@wssto2/vue-core 0.2.0 → 0.4.0

package/dist/index-GcLnFF-z.js

@@ -0,0 +1,706 @@
+import { r as q } from "./route-goWMxDUN.js";
+import { d as Le, p as Ce } from "./feature-DdUAfyi4.js";
+import { d as Re } from "./context-Ch1r4fdN.js";
+import { d as Ee } from "./defineRoutes-BGAdiIrt.js";
+import { useI18n as Q } from "vue-i18n";
+import { a as Ne } from "./error-CD7x0Jrz.js";
+import { u as ve } from "./describeError-Ctga6GcS.js";
+import { defineComponent as Y, ref as D, computed as j, watch as le, openBlock as f, createBlock as S, unref as t, withCtx as h, createElementVNode as N, createElementBlock as g, toDisplayString as k, createCommentVNode as O, createVNode as $, Fragment as K, renderList as P, createSlots as be, renderSlot as Se, createTextVNode as M, useTemplateRef as ne } from "vue";
+import { _ as I } from "./Button.vue_vue_type_script_setup_true_lang-CL9Qh5yq.js";
+import { _ as V } from "./FormGroup.vue_vue_type_script_setup_true_lang-DG2zdG_a.js";
+import { e as U } from "./control-7EP4tjYy.js";
+import { _ as Te } from "./AlertDialog.vue_vue_type_script_setup_true_lang-whA4WLdl.js";
+import { t as ee } from "./toast-D9Z5To38.js";
+import { _ as ce } from "./AccessGate.vue_vue_type_script_setup_true_lang-DcbZBINh.js";
+import { _ as Oe } from "./AsyncSection.vue_vue_type_script_setup_true_lang-Blj6KgCr.js";
+import { u as Ae } from "./useLoad-CYRVx6HW.js";
+import { _ as De, a as Ke } from "./SelectField.vue_vue_type_script_setup_true_lang-7O1BAx04.js";
+import { _ as Be } from "./SegmentedField.vue_vue_type_script_setup_true_lang-BMqWlpsL.js";
+import { u as Pe, _ as Ue } from "./useCommand-BkONMn3X.js";
+import { u as Fe } from "./platform-q3cjODLx.js";
+import { _ as Ge } from "./IconTile.vue_vue_type_script_setup_true_lang-BpIjgu5E.js";
+import { u as Me } from "./mediaQuery-CygcXmFW.js";
+import { _ as Ve } from "./Badge.vue_vue_type_script_setup_true_lang-DJyZc0C7.js";
+const C = {
+  rolesList: q("GET", "/v1/iam/roles", { permission: "iam.role:view" }),
+  rolesShow: q("GET", "/v1/iam/roles/:ref", { permission: "iam.role:view" }),
+  rolesHolders: q("GET", "/v1/iam/roles/:ref/holders", { permission: "iam.role:view" }),
+  rolesCompare: q("GET", "/v1/iam/roles/:ref/compare", { permission: "iam.role:view" }),
+  rolesCreate: q("POST", "/v1/iam/roles", { permission: "iam.role:manage" }),
+  rolesUpdate: q("PUT", "/v1/iam/roles/:ref", { permission: "iam.role:manage" }),
+  rolesDelete: q("DELETE", "/v1/iam/roles/:ref", { permission: "iam.role:delete" }),
+  rolesReplace: q("POST", "/v1/iam/roles/:ref/replace", { permission: "iam.role:manage" }),
+  bindable: q("GET", "/v1/iam/bindable-roles"),
+  subjectsAccess: q("GET", "/v1/iam/users/:id/access", { permission: "iam.user:view" }),
+  subjectsScopes: q("GET", "/v1/iam/users/:id/scopes", { permission: "iam.user:manage" }),
+  subjectsBind: q("POST", "/v1/iam/users/:id/bindings", { permission: "iam.user:manage" }),
+  subjectsUnbind: q("DELETE", "/v1/iam/users/:id/bindings/:binding_id", { permission: "iam.user:manage" }),
+  me: q.raw("GET", "/v1/me/access")
+}, [ze, ae] = Re("vue-core.access"), F = {
+  viewRoles: "iam.role:view",
+  manageRoles: "iam.role:manage",
+  deleteRoles: "iam.role:delete",
+  viewAccess: "iam.user:view",
+  manageBindings: "iam.user:manage"
+}, re = Ee({
+  roles: { name: "access.roles", path: "/iam/roles", component: () => import("./RolesPage-DzGGCMnm.js"), meta: { access: F.viewRoles, titleKey: "core.access.title" } },
+  newRole: { name: "access.roles.new", path: "/iam/roles/new", component: () => import("./NewRolePage-DTOWIxxC.js"), meta: { access: F.manageRoles, titleKey: "core.access.new_title" } },
+  role: {
+    name: "access.role",
+    path: "/iam/roles/:ref",
+    component: () => import("./RolePage-DZk7BZOc.js"),
+    // A role's ref (its key, or the id of a custom one) swaps in place when a link leads to another role.
