@wssto2/vue-core 0.4.27 → 0.5.0

package/dist/index-WkbzC_ee.js

@@ -0,0 +1,745 @@
+import { route as E } from "./client/index.js";
+import { d as Re, p as Ee } from "./feature-DdUAfyi4.js";
+import { d as Ne } from "./context-Ch1r4fdN.js";
+import { d as Se } from "./defineRoutes-BGAdiIrt.js";
+import { useI18n as z } from "vue-i18n";
+import { hasInjectionContext as Te, inject as Oe, defineComponent as J, ref as A, computed as N, watch as ce, openBlock as m, createBlock as T, unref as l, withCtx as h, createElementVNode as O, createElementBlock as _, toDisplayString as $, createCommentVNode as D, createVNode as j, Fragment as K, renderList as B, createSlots as _e, renderSlot as Ae, createTextVNode as G, useTemplateRef as re } from "vue";
+import { i as oe } from "./error-Bb_dr_Ay.js";
+import { u as De } from "./describeError-BqGAUZgX.js";
+import { _ as Y } from "./Button.vue_vue_type_script_setup_true_lang-CL9Qh5yq.js";
+import { _ as V } from "./FormGroup.vue_vue_type_script_setup_true_lang-BPchlRCl.js";
+import { g as U } from "./options-g8RwEhBk.js";
+import { _ as Ke } from "./AlertDialog.vue_vue_type_script_setup_true_lang-whA4WLdl.js";
+import { t as ee } from "./toast-CqSDTWRX.js";
+import { _ as ie } from "./AccessGate.vue_vue_type_script_setup_true_lang-Nw1IsB8N.js";
+import { _ as Pe } from "./AsyncSection.vue_vue_type_script_setup_true_lang-B0NfvG3B.js";
+import { _ as Be } from "./EmptyState.vue_vue_type_script_setup_true_lang-50p-Mp8I.js";
+import { u as Ue } from "./useLoad-W4tfxmm5.js";
+import { _ as Fe, a as Me } from "./SelectField.vue_vue_type_script_setup_true_lang-BzQC1qDQ.js";
+import { _ as Ge } from "./SegmentedField.vue_vue_type_script_setup_true_lang-BwyMvkis.js";
+import { u as Ve, _ as ze } from "./useCommand-CtqheKUv.js";
+import { u as He } from "./platform-Dl1fbScN.js";
+import { _ as We } from "./IconTile.vue_vue_type_script_setup_true_lang-_FXvaj93.js";
+import { u as Ie } from "./mediaQuery-CygcXmFW.js";
+import { _ as Qe } from "./Badge.vue_vue_type_script_setup_true_lang-DJyZc0C7.js";
+const S = {
+  rolesList: E("GET", "/v1/iam/roles", { permission: "iam.role:view" }),
+  rolesShow: E("GET", "/v1/iam/roles/:ref", { permission: "iam.role:view" }),
+  rolesHolders: E("GET", "/v1/iam/roles/:ref/holders", { permission: "iam.role:view" }),
+  rolesCompare: E("GET", "/v1/iam/roles/:ref/compare", { permission: "iam.role:view" }),
+  rolesCreate: E("POST", "/v1/iam/roles", { permission: "iam.role:manage" }),
+  rolesUpdate: E("PUT", "/v1/iam/roles/:ref", { permission: "iam.role:manage" }),
+  rolesDelete: E("DELETE", "/v1/iam/roles/:ref", { permission: "iam.role:delete" }),
+  rolesReplace: E("POST", "/v1/iam/roles/:ref/replace", { permission: "iam.role:manage" }),
+  bindable: E("GET", "/v1/iam/bindable-roles"),
+  subjectsAccess: E("GET", "/v1/iam/users/:id/access", { permission: "iam.user:view" }),
+  subjectsScopes: E("GET", "/v1/iam/users/:id/scopes", { permission: "iam.user:manage" }),
+  subjectsBind: E("POST", "/v1/iam/users/:id/bindings", { permission: "iam.user:manage" }),
+  subjectsUnbind: E("DELETE", "/v1/iam/users/:id/bindings/:binding_id", { permission: "iam.user:manage" }),
+  me: E.raw("GET", "/v1/me/access")
+}, [ge, ae] = Ne("vue-core.access"), F = {
+  viewRoles: "iam.role:view",
+  manageRoles: "iam.role:manage",
+  deleteRoles: "iam.role:delete",
+  viewAccess: "iam.user:view",
+  manageBindings: "iam.user:manage"
+}, ue = Se({
+  roles: { name: "access.roles", path: "/iam/roles", component: () => import("./RolesPage-BRdG-OSL.js"), meta: { access: F.viewRoles, titleKey: "core.access.title" } },
+  newRole: { name: "access.roles.new", path: "/iam/roles/new", component: () => import("./NewRolePage-CRZoUajV.js"), meta: { access: F.manageRoles, titleKey: "core.access.new_title" } },
+  role: {
+    name: "access.role",
+    path: "/iam/roles/:ref",
+    component: () => import("./RolePage-B9t586Q8.js"),
+    // A role's ref (its key, or the id of a custom one) swaps in place when a link leads to another role.
