@things-factory/auth-ui 10.1.31 → 10.1.33

package/dist-client/utils/credential-panel-state.d.ts

@@ -0,0 +1,51 @@
+/**
+ * What the appliance credential panel shows, as rules rather than as template conditions.
+ *
+ * ## Why these are not left inline
+ *
+ * Both of them decide whether a control that **takes a credential away** is on the screen, and
+ * both lean on a value that can be absent. Absence is where this goes wrong: a query that has
+ * not answered yet, a field the caller forgot to ask for, a refusal that arrives as data rather
+ * than as a throw. Each of those has to land on "no button" and not on "button", because the
+ * failure directions are not equal — a missing button is a feature somebody has to go and turn
+ * on, and a button that refuses when pressed is a product that looks broken.
+ *
+ * The template can then read as a template.
+ */
+/** The shape of an Apollo result, as much of it as these rules read. */
+type QueryResult = {
+    errors?: unknown;
+    data?: {
+        applianceCredentialRevocable?: boolean | null;
+    } | null;
+};
+/** The part of an appliance these rules read. */
+type CredentialPanelSubject = {
+    credentialRevoked?: boolean | null;
+} | null | undefined;
+/**
+ * Does revoking work here, for this reader?
+ *
+ * `errorPolicy: 'all'` hands a refusal back as `errors` instead of throwing, and a reader who
+ * may list appliances but may not act on their credentials is refused exactly there. That reads
+ * the same as a plain `false` — no button either way — so both come back as `false` rather than
+ * as something the caller has to tell apart.
+ */
+export declare function readRevocable(response: QueryResult | null | undefined): boolean;
+/**
+ * Is the revoke button on the panel?
+ *
+ * Only where revoking works and the credential has not already been taken away. Pressing it on
+ * an already-revoked appliance would move the serial a second time and change nothing a reader
+ * can see, which reads as the first press not having worked.
+ */
+export declare function showsRevokeButton(revocable: boolean, appliance: CredentialPanelSubject): boolean;
+/**
+ * Does the panel say this credential was revoked?
+ *
+ * Independent of the switch. Turning revocation off later does not un-revoke what was revoked
+ * (ADR-0085 decision 2), so an installation that changes its mind must not be shown a blank box
+ * where a revoked credential is.
+ */
+export declare function showsRevokedNote(appliance: CredentialPanelSubject): boolean;
+export {};

package/dist-client/utils/credential-panel-state.js

@@ -0,0 +1,49 @@
+/**
+ * What the appliance credential panel shows, as rules rather than as template conditions.
+ *
+ * ## Why these are not left inline
+ *
+ * Both of them decide whether a control that **takes a credential away** is on the screen, and
+ * both lean on a value that can be absent. Absence is where this goes wrong: a query that has
+ * not answered yet, a field the caller forgot to ask for, a refusal that arrives as data rather
+ * than as a throw. Each of those has to land on "no button" and not on "button", because the
+ * failure directions are not equal — a missing button is a feature somebody has to go and turn
+ * on, and a button that refuses when pressed is a product that looks broken.
+ *
+ * The template can then read as a template.
+ */
+/**
+ * Does revoking work here, for this reader?
+ *
+ * `errorPolicy: 'all'` hands a refusal back as `errors` instead of throwing, and a reader who
+ * may list appliances but may not act on their credentials is refused exactly there. That reads
+ * the same as a plain `false` — no button either way — so both come back as `false` rather than
+ * as something the caller has to tell apart.
+ */
+export function readRevocable(response) {
+    if (!response || response.errors) {
+        return false;
+    }
+    return response.data?.applianceCredentialRevocable === true;
+}
+/**
+ * Is the revoke button on the panel?
+ *
+ * Only where revoking works and the credential has not already been taken away. Pressing it on
+ * an already-revoked appliance would move the serial a second time and change nothing a reader
+ * can see, which reads as the first press not having worked.
+ */
+export function showsRevokeButton(revocable, appliance) {
+    return revocable && !appliance?.credentialRevoked;
+}
+/**
+ * Does the panel say this credential was revoked?
+ *
+ * Independent of the switch. Turning revocation off later does not un-revoke what was revoked
+ * (ADR-0085 decision 2), so an installation that changes its mind must not be shown a blank box
+ * where a revoked credential is.
+ */
+export function showsRevokedNote(appliance) {
+    return !!appliance?.credentialRevoked;
+}
+//# sourceMappingURL=credential-panel-state.js.map

