@things-factory/shell 10.1.37 → 10.1.38

package/dist-server/utils/index.d.ts

@@ -9,3 +9,4 @@ export * from './keyset-cursor.js';
 export * from './list-param-adjuster.js';
 export * from './get-times-for-period.js';
 export * from './headless-pool/index.js';
+export * from './subscribe-auth.js';

package/dist-server/utils/index.js

@@ -12,4 +12,5 @@ tslib_1.__exportStar(require("./keyset-cursor.js"), exports);
 tslib_1.__exportStar(require("./list-param-adjuster.js"), exports);
 tslib_1.__exportStar(require("./get-times-for-period.js"), exports);
 tslib_1.__exportStar(require("./headless-pool/index.js"), exports);
+tslib_1.__exportStar(require("./subscribe-auth.js"), exports);
 //# sourceMappingURL=index.js.map

package/dist-server/utils/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/utils/index.ts"],"names":[],"mappings":";;;AAAA,0DAA+B;AAC/B,mEAAwC;AACxC,iEAAsC;AACtC,kEAAuC;AACvC,qEAA0C;AAC1C,gEAAqC;AACrC,kFAAuD;AACvD,6DAAkC;AAClC,mEAAwC;AACxC,oEAAyC;AACzC,mEAAwC","sourcesContent":["export * from './get-domain.js'\nexport * from './apply-domain-filter.js'\nexport * from './condition-builder.js'\nexport * from './list-query-builder.js'\nexport * from './list-params-converter.js'\nexport * from './publish-progress.js'\nexport * from './get-query-builder-from-list-params.js'\nexport * from './keyset-cursor.js'\nexport * from './list-param-adjuster.js'\nexport * from './get-times-for-period.js'\nexport * from './headless-pool/index.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../server/utils/index.ts"],"names":[],"mappings":";;;AAAA,0DAA+B;AAC/B,mEAAwC;AACxC,iEAAsC;AACtC,kEAAuC;AACvC,qEAA0C;AAC1C,gEAAqC;AACrC,kFAAuD;AACvD,6DAAkC;AAClC,mEAAwC;AACxC,oEAAyC;AACzC,mEAAwC;AACxC,8DAAmC","sourcesContent":["export * from './get-domain.js'\nexport * from './apply-domain-filter.js'\nexport * from './condition-builder.js'\nexport * from './list-query-builder.js'\nexport * from './list-params-converter.js'\nexport * from './publish-progress.js'\nexport * from './get-query-builder-from-list-params.js'\nexport * from './keyset-cursor.js'\nexport * from './list-param-adjuster.js'\nexport * from './get-times-for-period.js'\nexport * from './headless-pool/index.js'\nexport * from './subscribe-auth.js'\n"]}

package/dist-server/utils/subscribe-auth.d.ts

@@ -0,0 +1,14 @@
+/**
+ * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).
+ * - domain 없음 → 거부.
+ * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.
+ *
+ * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은
+ * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가
+ * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.
+ *
+ * @param domain  context.state.domain
+ * @param user    context.state.user (domains[] / email 사용)
+ * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)
+ */
+export declare function assertDomainSubscribeAllowed(domain: any, user: any, isSuperUser: (domain: any, user: any) => boolean | Promise<boolean>): Promise<void>;

package/dist-server/utils/subscribe-auth.js

@@ -0,0 +1,35 @@
+"use strict";
+/*
+ * 구독 도메인 인증 게이트 — 순수 로직 (데코레이터·pubsub 없음 → 테스트 가능).
+ *
+ * 실시간 구독(@Subscription)은 같은 도메인 구성원만 허용해야 한다(도메인 격리 = 보안 핵심).
+ * 셸의 `data` 구독 · ai-assistant 의 chat-message · session-activity · board-ai 의 board-patch ·
+ * headless-twin 의 구독이 이 하나를 부른다(reuse — fork 금지). 가장 낮은 층에 둔다 — 부르는 쪽이 모두
+ * 이미 셸 위에 선다(2026-09-24 ai-assistant 에서 옮김). superUserGranted 는 process 전역 의존이라
+ * 주입받아 순수성 유지.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.assertDomainSubscribeAllowed = assertDomainSubscribeAllowed;
+/**
+ * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).
+ * - domain 없음 → 거부.
+ * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.
+ *
+ * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은
+ * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가
+ * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.
+ *
+ * @param domain  context.state.domain
+ * @param user    context.state.user (domains[] / email 사용)
+ * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)
+ */
+async function assertDomainSubscribeAllowed(domain, user, isSuperUser) {
+    if (!domain) {
+        throw new Error('domain required');
+    }
+    const subdomain = domain?.subdomain;
+    if (!user?.domains?.find((d) => d.subdomain === subdomain) && !(await isSuperUser(domain, user))) {
+        throw new Error(`domain(${subdomain}) is not working for user(${user?.email}).`);
+    }
+}
+//# sourceMappingURL=subscribe-auth.js.map

