that proposes a card. It is never given `decideAccessRequest`. The card's button\n * is pressed by the person, and the assistant then runs the mutation with that person's request state - the\n * door's `@privilege` and the review inside it apply as they do on the list screen.\n *\n * ── One review ────────────────────────────────────────────────────────────\n * `check` is `reviewDecision` - the function the list screen asks (`reviewAccessDecision`) and the decision\n * door runs again. The card cannot say something the screen does not.\n *\n * ⚠ The rows carry colleagues' names and the reasons they wrote, and proposing sends them to an external model.\n * Which product opens these targets is that product's decision.\n */\nimport type { EntryField, EntryIssue, EntryRow, EntryTargetDeclaration } from './entry-target-shape'\n\nexport const AUTH_ACCESS_DECISION = 'auth.access-decision'\nexport const AUTH_ACCESS_REQUEST = 'auth.access-request'\n\nconst PENDING_REQUESTS =\n  'query ($filters: [Filter!], $pagination: Pagination) { accessRequests(filters: $filters, pagination: $pagination) { items { id category privilege state requester { name email } } } }'\n\nconst ROLES_NAMED =\n  'query ($filters: [Filter!], $pagination: Pagination) { roles(filters: $filters, pagination: $pagination) { items { id name } } }'\n\n/** \"김○○ · warehouse:mutation\" - how a request is named on the card. */\nexport function requestLabel(request: any): string {\n  const who = request?.requester?.name || request?.requester?.email || ''\n  return [who, request?.category && request?.privilege ? `${request.category}:${request.privilege}` : ''].filter(Boolean).join(' · ')\n}\n\n/** The pending requests the said text names - by the requester's name or e-mail, or the privilege. Several stay several. */\nexport function requestsNamed(items: any[], said: string): { id: string; label: string }[] {\n  const text = (said || '').trim().toLowerCase()\n  if (!text) return []\n  return (items || [])\n    .filter(item => item?.state === 'PENDING')\n    .filter(item => {\n      if (item.id === said.trim()) return true\n      const names = [item.requester?.name, item.requester?.email, `${item.category}:${item.privilege}`, requestLabel(item)]\n      return names.some(name => typeof name === 'string' && name.toLowerCase().includes(text))\n    })\n    .map(item => ({ id: item.id, label: requestLabel(item) }))\n}\n\n/** A role named exactly - a near name is not taken. */\nexport function rolesNamed(items: any[], said: string): { id: string; label: string }[] {\n  const text = (said || '').trim().toLowerCase()\n  return (items || []).filter(item => typeof item?.name === 'string' && item.name.toLowerCase() === text).map(item => ({ id: item.id, label: item.name }))\n}\n\nconst DECISION_FIELDS: EntryField[] = [\n  {\n    name: 'request',\n    type: 'reference',\n    required: true,\n    labelKey: 'access-request.field.request',\n    description: \"the pending access request, by the requester's name and the privilege asked for\",\n    reference: {\n      query: PENDING_REQUESTS,\n      variables: () => ({ filters: [{ name: 'state', operator: 'eq', value: 'PENDING' }], pagination: { page: 1, limit: 500 } }),\n      recordsOf: (data, said) => requestsNamed(data?.accessRequests?.items ?? [], said)\n    }\n  },\n  {\n    name: 'decision',\n    type: 'enum',\n    required: true,\n    values: ['GRANT', 'DENY'],\n    labelKey: 'access-request.field.decision',\n    valueKeyPrefix: 'access-request.decision.',\n    description: 'GRANT puts the requester into a role; DENY refuses with a reason'\n  },\n  {\n    name: 'role',\n    type: 'reference',\n    labelKey: 'access-request.field.granted role',\n    description:\n      'the role to put the requester into, by its exact name - only for GRANT. Prefer the role with the fewest privileges that still holds the one asked for; the review names a smaller one when there is.',\n    reference: {\n      query: ROLES_NAMED,\n      variables: (said: string) => ({ filters: [{ name: 'name', operator: 'eq', value: said.trim() }], pagination: { page: 1, limit: 20 } }),\n      recordsOf: (data, said) => rolesNamed(data?.roles?.items ?? [], said)\n    }\n  },\n  {\n    name: 'reason',\n    type: 'text',\n    labelKey: 'access-request.field.decision reason',\n    description: 'why - required for DENY. Never written by the model: ask the person.'