package/dist-client/utils/credential-panel-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-panel-state.js","sourceRoot":"","sources":["../../client/utils/credential-panel-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAaH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwC;IACpE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,EAAE,4BAA4B,KAAK,IAAI,CAAA;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAkB,EAAE,SAAiC;IACrF,OAAO,SAAS,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAA;AACnD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiC;IAChE,OAAO,CAAC,CAAC,SAAS,EAAE,iBAAiB,CAAA;AACvC,CAAC","sourcesContent":["/**\n * What the appliance credential panel shows, as rules rather than as template conditions.\n *\n * ## Why these are not left inline\n *\n * Both of them decide whether a control that **takes a credential away** is on the screen, and\n * both lean on a value that can be absent. Absence is where this goes wrong: a query that has\n * not answered yet, a field the caller forgot to ask for, a refusal that arrives as data rather\n * than as a throw. Each of those has to land on \"no button\" and not on \"button\", because the\n * failure directions are not equal — a missing button is a feature somebody has to go and turn\n * on, and a button that refuses when pressed is a product that looks broken.\n *\n * The template can then read as a template.\n */\n\n/** The shape of an Apollo result, as much of it as these rules read. */\ntype QueryResult = {\n  errors?: unknown\n  data?: { applianceCredentialRevocable?: boolean | null } | null\n}\n\n/** The part of an appliance these rules read. */\ntype CredentialPanelSubject = {\n  credentialRevoked?: boolean | null\n} | null | undefined\n\n/**\n * Does revoking work here, for this reader?\n *\n * `errorPolicy: 'all'` hands a refusal back as `errors` instead of throwing, and a reader who\n * may list appliances but may not act on their credentials is refused exactly there. That reads\n * the same as a plain `false` — no button either way — so both come back as `false` rather than\n * as something the caller has to tell apart.\n */\nexport function readRevocable(response: QueryResult | null | undefined): boolean {\n  if (!response || response.errors) {\n    return false\n  }\n\n  return response.data?.applianceCredentialRevocable === true\n}\n\n/**\n * Is the revoke button on the panel?\n *\n * Only where revoking works and the credential has not already been taken away. Pressing it on\n * an already-revoked appliance would move the serial a second time and change nothing a reader\n * can see, which reads as the first press not having worked.\n */\nexport function showsRevokeButton(revocable: boolean, appliance: CredentialPanelSubject): boolean {\n  return revocable && !appliance?.credentialRevoked\n}\n\n/**\n * Does the panel say this credential was revoked?\n *\n * Independent of the switch. Turning revocation off later does not un-revoke what was revoked\n * (ADR-0085 decision 2), so an installation that changes its mind must not be shown a blank box\n * where a revoked credential is.\n */\nexport function showsRevokedNote(appliance: CredentialPanelSubject): boolean {\n  return !!appliance?.credentialRevoked\n}\n"]}

package/dist-client/utils/credential-panel-state.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/credential-panel-state.test.js

@@ -0,0 +1,88 @@
+import { readRevocable, showsRevokeButton, showsRevokedNote } from './credential-panel-state';
+/**
+ * The two rules that decide whether a control for taking a credential away is on the screen.
+ *
+ * Most of these are about absence, because that is where the rule can fall the wrong way: a
+ * query that has not answered, a field nobody asked for, a refusal that arrives as data. The
+ * two directions are not equally bad — a missing button is a feature to turn on, a button that
+ * refuses when pressed is a product that looks broken — so every absent case has to land on
+ * "no button".
+ */
+describe('does revoking work here', () => {
+    it('yes only for a plain true', () => {
+        expect(readRevocable({ data: { applianceCredentialRevocable: true } })).toBe(true);
+    });
+    it('no for a plain false', () => {
+        expect(readRevocable({ data: { applianceCredentialRevocable: false } })).toBe(false);
+    });
+    it('no when the read was refused', () => {
+        /*
+         * ⚠ How a reader without the privilege arrives here. errorPolicy 'all' hands the refusal
+         * back as data, so nothing throws and the value beside it is undefined.
+         */
+        expect(readRevocable({ errors: [{ message: 'forbidden' }], data: null })).toBe(false);
+        expect(readRevocable({ errors: [{ message: 'forbidden' }], data: { applianceCredentialRevocable: true } })).toBe(false);
+    });
+    it('no while nothing has answered yet', () => {
+        expect(readRevocable(undefined)).toBe(false);
+        expect(readRevocable(null)).toBe(false);
+        expect(readRevocable({})).toBe(false);
+        expect(readRevocable({ data: {} })).toBe(false);
+    });
+    it('does not take a truthy value for true', () => {
+        /*
+         * The field is declared Boolean, so anything else came from somewhere that is not this
+         * schema. Leaning the other way would put the button up on a shaped-but-wrong answer.
+         */
+        expect(readRevocable({ data: { applianceCredentialRevocable: 1 } })).toBe(false);
+        expect(readRevocable({ data: { applianceCredentialRevocable: 'true' } })).toBe(false);
+    });
+});
+describe('is the revoke button on the panel', () => {
+    it('yes where revoking works and the credential is live', () => {
+        expect(showsRevokeButton(true, { credentialRevoked: false })).toBe(true);
+    });
+    it('no where the installation never turned revoking on', () => {
+        /* ⚠ The default. The mutation behind the button answers 404 here. */
+        expect(showsRevokeButton(false, { credentialRevoked: false })).toBe(false);
+    });
+    it('no once it has already been revoked', () => {
+        /*
+         * A second press moves the serial again and changes nothing the reader can see, which reads
+         * as the first press not having worked.
+         */
+        expect(showsRevokeButton(true, { credentialRevoked: true })).toBe(false);
+    });
+    it('shows it when the field is absent rather than false', () => {
+        /*
+         * Absent means not revoked — an appliance loaded by a query that did not ask for the field,
+         * and the state a freshly registered one is in. Reading absence as revoked would take the
+         * button away from every appliance that still has a live credential.
+         */
+        expect(showsRevokeButton(true, {})).toBe(true);
+        expect(showsRevokeButton(true, { credentialRevoked: null })).toBe(true);
+    });
+    it('does not fall over before the record has loaded', () => {
+        expect(showsRevokeButton(true, null)).toBe(true);
+        expect(showsRevokeButton(false, undefined)).toBe(false);
+    });
+});
+describe('does the panel say this was revoked', () => {
+    it('only when the appliance says so', () => {
+        expect(showsRevokedNote({ credentialRevoked: true })).toBe(true);
+        expect(showsRevokedNote({ credentialRevoked: false })).toBe(false);
+        expect(showsRevokedNote({})).toBe(false);
+        expect(showsRevokedNote(null)).toBe(false);
+    });
+    it('says so even where revoking has since been turned off', () => {
+        /*
+         * ⚠ ADR-0085 decision 2 — the switch governs the door, not what was already done. The note
+         * reads the appliance and never the switch, so this holds by construction; the case is here
+         * because tying the note to the switch is the obvious shortcut and it would leave a revoked
+         * credential looking like one that was never issued.
+         */
+        expect(showsRevokedNote({ credentialRevoked: true })).toBe(true);
+        expect(showsRevokeButton(false, { credentialRevoked: true })).toBe(false);
+    });
+});
+//# sourceMappingURL=credential-panel-state.test.js.map