package/dist-server/utils/subscribe-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subscribe-auth.js","sourceRoot":"","sources":["../../server/utils/subscribe-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;AAeH,oEAYC;AAzBD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,4BAA4B,CAChD,MAAW,EACX,IAAS,EACT,WAAmE;IAEnE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAA;IACpC,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,SAAS,CAAA;IACnC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC,MAAM,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,UAAU,SAAS,6BAA6B,IAAI,EAAE,KAAK,IAAI,CAAC,CAAA;IAClF,CAAC;AACH,CAAC","sourcesContent":["/*\n * 구독 도메인 인증 게이트 — 순수 로직 (데코레이터·pubsub 없음 → 테스트 가능).\n *\n * 실시간 구독(@Subscription)은 같은 도메인 구성원만 허용해야 한다(도메인 격리 = 보안 핵심).\n * 셸의 `data` 구독 · ai-assistant 의 chat-message · session-activity · board-ai 의 board-patch ·\n * headless-twin 의 구독이 이 하나를 부른다(reuse — fork 금지). 가장 낮은 층에 둔다 — 부르는 쪽이 모두\n * 이미 셸 위에 선다(2026-09-24 ai-assistant 에서 옮김). superUserGranted 는 process 전역 의존이라\n * 주입받아 순수성 유지.\n */\n\n/**\n * 구독 허용 여부 단언. 불가 시 throw (graphql-ws 가 구독 거부).\n * - domain 없음 → 거부.\n * - user 가 해당 subdomain 의 도메인 소속이 아니고 superUser 도 아니면 → 거부.\n *\n * 주의(버그 수정): process.superUserGranted 는 async(Promise<boolean>) 다. 기존 양쪽 spine 은\n * `!process.superUserGranted(...)` 로 동기 평가해 `!Promise` = 항상 false → membership throw 가\n * 발동하지 않는 fail-open 상태였다. 여기서는 await 로 제대로 평가한다 → subscribe 는 async.\n *\n * @param domain  context.state.domain\n * @param user    context.state.user (domains[] / email 사용)\n * @param isSuperUser  (domain, user) → boolean | Promise<boolean> (process.superUserGranted 주입)\n */\nexport async function assertDomainSubscribeAllowed(\n  domain: any,\n  user: any,\n  isSuperUser: (domain: any, user: any) => boolean | Promise<boolean>\n): Promise<void> {\n  if (!domain) {\n    throw new Error('domain required')\n  }\n  const subdomain = domain?.subdomain\n  if (!user?.domains?.find((d: any) => d.subdomain === subdomain) && !(await isSuperUser(domain, user))) {\n    throw new Error(`domain(${subdomain}) is not working for user(${user?.email}).`)\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "10.1.37",
+  "version": "10.1.38",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -126,5 +126,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "d8a69e5c8803a4b9d3289df0cf38e161a207db61"
+  "gitHead": "b947349fe1c27d11038b592ceadaba336f14785b"
 }

package/tests/popup-buttons-class-shrinks.test.ts

@@ -27,17 +27,15 @@ const PACKAGES = path.join(REPO_ROOT, 'packages')
 
 const SKIP = new Set(['node_modules', 'dist', 'dist-client', 'dist-server', 'dist-shared', 'coverage'])
 
-/** Files that still render the CommonPopupStyles `.buttons` row, as of 2026-09-17. */
-const STILL_USING = [
-  'auth-ui/client/components/app-binding-detail.ts',
-  'auth-ui/client/components/appliance-editor.ts',
-  'auth-ui/client/components/application-editor.ts',
-  'organization/client/component/approval-line-items-editor-popup.ts',
-  'organization/client/component/approval-line-selector.ts',
-  'organization/client/component/assignees-editor-popup.ts',
-  'organization/client/component/department-selector.ts',
-  'organization/client/component/recipients-editor-popup.ts'
-]
+/**
+ * Files that still render the CommonPopupStyles `.buttons` row.
+ *
+ * Empty since 2026-09-24: auth-ui's three editors and organization's five popups moved to
+ * `<ox-popup-actions>`. The list stays so that a new hand-drawn row is still caught. The `.buttons`
+ * rule itself stays in `@operato/styles` - popups outside this repository (dssp, fmsim) still draw
+ * with it, and removing it is a decision to take with them.
+ */
+const STILL_USING: string[] = []
 
