npm - @things-factory/auth-ui - Versions diffs - 10.1.16 → 10.1.18 - Mend

@things-factory/auth-ui 10.1.16 → 10.1.18

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (98) hide show

package/dist-client/pages/domain-owner/domain-owner-management.js CHANGED Viewed

@@ -16,6 +16,7 @@ import { OxPrompt } from '@operato/popup/ox-prompt.js';
 import { CommonHeaderStyles, CommonGristStyles, ScrollbarStyles } from '@operato/styles';
 import { isMobileDevice } from '@operato/utils';
 import { p13n } from '@operato/p13n';
+import { arrayFromResponse, listOutcome } from '../../utils/list-result.js';
 /**
  * Domain Owners Management Page
  *
@@ -29,6 +30,8 @@ let DomainOwnerManagement = class DomainOwnerManagement extends p13n(localize(i1
         this.active = false;
         this.mode = isMobileDevice() ? 'CARD' : 'GRID';
         this.isDomainOwner = false;
+        /** The last fetch did not answer. Distinct from answering with nothing. */
+        this.failed = false;
     }
     static { this.styles = [
         CommonGristStyles,
@@ -44,6 +47,12 @@ let DomainOwnerManagement = class DomainOwnerManagement extends p13n(localize(i1
         overflow-y: auto;
         flex: 1;
       }
+      [failed] {
+        padding: var(--spacing-medium);
+        color: var(--md-sys-color-error);
+        font: var(--label-font, inherit);
+      }
     `
     ]; }
     get context() {
@@ -75,6 +84,8 @@ let DomainOwnerManagement = class DomainOwnerManagement extends p13n(localize(i1
           <ox-context-page-toolbar class="actions" .context=${this.context}></ox-context-page-toolbar>
         </div>
       </ox-grist>
+      ${this.failed ? html `<div failed>${i18next.t('text.the list could not be loaded')}</div>` : ''}
     `;
     }
     async pageInitialized() {
@@ -171,13 +182,25 @@ let DomainOwnerManagement = class DomainOwnerManagement extends p13n(localize(i1
             context: gqlContext(),
             fetchPolicy: 'network-only'
         });
-        const items = (response.data?.domainOwners || []).map((ow) => ({
-            ...ow,
-            userName: ow.user?.name,
-            userEmail: ow.user?.email,
-            grantedByName: ow.grantedBy?.name || ''
-        }));
-        return { total: items.length, records: items };
+        /*
+         * This read `response.data?.domainOwners || []`, which turned a refused query into
+         * "this domain has no owners". That is not a harmless blank: an administrator who
+         * believes it may go and add one, and the screen gave them no reason to doubt it.
+         *
+         * `arrayFromResponse` answers nothing when the server did not, and `failed` says so on
+         * screen beside the empty grid.
+         */
+        const { items, total, failed } = listOutcome(arrayFromResponse(response, 'domainOwners'));
+        this.failed = failed;
+        return {
+            total,
+            records: items.map((ow) => ({
+                ...ow,
+                userName: ow.user?.name,
+                userEmail: ow.user?.email,
+                grantedByName: ow.grantedBy?.name || ''
+            }))
+        };
     }
     _onAddOwner() {
         openPopup(html `
@@ -248,6 +271,10 @@ __decorate([
     state(),
     __metadata("design:type", Boolean)
 ], DomainOwnerManagement.prototype, "isDomainOwner", void 0);
+__decorate([
+    state(),
+    __metadata("design:type", Boolean)
+], DomainOwnerManagement.prototype, "failed", void 0);
 __decorate([
     query('ox-grist'),
     __metadata("design:type", DataGrist)

package/dist-client/pages/domain-owner/domain-owner-management.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"domain-owner-management.js","sourceRoot":"","sources":["../../../client/pages/domain-owner/domain-owner-management.ts"],"names":[],"mappings":";AAAA,OAAO,4BAA4B,CAAA;AACnC,OAAO,yCAAyC,CAAA;AAEhD,OAAO,iCAAiC,CAAA;AACxC,OAAO,6CAA6C,CAAA;AAEpD,OAAO,4CAA4C,CAAA;AAEnD,OAAO,GAAG,MAAM,aAAa,CAAA;AAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAEpC;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAArE;;QAkBwB,WAAM,GAAY,KAAK,CAAA;QAExB,SAAI,GAA6B,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAE9E,kBAAa,GAAY,KAAK,CAAA;IA2MjD,CAAC;aAhOQ,WAAM,GAAG;QACd,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,GAAG,CAAA;;;;;;;;;;KAUF;KACF,AAfY,CAeZ;IAUD,IAAI,OAAO;QACT,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACtC,IAAI,EAAE,oBAAoB;YAC1B,mDAAmD;YACnD,8CAA8C;YAC9C,4CAA4C;YAC5C,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;oBAC9B,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;oBACnC,IAAI,EAAE,YAAY;iBACnB;aACF;YACD,OAAO,EAAE,KAAK;SACf,CAAA;IACH,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAA;;gBAEC,IAAI,CAAC,IAAI;kBACP,IAAI,CAAC,MAAM;wBACL,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;kCACnB,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAE;;;8DAGf,IAAI,CAAC,OAAO;;;KAGrE,CAAA;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC5D,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;gBAC1C;oBACE,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,QAAQ;oBACpB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;oBACvC,QAAQ,EAAE;wBACR,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;4BACrD,yDAAyD;4BACzD,8CAA8C;4BAC9C,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;gCACjB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;qBACF;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;oBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;oBAChC