package/dist-client/utils/credential-panel-state.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-panel-state.test.js","sourceRoot":"","sources":["../../client/utils/credential-panel-state.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAE7F;;;;;;;;GAQG;AAEH,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC;;;WAGG;QACH,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrF,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAC9G,KAAK,CACN,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACjD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C;;;WAGG;QACH,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,CAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACvF,MAAM,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAAE,MAAa,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,qEAAqE;QACrE,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C;;;WAGG;QACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D;;;;WAIG;QACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9C,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChD,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAClE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D;;;;;WAKG;QACH,MAAM,CAAC,gBAAgB,CAAC,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readRevocable, showsRevokeButton, showsRevokedNote } from './credential-panel-state'\n\n/**\n * The two rules that decide whether a control for taking a credential away is on the screen.\n *\n * Most of these are about absence, because that is where the rule can fall the wrong way: a\n * query that has not answered, a field nobody asked for, a refusal that arrives as data. The\n * two directions are not equally bad — a missing button is a feature to turn on, a button that\n * refuses when pressed is a product that looks broken — so every absent case has to land on\n * \"no button\".\n */\n\ndescribe('does revoking work here', () => {\n  it('yes only for a plain true', () => {\n    expect(readRevocable({ data: { applianceCredentialRevocable: true } })).toBe(true)\n  })\n\n  it('no for a plain false', () => {\n    expect(readRevocable({ data: { applianceCredentialRevocable: false } })).toBe(false)\n  })\n\n  it('no when the read was refused', () => {\n    /*\n     * ⚠ How a reader without the privilege arrives here. errorPolicy 'all' hands the refusal\n     * back as data, so nothing throws and the value beside it is undefined.\n     */\n    expect(readRevocable({ errors: [{ message: 'forbidden' }], data: null })).toBe(false)\n    expect(readRevocable({ errors: [{ message: 'forbidden' }], data: { applianceCredentialRevocable: true } })).toBe(\n      false\n    )\n  })\n\n  it('no while nothing has answered yet', () => {\n    expect(readRevocable(undefined)).toBe(false)\n    expect(readRevocable(null)).toBe(false)\n    expect(readRevocable({})).toBe(false)\n    expect(readRevocable({ data: {} })).toBe(false)\n  })\n\n  it('does not take a truthy value for true', () => {\n    /*\n     * The field is declared Boolean, so anything else came from somewhere that is not this\n     * schema. Leaning the other way would put the button up on a shaped-but-wrong answer.\n     */\n    expect(readRevocable({ data: { applianceCredentialRevocable: 1 as any } })).toBe(false)\n    expect(readRevocable({ data: { applianceCredentialRevocable: 'true' as any } })).toBe(false)\n  })\n})\n\ndescribe('is the revoke button on the panel', () => {\n  it('yes where revoking works and the credential is live', () => {\n    expect(showsRevokeButton(true, { credentialRevoked: false })).toBe(true)\n  })\n\n  it('no where the installation never turned revoking on', () => {\n    /* ⚠ The default. The mutation behind the button answers 404 here. */\n    expect(showsRevokeButton(false, { credentialRevoked: false })).toBe(false)\n  })\n\n  it('no once it has already been revoked', () => {\n    /*\n     * A second press moves the serial again and changes nothing the reader can see, which reads\n     * as the first press not having worked.\n     */\n    expect(showsRevokeButton(true, { credentialRevoked: true })).toBe(false)\n  })\n\n  it('shows it when the field is absent rather than false', () => {\n    /*\n     * Absent means not revoked — an appliance loaded by a query that did not ask for the field,\n     * and the state a freshly registered one is in. Reading absence as revoked would take the\n     * button away from every appliance that still has a live credential.\n     */\n    expect(showsRevokeButton(true, {})).toBe(true)\n    expect(showsRevokeButton(true, { credentialRevoked: null })).toBe(true)\n  })\n\n  it('does not fall over before the record has loaded', () => {\n    expect(showsRevokeButton(true, null)).toBe(true)\n    expect(showsRevokeButton(false, undefined)).toBe(false)\n  })\n})\n\ndescribe('does the panel say this was revoked', () => {\n  it('only when the appliance says so', () => {\n    expect(showsRevokedNote({ credentialRevoked: true })).toBe(true)\n    expect(showsRevokedNote({ credentialRevoked: false })).toBe(false)\n    expect(showsRevokedNote({})).toBe(false)\n    expect(showsRevokedNote(null)).toBe(false)\n  })\n\n  it('says so even where revoking has since been turned off', () => {\n    /*\n     * ⚠ ADR-0085 decision 2 — the switch governs the door, not what was already done. The note\n     * reads the appliance and never the switch, so this holds by construction; the case is here\n     * because tying the note to the switch is the obvious shortcut and it would leave a revoked\n     * credential looking like one that was never issued.\n     */\n    expect(showsRevokedNote({ credentialRevoked: true })).toBe(true)\n    expect(showsRevokeButton(false, { credentialRevoked: true })).toBe(false)\n  })\n})\n"]}