+    meta: { access: F.viewRoles, titleKey: "core.access.title", remountOnParam: "ref" }
+  }
+}), to = {
+  access: F.viewAccess,
+  section: { labelKey: "core.access.person_roles", icon: "shieldStarFill" }
+};
+function lo(s) {
+  return Re({
+    id: "access",
+    routes: ue.records,
+    context: Ee(ge, {
+      catalogue: s.catalogue,
+      subjectRoute: s.subjectRoute ?? (() => null),
+      constraints: s.roleConstraints ?? [],
+      problems: s.problems ?? {},
+      scopes: s.scopes ?? null
+    }),
+    navigation: s.destination ? [{ destination: s.destination, to: ue.roles, within: ["access.role", "access.roles.new"] }] : []
+  });
+}
+const M = "system", de = ["view", "create", "update", "manage", "delete"], me = (s) => {
+  const o = de.indexOf(s);
+  return o === -1 ? de.length : o;
+}, se = (s) => s.system ? M : s.module, ye = (s) => s.resource === "" ? s.module : `${s.module}_${s.resource.replace(/\./g, "_")}`;
+function no(s) {
+  const o = /* @__PURE__ */ new Map();
+  for (const [n, t] of Object.entries(s)) {
+    const e = o.get(se(t)) ?? /* @__PURE__ */ new Map(), c = ye(t);
+    e.set(c, [...e.get(c) ?? [], { ...t, id: n }]), o.set(se(t), e);
+  }
+  return [...o.keys()].sort((n, t) => +(n === M) - +(t === M) || n.localeCompare(t)).map((n) => ({
+    key: n,
+    screens: [...o.get(n) ?? []].map(([t, e]) => ({ key: t, permissions: e.sort((c, u) => me(c.verb) - me(u.verb) || c.verb.localeCompare(u.verb)) })).sort((t, e) => t.key.localeCompare(e.key))
+  }));
+}
+function Ye(s, o) {
+  const a = /* @__PURE__ */ new Set(), n = (t) => {
+    for (const e of s[t]?.requires ?? [])
+      a.has(e) || (a.add(e), n(e));
+  };
+  return n(o), [...a];
+}
+function Je(s, o) {
+  const a = /* @__PURE__ */ new Set(), n = (t) => {
+    for (const [e, c] of Object.entries(s))
+      a.has(e) || !c.requires.includes(t) || (a.add(e), n(e));
+  };
+  return n(o), [...a];
+}
+function Xe(s, o, a) {
+  const n = Object.entries(s).filter(([e, c]) => c.ownable === a && e in o), t = n.find(([, e]) => e.verb === "view") ?? n[0];
+  return t ? o[t[0]] ?? null : null;
+}
+function Ze(s, o, a) {
+  for (const n of [a, ...Ye(s, a)]) {
+    if (n in o || !(n in s)) continue;
+    const t = s[n]?.ownable;
+    o[n] = t ? Xe(s, o, t) ?? "own" : "all";
+  }
+}
+function co(s, o, a) {
+  for (const n of [a, ...Je(s, a)]) delete o[n];
+}
+function ro(s, o, a, n) {
+  for (const [t, e] of Object.entries(s)) e.ownable === a && t in o && (o[t] = n);
+}
+function io(s, o) {
+  const a = new Set(Object.keys(o));
+  for (const n of a) Ze(s, o, n);
+  return Object.keys(o).filter((n) => !a.has(n));
+}
+function H() {
+  const { t: s, te: o } = z(), { catalogue: a } = ae(), n = (e, c) => {
+    const u = e.find((q) => o(q));
+    return u ? s(u) : c;
+  }, t = (e) => n([`access.levels.${e}`, `core.access.levels.${e}`], e);
+  return {
+    roleName: (e) => e.key ? n([`access.roles.${e.key}`], e.name) : e.name,
+    permissionLabel: (e) => n(a[e]?.labelKey ? [a[e].labelKey] : [], e),
+    permissionDescription: (e) => n(a[e]?.descriptionKey ? [a[e].descriptionKey] : [], ""),
+    groupLabel: (e) => n([`access.modules.${e}`, ...e === M ? ["core.access.system_group"] : []], e),
+    screenLabel: (e) => n([`access.resources.${e}`], e),
