@updraft-solutions/mcrit-sdk 0.14.12 → 0.14.13

package/src/schemas/fbo.spec.ts

@@ -1,14 +1,18 @@
 import { describe, expect, it } from "vitest";
 import {
   fboActivitySchema,
+  fboCompanyGrantSchema,
   fboCompanyMemberSchema,
+  fboCompanySchema,
   fboDutyAffectedSchema,
   fboDutySchema,
   fboDutySeriesResponseSchema,
   fboFlightDocumentSchema,
   fboFlightSchema,
   fboFlightStatusSchema,
+  fboGrantAbilitySchema,
   fboMaterialiseResultSchema,
+  fboMetaSchema,
   fboOccupationSchema,
   fboOperationsSchema,
   fboPersonSchema,
@@ -473,3 +477,115 @@ describe("fboFlightSchema — POB, documents and the customs mail stamp", () =>
     expect(fboFlightSchema.safeParse(bad).success).toBe(false);
   });
 });
+
+/**
+ * Fixtures copied from `CompanyGrantResource`, the FBO meta endpoint and the
+ * attached-companies index, so a schema that drifts from the payload fails
+ * here rather than at runtime in the app.
+ */
+const grantPayload = {
+  id: 12,
+  grantee: { id: 34, name: "Alpha Handling" },
+  target: { id: 35, name: "Bravo Charter" },
+  ability: "duties.view",
+  ability_label: "Dienstpläne einsehen",
+  granted_by: { id: 7, name: "Erika Muster" },
+  created_at: "2026-08-29T09:00:00.000000Z",
+  can: { delete: true },
+};
+
+describe("fboCompanyGrantSchema", () => {
+  it("parses a grant exactly as the register emits it", () => {
+    expect(fboCompanyGrantSchema.parse(grantPayload).ability).toBe("duties.view");
+  });
+
+  it("parses a migrated grant nobody signed — granted_by is null", () => {
+    expect(fboCompanyGrantSchema.parse({ ...grantPayload, granted_by: null }).granted_by).toBeNull();
+  });
+
+  it("parses a side whose company left the FBO domain — the ref is null, not missing", () => {
+    expect(fboCompanyGrantSchema.parse({ ...grantPayload, target: null }).target).toBeNull();
+  });
+
+  it("rejects an ability outside the register's vocabulary", () => {
+    expect(fboCompanyGrantSchema.safeParse({ ...grantPayload, ability: "flights.view" }).success).toBe(false);
+  });
+
+  it("rejects a row without its ability label — the UI has no copy of its own", () => {
+    const { ability_label: _label, ...withoutLabel } = grantPayload;
+    expect(fboCompanyGrantSchema.safeParse(withoutLabel).success).toBe(false);
+  });
+});
+
+describe("fboGrantAbilitySchema", () => {
+  it("accepts the one ability the register knows", () => {
+    expect(fboGrantAbilitySchema.parse("duties.view")).toBe("duties.view");
+  });
+
+  it("rejects an ability the client cannot render", () => {
+    expect(fboGrantAbilitySchema.safeParse("traffic.details").success).toBe(false);
+  });
+});
+
+describe("fboMetaSchema", () => {
+  const metaPayload = {
+    roles: ["fbo", "operator"],
+    root_id: 34,
+    can_decide: true,
+    can_view_own_flights: false,
+    grant_abilities: [{ value: "duties.view", label: "View duty rosters" }],
+    can_manage_grants: true,
+    companies: [{ id: 34, name: "Alpha Handling" }],
+  };
+
+  it("parses the meta payload as the API emits it", () => {
+    const parsed = fboMetaSchema.parse(metaPayload);
+    expect(parsed.grant_abilities?.[0]?.value).toBe("duties.view");
+    expect(parsed.can_manage_grants).toBe(true);
+  });
+
+  it("parses a payload from an API that predates the grant register — only roles is required", () => {
+    const parsed = fboMetaSchema.parse({ roles: [] });
+    expect(parsed.grant_abilities).toBeUndefined();
+    expect(parsed.can_view_own_flights).toBeUndefined();
+  });
+
+  it("rejects a grant ability option the client cannot render", () => {
+    const bad = { ...metaPayload, grant_abilities: [{ value: "duties.edit", label: "Edit" }] };
+    expect(fboMetaSchema.safeParse(bad).success).toBe(false);
+  });
+});
+
+describe("fboCompanySchema", () => {
+  const companyPayload = {
+    id: 35,
+    name: "Bravo Charter",
+    email: "ops@bravo.test",
+    phone: null,
+    description: null,
+    contact_name: "Erika Muster",
+    companyType: "interface",
+    is_ima_imported: true,
+    fbo: { role: "operator", flights_require_approval: true, notify_on_movement: false, has_duties: true, has_airplanes: false },
+    members_count: 4,
+    movements_count: 92,
+    grants_out_count: 1,
+    grants_in_count: 0,
+    can: { update: true, updateIdentity: true },
+  };
+
+  it("parses an attached company with both grant counts", () => {
+    const parsed = fboCompanySchema.parse(companyPayload);
+    expect(parsed.grants_out_count).toBe(1);
+    expect(parsed.grants_in_count).toBe(0);
+  });
+
+  it("parses a payload from an API that does not count grants yet", () => {
+    const { grants_out_count: _out, grants_in_count: _in, ...withoutCounts } = companyPayload;
+    expect(fboCompanySchema.parse(withoutCounts).grants_out_count).toBeUndefined();
+  });
+
+  it("parses a company with no FBO profile at all", () => {
+    expect(fboCompanySchema.parse({ ...companyPayload, fbo: null }).fbo).toBeNull();
+  });
+});