package/dist-client/utils/inherited-name-refusal.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Reading back the one refusal a screen can offer a way out of. (Pure rule.)
+ *
+ * ## Why this one is different from the others
+ *
+ * Most refusals end the attempt: the operator reads them and changes what they were doing. This
+ * one does not. A role name that is already visible through the parent domain is refused
+ * **because the platform will not let it happen silently**, not because it must not happen —
+ * standing up the same names in this domain is the first step of moving off an inherited
+ * structure (ADR-0062 decisions 2 and 3).
+ *
+ * So the screen has to recognise this refusal specifically, tell the operator which domain the
+ * other role stands in, and offer to go again saying so. A screen that only printed the sentence
+ * would leave the way out reachable by nobody.
+ *
+ * ## Why the code and not the sentence
+ *
+ * The sentence is built in the caller's language, so matching on its text works until somebody
+ * is reading the screen in Korean. `extensions.refusal.code` is the contract and travels
+ * unchanged (ADR-0042, ADR-0054).
+ */
+/** What the refusal carries: the name that was asked for, and where the other one stands. */
+export type InheritedNameRefusal = {
+    name: string;
+    domain: string;
+};
+type GraphQLErrorish = {
+    extensions?: {
+        refusal?: {
+            code?: unknown;
+            params?: Record<string, unknown> | null;
+        } | null;
+    } | null;
+};
+/**
+ * The refusal's values when this response is that refusal, and nothing otherwise.
+ *
+ * `null` for every other outcome — a different refusal, a plain error, a response that succeeded.
+ * The caller treats `null` as "there is no way out to offer", which is right for all of them.
+ */
+export declare function standsInheritedRefusal(response: {
+    errors?: GraphQLErrorish[] | null;
+} | null | undefined): InheritedNameRefusal | null;
+export {};

package/dist-client/utils/inherited-name-refusal.js

@@ -0,0 +1,46 @@
+/**
+ * Reading back the one refusal a screen can offer a way out of. (Pure rule.)
+ *
+ * ## Why this one is different from the others
+ *
+ * Most refusals end the attempt: the operator reads them and changes what they were doing. This
+ * one does not. A role name that is already visible through the parent domain is refused
+ * **because the platform will not let it happen silently**, not because it must not happen —
+ * standing up the same names in this domain is the first step of moving off an inherited
+ * structure (ADR-0062 decisions 2 and 3).
+ *
+ * So the screen has to recognise this refusal specifically, tell the operator which domain the
+ * other role stands in, and offer to go again saying so. A screen that only printed the sentence
+ * would leave the way out reachable by nobody.
+ *
+ * ## Why the code and not the sentence
+ *
+ * The sentence is built in the caller's language, so matching on its text works until somebody
+ * is reading the screen in Korean. `extensions.refusal.code` is the contract and travels
+ * unchanged (ADR-0042, ADR-0054).
+ */
+const CODE = 'role-name-stands-inherited';
+/**
+ * The refusal's values when this response is that refusal, and nothing otherwise.
+ *
+ * `null` for every other outcome — a different refusal, a plain error, a response that succeeded.
+ * The caller treats `null` as "there is no way out to offer", which is right for all of them.
+ */
+export function standsInheritedRefusal(response) {
+    const refusal = (response?.errors || []).map(error => error?.extensions?.refusal).find(r => r?.code === CODE);
+    if (!refusal) {
+        return null;
+    }
+    const params = refusal.params || {};
+    /*
+     * The name is what the operator typed, so a refusal without it is not one this screen can put
+     * a question to. The domain may be empty — a parent row with no name loaded — and the question
+     * still reads, so only the name is required.
+     */
+    const name = typeof params.name === 'string' ? params.name : '';
+    if (!name) {
+        return null;
+    }
+    return { name, domain: typeof params.domain === 'string' ? params.domain : '' };
+}
+//# sourceMappingURL=inherited-name-refusal.js.map