+    ownableLabel: (e) => n([`access.ownable.${e.replace(/\./g, "_")}`], e),
+    qualifierLabel: (e) => s(`core.access.qualifier.${e}`),
+    qualifierHint: (e) => s(`core.access.qualifier_hint.${e}`),
+    qualifierNoun: (e) => s(`core.access.qualifier_noun.${e}`),
+    levelLabel: t,
+    /** A place: the level and its name (`Dealer · Auto Zagreb`); the root, which has no name, by its level. */
+    scopeLabel: (e) => e.name ? `${t(e.level)} · ${e.name}` : t(e.level),
+    roleKind: (e) => s(`core.access.role_kind.${e.computed ? "computed" : e.predefined ? "predefined" : "custom"}`)
+  };
+}
+function es(s) {
+  if (!oe(s) || s.code !== "authz.invalid") return [];
+  const o = s.params?.problems;
+  return Array.isArray(o) ? o.flatMap((a) => {
+    if (typeof a != "object" || a === null || typeof a.code != "string") return [];
+    const { code: n, permission: t, detail: e } = a;
+    return [{ code: n, ...typeof t == "string" ? { permission: t } : {}, ...typeof e == "string" ? { detail: e } : {} }];
+  }) : [];
+}
+function he() {
+  const { t: s, te: o } = z(), a = De(), n = Te() ? Oe(ge, null) : null, t = n ? H() : null;
+  return (e, c) => {
+    const u = es(e);
+    if (u.length === 0) return a(e, c);
+    const q = u.map((g) => {
+      const L = [n?.problems[g.code], `core.access.problems.${g.code}`].find((r) => r && o(r)), R = { code: g.code, permission: g.permission ? t?.permissionLabel(g.permission) ?? g.permission : "", detail: g.detail ?? "" };
+      return s(L ?? "core.access.problems.unknown", R);
+    });
+    return [...new Set(q)].join(" ");
+  };
+}
+function ss() {
+  const s = he();
+  return (o, a) => oe(a) && a.code?.startsWith("authz.") ? s(a) : void 0;
+}
+function os(s) {
+  return {
+    roles: async (o) => (await s.request(S.rolesList, void 0, o)).data.roles,
+    role: async (o, a) => (await s.request(S.rolesShow, { ref: o }, a)).data,
+    holders: async (o, a) => (await s.request(S.rolesHolders, { ref: o }, a)).data.holders,
+    compare: async (o, a, n) => (await s.request(S.rolesCompare, { ref: o, with: a }, n)).data,
+    create: async (o) => (await s.request(S.rolesCreate, o)).data,
+    update: async (o) => (await s.request(S.rolesUpdate, o)).data,
+    remove: async (o) => void await s.request(S.rolesDelete, { ref: o }),
+    replace: async (o, a) => (await s.request(S.rolesReplace, { ref: o, with: a })).data.rebound,
+    access: async (o, a) => (await s.request(S.subjectsAccess, { id: o.id }, a)).data,
+    scopes: async (o, a) => (await s.request(S.subjectsScopes, { id: o.id }, a)).data,
+    bindable: async (o, a, n) => (await s.request(S.bindable, { level: o, scope_id: a ?? 0 }, n)).data.roles,
+    bind: async (o, a) => (await s.request(S.subjectsBind, { id: o.id, ...a })).data,
+    unbind: async (o, a) => void await s.request(S.subjectsUnbind, { id: o.id, binding_id: a })
+  };
+}
+const we = () => os(He().http);
+function as(s) {
+  const o = /* @__PURE__ */ new Map();
+  for (const t of s.places) o.set(t.level, t.parent_level);
+  const a = (t) => {
+    const e = [t], c = new Set(e);
+    for (let u = o.get(t); u !== void 0 && u !== s.root_level && o.has(u) && !c.has(u); u = o.get(u))
+      e.unshift(u), c.add(u);
+    return e;