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;oBACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACrC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACrC,KAAK,EAAE,GAAG;iBACX;aACF;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAa,EAAE,UAAe;QAC9C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,mBAAmB,EAAE,CAAA;YAC1B,MAAM,IAAI,CAAC,cAAc,CAAA;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAS,CAAA;QACzC,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAA;IACrD,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,GAAG,CAAA;;;;;;;;;;;;;;;;;;;OAmBT;YACD,OAAO,EAAE,UAAU,EAAE;YACrB,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAA;QAEF,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC;YAClE,GAAG,EAAE;YACL,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI;YACvB,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK;YACzB,aAAa,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;SACxC,CAAC,CAAC,CAAA;QAEH,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IAChD,CAAC;IAEO,WAAW;QACjB,SAAS,CACP,IAAI,CAAA;;gCAEsB,GAAG,EAAE;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAClB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAA;QACjE,CAAC;;OAEJ,EACD;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;SAC3C,CACF,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAW;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAA;QAEjD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE;YACzD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBACnC,QAAQ,EAAE,GAAG,CAAA;;;;SAIZ;gBACD,SAAS,EAAE,EAAE,QAAQ,EAAE;gBACvB,OAAO,EAAE,UAAU,EAAE;aACtB,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAA;gBACjE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC/B,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;gBACjC,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE;aACrD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,QAAQ,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACrG,CAAC;;AA9M4B;IAA5B,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;qDAAwB;AACxB;IAA3B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDAAY;AACX;IAA3B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDAAoE;AAE9E;IAAhB,KAAK,EAAE;;4DAAuC;AAEpB;IAA1B,KAAK,CAAC,UAAU,CAAC;8BAAiB,SAAS;oDAAA;AAxBjC,qBAAqB;IADjC,aAAa,CAAC,yBAAyB,CAAC;GAC5B,qBAAqB,CAiOjC","sourcesContent":["import '@material/web/icon/icon.js'\nimport '@material/web/button/elevated-button.js'\n\nimport '@operato/data-grist/ox-grist.js'\nimport '@operato/context/ox-context-page-toolbar.js'\n\nimport '../../components/add-domain-owner-popup.js'\n\nimport gql from 'graphql-tag'\nimport { css, html } from 'lit'\nimport { customElement, property, query, state } from 'lit/decorators.js'\n\nimport { DataGrist } from '@operato/data-grist/ox-grist.js'\nimport { client, gqlContext } from '@operato/graphql'\nimport { i18next, localize } from '@operato/i18n'\nimport { openPopup } from '@operato/layout'\nimport { PageView, store } from '@operato/shell'\nimport { OxPrompt } from '@operato/popup/ox-prompt.js'\nimport { CommonHeaderStyles, CommonGristStyles, ScrollbarStyles } from '@operato/styles'\nimport { isMobileDevice } from '@operato/utils'\nimport { p13n } from '@operato/p13n'\n\n/*\n Domain Owners Management Page\n \n 현재 도메인의 owner 목록을 표시하고, 추가/제거를 관리한다.\n * 멀티 오너 지원 — 모든 owner는 동등한 권한을 가짐 (primary 없음).\n * Domain.owner legacy cache 필드는 대표 owner 표시용으로 유지됨.\n */\n@customElement('domain-owner-management')\nexport class DomainOwnerManagement extends p13n(localize(i18next)(PageView)) {\n static styles = [\n CommonGristStyles,\n CommonHeaderStyles,\n ScrollbarStyles,\n css`\n :host {\n display: flex;\n flex-direction: column;\n overflow: hidden;\n }\n ox-grist {\n overflow-y: auto;\n flex: 1;\n }\n `\n ]\n\n @property({ type: Boolean }) active: boolean = false\n @property({ type: Object }) config: any\n @property({ type: String }) mode: 'CARD' \| 'LIST' \| 'GRID' = isMobileDevice() ? 'CARD' : 'GRID'\n\n @state() private isDomainOwner: boolean = false\n\n @query('ox-grist') private grist!: DataGrist\n\n get context() {\n return {\n title: i18next.t('text.domain owners'),\n help: 'auth/domain-owners',\n // 서버의 @privilege 가 최종 게이트. 버튼 표시/숨김은 isDomainOwner\n // 클라이언트 플래그에 의존하지 않음 — auth profile 이 해당 플래그를\n // 제대로 세팅 안 했을 때 버튼이 사라져 조작 불가 상태가 되는 것을 방지.\n actions: [\n {\n title: i18next.t('button.add'),\n action: this._onAddOwner.bind(this),\n icon: 'person_add'\n }\n ],\n toolbar: false\n }\n }\n\n render() {\n return html`\n <ox-grist\n .mode=${this.mode}\n .config=${this.config}\n .fetchHandler=${this._fetchHandler.bind(this)}\n .personalConfigProvider=${this.getPagePreferenceProvider('ox-grist')!}\n >\n <div slot=\"headroom\" class=\"header\">\n <ox-context-page-toolbar class=\"actions\" .context=${this.context}></ox-context-page-toolbar>\n </div>\n </ox-grist>\n `\n }\n\n async pageInitialized() {\n this.config = {\n rows: { appendable: false, selectable: { multiple: false } },\n columns: [\n { type: 'gutter', gutterName: 'sequence' },\n {\n type: 'gutter',\n gutterName: 'button',\n icon: 'person_remove',\n title: i18next.t('button.remove owner'),\n handlers: {\n click: (_columns, _data, _column, record, _rowIndex) => {\n // 클라이언트 게이트 없음 — 서버의 @privilege(domainOwnerGranted:true)\n // 가 최종 authoritative. 오너 아니면 서버 에러를 프롬프트로 표시.