package/dist-client/utils/inherited-name-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inherited-name-refusal.js","sourceRoot":"","sources":["../../client/utils/inherited-name-refusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,MAAM,IAAI,GAAG,4BAA4B,CAAA;AAMzC;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAAkE;IAElE,MAAM,OAAO,GAAG,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,IAAI,CAAC,CAAA;IAE7G,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAA;IAEnC;;;;OAIG;IACH,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAA;IAE/D,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;AACjF,CAAC","sourcesContent":["/**\n * Reading back the one refusal a screen can offer a way out of. (Pure rule.)\n *\n * ## Why this one is different from the others\n *\n * Most refusals end the attempt: the operator reads them and changes what they were doing. This\n * one does not. A role name that is already visible through the parent domain is refused\n * **because the platform will not let it happen silently**, not because it must not happen —\n * standing up the same names in this domain is the first step of moving off an inherited\n * structure (ADR-0062 decisions 2 and 3).\n *\n * So the screen has to recognise this refusal specifically, tell the operator which domain the\n * other role stands in, and offer to go again saying so. A screen that only printed the sentence\n * would leave the way out reachable by nobody.\n *\n * ## Why the code and not the sentence\n *\n * The sentence is built in the caller's language, so matching on its text works until somebody\n * is reading the screen in Korean. `extensions.refusal.code` is the contract and travels\n * unchanged (ADR-0042, ADR-0054).\n */\n\n/** What the refusal carries: the name that was asked for, and where the other one stands. */\nexport type InheritedNameRefusal = {\n  name: string\n  domain: string\n}\n\nconst CODE = 'role-name-stands-inherited'\n\ntype GraphQLErrorish = {\n  extensions?: { refusal?: { code?: unknown; params?: Record<string, unknown> | null } | null } | null\n}\n\n/**\n * The refusal's values when this response is that refusal, and nothing otherwise.\n *\n * `null` for every other outcome — a different refusal, a plain error, a response that succeeded.\n * The caller treats `null` as \"there is no way out to offer\", which is right for all of them.\n */\nexport function standsInheritedRefusal(\n  response: { errors?: GraphQLErrorish[] | null } | null | undefined\n): InheritedNameRefusal | null {\n  const refusal = (response?.errors || []).map(error => error?.extensions?.refusal).find(r => r?.code === CODE)\n\n  if (!refusal) {\n    return null\n  }\n\n  const params = refusal.params || {}\n\n  /*\n   * The name is what the operator typed, so a refusal without it is not one this screen can put\n   * a question to. The domain may be empty — a parent row with no name loaded — and the question\n   * still reads, so only the name is required.\n   */\n  const name = typeof params.name === 'string' ? params.name : ''\n\n  if (!name) {\n    return null\n  }\n\n  return { name, domain: typeof params.domain === 'string' ? params.domain : '' }\n}\n"]}

package/dist-client/utils/inherited-name-refusal.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/inherited-name-refusal.test.js

@@ -0,0 +1,60 @@
+import { standsInheritedRefusal } from './inherited-name-refusal';
+/**
+ * Recognising the refusal the screen can offer a way out of.
+ *
+ * Both directions cost. Missing it leaves the operator reading a sentence about a domain they
+ * may not have known existed, with no way to act on it — and standing up the same names here is
+ * the only route off an inherited structure. Seeing it where it is not would offer to force
+ * through a refusal that means something else.
+ */
+const refusalResponse = (code, params) => ({
+    errors: [{ extensions: { refusal: { code, params } } }]
+});
+describe('the refusal that has a way out', () => {
+    it('is read back with the name and the domain', () => {
+        expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 'approver', domain: 'system' }))).toEqual({ name: 'approver', domain: 'system' });
+    });
+    it('is found among other errors', () => {
+        const response = {
+            errors: [
+                { extensions: { refusal: { code: 'something-else', params: {} } } },
+                { extensions: { refusal: { code: 'role-name-stands-inherited', params: { name: 'approver', domain: 'system' } } } }
+            ]
+        };
+        expect(standsInheritedRefusal(response)).toMatchObject({ name: 'approver' });
+    });
+    it('still reads when the domain could not be named', () => {
+        /* The question is worth asking without it; the name is what makes it answerable. */
+        expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 'approver' }))).toEqual({
+            name: 'approver',
+            domain: ''
+        });
+    });
+});
+describe('everything else', () => {
+    it('a different refusal', () => {
+        /*
+         * ⚠ `role-name-taken-here` is the one with no way out — two rows in one domain would be
+         * indistinguishable. Offering to force it would be offering something that cannot happen.
+         */
+        expect(standsInheritedRefusal(refusalResponse('role-name-taken-here', { name: 'approver' }))).toBeNull();
+    });
+    it('a plain error with no refusal on it', () => {
+        expect(standsInheritedRefusal({ errors: [{ extensions: { code: 'INTERNAL_SERVER_ERROR' } }] })).toBeNull();
+    });
+    it('a response that worked', () => {
+        expect(standsInheritedRefusal({})).toBeNull();
+        expect(standsInheritedRefusal({ errors: [] })).toBeNull();
+        expect(standsInheritedRefusal(null)).toBeNull();
+        expect(standsInheritedRefusal(undefined)).toBeNull();
+    });
+    it('the right code with nothing to put in the question', () => {
+        /* Without the name there is no question to ask, so there is no way out to offer. */
+        expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', {}))).toBeNull();
+        expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', null))).toBeNull();
+    });
+    it('does not take a code-shaped value that is not a string', () => {
+        expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 42 }))).toBeNull();
+    });
+});
+//# sourceMappingURL=inherited-name-refusal.test.js.map