 function clientSources(dir: string, found: string[] = []): string[] {
   for (const entry of readdirSync(dir)) {
@@ -52,7 +50,12 @@ function clientSources(dir: string, found: string[] = []): string[] {
     }
 
     if (stat.isDirectory()) clientSources(full, found)
-    else if (entry.endsWith('.ts') && full.includes(`${path.sep}client${path.sep}`)) found.push(full)
+    /*
+     * Tests are skipped: they never render a popup, and a test that guards the row has to name the
+     * class it forbids - which this scan would then count as a use (it did, 2026-09-24).
+     */
+    else if (entry.endsWith('.ts') && !entry.endsWith('.test.ts') && full.includes(`${path.sep}client${path.sep}`))
+      found.push(full)
   }
   return found
 }

package/tests/subscribe-auth.test.ts

@@ -0,0 +1,57 @@
+/**
+ * 구독 도메인 인증 게이트 — 단위 테스트 (보안 핵심: 도메인 격리).
+ * board-patch / chat-message 양쪽 spine 이 공유하는 게이트.
+ *
+ * 회귀 방지: process.superUserGranted 는 async 다. 동기 `!process.superUserGranted(...)` 로
+ * 평가하면 `!Promise` = 항상 false → membership throw 가 죽는다(fail-open). 게이트는 반드시
+ * await 로 평가해야 한다. 아래 superUser 분기 테스트가 그 회귀를 박는다.
+ */
+import { assertDomainSubscribeAllowed } from '../server/utils/subscribe-auth'
+
+const never = async () => false // superUser 아님 (async — 실제 process.superUserGranted 와 동일)
+const always = async () => true // superUser (async)
+
+const domain = { id: 'd1', subdomain: 'acme' }
+const userInDomain = { email: 'a@x.io', domains: [{ subdomain: 'acme' }, { subdomain: 'other' }] }
+const userOutDomain = { email: 'b@x.io', domains: [{ subdomain: 'other' }] }
+
+describe('assertDomainSubscribeAllowed (도메인 격리 게이트)', () => {
+  it('domain 없으면 → reject (domain required)', async () => {
+    await expect(assertDomainSubscribeAllowed(undefined, userInDomain, never)).rejects.toThrow('domain required')
+    await expect(assertDomainSubscribeAllowed(null, userInDomain, never)).rejects.toThrow('domain required')
+  })
+
+  it('user 가 해당 subdomain 소속 → 통과 (superUser 검사 불필요)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userInDomain, never)).resolves.toBeUndefined()
+  })
+
+  it('user 가 미소속 + superUser 아님 → reject (격리 — 핵심)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userOutDomain, never)).rejects.toThrow(
+      'domain(acme) is not working for user(b@x.io).'
+    )
+  })
+
+  it('user 가 미소속이어도 superUser(async resolve true) 면 → 통과 (await 회귀 방지)', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, userOutDomain, always)).resolves.toBeUndefined()
+  })
+
+  it('user.domains 없음 + superUser 아님 → reject', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, { email: 'c@x.io' }, never)).rejects.toThrow(
+      'domain(acme) is not working for user(c@x.io).'
+    )
+  })
+
+  it('user.domains 없음 + superUser → 통과', async () => {
+    await expect(assertDomainSubscribeAllowed(domain, { email: 'c@x.io' }, always)).resolves.toBeUndefined()
+  })
+
+  it('isSuperUser 는 domain+user 를 받아 호출되고 await 된다', async () => {
+    const calls: any[] = []
+    const spy = async (d: any, u: any) => {
+      calls.push([d, u])
+      return true
+    }
+    await assertDomainSubscribeAllowed(domain, userOutDomain, spy)
+    expect(calls).toEqual([[domain, userOutDomain]])
+  })
+})

package/tests/theme-file-names.test.ts

@@ -25,18 +25,14 @@ const PACKAGES = path.resolve(__dirname, '..', '..')
 const SHELL_THEMES = path.resolve(__dirname, '..', 'client', 'themes')
 