\n if (record?.user) {\n this._onRemoveOwner(record)\n }\n }\n }\n },\n {\n type: 'string',\n name: 'userName',\n header: i18next.t('field.name'),\n record: { editable: false },\n width: 180\n },\n {\n type: 'string',\n name: 'userEmail',\n header: i18next.t('field.email'),\n record: { editable: false },\n width: 220\n },\n {\n type: 'string',\n name: 'reason',\n header: i18next.t('field.reason'),\n record: { editable: false },\n width: 220\n },\n {\n type: 'string',\n name: 'grantedByName',\n header: i18next.t('field.granted by'),\n record: { editable: false },\n width: 160\n },\n {\n type: 'datetime',\n name: 'grantedAt',\n header: i18next.t('field.granted at'),\n width: 180\n }\n ]\n }\n }\n\n async pageUpdated(_changes: any, _lifecycle: any) {\n if (this.active) {\n this._refreshPermissions()\n await this.updateComplete\n this.grist.fetch()\n }\n }\n\n private _refreshPermissions() {\n const __state__ = store.getState() as any\n const me = __state__.auth?.user \|\| {}\n this.isDomainOwner = !!me.domainOwner \|\| !!me.super\n }\n\n private async _fetchHandler() {\n const response = await client.query({\n query: gql`\n query {\n domainOwners {\n id\n user {\n id\n name\n email\n username\n }\n grantedBy {\n id\n name\n email\n }\n grantedAt\n reason\n }\n }\n `,\n context: gqlContext(),\n fetchPolicy: 'network-only'\n })\n\n const items = (response.data?.domainOwners \|\| []).map((ow: any) => ({\n ...ow,\n userName: ow.user?.name,\n userEmail: ow.user?.email,\n grantedByName: ow.grantedBy?.name \|\| ''\n }))\n\n return { total: items.length, records: items }\n }\n\n private _onAddOwner() {\n openPopup(\n html`\n <add-domain-owner-popup\n @domain-owner-added=${() => {\n this.grist.fetch()\n this._notify(i18next.t('text.domain owner added successfully'))\n }}\n ></add-domain-owner-popup>\n `,\n {\n size: 'small',\n title: i18next.t('title.add domain owner')\n }\n )\n }\n\n private async _onRemoveOwner(record: any) {\n const username = record.user?.username \|\| record.user?.email\n const displayName = record.user?.name \|\| username\n\n const confirmed = await OxPrompt.open({\n type: 'warning',\n title: i18next.t('text.are_you_sure'),\n text: i18next.t('text.are_you_sure_to_remove_domain_owner', { x: displayName }),\n confirmButton: { text: i18next.t('button.remove owner') },\n cancelButton: { text: i18next.t('button.cancel') }\n })\n if (!confirmed) return\n\n try {\n const response = await client.mutate({\n mutation: gql`\n mutation removeDomainOwner($username: String!) {\n removeDomainOwner(username: $username)\n }\n `,\n variables: { username },\n context: gqlContext()\n })\n\n if (!response.errors?.length) {\n this._notify(i18next.t('text.domain owner removed successfully'))\n this.grist.fetch()\n }\n } catch (err: any) {\n await OxPrompt.open({\n type: 'error',\n title: i18next.t('text.failed'),\n text: err?.message \|\| String(err),\n confirmButton: { text: i18next.t('button.confirm') }\n })\n }\n }\n\n private _notify(message: string) {\n document.dispatchEvent(new CustomEvent('notify', { detail: { message, option: { timer: 1500 } } }))\n }\n}\n"]}
1	+ {"version":3,"file":"domain-owner-management.js","sourceRoot":"","sources":["../../../client/pages/domain-owner/domain-owner-management.ts"],"names":[],"mappings":";AAAA,OAAO,4BAA4B,CAAA;AACnC,OAAO,yCAAyC,CAAA;AAEhD,OAAO,iCAAiC,CAAA;AACxC,OAAO,6CAA6C,CAAA;AAEpD,OAAO,4CAA4C,CAAA;AAEnD,OAAO,GAAG,MAAM,aAAa,CAAA;AAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAA;AAC/B,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,iCAAiC,CAAA;AAC3D,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAChD,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AACtD,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAA;AAEpC,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAE3E;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAsB,SAAQ,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC;IAArE;;QAwBwB,WAAM,GAAY,KAAK,CAAA;QAExB,SAAI,GAA6B,cAAc,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAA;QAE9E,kBAAa,GAAY,KAAK,CAAA;QAE/C,2EAA2E;QAC1D,WAAM,GAAY,KAAK,CAAA;IA0N1C,CAAC;aAxPQ,WAAM,GAAG;QACd,iBAAiB;QACjB,kBAAkB;QAClB,eAAe;QACf,GAAG,CAAA;;;;;;;;;;;;;;;;KAgBF;KACF,AArBY,CAqBZ;IAaD,IAAI,OAAO;QACT,OAAO;YACL,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC;YACtC,IAAI,EAAE,oBAAoB;YAC1B,mDAAmD;YACnD,8CAA8C;YAC9C,4CAA4C;YAC5C,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;oBAC9B,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;oBACnC,IAAI,EAAE,YAAY;iBACnB;aACF;YACD,OAAO,EAAE,KAAK;SACf,CAAA;IACH,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAA;;gBAEC,IAAI,CAAC,IAAI;kBACP,IAAI,CAAC,MAAM;wBACL,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;kCACnB,IAAI,CAAC,yBAAyB,CAAC,UAAU,CAAE;;;8DAGf,IAAI,CAAC,OAAO;;;;QAIlE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA,eAAe,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;KAC/F,CAAA;IACH,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,IAAI,CAAC,MAAM,GAAG;YACZ,IAAI,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;YAC5D,OAAO,EAAE;gBACP,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE;gBAC1C;oBACE,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,QAAQ;oBACpB,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;oBACvC,QAAQ,EAAE;wBACR,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;4BACrD,yDAAyD;4BACzD,8CAA8C;4BAC9C,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;gCACjB,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;4BAC7B,CAAC;wBACH,CAAC;qBACF;iBACF;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC;oBAC/B,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;oBAChC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