package/dist-client/utils/inherited-name-refusal.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inherited-name-refusal.test.js","sourceRoot":"","sources":["../../client/utils/inherited-name-refusal.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAA;AAEjE;;;;;;;GAOG;AAEH,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,MAAW,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;CACxD,CAAC,CAAA;AAEF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC9C,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CACJ,sBAAsB,CAAC,eAAe,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC9G,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,QAAQ,GAAG;YACf,MAAM,EAAE;gBACN,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE;gBACnE,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE;aACpH;SACF,CAAA;QAED,MAAM,CAAC,sBAAsB,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,oFAAoF;QACpF,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1G,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,EAAE;SACX,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B;;;WAGG;QACH,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC1G,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACnH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC7C,MAAM,CAAC,sBAAsB,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QACzD,MAAM,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC/C,MAAM,CAAC,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,oFAAoF;QACpF,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC5F,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,4BAA4B,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,CAAC,sBAAsB,CAAC,eAAe,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { standsInheritedRefusal } from './inherited-name-refusal'\n\n/**\n * Recognising the refusal the screen can offer a way out of.\n *\n * Both directions cost. Missing it leaves the operator reading a sentence about a domain they\n * may not have known existed, with no way to act on it — and standing up the same names here is\n * the only route off an inherited structure. Seeing it where it is not would offer to force\n * through a refusal that means something else.\n */\n\nconst refusalResponse = (code: string, params: any) => ({\n  errors: [{ extensions: { refusal: { code, params } } }]\n})\n\ndescribe('the refusal that has a way out', () => {\n  it('is read back with the name and the domain', () => {\n    expect(\n      standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 'approver', domain: 'system' }))\n    ).toEqual({ name: 'approver', domain: 'system' })\n  })\n\n  it('is found among other errors', () => {\n    const response = {\n      errors: [\n        { extensions: { refusal: { code: 'something-else', params: {} } } },\n        { extensions: { refusal: { code: 'role-name-stands-inherited', params: { name: 'approver', domain: 'system' } } } }\n      ]\n    }\n\n    expect(standsInheritedRefusal(response)).toMatchObject({ name: 'approver' })\n  })\n\n  it('still reads when the domain could not be named', () => {\n    /* The question is worth asking without it; the name is what makes it answerable. */\n    expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 'approver' }))).toEqual({\n      name: 'approver',\n      domain: ''\n    })\n  })\n})\n\ndescribe('everything else', () => {\n  it('a different refusal', () => {\n    /*\n     * ⚠ `role-name-taken-here` is the one with no way out — two rows in one domain would be\n     * indistinguishable. Offering to force it would be offering something that cannot happen.\n     */\n    expect(standsInheritedRefusal(refusalResponse('role-name-taken-here', { name: 'approver' }))).toBeNull()\n  })\n\n  it('a plain error with no refusal on it', () => {\n    expect(standsInheritedRefusal({ errors: [{ extensions: { code: 'INTERNAL_SERVER_ERROR' } as any }] })).toBeNull()\n  })\n\n  it('a response that worked', () => {\n    expect(standsInheritedRefusal({})).toBeNull()\n    expect(standsInheritedRefusal({ errors: [] })).toBeNull()\n    expect(standsInheritedRefusal(null)).toBeNull()\n    expect(standsInheritedRefusal(undefined)).toBeNull()\n  })\n\n  it('the right code with nothing to put in the question', () => {\n    /* Without the name there is no question to ask, so there is no way out to offer. */\n    expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', {}))).toBeNull()\n    expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', null))).toBeNull()\n  })\n\n  it('does not take a code-shaped value that is not a string', () => {\n    expect(standsInheritedRefusal(refusalResponse('role-name-stands-inherited', { name: 42 }))).toBeNull()\n  })\n})\n"]}

package/dist-client/utils/invitation-token.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)
+ *
+ * ## Why the token is in the fragment
+ *
+ * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
+ * reaches the server as `/accept-invitation` and nothing else. The token never appears in an
+ * access log, a proxy log, or a `Referer` sent onward to some other site.
+ *
+ * That leaves the places the browser itself keeps it: the address bar and the history entry.
+ * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the
+ * two answers come back together — reading the token and removing it are one act, and a caller
+ * that did the first without the second would leave it on screen.
+ *
+ * ## What it refuses to read
+ *
+ * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and
+ * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page
+ * anchor — to the server as a credential attempt. It answers empty instead, and the page shows
+ * the box where the code from the mail can be pasted.
+ */
+export type InvitationLink = {
+    /** The token, or an empty string when the link carries none this rule will read. */
+    token: string;
+    /** The same URL without its fragment, for the caller to replace the address with. */
+    clean: string;
+};
+export declare function readInvitationToken(href: string): InvitationLink;

package/dist-client/utils/invitation-token.js

@@ -0,0 +1,40 @@
+/**
+ * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)
+ *
+ * ## Why the token is in the fragment
+ *
+ * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`
+ * reaches the server as `/accept-invitation` and nothing else. The token never appears in an
+ * access log, a proxy log, or a `Referer` sent onward to some other site.
+ *
+ * That leaves the places the browser itself keeps it: the address bar and the history entry.
+ * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the
+ * two answers come back together — reading the token and removing it are one act, and a caller
+ * that did the first without the second would leave it on screen.
+ *
+ * ## What it refuses to read
+ *
+ * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and
+ * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page
+ * anchor — to the server as a credential attempt. It answers empty instead, and the page shows
+ * the box where the code from the mail can be pasted.
+ */
+/** 16 bytes as hex, which is what `makeInvitationToken` produces. */
+const TOKEN = /^[0-9a-f]{32}$/;
+export function readInvitationToken(href) {
+    if (!href) {
+        return { token: '', clean: '' };
+    }
+    const hash = href.indexOf('#');
+    if (hash < 0) {
+        return { token: '', clean: href };
+    }
+    const clean = href.slice(0, hash);
+    /*
+     * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that
+     * rewrite links, and neither costs anything to accept.
+     */
+    const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '');
+    return { token: TOKEN.test(raw) ? raw : '', clean };
+}
+//# sourceMappingURL=invitation-token.js.map