 /**
- * Files that carry a shell theme file's name today.
+ * Files that carry a shell theme file's name today - none, since 2026-09-24.
  *
- * - The generator templates are copied into a new application, so a new product is born replacing
- *   the shell theme - operato-warehouse was born that way. They are fixed once the four operato
- *   products have moved.
+ * figure-ui moved its palette out of themes/ (e638595af8). The generator templates, which gave every
+ * new application a light.css and dark.css - operato-warehouse was born replacing the shell theme
+ * that way - now give it `{{name}}-accent.css`, after the four operato products had moved. The list
+ * stays empty so a new one is caught.
  */
-const KNOWN: string[] = [
-  'generator/templates/app/client/themes/dark.css',
-  'generator/templates/app/client/themes/light.css',
-  'generator/templates/brand/client/themes/dark.css',
-  'generator/templates/brand/client/themes/light.css'
-]
+const KNOWN: string[] = []
 
 /** Every `client/themes/*.css` under packages, as a path relative to packages. */
 function themeFiles(): string[] {

package/translations/en.json

@@ -147,6 +147,7 @@
   "text.there_is_nothing_to_process": "there is nothing to process",
   "text.there_is_nothing_to_save": "there is nothing to save",
   "text.you.are.now.in": "you are now in {state}",
+  "title.approval-line editor": "approval line editor",
   "title.activity list": "activity list",
   "title.activity model item list": "activity model item list",
   "title.approval-line item list": "approval line item list",
@@ -156,5 +157,6 @@
   "title.import event": "import events",
   "title.lookup role": "lookup role",
   "title.select_item": "select item",
-  "term.domain": "site"
+  "term.domain": "site",
+  "field.roles": "roles"
 }

package/translations/ja.json

@@ -147,6 +147,7 @@
   "text.there_is_nothing_to_process": "処理するデータがありません.",
   "text.there_is_nothing_to_save": "保存するデータがありません.",
   "text.you.are.now.in": "{state}になりました.",
+  "title.approval-line editor": "決裁ライン編集",
   "title.activity list": "業務定義リスト",
   "title.activity model item list": "業務モデルリスト",
   "title.approval-line item list": "決裁ライン詳細",
@@ -156,5 +157,6 @@
   "title.import event": "イベントの取り込み",
   "title.lookup role": "ロール検索",
   "title.select_item": "アイテム選択",
-  "term.domain": "事業場"
+  "term.domain": "事業場",
+  "field.roles": "ロール"
 }

package/translations/ko.json

@@ -147,6 +147,7 @@
   "text.there_is_nothing_to_process": "처리할 데이터가 없습니다.",
   "text.there_is_nothing_to_save": "저장할 데이터가 없습니다.",
   "text.you.are.now.in": "{state} 되었습니다.",
+  "title.approval-line editor": "결재선 편집",
   "title.activity list": "업무정의 리스트",
   "title.activity model item list": "업무 모델 항목",
   "title.approval-line item list": "결재선 상세",
@@ -156,5 +157,6 @@
   "title.import event": "일정 가져오기",
   "title.lookup role": "역할 검색",
   "title.select_item": "아이템 선택",
-  "term.domain": "사업장"
+  "term.domain": "사업장",
+  "field.roles": "역할"
 }

package/translations/ms.json

@@ -147,6 +147,7 @@
   "text.there_is_nothing_to_process": "there is nothing to process",
   "text.there_is_nothing_to_save": "there is nothing to save",
   "text.you.are.now.in": "anda berada di {state}",
+  "title.approval-line editor": "editor garis kelulusan",
   "title.activity list": "senarai aktiviti",
   "title.activity model item list": "senarai item model aktiviti",
   "title.approval-line item list": "senarai item garis kelulusan",
@@ -156,5 +157,6 @@
   "title.import event": "import acara",
   "title.lookup role": "cari peranan",
   "title.select_item": "pilih item",
-  "term.domain": "tapak"
+  "term.domain": "tapak",
+  "field.roles": "peranan"
 }

package/translations/zh.json

@@ -147,6 +147,7 @@
   "text.there_is_nothing_to_process": "没有要处理的数据。",
   "text.there_is_nothing_to_save": "没有要保存的数据。",
   "text.you.are.now.in": "您现在是 {state}。",
+  "title.approval-line editor": "审批线编辑器",
   "title.activity list": "业务列表",
   "title.activity model item list": "业务模型项目列表",
   "title.approval-line item list": "审批线项目列表",
@@ -155,5 +156,6 @@
   "title.event list": "事件列表",
   "title.import event": "导入事件",
   "title.lookup role": "查找角色",
-  "title.select_item": "选择项目"
+  "title.select_item": "选择项目",
+  "field.roles": "角色"
 }