+  }, n = [...o.keys()].map((t) => ({ level: t, chain: a(t) })).sort((t, e) => e.chain.length - t.chain.length || t.level.localeCompare(e.level));
+  return s.root ? [...n, { level: s.root_level, chain: [] }] : n;
+}
+const ts = (s) => s.filter((o) => o.chain.length > 0).sort((o, a) => o.chain.length - a.chain.length)[0] ?? s[0] ?? null;
+function fe(s, o, a, n) {
+  const t = o.chain[a], e = o.chain[a + 1];
+  return s.places.filter(
+    (c) => c.level === t && (a === 0 || c.parent_level === o.chain[a - 1] && c.parent_id === n[a - 1]) && (e === void 0 || s.places.some((u) => u.level === e && u.parent_id === c.id))
+  );
+}
+const ls = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "add-role-sheet"
+}, ns = {
+  key: 0,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "scopes-failed"
+}, cs = {
+  key: 1,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "no-places"
+}, rs = {
+  key: 0,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-loading"
+}, is = {
+  key: 1,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "roles-failed"
+}, us = {
+  key: 2,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-none"
+}, ds = {
+  key: 3,
+  "data-test": "bindable-roles"
+}, ms = { class: "px-row-inset pb-1.5 text-footnote uppercase tracking-wide text-content-muted" }, fs = {
+  key: 4,
+  "data-test": "chosen-role"
+}, ps = /* @__PURE__ */ J({
+  __name: "AddRoleDialog",
+  props: {
+    subject: {},
+    subjectLabel: {}
+  },
+  emits: ["added"],
+  setup(s, { expose: o, emit: a }) {
+    const n = s, t = a, { t: e } = z(), c = H(), u = we(), { catalogue: q, scopes: g } = ae(), R = Ve({
+      defaults: () => ({ level: null, place: null, role: null }),
+      validator: {
+        safeParse(i) {
+          const f = i, d = [
+            ...f.level === null || f.level !== p.value?.root_level && f.place === null ? [{ path: ["level"], message: e("core.access.add.choose_place") }] : [],
+            ...f.role === null ? [{ path: ["role"], message: e("core.access.add.choose_role") }] : []
+          ];
+          return d.length === 0 ? { success: !0, data: { level: f.level, place: f.place, role: f.role } } : { success: !1, error: { issues: d } };
+        }
+      },
+      failureMessage: ss(),
+      run: (i) => u.bind(n.subject, { role_ref: i.role, level: i.level, scope_id: i.place }),
+      done: (i) => {
+        ee.success(e("core.access.added")), t("added", i);
+      }
+    }), r = R.form.values, p = A(null), y = A(!1), v = A([]), b = A([]), x = A(!1), w = A(!1), k = N(() => p.value ? as(p.value) : []), C = N(() => k.value.find((i) => i.level === r.level) ?? null), te = N(() => k.value.length > 1), ke = N(() => {
+      const i = p.value, f = C.value;
+      return i && f ? f.chain.map((d, P) => ({ name: d, places: fe(i, f, P, v.value) })) : [];
+    }), $e = N(() => {
+      const i = C.value?.chain.length ?? 0, f = i ? v.value[i - 1] : null;
+      return p.value?.places.find((d) => d.level === C.value?.level && d.id === f)?.name ?? null;
+    }), X = N(() => C.value !== null && C.value.chain.every((i, f) => v.value[f] != null));
+    function le(i) {
+      r.level = i, v.value = [], r.place = null;
+    }
+    function ne(i, f) {
+      const d = v.value.slice(0, i);
+      d[i] = f, v.value = d;
+    }