package/dist-client/utils/invitation-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-token.js","sourceRoot":"","sources":["../../client/utils/invitation-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,qEAAqE;AACrE,MAAM,KAAK,GAAG,gBAAgB,CAAA;AAS9B,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;IACjC,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAE9B,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACnC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;IAEjC;;;OAGG;IACH,MAAM,GAAG,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAE5E,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAA;AACrD,CAAC","sourcesContent":["/**\n * Taking the invitation token out of the link, and out of the address bar. (Pure rule.)\n *\n * ## Why the token is in the fragment\n *\n * A browser does not send what follows `#`, so a link shaped `…/accept-invitation#<token>`\n * reaches the server as `/accept-invitation` and nothing else. The token never appears in an\n * access log, a proxy log, or a `Referer` sent onward to some other site.\n *\n * That leaves the places the browser itself keeps it: the address bar and the history entry.\n * Both are cleared by replacing the URL with the one this returns as `clean`, which is why the\n * two answers come back together — reading the token and removing it are one act, and a caller\n * that did the first without the second would leave it on screen.\n *\n * ## What it refuses to read\n *\n * A token is hex from `crypto.randomBytes(16)`. Anything else in the fragment is not one, and\n * taking it anyway would send whatever a link happened to carry — a tracking fragment, a page\n * anchor — to the server as a credential attempt. It answers empty instead, and the page shows\n * the box where the code from the mail can be pasted.\n */\n\n/** 16 bytes as hex, which is what `makeInvitationToken` produces. */\nconst TOKEN = /^[0-9a-f]{32}$/\n\nexport type InvitationLink = {\n  /** The token, or an empty string when the link carries none this rule will read. */\n  token: string\n  /** The same URL without its fragment, for the caller to replace the address with. */\n  clean: string\n}\n\nexport function readInvitationToken(href: string): InvitationLink {\n  if (!href) {\n    return { token: '', clean: '' }\n  }\n\n  const hash = href.indexOf('#')\n\n  if (hash < 0) {\n    return { token: '', clean: href }\n  }\n\n  const clean = href.slice(0, hash)\n\n  /*\n   * `#invite=<token>` as well as a bare `#<token>`. Both shapes turn up in mail clients that\n   * rewrite links, and neither costs anything to accept.\n   */\n  const raw = decodeURIComponent(href.slice(hash + 1)).replace(/^invite=/, '')\n\n  return { token: TOKEN.test(raw) ? raw : '', clean }\n}\n"]}

package/dist-client/utils/invitation-token.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/invitation-token.test.js

@@ -0,0 +1,60 @@
+import { readInvitationToken } from './invitation-token';
+/**
+ * Reading the invitation token out of the link, and handing back the link without it.
+ *
+ * The two answers travel together because removing the token is not optional: the fragment keeps
+ * it out of server and proxy logs, and replacing the address is what keeps it out of the browser
+ * history and off the screen. A caller that read it and forgot to replace would undo the point.
+ */
+const TOKEN = '0123456789abcdef0123456789abcdef';
+const PAGE = 'https://acme.example.com/accept-invitation';
+describe('a link with a token in it', () => {
+    it('reads a bare fragment', () => {
+        expect(readInvitationToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
+    });
+    it('reads the named form some mail clients produce', () => {
+        expect(readInvitationToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE });
+    });
+    it('reads one that arrived percent-encoded', () => {
+        expect(readInvitationToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN);
+    });
+    it('hands back the address without the fragment', () => {
+        /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in
+           this history entry, which is the half of the hiding the fragment does not do by itself. */
+        expect(readInvitationToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`);
+    });
+});
+describe('a link with nothing usable in it', () => {
+    it('has no fragment at all', () => {
+        expect(readInvitationToken(PAGE)).toEqual({ token: '', clean: PAGE });
+    });
+    it('has an empty fragment', () => {
+        expect(readInvitationToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE });
+    });
+    it('⚠ carries something that is not a token', () => {
+        /*
+         * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a
+         * credential attempt would be this page volunteering whatever it was given.
+         */
+        expect(readInvitationToken(`${PAGE}#section-2`).token).toEqual('');
+        expect(readInvitationToken(`${PAGE}#utm_source=mail`).token).toEqual('');
+        expect(readInvitationToken(`${PAGE}#<script>`).token).toEqual('');
+    });
+    it('carries something token-shaped but the wrong length', () => {
+        expect(readInvitationToken(`${PAGE}#0123456789abcdef`).token).toEqual('');
+        expect(readInvitationToken(`${PAGE}#${TOKEN}ff`).token).toEqual('');
+    });
+    it('carries hex in the wrong case', () => {
+        /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */
+        expect(readInvitationToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('');
+    });
+    it('still hands back a clean address to replace with', () => {
+        /* Even a fragment that is not ours should not be left sitting in the bar for this page. */
+        expect(readInvitationToken(`${PAGE}#section-2`).clean).toEqual(PAGE);
+    });
+    it('is given nothing at all', () => {
+        expect(readInvitationToken('')).toEqual({ token: '', clean: '' });
+        expect(readInvitationToken(undefined)).toEqual({ token: '', clean: '' });
+    });
+});
+//# sourceMappingURL=invitation-token.test.js.map