;oBACjC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,eAAe;oBACrB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACrC,MAAM,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;oBAC3B,KAAK,EAAE,GAAG;iBACX;gBACD;oBACE,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,WAAW;oBACjB,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC;oBACrC,KAAK,EAAE,GAAG;iBACX;aACF;SACF,CAAA;IACH,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,QAAa,EAAE,UAAe;QAC9C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,mBAAmB,EAAE,CAAA;YAC1B,MAAM,IAAI,CAAC,cAAc,CAAA;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QACpB,CAAC;IACH,CAAC;IAEO,mBAAmB;QACzB,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,EAAS,CAAA;QACzC,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,CAAA;QACrC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,IAAI,CAAC,CAAC,EAAE,CAAC,KAAK,CAAA;IACrD,CAAC;IAEO,KAAK,CAAC,aAAa;QACzB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;YAClC,KAAK,EAAE,GAAG,CAAA;;;;;;;;;;;;;;;;;;;OAmBT;YACD,OAAO,EAAE,UAAU,EAAE;YACrB,WAAW,EAAE,cAAc;SAC5B,CAAC,CAAA;QAEF;;;;;;;WAOG;QACH,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAA;QAEzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QAEpB,OAAO;YACL,KAAK;YACL,OAAO,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAO,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,EAAE;gBACL,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI;gBACvB,SAAS,EAAE,EAAE,CAAC,IAAI,EAAE,KAAK;gBACzB,aAAa,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE;aACxC,CAAC,CAAC;SACJ,CAAA;IACH,CAAC;IAEO,WAAW;QACjB,SAAS,CACP,IAAI,CAAA;;gCAEsB,GAAG,EAAE;YACzB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YAClB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,sCAAsC,CAAC,CAAC,CAAA;QACjE,CAAC;;OAEJ,EACD;YACE,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,wBAAwB,CAAC;SAC3C,CACF,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAW;QACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,CAAA;QAEjD,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C,EAAE,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;YAC/E,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE;YACzD,YAAY,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE;SACnD,CAAC,CAAA;QACF,IAAI,CAAC,SAAS;YAAE,OAAM;QAEtB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBACnC,QAAQ,EAAE,GAAG,CAAA;;;;SAIZ;gBACD,SAAS,EAAE,EAAE,QAAQ,EAAE;gBACvB,OAAO,EAAE,UAAU,EAAE;aACtB,CAAC,CAAA;YAEF,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAA;gBACjE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,MAAM,QAAQ,CAAC,IAAI,CAAC;gBAClB,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;gBAC/B,IAAI,EAAE,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC;gBACjC,aAAa,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,EAAE;aACrD,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,OAAe;QAC7B,QAAQ,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACrG,CAAC;;AAhO4B;IAA5B,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;qDAAwB;AACxB;IAA3B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDAAY;AACX;IAA3B,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDAAoE;AAE9E;IAAhB,KAAK,EAAE;;4DAAuC;AAG9B;IAAhB,KAAK,EAAE;;qDAAgC;AAEb;IAA1B,KAAK,CAAC,UAAU,CAAC;8BAAiB,SAAS;oDAAA;AAjCjC,qBAAqB;IADjC,aAAa,CAAC,yBAAyB,CAAC;GAC5B,qBAAqB,CAyPjC","sourcesContent":["import '@material/web/icon/icon.js'\nimport '@material/web/button/elevated-button.js'\n\nimport '@operato/data-grist/ox-grist.js'\nimport '@operato/context/ox-context-page-toolbar.js'\n\nimport '../../components/add-domain-owner-popup.js'\n\nimport gql from 'graphql-tag'\nimport { css, html } from 'lit'\nimport { customElement, property, query, state } from 'lit/decorators.js'\n\nimport { DataGrist } from '@operato/data-grist/ox-grist.js'\nimport { client, gqlContext } from '@operato/graphql'\nimport { i18next, localize } from '@operato/i18n'\nimport { openPopup } from '@operato/layout'\nimport { PageView, store } from '@operato/shell'\nimport { OxPrompt } from '@operato/popup/ox-prompt.js'\nimport { CommonHeaderStyles, CommonGristStyles, ScrollbarStyles } from '@operato/styles'\nimport { isMobileDevice } from '@operato/utils'\nimport { p13n } from '@operato/p13n'\n\nimport { arrayFromResponse, listOutcome } from '../../utils/list-result.js'\n\n/*\n Domain Owners Management Page\n \n 현재 도메인의 owner 목록을 표시하고, 추가/제거를 관리한다.\n * 멀티 오너 지원 — 모든 owner는 동등한 권한을 가짐 (primary 없음).\n * Domain.owner legacy cache 필드는 대표 owner 표시용으로 유지됨.\n /\n@customElement('domain-owner-management')\nexport class DomainOwnerManagement extends p13n(localize(i18next)(PageView)) {\n static styles = [\n CommonGristStyles,\n CommonHeaderStyles,\n ScrollbarStyles,\n css`\n :host {\n display: flex;\n flex-direction: column;\n overflow: hidden;\n }\n ox-grist {\n overflow-y: auto;\n flex: 1;\n }\n\n [failed] {\n padding: var(--spacing-medium);\n color: var(--md-sys-color-error);\n font: var(--label-font, inherit);\n }\n `\n ]\n\n @property({ type: Boolean }) active: boolean = false\n @property({ type: Object }) config: any\n @property({ type: String }) mode: 'CARD' \| 'LIST' \| 'GRID' = isMobileDevice() ? 'CARD' : 'GRID'\n\n @state() private isDomainOwner: boolean = false\n\n /* The last fetch did not answer. Distinct from answering with nothing. /\n @state() private failed: boolean = false\n\n @query('ox-grist') private grist!: DataGrist\n\n get context() {\n return {\n title: i18next.t('text.domain owners'),\n help: 'auth/domain-owners',\n // 서버의 @privilege 가 최종 게이트. 