\n  }\n]\n\nconst idOf = (value: unknown) => (value && typeof value === 'object' && typeof (value as any).id === 'string' ? (value as any).id : undefined)\n\n/** A row as the decision door takes it. */\nexport function decisionOf(row: EntryRow) {\n  const decision = row.values.decision === 'DENY' ? 'DENY' : 'GRANT'\n  return {\n    requestId: idOf(row.values.request),\n    decision,\n    roleId: decision === 'GRANT' ? idOf(row.values.role) : undefined,\n    reason: typeof row.values.reason === 'string' ? row.values.reason : undefined\n  }\n}\n\n/** The review's findings as the card's issues - the words are the screen's (`access-request.issue.<code>`). */\nexport function issuesOf(findings: { code: string; blocking: boolean; field?: string; params?: Record<string, unknown> }[]): EntryIssue[] {\n  return findings.map(finding => ({\n    ...(finding.field && finding.field !== 'decision' ? { field: finding.field } : {}),\n    code: finding.code,\n    messageKey: `access-request.issue.${finding.code}`,\n    params: finding.params,\n    blocking: finding.blocking\n  }))\n}\n\nexport function accessDecisionEntryTarget(): EntryTargetDeclaration {\n  return {\n    key: AUTH_ACCESS_DECISION,\n    labelKey: 'access-request.title.decision draft',\n    description:\n      'one decision on a pending access request: which request, grant or deny, the role to grant with, and the reason to deny.',\n    mutation: 'mutation ($decision: AccessDecisionInput!) { decideAccessRequest(decision: $decision) { id state } }',\n    fields: DECISION_FIELDS,\n    maxRows: 50,\n    variables: row => ({ decision: decisionOf(row) }),\n    appliedOf: (data, row) => ({ id: data?.decideAccessRequest?.id, label: (row.values.request as any)?.label }),\n\n    check: async (rows, { state }) => {\n      const { reviewDecision } = await import('../controllers/access-request.js')\n      const out: EntryIssue[][] = []\n      for (const row of rows) {\n        const decision = decisionOf(row)\n        out.push(decision.requestId ? issuesOf(await reviewDecision(decision as any, { state } as any)) : [])\n      }\n      return out\n    }\n  }\n}\n\nconst REQUEST_FIELDS: EntryField[] = [\n  { name: 'category', type: 'string', required: true, labelKey: 'access-request.field.category', description: 'the category of the privilege, as the refusal named it' },\n  { name: 'privilege', type: 'string', required: true, labelKey: 'access-request.field.privilege', description: 'the privilege, as the refusal named it - query, mutation, ...' },\n  { name: 'reason', type: 'text', required: true, labelKey: 'access-request.field.reason', description: \"why the person needs it, in the person's words - ask them; never write it yourself\" }\n]\n\nexport function accessRequestEntryTarget(): EntryTargetDeclaration {\n  return {\n    key: AUTH_ACCESS_REQUEST,\n    labelKey: 'access-request.title.request draft',\n    description: 'one request for a privilege the person was refused for want of a role.',\n    mutation: 'mutation ($request: NewAccessRequest!) { requestAccess(request: $request) { id count } }',\n    fields: REQUEST_FIELDS,\n    maxRows: 10,\n    variables: row => ({ request: { category: row.values.category, privilege: row.values.privilege, reason: row.values.reason } }),\n    appliedOf: data => ({ id: data?.requestAccess?.id }),\n\n    /* What the door would refuse - asked before the card, so the person is not offered a request that cannot stand. */\n    check: async (rows, { state }) => {\n      const { judgePermission } = await import('../utils/check-permission.js')\n      const out: EntryIssue[][] = []\n      for (const row of rows) {\n        const category = String(row.values.category ?? '')\n        const privilege = String(row.values.privilege ?? '')\n        if (!category || !privilege) {\n          out.push([])\n          continue\n        }\n        const judgement = await judgePermission({ category, privilege }, state?.user, state?.domain, state?.unsafeIP, state?.prohibitedPrivileges)\n        out.push(\n          judgement.permitted === true\n            ? [{ code: 'already-holds', messageKey: 'access-request.issue.already-holds', blocking: true }]\n            : judgement.because !== 'role'\n              ? [{ code: 'not-by-role', messageKey: 'access-request.issue.not-by-role', params: { because: judgement.because }, blocking: true }]\n              : []\n        )\n      }\n      return out\n    }\n  }\n}\n\nexport function accessEntryTargets(): EntryTargetDeclaration[] {\n  return [accessDecisionEntryTarget(), accessRequestEntryTarget()]\n}\n"]}