package/dist-client/utils/invitation-token.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitation-token.test.js","sourceRoot":"","sources":["../../client/utils/invitation-token.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAA;AAExD;;;;;;GAMG;AAEH,MAAM,KAAK,GAAG,kCAAkC,CAAA;AAChD,MAAM,IAAI,GAAG,4CAA4C,CAAA;AAEzD,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACxF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,WAAW,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,aAAa,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IAC/E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;qGAC6F;QAC7F,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,MAAM,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD;;;WAGG;QACH,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACxE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACrE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,wFAAwF;QACxF,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,2FAA2F;QAC3F,MAAM,CAAC,mBAAmB,CAAC,GAAG,IAAI,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;QACjE,MAAM,CAAC,mBAAmB,CAAC,SAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { readInvitationToken } from './invitation-token'\n\n/**\n * Reading the invitation token out of the link, and handing back the link without it.\n *\n * The two answers travel together because removing the token is not optional: the fragment keeps\n * it out of server and proxy logs, and replacing the address is what keeps it out of the browser\n * history and off the screen. A caller that read it and forgot to replace would undo the point.\n */\n\nconst TOKEN = '0123456789abcdef0123456789abcdef'\nconst PAGE = 'https://acme.example.com/accept-invitation'\n\ndescribe('a link with a token in it', () => {\n  it('reads a bare fragment', () => {\n    expect(readInvitationToken(`${PAGE}#${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads the named form some mail clients produce', () => {\n    expect(readInvitationToken(`${PAGE}#invite=${TOKEN}`)).toEqual({ token: TOKEN, clean: PAGE })\n  })\n\n  it('reads one that arrived percent-encoded', () => {\n    expect(readInvitationToken(`${PAGE}#invite%3D${TOKEN}`).token).toEqual(TOKEN)\n  })\n\n  it('hands back the address without the fragment', () => {\n    /* ⚠ What the caller replaces the address with. Without it the token stays on screen and in\n       this history entry, which is the half of the hiding the fragment does not do by itself. */\n    expect(readInvitationToken(`${PAGE}?x=1#${TOKEN}`).clean).toEqual(`${PAGE}?x=1`)\n  })\n})\n\ndescribe('a link with nothing usable in it', () => {\n  it('has no fragment at all', () => {\n    expect(readInvitationToken(PAGE)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('has an empty fragment', () => {\n    expect(readInvitationToken(`${PAGE}#`)).toEqual({ token: '', clean: PAGE })\n  })\n\n  it('⚠ carries something that is not a token', () => {\n    /*\n     * ⚠ A page anchor, a tracking fragment, anything a link happened to pick up. Sending it as a\n     * credential attempt would be this page volunteering whatever it was given.\n     */\n    expect(readInvitationToken(`${PAGE}#section-2`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#utm_source=mail`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#<script>`).token).toEqual('')\n  })\n\n  it('carries something token-shaped but the wrong length', () => {\n    expect(readInvitationToken(`${PAGE}#0123456789abcdef`).token).toEqual('')\n    expect(readInvitationToken(`${PAGE}#${TOKEN}ff`).token).toEqual('')\n  })\n\n  it('carries hex in the wrong case', () => {\n    /* `makeInvitationToken` produces lower-case hex. Anything else did not come from us. */\n    expect(readInvitationToken(`${PAGE}#${TOKEN.toUpperCase()}`).token).toEqual('')\n  })\n\n  it('still hands back a clean address to replace with', () => {\n    /* Even a fragment that is not ours should not be left sitting in the bar for this page. */\n    expect(readInvitationToken(`${PAGE}#section-2`).clean).toEqual(PAGE)\n  })\n\n  it('is given nothing at all', () => {\n    expect(readInvitationToken('')).toEqual({ token: '', clean: '' })\n    expect(readInvitationToken(undefined as any)).toEqual({ token: '', clean: '' })\n  })\n})\n"]}

package/dist-client/utils/role-origin.d.ts

@@ -0,0 +1,44 @@
+/**
+ * When a list of roles has to say where each one came from. (Pure rule.)
+ *
+ * ## The situation it is for
+ *
+ * Roles are visible one level up: a domain sees its own and its parent's. Nothing stops a
+ * domain having a role with the same name as one it inherits — the duplicate checks on the
+ * server ask only about the domain itself — so a picker can offer two rows reading `approver`
+ * with no way to tell them apart. Whichever gets ticked decides who a gate lets through, and
+ * an approval line can end up pointing at the one nobody looks at (ADR-0062 decision 3).
+ *
+ * ## Why the rule is about the list and not about one role
+ *
+ * A role does not know whether it is inherited — that depends on which domain is being looked
+ * at, and a list of roles from one domain is the ordinary case. So the question is asked of the
+ * list: **does this set span more than one domain?** If it does, every row says which, and the
+ * rows that shared a name stop being identical. If it does not, nothing is added and the
+ * ordinary case stays quiet.
+ *
+ * That also answers correctly for a role whose name happens to be unique but which still comes
+ * from somewhere else — granting one of those is a different act from granting your own, and
+ * the operator should be able to see which they are doing.
+ */
+/** The part of a role this rule reads. `domain` is absent on lists that never asked for it. */
+export type RoleWithOrigin = {
+    domain?: {
+        name?: string | null;
+    } | null;
+} | null | undefined;
+/**
+ * Should this list show where each role comes from?
+ *
+ * False when every role names the same domain, when none of them names one at all, and for an
+ * empty list. A list that is only partly labelled counts as spanning — one row that cannot say
+ * where it came from, beside rows that can, is the ambiguity this exists to remove.
+ */
+export declare function showsRoleOrigin(roles: RoleWithOrigin[] | null | undefined): boolean;
+/**
+ * What to print beside a role, or an empty string.
+ *
+ * A role with no domain on it prints nothing rather than a placeholder: the list is already
+ * labelled, so an unlabelled row reads as "not said" instead of as a domain called something.
+ */
+export declare function roleOrigin(role: RoleWithOrigin): string;