+    ce([() => r.level, v, p], () => {
+      const i = p.value, f = C.value;
+      if (!(!i || !f)) {
+        for (let d = 0; d < f.chain.length; d++) {
+          if (v.value[d] != null) continue;
+          const P = fe(i, f, d, v.value);
+          P.length === 1 && P[0] && ne(d, P[0].id);
+          break;
+        }
+        r.place = f.chain.length === 0 ? null : v.value[f.chain.length - 1] ?? null;
+      }
+    }, { deep: !0 });
+    async function xe() {
+      if (r.role = null, b.value = [], w.value = !1, !C.value || !X.value) return;
+      x.value = !0;
+      const i = `${r.level}:${r.place}`;
+      try {
+        const f = await u.bindable(C.value.level, r.place);
+        i === `${r.level}:${r.place}` && (b.value = f);
+      } catch {
+        i === `${r.level}:${r.place}` && (w.value = !0);
+      } finally {
+        x.value = !1;
+      }
+    }
+    ce([() => r.level, () => r.place, X], () => void xe());
+    const je = N(() => b.value.map((i) => ({ value: i.ref, label: c.roleName(i), description: c.roleKind(i) }))), W = N(() => b.value.find((i) => i.ref === r.role) ?? null), qe = N(() => {
+      const i = /* @__PURE__ */ new Map();
+      for (const f of W.value?.grants ?? []) {
+        const d = q[f.permission]?.ownable;
+        d && (!i.has(d) || f.permission.endsWith(":view")) && i.set(d, f.qualifier);
+      }
+      return [...i].map(([f, d]) => ({ ownable: f, qualifier: d }));
+    }), Le = N(() => c.scopeLabel({ level: r.level ?? p.value?.root_level ?? "", name: $e.value }));
+    async function Ce() {
+      p.value = null, y.value = !1, v.value = [], b.value = [], R.present();
+      try {
+        p.value = g ? await g(n.subject, new AbortController().signal) : await u.scopes(n.subject);
+      } catch {
+        y.value = !0;
+        return;
+      }
+      const i = ts(k.value);
+      i && le(i.level);
+    }
+    return o({ present: Ce }), (i, f) => (m(), T(l(ze), {
+      command: l(R),
+      title: l(e)("core.access.add_role"),
+      subtitle: n.subjectLabel,
+      size: "lg",
+      "confirm-label": l(e)("core.access.add.confirm")
+    }, {
+      default: h(() => [
+        O("div", ls, [
+          y.value ? (m(), _("p", ns, $(l(e)("core.access.add.scopes_failed")), 1)) : p.value && k.value.length === 0 ? (m(), _("p", cs, $(l(e)("core.access.add.no_places")), 1)) : D("", !0),
+          te.value ? (m(), T(l(V), {
+            key: 2,
+            header: l(e)("core.access.add.scope_header")
+          }, {
+            default: h(() => [
+              j(l(Ge), {
+                "model-value": l(r).level,
+                label: l(e)("core.access.add.scope_level"),
+                options: k.value.map((d) => ({ value: d.level, label: l(c).levelLabel(d.level) })),
+                "onUpdate:modelValue": f[0] || (f[0] = (d) => le(d))
+              }, null, 8, ["model-value", "label", "options"]),
+              (m(!0), _(K, null, B(ke.value, (d, P) => (m(), T(l(Fe), {
+                key: d.name,
+                "model-value": v.value[P] ?? null,
+                label: l(c).levelLabel(d.name),
+                options: d.places.map((I) => ({ value: I.id, label: I.name })),
+                "onUpdate:modelValue": (I) => ne(P, I)