package/dist-server/ai-entry/entry-target-shape.d.ts

@@ -0,0 +1,82 @@
+export type EntryFieldType = 'string' | 'text' | 'number' | 'integer' | 'date' | 'datetime' | 'boolean' | 'enum' | 'reference';
+export interface EntryReference {
+    query: string;
+    variables(text: string): Record<string, unknown>;
+    recordsOf(data: any, text: string): {
+        id: string;
+        label?: string;
+    }[];
+}
+export interface EntryField {
+    name: string;
+    type: EntryFieldType;
+    required?: boolean;
+    values?: string[];
+    description?: string;
+    labelKey?: string;
+    total?: boolean;
+    valueKeyPrefix?: string;
+    reference?: EntryReference;
+}
+export interface EntryIssue {
+    field?: string;
+    code: string;
+    messageKey?: string;
+    params?: Record<string, unknown>;
+    blocking: boolean;
+}
+export interface EntryRow {
+    index: number;
+    values: Record<string, unknown>;
+    sources: unknown[];
+    issues: EntryIssue[];
+}
+export type EntryRecord = {
+    id: string;
+} & Record<string, unknown>;
+export interface EntryUpdate {
+    read: {
+        query: string;
+        variables(ids: string[]): Record<string, unknown>;
+        recordsOf(data: any, ids: string[]): EntryRecord[];
+    };
+    find?: {
+        query: string;
+        variables(criteria: Record<string, unknown>): Record<string, unknown>;
+        recordsOf(data: any, criteria: Record<string, unknown>): EntryRecord[];
+        criteria: EntryField[];
+    };
+    mutation: string;
+    variables(change: {
+        id: string;
+        record: EntryRecord;
+        values: Record<string, unknown>;
+    }): Record<string, unknown>;
+    labelOf?(record: EntryRecord): string;
+    fields?: string[];
+    /** Read-only checks of the changes, asked when the card is made and again when it is pressed - one issue list per row. */
+    check?(rows: {
+        id: string;
+        record?: EntryRecord;
+        values: Record<string, unknown>;
+    }[], context: {
+        state: any;
+    }): EntryIssue[][] | Promise<EntryIssue[][]>;
+}
+export interface EntryTargetDeclaration {
+    key: string;
+    labelKey: string;
+    description: string;
+    fields: EntryField[];
+    mutation: string;
+    variables(row: EntryRow): Record<string, unknown>;
+    appliedOf?(data: any, row: EntryRow): {
+        id?: string;
+        label?: string;
+    } | undefined;
+    maxRows?: number;
+    check?(rows: EntryRow[], context: {
+        state: any;
+    }): EntryIssue[][] | Promise<EntryIssue[][]>;
+    update?: EntryUpdate;
+}

package/dist-server/ai-entry/entry-target-shape.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=entry-target-shape.js.map

package/dist-server/ai-entry/entry-target-shape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-target-shape.js","sourceRoot":"","sources":["../../server/ai-entry/entry-target-shape.ts"],"names":[],"mappings":"","sourcesContent":["/*\n * The shape of an AI 입력 (data entry) target - the same shape as `EntryTarget` in\n * @things-factory/ai-assistant (server/service/data-entry/entry-target.ts).\n *\n * Kept here as a structural copy (the same one organization keeps) so that this package declares its targets as plain data and does not\n * depend on the assistant at run time. An application that runs the assistant passes these declarations\n * to `registerEntryTarget`; the assistant validates them at boot.\n */\nexport type EntryFieldType = 'string' | 'text' | 'number' | 'integer' | 'date' | 'datetime' | 'boolean' | 'enum' | 'reference'\n\nexport interface EntryReference {\n  query: string\n  variables(text: string): Record<string, unknown>\n  recordsOf(data: any, text: string): { id: string; label?: string }[]\n}\n\nexport interface EntryField {\n  name: string\n  type: EntryFieldType\n  required?: boolean\n  values?: string[]\n  description?: string\n  labelKey?: string\n  total?: boolean\n  valueKeyPrefix?: string\n  reference?: EntryReference\n}\n\nexport interface EntryIssue {\n  field?: string\n  code: string\n  messageKey?: string\n  params?: Record<string, unknown>\n  blocking: boolean\n}\n\nexport interface EntryRow {\n  index: number\n  values: Record<string, unknown>\n  sources: unknown[]\n  issues: EntryIssue[]\n}\n\nexport type EntryRecord = { id: string } & Record<string, unknown>\n\nexport interface EntryUpdate {\n  read: { query: string; variables(ids: string[]): Record<string, unknown>; recordsOf(data: any, ids: string[]): EntryRecord[] }\n  find?: {\n    query: string\n    variables(criteria: Record<string, unknown>): Record<string, unknown>\n    recordsOf(data: any, criteria: Record<string, unknown>): EntryRecord[]\n    criteria: EntryField[]\n  }\n  mutation: string\n  variables(change: { id: string; record: EntryRecord; values: Record<string, unknown> }): Record<string, unknown>\n  labelOf?