버튼 표시/숨김은 isDomainOwner\n // 클라이언트 플래그에 의존하지 않음 — auth profile 이 해당 플래그를\n // 제대로 세팅 안 했을 때 버튼이 사라져 조작 불가 상태가 되는 것을 방지.\n actions: [\n {\n title: i18next.t('button.add'),\n action: this._onAddOwner.bind(this),\n icon: 'person_add'\n }\n ],\n toolbar: false\n }\n }\n\n render() {\n return html`\n <ox-grist\n .mode=${this.mode}\n .config=${this.config}\n .fetchHandler=${this._fetchHandler.bind(this)}\n .personalConfigProvider=${this.getPagePreferenceProvider('ox-grist')!}\n >\n <div slot=\"headroom\" class=\"header\">\n <ox-context-page-toolbar class=\"actions\" .context=${this.context}></ox-context-page-toolbar>\n </div>\n </ox-grist>\n\n ${this.failed ? html`<div failed>${i18next.t('text.the list could not be loaded')}</div>` : ''}\n `\n }\n\n async pageInitialized() {\n this.config = {\n rows: { appendable: false, selectable: { multiple: false } },\n columns: [\n { type: 'gutter', gutterName: 'sequence' },\n {\n type: 'gutter',\n gutterName: 'button',\n icon: 'person_remove',\n title: i18next.t('button.remove owner'),\n handlers: {\n click: (_columns, _data, _column, record, _rowIndex) => {\n // 클라이언트 게이트 없음 — 서버의 @privilege(domainOwnerGranted:true)\n // 가 최종 authoritative. 오너 아니면 서버 에러를 프롬프트로 표시.\n if (record?.user) {\n this._onRemoveOwner(record)\n }\n }\n }\n },\n {\n type: 'string',\n name: 'userName',\n header: i18next.t('field.name'),\n record: { editable: false },\n width: 180\n },\n {\n type: 'string',\n name: 'userEmail',\n header: i18next.t('field.email'),\n record: { editable: false },\n width: 220\n },\n {\n type: 'string',\n name: 'reason',\n header: i18next.t('field.reason'),\n record: { editable: false },\n width: 220\n },\n {\n type: 'string',\n name: 'grantedByName',\n header: i18next.t('field.granted by'),\n record: { editable: false },\n width: 160\n },\n {\n type: 'datetime',\n name: 'grantedAt',\n header: i18next.t('field.granted at'),\n width: 180\n }\n ]\n }\n }\n\n async pageUpdated(_changes: any, _lifecycle: any) {\n if (this.active) {\n this._refreshPermissions()\n await this.updateComplete\n this.grist.fetch()\n }\n }\n\n private _refreshPermissions() {\n const __state__ = store.getState() as any\n const me = __state__.auth?.user \|\| {}\n this.isDomainOwner = !!me.domainOwner \|\| !!me.super\n }\n\n private async _fetchHandler() {\n const response = await client.query({\n query: gql`\n query {\n domainOwners {\n id\n user {\n id\n name\n email\n username\n }\n grantedBy {\n id\n name\n email\n }\n grantedAt\n reason\n }\n }\n `,\n context: gqlContext(),\n fetchPolicy: 'network-only'\n })\n\n /\n * This read `response.data?.domainOwners \|\| []`, which turned a refused query into\n * \"this domain has no owners\". That is not a harmless blank: an administrator who\n * believes it may go and add one, and the screen gave them no reason to doubt it.\n \n `arrayFromResponse` answers nothing when the server did not, and `failed` says so on\n * screen beside the empty grid.\n */\n const { items, total, failed } = listOutcome(arrayFromResponse(response, 'domainOwners'))\n\n this.failed = failed\n\n return {\n total,\n records: items.map((ow: any) => ({\n ...ow,\n userName: ow.user?.name,\n userEmail: ow.user?.email,\n grantedByName: ow.grantedBy?.name \|\| ''\n }))\n }\n }\n\n private _onAddOwner() {\n openPopup(\n html`\n <add-domain-owner-popup\n @domain-owner-added=${() => {\n this.grist.fetch()\n this._notify(i18next.t('text.domain owner added successfully'))\n }}\n ></add-domain-owner-popup>\n `,\n {\n size: 'small',\n title: i18next.t('title.add domain owner')\n }\n )\n }\n\n private async _onRemoveOwner(record: any) {\n const username = record.user?.username \|\| record.user?.email\n const displayName = record.user?.name \|\| username\n\n const confirmed = await OxPrompt.open({\n type: 'warning',\n title: i18next.t('text.are_you_sure'),\n text: i18next.t('text.are_you_sure_to_remove_domain_owner', { x: displayName }),\n confirmButton: { text: i18next.t('button.remove owner') },\n cancelButton: { text: i18next.t('button.cancel') }\n })\n if (!confirmed) return\n\n try {\n const response = await client.mutate({\n mutation: gql`\n mutation removeDomainOwner($username: String!) {\n removeDomainOwner(username: $username)\n }\n `,\n variables: { username },\n context: gqlContext()\n })\n\n if (!response.errors?.length) {\n this._notify(i18next.t('text.domain owner removed successfully'))\n this.grist.fetch()\n }\n } catch (err: any) {\n await OxPrompt.open({\n type: 'error',\n title: i18next.t('text.failed'),\n text: err?.message \|\| String(err),\n confirmButton: { text: i18next.t('button.confirm') }\n })\n }\n }\n\n private _notify(message: string) {\n document.dispatchEvent(new CustomEvent('notify', { detail: { message, option: { timer: 1500 } } }))\n }\n}\n"]}

package/dist-client/pages/secrets-are-not-printed.test.d.ts ADDED Viewed

	@@ -0,0 +1 @@
1	+ export {};

package/dist-client/pages/secrets-are-not-printed.test.js ADDED Viewed

@@ -0,0 +1,88 @@
+import { readdirSync, readFileSync, statSync } from 'fs';
+import { join } from 'path';
+/**
+ * No auth screen prints a credential into a plain input.
+ *
+ * Three of them did, from the moment the page loaded: the binding detail showed an access
+ * token and a refresh token, the appliance detail showed an access token, the application
+ * detail showed its client secret. `secret-field` replaced all four — masked, copyable
+ * without revealing, revealed only when the reader asks.