+              }, null, 8, ["model-value", "label", "options", "onUpdate:modelValue"]))), 128))
+            ]),
+            _: 1
+          }, 8, ["header"])) : D("", !0),
+          X.value ? (m(), _(K, { key: 3 }, [
+            x.value ? (m(), _("p", rs, $(l(e)("core.access.add.roles_loading")), 1)) : w.value ? (m(), _("p", is, $(l(e)("core.access.add.roles_failed")), 1)) : b.value.length === 0 ? (m(), _("p", us, $(l(e)("core.access.add.no_roles")), 1)) : (m(), _("div", ds, [
+              O("p", ms, $(l(e)("core.access.add.role")), 1),
+              j(l(Me), {
+                options: je.value,
+                "model-value": l(r).role,
+                onSelect: f[1] || (f[1] = (d) => l(r).role = d)
+              }, null, 8, ["options", "model-value"])
+            ]))
+          ], 64)) : D("", !0),
+          W.value ? (m(), _("div", fs, [
+            j(l(V), {
+              header: l(e)("core.access.add.role_gives"),
+              footer: l(e)("core.access.add.role_gives_footer")
+            }, {
+              default: h(() => [
+                j(l(U), {
+                  layout: "setting",
+                  label: l(c).roleName(W.value),
+                  sub: W.value.description
+                }, null, 8, ["label", "sub"]),
+                (m(!0), _(K, null, B(qe.value, (d) => (m(), T(l(U), {
+                  key: d.ownable,
+                  layout: "setting",
+                  label: l(c).ownableLabel(d.ownable),
+                  value: `${l(c).qualifierNoun(d.qualifier)} · ${Le.value}`
+                }, null, 8, ["label", "value"]))), 128))
+              ]),
+              _: 1
+            }, 8, ["header", "footer"])
+          ])) : D("", !0)
+        ])
+      ]),
+      _: 1
+    }, 8, ["command", "title", "subtitle", "confirm-label"]));
+  }
+}), vs = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "binding-scope"
+}, bs = /* @__PURE__ */ J({
+  __name: "BindingRow",
+  props: {
+    binding: {}
+  },
+  setup(s) {
+    const o = s, a = H(), n = N(() => [a.roleKind(o.binding.role), ...o.binding.role.attrs.map((t) => `${t.attribute}: ${t.values.join(", ")}`)].join(" · "));
+    return (t, e) => (m(), T(l(U), {
+      layout: "setting",
+      label: l(a).roleName(o.binding.role),
+      sub: n.value
+    }, _e({
+      leading: h(() => [
+        j(l(We), {
+          tone: o.binding.role.predefined ? "anchor" : "brand",
+          icon: "shieldStarFill"
+        }, null, 8, ["tone"])
+      ]),
+      default: h(() => [
+        O("span", vs, $(l(a).scopeLabel(o.binding.scope)), 1)
+      ]),
+      _: 2
+    }, [
+      t.$slots.trailing ? {
+        name: "trailing",
+        fn: h(() => [
+          Ae(t.$slots, "trailing")
+        ]),
+        key: "0"
+      } : void 0
+    ]), 1032, ["label", "sub"]));
+  }
+}), pe = { own: 0, own_location: 1, all: 2 }, ve = (s, o) => pe[o] > pe[s] ? o : s, Q = (s) => `${s.level}:${s.id ?? ""}`, Z = ["view", "create", "update", "manage", "delete"], be = (s) => Z.includes(s) ? Z.indexOf(s) : Z.length;
+function _s(s, o) {
+  const a = /* @__PURE__ */ new Map();
+  for (const t of o) {
+    if (t.grants.length === 0) continue;