+    meta: { access: F.viewRoles, titleKey: "core.access.title", remountOnParam: "ref" }
+  }
+}), Xs = {
+  access: F.viewAccess,
+  section: { labelKey: "core.access.person_roles", icon: "shieldStarFill" }
+};
+function Zs(a) {
+  return Le({
+    id: "access",
+    routes: re.records,
+    context: Ce(ze, {
+      catalogue: a.catalogue,
+      subjectRoute: a.subjectRoute ?? (() => null),
+      scopes: a.scopes ?? null
+    }),
+    navigation: a.destination ? [{ destination: a.destination, to: re.roles, within: ["access.role", "access.roles.new"] }] : []
+  });
+}
+const G = "system", ie = ["view", "create", "update", "manage", "delete"], ue = (a) => {
+  const s = ie.indexOf(a);
+  return s === -1 ? ie.length : s;
+}, se = (a) => a.system ? G : a.module, _e = (a) => a.resource === "" ? a.module : `${a.module}_${a.resource.replace(/\./g, "_")}`;
+function ea(a) {
+  const s = /* @__PURE__ */ new Map();
+  for (const [n, l] of Object.entries(a)) {
+    const e = s.get(se(l)) ?? /* @__PURE__ */ new Map(), c = _e(l);
+    e.set(c, [...e.get(c) ?? [], { ...l, id: n }]), s.set(se(l), e);
+  }
+  return [...s.keys()].sort((n, l) => +(n === G) - +(l === G) || n.localeCompare(l)).map((n) => ({
+    key: n,
+    screens: [...s.get(n) ?? []].map(([l, e]) => ({ key: l, permissions: e.sort((c, m) => ue(c.verb) - ue(m.verb) || c.verb.localeCompare(m.verb)) })).sort((l, e) => l.key.localeCompare(e.key))
+  }));
+}
+function He(a, s) {
+  const o = /* @__PURE__ */ new Set(), n = (l) => {
+    for (const e of a[l]?.requires ?? [])
+      o.has(e) || (o.add(e), n(e));
+  };
+  return n(s), [...o];
+}
+function We(a, s) {
+  const o = /* @__PURE__ */ new Set(), n = (l) => {
+    for (const [e, c] of Object.entries(a))
+      o.has(e) || !c.requires.includes(l) || (o.add(e), n(e));
+  };
+  return n(s), [...o];
+}
+function Ie(a, s, o) {
+  const n = Object.entries(a).filter(([e, c]) => c.ownable === o && e in s), l = n.find(([, e]) => e.verb === "view") ?? n[0];
+  return l ? s[l[0]] ?? null : null;
+}
+function Qe(a, s, o) {
+  for (const n of [o, ...He(a, o)]) {
+    if (n in s || !(n in a)) continue;
+    const l = a[n]?.ownable;
+    s[n] = l ? Ie(a, s, l) ?? "own" : "all";
+  }
+}
+function sa(a, s, o) {
+  for (const n of [o, ...We(a, o)]) delete s[n];
+}
+function aa(a, s, o, n) {
+  for (const [l, e] of Object.entries(a)) e.ownable === o && l in s && (s[l] = n);
+}
+function oa(a, s) {
+  const o = new Set(Object.keys(s));
+  for (const n of o) Qe(a, s, n);
+  return Object.keys(s).filter((n) => !o.has(n));
+}
+function J() {
+  const { t: a, te: s } = Q(), { catalogue: o } = ae(), n = (e, c) => {
+    const m = e.find((L) => s(L));
+    return m ? a(m) : c;
+  }, l = (e) => n([`access.levels.${e}`, `core.access.levels.${e}`], e);
+  return {
+    roleName: (e) => e.key ? n([`access.roles.${e.key}`], e.name) : e.name,
+    permissionLabel: (e) => n(o[e]?.labelKey ? [o[e].labelKey] : [], e),
+    permissionDescription: (e) => n(o[e]?.descriptionKey ? [o[e].descriptionKey] : [], ""),
+    groupLabel: (e) => n([`access.modules.${e}`, ...e === G ? ["core.access.system_group"] : []], e),
+    screenLabel: (e) => n([`access.resources.${e}`], e),
+    ownableLabel: (e) => n([`access.ownable.${e.replace(/\./g, "_")}`], e),
+    qualifierLabel: (e) => a(`core.access.qualifier.${e}`),
+    qualifierHint: (e) => a(`core.access.qualifier_hint.${e}`),
+    qualifierNoun: (e) => a(`core.access.qualifier_noun.${e}`),
+    levelLabel: l,
+    /** A place: the level and its name (`Dealer · Auto Zagreb`); the root, which has no name, by its level. */
+    scopeLabel: (e) => e.name ? `${l(e.level)} · ${e.name}` : l(e.level),
+    roleKind: (e) => a(`core.access.role_kind.${e.computed ? "computed" : e.predefined ? "predefined" : "custom"}`)
+  };
+}
+function Ye() {
+  const a = ve();
+  return (s, o) => Ne(o) && o.code?.startsWith("authz.") ? a(o) : void 0;
+}