+ *
+ * This is worth a test rather than a habit because the wrong version is the natural one to
+ * write. A readonly input beside a copy button is what a credential looks like in every
+ * other admin console anyone has seen, it reviews cleanly, and nothing in the build objects.
+ *
+ * ⚠ Comments are stripped first — the prose here and in those screens names every field this
+ * searches for, explaining why they are absent.
+ *
+ * ⚠ **The scan covers `components/` as well as `pages/`, and that is the whole point.** The
+ * three screens named above moved into popups under `components/` when the register and detail
+ * routes were removed. A scan rooted at `pages/` went on passing afterwards — not because the
+ * rule held, but because everything it was written to watch had walked out of its range. The
+ * search has to follow the credentials, not the folder they used to live in.
+ */
+const SECRETS = ['appSecret', 'refreshToken', 'clientSecret', 'privateKey', 'accessToken'];
+/** Everywhere an auth screen can live: the routed pages and the popups they open. */
+const SCREENS = [join(__dirname), join(__dirname, '..', 'components')];
+function tsFilesUnder(dir) {
+    return readdirSync(dir).flatMap(entry => {
+        const path = join(dir, entry);
+        if (statSync(path).isDirectory()) {
+            return tsFilesUnder(path);
+        }
+        return entry.endsWith('.ts') && !entry.endsWith('.test.ts') ? [path] : [];
+    });
+}
+function sourceOf(path) {
+    return readFileSync(path, 'utf-8')
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .replace(/^[ \t]*\/\/.*$/gm, '')
+        .replace(/<!--[\s\S]*?-->/g, '');
+}
+describe('auth screens', () => {
+    it('never bind a credential into a plain input', () => {
+        const offenders = [];
+        for (const path of SCREENS.flatMap(tsFilesUnder)) {
+            const source = sourceOf(path);
+            for (const secret of SECRETS) {
+                /*
+                 * An `<input>` whose value expression ends at the secret's name. The trailing
+                 * boundary matters: `accessTokenUrl` is an endpoint, not a credential, and an
+                 * earlier version of this search flagged it.
+                 */
+                const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\b${secret}\\b(?!Url)[^}]*\\}`);
+                if (bound.test(source)) {
+                    offenders.push(`${path.split('/client/')[1]} — ${secret}`);
+                }
+            }
+        }
+        expect(offenders).toEqual([]);
+    });
+    it('still knows what it is looking for', () => {
+        /*
+         * A search that matches nothing passes whether the screens are clean or the pattern is
+         * broken. This proves the pattern finds the shape it is meant to find, so a green run
+         * above means the screens are clean rather than the regex is dead.
+         */
+        const sample = '<input id="x" type="text" .value=${app.appSecret} readonly />';
+        const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\bappSecret\\b(?!Url)[^}]*\\}`);
+        expect(bound.test(sample)).toBe(true);
+    });
+    it('looks at the popups, not only the routed pages', () => {
+        /*
+         * The case that would have caught the silent green. `appliance-editor`, `application-editor`
+         * and `app-binding-detail` are where the credentials are shown now; a scan that cannot see
+         * them proves nothing about them.
+         */
+        const scanned = SCREENS.flatMap(tsFilesUnder);
+        for (const screen of ['appliance-editor.ts', 'application-editor.ts', 'app-binding-detail.ts']) {
+            expect(scanned.some(path => path.endsWith(screen))).toBe(true);
+        }
+    });
+    it('does not mistake an endpoint for a credential', () => {
+        const sample = '<input id="x" type="text" .value=${app.accessTokenUrl} readonly />';
+        const bound = new RegExp(`<input[^>]*\\.value=\\$\\{[^}]*\\baccessToken\\b(?!Url)[^}]*\\}`);
+        expect(bound.test(sample)).toBe(false);
+    });
+});
+//# sourceMappingURL=secrets-are-not-printed.test.js.map

package/dist-client/pages/secrets-are-not-printed.test.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"secrets-are-not-printed.test.js","sourceRoot":"","sources":["../../client/pages/secrets-are-not-printed.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,OAAO,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;AAE1F,qFAAqF;AACrF,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAA;AAEtE,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAE7B,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YACjC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,OAAO,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;SAC/B,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC;SAChC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;SAC/B,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAA;AACpC,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,SAAS,GAAa,EAAE,CAAA;QAE9B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;YAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B;;;;mBAIG;gBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,qCAAqC,MAAM,oBAAoB,CAAC,CAAA;gBAEzF,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;oBACvB,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAA;gBAC5D,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C;;;;WAIG;QACH,MAAM,MAAM,GAAG,+DAA+D,CAAA;QAC9E,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,+DAA+D,CAAC,CAAA;QAEzF,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD;;;;WAIG;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QAE7C,KAAK,MAAM,MAAM,IAAI,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,uBAAuB,CAAC,EAAE,CAAC;YAC/F,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,oEAAoE,CAAA;QACnF,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iEAAiE,CAAC,CAAA;QAE3F,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readdirSync, readFileSync, statSync } from 'fs'\nimport { join } from 'path'\n\n/**\n * No auth screen prints a credential into a plain input.