package/src/schemas/fbo.ts

@@ -436,3 +436,102 @@ export const fboMaterialiseResultSchema = z.object({
   skipped_existing: z.number(),
   skipped_closed: z.number(),
 });
+
+/**
+ * What one company may exercise on another company's data inside the same FBO
+ * tree — the vocabulary of the root's grant register. Mirrors the API enum
+ * exactly; a value outside it means the register grew an ability this client
+ * does not know how to render, and failing here is the point.
+ */
+export const fboGrantAbilitySchema = z.enum(["duties.view"]);
+
+/**
+ * One entry of `GET fbo/meta`'s `grant_abilities` — the ability vocabulary
+ * with the label the API already translated, so no client hardcodes copy for
+ * an ability it may not know.
+ */
+export const fboGrantAbilityOptionSchema = z.object({
+  value: fboGrantAbilitySchema,
+  label: z.string(),
+});
+
+/**
+ * A company side of a grant. Rendered as `{id, name}` rather than a full
+ * company payload: a grant is a relation between two companies, not a view of
+ * either. Null only when that company stopped taking part in the FBO domain.
+ */
+export const fboGrantCompanyRefSchema = z.object({
+  id: z.number(),
+  name: z.string().nullable(),
+});
+
+/**
+ * One row of the root's company-grant register — `CompanyGrantResource`.
+ * `granted_by` is null for a grant the migration wrote rather than a person.
+ * `can.delete` is always true on a row that reached the client at all (only
+ * `fbo.company.manage` at the tree root can read the register), but it is
+ * read as a gate like every other row's, never assumed.
+ */
+export const fboCompanyGrantSchema = z.object({
+  id: z.number(),
+  grantee: fboGrantCompanyRefSchema.nullable(),
+  target: fboGrantCompanyRefSchema.nullable(),
+  ability: fboGrantAbilitySchema,
+  ability_label: z.string(),
+  granted_by: z.object({ id: z.number(), name: z.string() }).nullable(),
+  created_at: z.string().nullable(),
+  can: z.object({ delete: z.boolean() }).optional(),
+});
+
+/** `POST companies/{id}/fbo/company-grants` — the register's write shape. */
+export const fboCompanyGrantInputSchema = z.object({
+  grantee_company_id: z.number(),
+  target_company_id: z.number(),
+  ability: fboGrantAbilitySchema,
+});
+
+/**
+ * `GET companies/{id}/fbo/meta` — the FBO vocabulary and the caller's
+ * root-evaluated capabilities, served so no client hardcodes either.
+ *
+ * Every key but `roles` is optional: the endpoint is the one surface an
+ * own-author filer can reach before anything else is known, and it has grown
+ * keys over time — a client pinned to an older API must still parse it.
+ *
+ * `can_view_own_flights` is the TIER, not the bare permission: true only when
+ * this caller's sight of movements is the own-author one (false for a decider
+ * or an operator, who hold the wider `fbo.flight.viewAny`).
+ */
+export const fboMetaSchema = z.object({
+  roles: z.array(z.string()),
+  root_id: z.number().nullable().optional(),
+  can_decide: z.boolean().optional(),
+  can_view_own_flights: z.boolean().optional(),
+  grant_abilities: z.array(fboGrantAbilityOptionSchema).optional(),
+  can_manage_grants: z.boolean().optional(),
+  companies: z.array(fboGrantCompanyRefSchema).optional(),
+});
+
+/**
+ * A company attached to the FBO as its root's admin reads it —
+ * `CompanyResource` under `GET companies/{fbo}/fbo/companies`. The three
+ * counts are aggregates the index adds (`withCount`) and are null on any
+ * payload that did not compute them; `grants_out_count`/`grants_in_count`
+ * are additionally optional, being newer than the surface itself.
+ */
+export const fboCompanySchema = z.object({
+  id: z.number(),
+  name: z.string(),
+  email: z.string().nullable(),
+  phone: z.string().nullable(),
+  description: z.string().nullable(),
+  contact_name: z.string().nullable(),
+  companyType: z.string(),
+  is_ima_imported: z.boolean(),
+  fbo: fboCompanyProfileSchema.nullable(),
+  members_count: z.number().nullable(),
+  movements_count: z.number().nullable(),
+  grants_out_count: z.number().nullable().optional(),
+  grants_in_count: z.number().nullable().optional(),
+  can: z.object({ update: z.boolean(), updateIdentity: z.boolean() }),
+});

package/src/types/fbo.ts

@@ -36,3 +36,10 @@ export type FboActivityChanges = z.infer<typeof Fbo.fboActivityChangesSchema>;
 export type FboActivity = z.infer<typeof Fbo.fboActivitySchema>;
 export type FboRecurringFlight = z.infer<typeof Fbo.fboRecurringFlightSchema>;
 export type FboMaterialiseResult = z.infer<typeof Fbo.fboMaterialiseResultSchema>;
+export type FboGrantAbility = z.infer<typeof Fbo.fboGrantAbilitySchema>;
+export type FboGrantAbilityOption = z.infer<typeof Fbo.fboGrantAbilityOptionSchema>;
+export type FboGrantCompanyRef = z.infer<typeof Fbo.fboGrantCompanyRefSchema>;
+export type FboCompanyGrant = z.infer<typeof Fbo.fboCompanyGrantSchema>;
+export type FboCompanyGrantInput = z.infer<typeof Fbo.fboCompanyGrantInputSchema>;
+export type FboMeta = z.infer<typeof Fbo.fboMetaSchema>;
+export type FboCompany = z.infer<typeof Fbo.fboCompanySchema>;