+function Je(a) {
+  return {
+    roles: async (s) => (await a.request(C.rolesList, void 0, s)).data.roles,
+    role: async (s, o) => (await a.request(C.rolesShow, { ref: s }, o)).data,
+    holders: async (s, o) => (await a.request(C.rolesHolders, { ref: s }, o)).data.holders,
+    compare: async (s, o, n) => (await a.request(C.rolesCompare, { ref: s, with: o }, n)).data,
+    create: async (s) => (await a.request(C.rolesCreate, s)).data,
+    update: async (s) => (await a.request(C.rolesUpdate, s)).data,
+    remove: async (s) => void await a.request(C.rolesDelete, { ref: s }),
+    replace: async (s, o) => (await a.request(C.rolesReplace, { ref: s, with: o })).data.rebound,
+    access: async (s, o) => (await a.request(C.subjectsAccess, { id: s.id }, o)).data,
+    scopes: async (s, o) => (await a.request(C.subjectsScopes, { id: s.id }, o)).data,
+    bindable: async (s, o, n) => (await a.request(C.bindable, { level: s, scope_id: o ?? 0 }, n)).data.roles,
+    bind: async (s, o) => (await a.request(C.subjectsBind, { id: s.id, ...o })).data,
+    unbind: async (s, o) => void await a.request(C.subjectsUnbind, { id: s.id, binding_id: o })
+  };
+}
+const ge = () => Je(Fe().http);
+function Xe(a) {
+  const s = /* @__PURE__ */ new Map();
+  for (const l of a.places) s.set(l.level, l.parent_level);
+  const o = (l) => {
+    const e = [l], c = new Set(e);
+    for (let m = s.get(l); m !== void 0 && m !== a.root_level && s.has(m) && !c.has(m); m = s.get(m))
+      e.unshift(m), c.add(m);
+    return e;
+  }, n = [...s.keys()].map((l) => ({ level: l, chain: o(l) })).sort((l, e) => e.chain.length - l.chain.length || l.level.localeCompare(e.level));
+  return a.root ? [...n, { level: a.root_level, chain: [] }] : n;
+}
+const Ze = (a) => a.filter((s) => s.chain.length > 0).sort((s, o) => s.chain.length - o.chain.length)[0] ?? a[0] ?? null;
+function de(a, s, o, n) {
+  const l = s.chain[o], e = s.chain[o + 1];
+  return a.places.filter(
+    (c) => c.level === l && (o === 0 || c.parent_level === s.chain[o - 1] && c.parent_id === n[o - 1]) && (e === void 0 || a.places.some((m) => m.level === e && m.parent_id === c.id))
+  );
+}
+const es = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "add-role-sheet"
+}, ss = {
+  key: 0,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "scopes-failed"
+}, as = {
+  key: 1,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "no-places"
+}, os = {
+  key: 0,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-loading"
+}, ts = {
+  key: 1,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "roles-failed"
+}, ls = {
+  key: 2,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-none"
+}, ns = {
+  key: 3,
+  "data-test": "bindable-roles"
+}, cs = { class: "px-row-inset pb-1.5 text-footnote uppercase tracking-wide text-content-muted" }, rs = {
+  key: 4,
+  "data-test": "chosen-role"
+}, is = /* @__PURE__ */ Y({
+  __name: "AddRoleDialog",
+  props: {
+    subject: {},
+    subjectLabel: {}
+  },
+  emits: ["added"],
+  setup(a, { expose: s, emit: o }) {
+    const n = a, l = o, { t: e } = Q(), c = J(), m = ge(), { catalogue: L, scopes: x } = ae(), R = Pe({
+      defaults: () => ({ level: null, place: null, role: null }),
+      validator: {
+        safeParse(i) {
+          const d = i, u = [
+            ...d.level === null || d.level !== p.value?.root_level && d.place === null ? [{ path: ["level"], message: e("core.access.add.choose_place") }] : [],
+            ...d.role === null ? [{ path: ["role"], message: e("core.access.add.choose_role") }] : []
+          ];
+          return u.length === 0 ? { success: !0, data: { level: d.level, place: d.place, role: d.role } } : { success: !1, error: { issues: u } };
+        }
+      },
+      failureMessage: Ye(),
+      run: (i) => m.bind(n.subject, { role_ref: i.role, level: i.level, scope_id: i.place }),
+      done: (i) => {
+        ee.success(e("core.access.added")), l("added", i);