\n *\n * Three of them did, from the moment the page loaded: the binding detail showed an access\n * token and a refresh token, the appliance detail showed an access token, the application\n * detail showed its client secret. `secret-field` replaced all four — masked, copyable\n * without revealing, revealed only when the reader asks.\n *\n * This is worth a test rather than a habit because the wrong version is the natural one to\n * write. A readonly input beside a copy button is what a credential looks like in every\n * other admin console anyone has seen, it reviews cleanly, and nothing in the build objects.\n *\n * ⚠ Comments are stripped first — the prose here and in those screens names every field this\n * searches for, explaining why they are absent.\n *\n * ⚠ **The scan covers `components/` as well as `pages/`, and that is the whole point.** The\n * three screens named above moved into popups under `components/` when the register and detail\n * routes were removed. A scan rooted at `pages/` went on passing afterwards — not because the\n * rule held, but because everything it was written to watch had walked out of its range. The\n * search has to follow the credentials, not the folder they used to live in.\n */\n\nconst SECRETS = ['appSecret', 'refreshToken', 'clientSecret', 'privateKey', 'accessToken']\n\n/** Everywhere an auth screen can live: the routed pages and the popups they open. */\nconst SCREENS = [join(__dirname), join(__dirname, '..', 'components')]\n\nfunction tsFilesUnder(dir: string): string[] {\n return readdirSync(dir).flatMap(entry => {\n const path = join(dir, entry)\n\n if (statSync(path).isDirectory()) {\n return tsFilesUnder(path)\n }\n\n return entry.endsWith('.ts') && !entry.endsWith('.test.ts') ? [path] : []\n })\n}\n\nfunction sourceOf(path: string): string {\n return readFileSync(path, 'utf-8')\n .replace(/\\/\\*[\\s\\S]*?\\*\\//g, '')\n .replace(/^[ \\t]*\\/\\/.*$/gm, '')\n .replace(//g, '')\n}\n\ndescribe('auth screens', () => {\n it('never bind a credential into a plain input', () => {\n const offenders: string[] = []\n\n for (const path of SCREENS.flatMap(tsFilesUnder)) {\n const source = sourceOf(path)\n\n for (const secret of SECRETS) {\n /*\n * An `<input>` whose value expression ends at the secret's name. The trailing\n * boundary matters: `accessTokenUrl` is an endpoint, not a credential, and an\n * earlier version of this search flagged it.\n */\n const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\b${secret}\\\\b(?!Url)[^}]*\\\\}`)\n\n if (bound.test(source)) {\n offenders.push(`${path.split('/client/')[1]} — ${secret}`)\n }\n }\n }\n\n expect(offenders).toEqual([])\n })\n\n it('still knows what it is looking for', () => {\n /*\n * A search that matches nothing passes whether the screens are clean or the pattern is\n * broken. This proves the pattern finds the shape it is meant to find, so a green run\n * above means the screens are clean rather than the regex is dead.\n */\n const sample = '<input id=\"x\" type=\"text\" .value=${app.appSecret} readonly />'\n const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\bappSecret\\\\b(?!Url)[^}]*\\\\}`)\n\n expect(bound.test(sample)).toBe(true)\n })\n\n it('looks at the popups, not only the routed pages', () => {\n /*\n * The case that would have caught the silent green. `appliance-editor`, `application-editor`\n * and `app-binding-detail` are where the credentials are shown now; a scan that cannot see\n * them proves nothing about them.\n */\n const scanned = SCREENS.flatMap(tsFilesUnder)\n\n for (const screen of ['appliance-editor.ts', 'application-editor.ts', 'app-binding-detail.ts']) {\n expect(scanned.some(path => path.endsWith(screen))).toBe(true)\n }\n })\n\n it('does not mistake an endpoint for a credential', () => {\n const sample = '<input id=\"x\" type=\"text\" .value=${app.accessTokenUrl} readonly />'\n const bound = new RegExp(`<input[^>]*\\\\.value=\\\\$\\\\{[^}]*\\\\baccessToken\\\\b(?!Url)[^}]*\\\\}`)\n\n expect(bound.test(sample)).toBe(false)\n })\n})\n"]}

package/dist-client/route.js CHANGED Viewed

@@ -6,30 +6,15 @@ export default function route(page) {
             /* webpackChunkName: "profile" */
             './pages/profile.js');
             return page;
-        case 'appliance-register':
-            import('./pages/appliance/register');
-            return page;
-        case 'application':
-            import('./pages/application/application');
-            return page;
         case 'applications':
             import('./pages/application/applications');
             return page;
-        case 'application-register':
-            import('./pages/application/register');
-            return page;
         case 'app-bindings':
             import('./pages/app-binding/app-bindings');
             return page;
-        case 'app-binding':
-            import('./pages/app-binding/app-binding');
-            return page;
         case 'appliance-home':
             import('./pages/appliance/home');
             return page;
-        case 'appliance':
-            import('./pages/appliance/appliance');
-            return page;
         case 'roles':
             import('./pages/role/role-list-page');
             return page;