(record: EntryRecord): string\n  fields?: string[]\n  /** Read-only checks of the changes, asked when the card is made and again when it is pressed - one issue list per row. */\n  check?(rows: { id: string; record?: EntryRecord; values: Record<string, unknown> }[], context: { state: any }): EntryIssue[][] | Promise<EntryIssue[][]>\n}\n\nexport interface EntryTargetDeclaration {\n  key: string\n  labelKey: string\n  description: string\n  fields: EntryField[]\n  mutation: string\n  variables(row: EntryRow): Record<string, unknown>\n  appliedOf?(data: any, row: EntryRow): { id?: string; label?: string } | undefined\n  maxRows?: number\n  check?(rows: EntryRow[], context: { state: any }): EntryIssue[][] | Promise<EntryIssue[][]>\n  update?: EntryUpdate\n}\n"]}

package/dist-server/controllers/access-request.d.ts

@@ -0,0 +1,57 @@
+import { EntityManager } from 'typeorm';
+import { Domain, Refusal } from '@things-factory/shell';
+import { AccessRequest } from '../service/access-request/access-request.js';
+import { Role } from '../service/role/role.js';
+import { AccessDecisionKind, DecisionFacts, DecisionIssue } from '../utils/access-request-review.js';
+export type NewAccessRequestInput = {
+    category: string;
+    privilege: string;
+    operationName?: string;
+    reason?: string;
+};
+export type AccessDecisionInput = {
+    requestId: string;
+    decision: AccessDecisionKind;
+    roleId?: string;
+    reason?: string;
+};
+/** Refuses a decision whose review blocks it - the first blocking issue names the refusal, all codes go along. */
+export declare class AccessDecisionRefused extends Refusal {
+    readonly issues: DecisionIssue[];
+    constructor(issues: DecisionIssue[]);
+}
+/**
+ * The caller asks for `category:privilege` in this domain.
+ *
+ * The server judges again whether a role would open it - the `because` a screen got with its refusal is not
+ * taken on trust (ADR-0103 decision 2). Asking again while one is pending adds to that one.
+ */
+export declare function requestAccess(input: NewAccessRequestInput, context: ResolverContext): Promise<AccessRequest>;
+/** How long a denial is shown back to the person and holds against the same words (questions Q9 · 5). */
+export declare const ACCESS_REQUEST_DENIAL_DAYS = 7;
+/** The latest denial of this person and privilege within ACCESS_REQUEST_DENIAL_DAYS, if any. */
+export declare function latestDenial(domain: Domain, requesterId: string, category: string, privilege: string, now: Date, tx?: EntityManager): Promise<AccessRequest>;
+/** The requester takes back their own pending request. */
+export declare function withdrawAccessRequest(id: string, context: ResolverContext): Promise<AccessRequest>;
+/**
+ * The people who can decide: domain owners and holders of the role-granting privilege - the same pair the
+ * decision door declares (`@privilege(category: "user", privilege: "mutation", domainOwnerGranted: true)`).
+ * The requester is never one of them.
+ */
+export declare function findDeciderIds(domain: Domain, requesterId: string, tx?: EntityManager): Promise<string[]>;
+/** Every assignable role that grants `category:privilege`, smallest first. */
+export declare function rolesGranting(category: string, privilege: string, domain: Domain, tx?: EntityManager): Promise<{
+    id: string;
+    name: string;
+    privilegeCount: number;
+    role: Role;
+}[]>;
+/** The facts `reviewAccessDecision` reads - collected as the person deciding, inside this domain. */
+export declare function collectDecisionFacts(input: AccessDecisionInput, context: ResolverContext): Promise<DecisionFacts>;
+export declare function reviewDecision(input: AccessDecisionInput, context: ResolverContext): Promise<DecisionIssue[]>;
+/**
+ * Grants or denies. The review runs again here - the card and the screen were shown a moment ago, and another
+ * person may have decided since. The state moves PENDING → decided in one conditional update, so two people
+ * deciding at once cannot both win.
+ */
+export declare function decideAccessRequest(input: AccessDecisionInput, context: ResolverContext): Promise<AccessRequest>;