+      }
+    }), r = R.form.values, p = D(null), _ = D(!1), b = D([]), v = D([]), y = D(!1), w = D(!1), E = j(() => p.value ? Xe(p.value) : []), A = j(() => E.value.find((i) => i.level === r.level) ?? null), he = j(() => E.value.length > 1), ye = j(() => {
+      const i = p.value, d = A.value;
+      return i && d ? d.chain.map((u, B) => ({ name: u, places: de(i, d, B, b.value) })) : [];
+    }), we = j(() => {
+      const i = A.value?.chain.length ?? 0, d = i ? b.value[i - 1] : null;
+      return p.value?.places.find((u) => u.level === A.value?.level && u.id === d)?.name ?? null;
+    }), X = j(() => A.value !== null && A.value.chain.every((i, d) => b.value[d] != null));
+    function oe(i) {
+      r.level = i, b.value = [], r.place = null;
+    }
+    function te(i, d) {
+      const u = b.value.slice(0, i);
+      u[i] = d, b.value = u;
+    }
+    le([() => r.level, b, p], () => {
+      const i = p.value, d = A.value;
+      if (!(!i || !d)) {
+        for (let u = 0; u < d.chain.length; u++) {
+          if (b.value[u] != null) continue;
+          const B = de(i, d, u, b.value);
+          B.length === 1 && B[0] && te(u, B[0].id);
+          break;
+        }
+        r.place = d.chain.length === 0 ? null : b.value[d.chain.length - 1] ?? null;
+      }
+    }, { deep: !0 });
+    async function ke() {
+      if (r.role = null, v.value = [], w.value = !1, !A.value || !X.value) return;
+      y.value = !0;
+      const i = `${r.level}:${r.place}`;
+      try {
+        const d = await m.bindable(A.value.level, r.place);
+        i === `${r.level}:${r.place}` && (v.value = d);
+      } catch {
+        i === `${r.level}:${r.place}` && (w.value = !0);
+      } finally {
+        y.value = !1;
+      }
+    }
+    le([() => r.level, () => r.place, X], () => void ke());
+    const $e = j(() => v.value.map((i) => ({ value: i.ref, label: c.roleName(i), description: c.roleKind(i) }))), z = j(() => v.value.find((i) => i.ref === r.role) ?? null), xe = j(() => {
+      const i = /* @__PURE__ */ new Map();
+      for (const d of z.value?.grants ?? []) {
+        const u = L[d.permission]?.ownable;
+        u && (!i.has(u) || d.permission.endsWith(":view")) && i.set(u, d.qualifier);
+      }
+      return [...i].map(([d, u]) => ({ ownable: d, qualifier: u }));
+    }), qe = j(() => c.scopeLabel({ level: r.level ?? p.value?.root_level ?? "", name: we.value }));
+    async function je() {
+      p.value = null, _.value = !1, b.value = [], v.value = [], R.present();
+      try {
+        p.value = x ? await x(n.subject, new AbortController().signal) : await m.scopes(n.subject);
+      } catch {
+        _.value = !0;
+        return;
+      }
+      const i = Ze(E.value);
+      i && oe(i.level);
+    }
+    return s({ present: je }), (i, d) => (f(), S(t(Ue), {
+      command: t(R),
+      title: t(e)("core.access.add_role"),
+      subtitle: n.subjectLabel,
+      size: "lg",
+      "confirm-label": t(e)("core.access.add.confirm")
+    }, {
+      default: h(() => [
+        N("div", es, [
+          _.value ? (f(), g("p", ss, k(t(e)("core.access.add.scopes_failed")), 1)) : p.value && E.value.length === 0 ? (f(), g("p", as, k(t(e)("core.access.add.no_places")), 1)) : O("", !0),
+          he.value ? (f(), S(t(V), {
+            key: 2,
+            header: t(e)("core.access.add.scope_header")
+          }, {
+            default: h(() => [
+              $(t(Be), {
+                "model-value": t(r).level,
+                label: t(e)("core.access.add.scope_level"),
+                options: E.value.map((u) => ({ value: u.level, label: t(c).levelLabel(u.level) })),
+                "onUpdate:modelValue": d[0] || (d[0] = (u) => oe(u))
+              }, null, 8, ["model-value", "label", "options"]),
+              (f(!0), g(K, null, P(ye.value, (u, B) => (f(), S(t(De), {
+                key: u.name,
+                "model-value": b.value[B] ?? null,