package/dist-client/route.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"route.js","sourceRoot":"","sources":["../client/route.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,OAAO,UAAU,KAAK,CAAC,IAAI;IAChC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,MAAM;YACJ,2BAA2B;YAC3B,iCAAiC;YACjC,oBAAoB,CACrB,CAAA;YACD,OAAO,IAAI,CAAA;QAEb,KAAK,~~oBAAoB;YACvB,MAAM,CAAC,4BAA4B,CAAC,CAAA;YACpC,OAAO,IAAI,CAAA;QAEb,KAAK,aAAa;YAChB,MAAM,CAAC,iCAAiC,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QAEb,KAAK,~~cAAc;YACjB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,~~sBAAsB;YACzB,MAAM,CAAC,8BAA8B,CAAC,CAAA;YACtC,OAAO,IAAI,CAAA;QAEb,KAAK,~~cAAc;YACjB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,~~aAAa;YAChB,MAAM,CAAC,iCAAiC,CAAC,CAAA;YACzC,OAAO,IAAI,CAAA;QAEb,KAAK,~~gBAAgB;YACnB,MAAM,CAAC,wBAAwB,CAAC,CAAA;YAChC,OAAO,IAAI,CAAA;QAEb,KAAK,~~WAAW;YACd,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACrC,~~OAAO~~,IAAI,CAAA~~;~~QAEb,KAAK,OAAO;~~YACV,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACrC,OAAO,IAAI,CAAA;QAEb,KAAK,iBAAiB;YACpB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,OAAO;YACV,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACrC,OAAO,IAAI,CAAA;QAEb,KAAK,UAAU;YACb,MAAM,CAAC,oCAAoC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QAEb,KAAK,SAAS;YACZ,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,eAAe;YAClB,MAAM,CAAC,8CAA8C,CAAC,CAAA;YACtD,OAAO,IAAI,CAAA;QAEb,KAAK,UAAU;YACb,MAAM,CAAC,mCAAmC,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAA;QAEb,KAAK,YAAY;YACf,MAAM,CAAC,+CAA+C,CAAC,CAAA;YACvD,OAAO,IAAI,CAAA;QAEb,KAAK,gBAAgB;YACnB,MAAM,CAAC,mDAAmD,CAAC,CAAA;YAC3D,OAAO,IAAI,CAAA;QAEb,KAAK,cAAc;YACjB,MAAM,CAAC,+CAA+C,CAAC,CAAA;YACvD,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC","sourcesContent":["export default function route(page) {\n switch (page) {\n case 'profile':\n import(\n /* webpackPrefetch: true /\n / webpackChunkName: \"profile\" */\n './pages/profile.js'\n )\n return page\n\n case '~~appliance-register':\n import('./pages/appliance/register')\n return page\n\n case 'application':\n import('./pages/application/application')\n return page\n\n case '~~applications':\n import('./pages/application/applications')\n return page\n\n case '~~application-register':\n import('./pages/application/register')\n return page\n\n case '~~app-bindings':\n import('./pages/app-binding/app-bindings')\n return page\n\n case '~~app-binding':\n import('./pages/app-binding/app-binding')\n return page\n\n case '~~appliance-home':\n import('./pages/appliance/home')\n return page\n\n case '~~appliance':\n import('./pages/appliance/appliance')\n return page\n\n case '~~roles':\n import('./pages/role/role-list-page')\n return page\n\n case 'role-privileges':\n import('./pages/role/role-privilege-page')\n return page\n\n case 'users':\n import('./pages/user/user-list-page')\n return page\n\n case 'partners':\n import('./pages/partner/partner-management')\n return page\n\n case 'domains':\n import('./pages/domain/domain-management')\n return page\n\n case 'domain-owners':\n import('./pages/domain-owner/domain-owner-management')\n return page\n\n case 'env-vars':\n import('./pages/env-var/env-var-list-page')\n return page\n\n case 'attributes':\n import('./pages/attribute/attribute-set-management.js')\n return page\n\n case 'auth-providers':\n import('./pages/auth-provider/auth-provider-management.js')\n return page\n\n case 'domain-links':\n import('./pages/domain-link/domain-link-management.js')\n return page\n }\n}\n"]}
1	+ {"version":3,"file":"route.js","sourceRoot":"","sources":["../client/route.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,OAAO,UAAU,KAAK,CAAC,IAAI;IAChC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,MAAM;YACJ,2BAA2B;YAC3B,iCAAiC;YACjC,oBAAoB,CACrB,CAAA;YACD,OAAO,IAAI,CAAA;QAEb,KAAK,cAAc;YACjB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,cAAc;YACjB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,gBAAgB;YACnB,MAAM,CAAC,wBAAwB,CAAC,CAAA;YAChC,OAAO,IAAI,CAAA;QAEb,KAAK,OAAO;YACV,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACrC,OAAO,IAAI,CAAA;QAEb,KAAK,iBAAiB;YACpB,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,OAAO;YACV,MAAM,CAAC,6BAA6B,CAAC,CAAA;YACrC,OAAO,IAAI,CAAA;QAEb,KAAK,UAAU;YACb,MAAM,CAAC,oCAAoC,CAAC,CAAA;YAC5C,OAAO,IAAI,CAAA;QAEb,KAAK,SAAS;YACZ,MAAM,CAAC,kCAAkC,CAAC,CAAA;YAC1C,OAAO,IAAI,CAAA;QAEb,KAAK,eAAe;YAClB,MAAM,CAAC,8CAA8C,CAAC,CAAA;YACtD,OAAO,IAAI,CAAA;QAEb,KAAK,UAAU;YACb,MAAM,CAAC,mCAAmC,CAAC,CAAA;YAC3C,OAAO,IAAI,CAAA;QAEb,KAAK,YAAY;YACf,MAAM,CAAC,+CAA+C,CAAC,CAAA;YACvD,OAAO,IAAI,CAAA;QAEb,KAAK,gBAAgB;YACnB,MAAM,CAAC,mDAAmD,CAAC,CAAA;YAC3D,OAAO,IAAI,CAAA;QAEb,KAAK,cAAc;YACjB,MAAM,CAAC,+CAA+C,CAAC,CAAA;YACvD,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC","sourcesContent":["export default function route(page) {\n switch (page) {\n case 'profile':\n import(\n /* webpackPrefetch: true /\n / webpackChunkName: \"profile\" */\n './pages/profile.js'\n )\n return page\n\n case 'applications':\n import('./pages/application/applications')\n return page\n\n case 'app-bindings':\n import('./pages/app-binding/app-bindings')\n return page\n\n case 'appliance-home':\n import('./pages/appliance/home')\n return page\n\n case 'roles':\n import('./pages/role/role-list-page')\n return page\n\n case 'role-privileges':\n import('./pages/role/role-privilege-page')\n return page\n\n case 'users':\n import('./pages/user/user-list-page')\n return page\n\n case 'partners':\n import('./pages/partner/partner-management')\n return page\n\n case 'domains':\n import('./pages/domain/domain-management')\n return page\n\n case 'domain-owners':\n import('./pages/domain-owner/domain-owner-management')\n return page\n\n case 'env-vars':\n import('./pages/env-var/env-var-list-page')\n return page\n\n case 'attributes':\n import('./pages/attribute/attribute-set-management.js')\n return page\n\n case 'auth-providers':\n import('./pages/auth-provider/auth-provider-management.js')\n return page\n\n case 'domain-links':\n import('./pages/domain-link/domain-link-management.js')\n return page\n }\n}\n"]}