+                label: t(c).levelLabel(u.name),
+                options: u.places.map((H) => ({ value: H.id, label: H.name })),
+                "onUpdate:modelValue": (H) => te(B, H)
+              }, null, 8, ["model-value", "label", "options", "onUpdate:modelValue"]))), 128))
+            ]),
+            _: 1
+          }, 8, ["header"])) : O("", !0),
+          X.value ? (f(), g(K, { key: 3 }, [
+            y.value ? (f(), g("p", os, k(t(e)("core.access.add.roles_loading")), 1)) : w.value ? (f(), g("p", ts, k(t(e)("core.access.add.roles_failed")), 1)) : v.value.length === 0 ? (f(), g("p", ls, k(t(e)("core.access.add.no_roles")), 1)) : (f(), g("div", ns, [
+              N("p", cs, k(t(e)("core.access.add.role")), 1),
+              $(t(Ke), {
+                options: $e.value,
+                "model-value": t(r).role,
+                onSelect: d[1] || (d[1] = (u) => t(r).role = u)
+              }, null, 8, ["options", "model-value"])
+            ]))
+          ], 64)) : O("", !0),
+          z.value ? (f(), g("div", rs, [
+            $(t(V), {
+              header: t(e)("core.access.add.role_gives"),
+              footer: t(e)("core.access.add.role_gives_footer")
+            }, {
+              default: h(() => [
+                $(t(U), {
+                  layout: "setting",
+                  label: t(c).roleName(z.value),
+                  sub: z.value.description
+                }, null, 8, ["label", "sub"]),
+                (f(!0), g(K, null, P(xe.value, (u) => (f(), S(t(U), {
+                  key: u.ownable,
+                  layout: "setting",
+                  label: t(c).ownableLabel(u.ownable),
+                  value: `${t(c).qualifierNoun(u.qualifier)} · ${qe.value}`
+                }, null, 8, ["label", "value"]))), 128))
+              ]),
+              _: 1
+            }, 8, ["header", "footer"])
+          ])) : O("", !0)
+        ])
+      ]),
+      _: 1
+    }, 8, ["command", "title", "subtitle", "confirm-label"]));
+  }
+}), us = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "binding-scope"
+}, ds = /* @__PURE__ */ Y({
+  __name: "BindingRow",
+  props: {
+    binding: {}
+  },
+  setup(a) {
+    const s = a, o = J(), n = j(() => [o.roleKind(s.binding.role), ...s.binding.role.attrs.map((l) => `${l.attribute}: ${l.values.join(", ")}`)].join(" · "));
+    return (l, e) => (f(), S(t(U), {
+      layout: "setting",
+      label: t(o).roleName(s.binding.role),
+      sub: n.value
+    }, be({
+      leading: h(() => [
+        $(t(Ge), {
+          tone: s.binding.role.predefined ? "anchor" : "brand",
+          icon: "shieldStarFill"
+        }, null, 8, ["tone"])
+      ]),
+      default: h(() => [
+        N("span", us, k(t(o).scopeLabel(s.binding.scope)), 1)
+      ]),
+      _: 2
+    }, [
+      l.$slots.trailing ? {
+        name: "trailing",
+        fn: h(() => [
+          Se(l.$slots, "trailing")
+        ]),
+        key: "0"
+      } : void 0
+    ]), 1032, ["label", "sub"]));
+  }
+}), me = { own: 0, own_location: 1, all: 2 }, fe = (a, s) => me[s] > me[a] ? s : a, W = (a) => `${a.level}:${a.id ?? ""}`, Z = ["view", "create", "update", "manage", "delete"], pe = (a) => Z.includes(a) ? Z.indexOf(a) : Z.length;
+function ms(a, s) {
+  const o = /* @__PURE__ */ new Map();
+  for (const l of s) {
+    if (l.grants.length === 0) continue;
+    const e = a[l.permission], [c = l.permission, m = ""] = l.permission.split(":"), L = e ? se(e) : c.split(".")[0] ?? c, x = e ? _e(e) : c.replace(/\./g, "_"), T = e?.ownable != null, R = o.get(L) ?? /* @__PURE__ */ new Map(), r = R.get(x) ?? { key: x, actions: [], sources: [], qualifier: null, scopes: [], ownable: !1, allUnavailable: !0 };
+    r.actions.push({ permission: l.permission, verb: e?.verb ?? m, unavailable: l.unavailable, grants: l.grants }), r.ownable || (r.ownable = T), r.allUnavailable && (r.allUnavailable = l.unavailable);
+    for (const p of l.grants) {
+      const _ = T ? p.qualifier : "all";
+      r.scopes.some((v) => W(v) === W(p.scope)) || r.scopes.push(p.scope), T && (r.qualifier = r.qualifier ? fe(r.qualifier, _) : _);
+      const b = r.sources.find((v) => v.roleName === p.role_name && W(v.scope) === W(p.scope));
+      b ? T && (r.sources[r.sources.indexOf(b)] = { ...b, qualifier: fe(b.qualifier, _) }) : r.sources.push({ roleKey: p.role_key, roleName: p.role_name, qualifier: _, scope: p.scope });
+    }
+    R.set(x, r), o.set(L, R);
+  }
+  return [...o.keys()].sort((l, e) => +(l === G) - +(e === G) || l.localeCompare(e)).map((l) => ({
+    key: l,
+    screens: [...o.get(l)?.values() ?? []].map((e) => ({
+      ...e,
+      actions: [...e.actions].sort((c, m) => pe(c.verb) - pe(m.verb) || c.verb.localeCompare(m.verb)),
+      // the root (the place without an id) first: what applies everywhere is what a reader looks for
+      scopes: [...e.scopes].sort((c, m) => +(m.id === null) - +(c.id === null))
+    })).sort((e, c) => e.key.localeCompare(c.key))
+  }));
+}
+const fs = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "effective-access"
+}, ps = { class: "px-row-inset text-title3 font-semibold text-content-strong" }, vs = {
+  class: "block",
+  "data-test": "effective-actions"
+}, bs = {
+  class: "block",
+  "data-test": "effective-sources"
+}, _s = {
+  key: 0,
+  class: "mt-2 flex flex-col gap-1.5 border-l border-border-separator pl-3",
+  "data-test": "effective-why"
+}, gs = ["data-permission"], hs = { class: "text-content" }, ys = {
+  key: 0,
+  class: "ml-2 text-content-muted"
+}, ws = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-unavailable"
+}, ks = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "effective-reach"
+}, $s = ["data-test"], xs = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-show-all"
+}, qs = /* @__PURE__ */ Y({
+  __name: "EffectiveAccess",
+  props: {
+    effective: {},
+    name: {}
+  },
+  setup(a) {
+    const s = a, { t: o } = Q(), { catalogue: n } = ae(), l = J(), e = Me(), c = j(() => ms(n, s.effective)), m = D(!1), L = j(() => e.value && !m.value ? c.value.slice(0, 3) : c.value), x = D({}), T = (p) => p.actions.map((_) => l.permissionLabel(_.permission)).join(" · "), R = (p) => p.sources.map((_) => {
+      const b = l.roleName({ key: _.roleKey, name: _.roleName });
+      return p.ownable ? `${b} (${l.qualifierNoun(_.qualifier).toLowerCase()})` : b;
+    }).join(", "), r = (p) => [p.qualifier ? l.qualifierNoun(p.qualifier) : "", p.scopes.map((_) => l.scopeLabel(_)).join(", ")].filter(Boolean).join(" · ");
+    return (p, _) => (f(), g("section", fs, [
+      N("h2", ps, k(t(o)("core.access.effective.title", { name: s.name })), 1),
+      c.value.length === 0 ? (f(), S(t(V), {
+        key: 0,
+        footer: t(o)("core.access.effective.footer")
+      }, {
+        default: h(() => [
+          $(t(U), {
+            layout: "setting",
+            label: t(o)("core.access.effective.empty")
+          }, null, 8, ["label"])
+        ]),
+        _: 1
+      }, 8, ["footer"])) : (f(), g(K, { key: 1 }, [
+        (f(!0), g(K, null, P(L.value, (b) => (f(), S(t(V), {
+          key: b.key,
+          header: t(l).groupLabel(b.key),
+          footer: b === L.value[L.value.length - 1] ? t(o)("core.access.effective.footer") : void 0
+        }, {
+          default: h(() => [
+            (f(!0), g(K, null, P(b.screens, (v) => (f(), S(t(U), {
+              key: v.key,
+              layout: "setting",
+              label: t(l).screenLabel(v.key)
+            }, {
+              sub: h(() => [
+                N("span", vs, k(T(v)), 1),
+                N("span", bs, k(t(o)("core.access.effective.from_roles", { roles: R(v) })), 1),
+                x.value[v.key] ? (f(), g("ul", _s, [
+                  (f(!0), g(K, null, P(v.actions, (y) => (f(), g("li", {
+                    key: y.permission,
+                    "data-permission": y.permission
+                  }, [
+                    N("span", hs, k(t(l).permissionLabel(y.permission)), 1),
+                    y.unavailable ? (f(), g("span", ys, k(t(o)("core.access.effective.unavailable")), 1)) : O("", !0),
+                    (f(!0), g(K, null, P(y.grants, (w) => (f(), g("span", {
+                      key: `${w.binding_id}-${w.scope.level}-${w.scope.id ?? 0}`,
+                      class: "block text-content-muted"
+                    }, k(t(o)("core.access.effective.why_row", {
+                      role: t(l).roleName({ key: w.role_key, name: w.role_name }),
+                      whose: t(l).qualifierNoun(v.ownable ? w.qualifier : "all"),
+                      scope: t(l).scopeLabel(w.scope)
+                    })), 1))), 128))
+                  ], 8, gs))), 128))
+                ])) : O("", !0)
+              ]),
+              default: h(() => [
+                v.allUnavailable ? (f(), g("span", ws, [
+                  $(t(Ve), { tone: "warning" }, {
+                    default: h(() => [
+                      M(k(t(o)("core.access.effective.unavailable")), 1)
+                    ]),
+                    _: 1
+                  })
+                ])) : O("", !0),
+                N("span", ks, k(r(v)), 1),
+                N("span", {
+                  class: "contents",
+                  "data-test": `why-${v.key}`
+                }, [
+                  $(t(I), {
+                    prominence: "secondary",
+                    size: "sm",
+                    onClick: (y) => x.value[v.key] = !x.value[v.key]
+                  }, {
+                    default: h(() => [
+                      M(k(x.value[v.key] ? t(o)("core.access.effective.hide_why") : t(o)("core.access.effective.show_why")), 1)
+                    ]),
+                    _: 2
+                  }, 1032, ["onClick"])
+                ], 8, $s)
+              ]),
+              _: 2
+            }, 1032, ["label"]))), 128))
+          ]),
+          _: 2
+        }, 1032, ["header", "footer"]))), 128)),
+        t(e) && c.value.length > 3 ? (f(), g("span", xs, [
+          $(t(I), {
+            prominence: "secondary",
+            class: "self-center",
+            onClick: _[0] || (_[0] = (b) => m.value = !m.value)
+          }, {
+            default: h(() => [
+              M(k(m.value ? t(o)("core.access.effective.fewer_modules") : t(o)("core.access.effective.all_modules", { count: c.value.length })), 1)
+            ]),
+            _: 1
+          })
+        ])) : O("", !0)
+      ], 64))
+    ]));
+  }
+}), js = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "access-panel"
+}, Ls = ["data-test"], Cs = {
+  class: "contents",
+  "data-test": "add-role"
+}, ta = /* @__PURE__ */ Y({
+  __name: "PersonAccess",
+  props: {
+    subject: {},
+    name: {},
+    subjectLabel: {}
+  },
+  emits: ["loaded"],
+  setup(a, { expose: s, emit: o }) {
+    const n = a, l = o, { t: e } = Q(), c = J(), m = ve(), L = ge(), x = Ae(async ({ signal: v }) => {
+      const y = await L.access(n.subject, { signal: v });
+      return l("loaded", y.bindings.length), y;
+    }, { watch: () => n.subject.id }), T = ne("addDialog"), R = ne("removeDialog");
+    async function r(v) {
+      await L.unbind(n.subject, v.id), ee.success(e("core.access.removed")), await x.reload();
+    }
+    const p = (v) => ee.error(m(v, { fallback: e("core.access.remove_failed") })), _ = D(null), b = j(() => _.value ? e("core.access.remove_body", { name: n.name, role: c.roleName(_.value.role), scope: c.scopeLabel(_.value.scope) }) : "");
+    return s({ reload: x.reload }), (v, y) => (f(), g("div", js, [
+      $(t(Oe), {
+        state: t(x).state.value,
+        "skeleton-rows": 6,
+        "is-empty": () => !1,
+        onRetry: y[1] || (y[1] = (w) => t(x).reload())
+      }, {
+        default: h(({ value: w }) => [
+          $(t(V), {
+            header: t(e)("core.access.person_roles"),
+            footer: t(e)("core.access.roles_footer")
+          }, {
+            default: h(() => [
+              w.bindings.length === 0 ? (f(), S(t(U), {
+                key: 0,
+                layout: "setting",
+                label: t(e)("core.access.no_roles_title"),
+                sub: t(e)("core.access.no_roles_description")
+              }, null, 8, ["label", "sub"])) : O("", !0),
+              (f(!0), g(K, null, P(w.bindings, (E) => (f(), S(ds, {
+                key: E.id,
+                binding: E
+              }, be({ _: 2 }, [
+                w.can_manage ? {
+                  name: "trailing",
+                  fn: h(() => [
+                    $(t(ce), {
+                      permission: t(F).manageBindings
+                    }, {
+                      default: h(() => [
+                        N("span", {
+                          class: "contents",
+                          "data-test": `remove-binding-${E.id}`
+                        }, [
+                          $(t(I), {
+                            tone: "critical",
+                            prominence: "secondary",
+                            size: "sm",
+                            onClick: (A) => (_.value = E, R.value?.present(E))
+                          }, {
+                            default: h(() => [
+                              M(k(t(e)("core.access.remove")), 1)
+                            ]),
+                            _: 1
+                          }, 8, ["onClick"])
+                        ], 8, Ls)
+                      ]),
+                      _: 2
+                    }, 1032, ["permission"])
+                  ]),
+                  key: "0"
+                } : void 0
+              ]), 1032, ["binding"]))), 128)),
+              w.can_manage ? (f(), S(t(ce), {
+                key: 1,
+                permission: t(F).manageBindings
+              }, {
+                default: h(() => [
+                  $(t(U), { layout: "stacked" }, {
+                    default: h(() => [
+                      N("span", Cs, [
+                        $(t(I), {
+                          prominence: "secondary",
+                          icon: "addLine",
+                          onClick: y[0] || (y[0] = (E) => T.value?.present())
+                        }, {
+                          default: h(() => [
+                            M(k(t(e)("core.access.add_role")), 1)
+                          ]),
+                          _: 1
+                        })
+                      ])
+                    ]),
+                    _: 1
+                  })
+                ]),
+                _: 1
+              }, 8, ["permission"])) : O("", !0)
+            ]),
+            _: 2
+          }, 1032, ["header", "footer"]),
+          $(qs, {
+            effective: w.effective,
+            name: n.name
+          }, null, 8, ["effective", "name"])
+        ]),
+        _: 1
+      }, 8, ["state"]),
+      $(is, {
+        ref_key: "addDialog",
+        ref: T,
+        subject: n.subject,
+        "subject-label": n.subjectLabel ?? n.name,
+        onAdded: y[2] || (y[2] = (w) => t(x).reload())
+      }, null, 8, ["subject", "subject-label"]),
+      $(t(Te), {
+        ref_key: "removeDialog",
+        ref: R,
+        tone: "critical",
+        title: t(e)("core.access.remove_title"),
+        message: b.value,
+        "confirm-label": t(e)("core.access.remove"),
+        action: r,
+        onFailed: p
+      }, null, 8, ["title", "message", "confirm-label"])
+    ]));
+  }
+});
+export {
+  ds as _,
+  ge as a,
+  F as b,
+  re as c,
+  ae as d,
+  se as e,
+  Ye as f,
+  Qe as g,
+  oa as h,
+  ta as i,
+  Zs as j,
+  C as k,
+  We as l,
+  Xs as m,
+  He as n,
+  Ie as o,
+  ea as p,
+  sa as r,
+  aa as s,
+  J as u
+};