+    const e = s[t.permission], [c = t.permission, u = ""] = t.permission.split(":"), q = e ? se(e) : c.split(".")[0] ?? c, g = e ? ye(e) : c.replace(/\./g, "_"), L = e?.ownable != null, R = a.get(q) ?? /* @__PURE__ */ new Map(), r = R.get(g) ?? { key: g, actions: [], sources: [], qualifier: null, scopes: [], ownable: !1, allUnavailable: !0 };
+    r.actions.push({ permission: t.permission, verb: e?.verb ?? u, unavailable: t.unavailable, grants: t.grants }), r.ownable || (r.ownable = L), r.allUnavailable && (r.allUnavailable = t.unavailable);
+    for (const p of t.grants) {
+      const y = L ? p.qualifier : "all";
+      r.scopes.some((b) => Q(b) === Q(p.scope)) || r.scopes.push(p.scope), L && (r.qualifier = r.qualifier ? ve(r.qualifier, y) : y);
+      const v = r.sources.find((b) => b.roleName === p.role_name && Q(b.scope) === Q(p.scope));
+      v ? L && (r.sources[r.sources.indexOf(v)] = { ...v, qualifier: ve(v.qualifier, y) }) : r.sources.push({ roleKey: p.role_key, roleName: p.role_name, qualifier: y, scope: p.scope });
+    }
+    R.set(g, r), a.set(q, R);
+  }
+  return [...a.keys()].sort((t, e) => +(t === M) - +(e === M) || t.localeCompare(e)).map((t) => ({
+    key: t,
+    screens: [...a.get(t)?.values() ?? []].map((e) => ({
+      ...e,
+      actions: [...e.actions].sort((c, u) => be(c.verb) - be(u.verb) || c.verb.localeCompare(u.verb)),
+      // the root (the place without an id) first: what applies everywhere is what a reader looks for
+      scopes: [...e.scopes].sort((c, u) => +(u.id === null) - +(c.id === null))
+    })).sort((e, c) => e.key.localeCompare(c.key))
+  }));
+}
+const gs = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "effective-access"
+}, ys = { class: "px-row-inset text-title3 font-semibold text-content-strong" }, hs = {
+  class: "block",
+  "data-test": "effective-actions"
+}, ws = {
+  class: "block",
+  "data-test": "effective-sources"
+}, ks = {
+  key: 0,
+  class: "mt-2 flex flex-col gap-1.5 border-l border-border-separator pl-3",
+  "data-test": "effective-why"
+}, $s = ["data-permission"], xs = { class: "text-content" }, js = {
+  key: 0,
+  class: "ml-2 text-content-muted"
+}, qs = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-unavailable"
+}, Ls = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "effective-reach"
+}, Cs = ["data-test"], Rs = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-show-all"
+}, Es = /* @__PURE__ */ J({
+  __name: "EffectiveAccess",
+  props: {
+    effective: {},
+    name: {}
+  },
+  setup(s) {
+    const o = s, { t: a } = z(), { catalogue: n } = ae(), t = H(), e = Ie(), c = N(() => _s(n, o.effective)), u = A(!1), q = N(() => e.value && !u.value ? c.value.slice(0, 3) : c.value), g = A({}), L = (p) => p.actions.map((y) => t.permissionLabel(y.permission)).join(" · "), R = (p) => p.sources.map((y) => {
+      const v = t.roleName({ key: y.roleKey, name: y.roleName });
+      return p.ownable ? `${v} (${t.qualifierNoun(y.qualifier).toLowerCase()})` : v;
+    }).join(", "), r = (p) => [p.qualifier ? t.qualifierNoun(p.qualifier) : "", p.scopes.map((y) => t.scopeLabel(y)).join(", ")].filter(Boolean).join(" · ");
+    return (p, y) => (m(), _("section", gs, [
+      O("h2", ys, $(l(a)("core.access.effective.title", { name: o.name })), 1),
+      c.value.length === 0 ? (m(), T(l(V), {
+        key: 0,
+        footer: l(a)("core.access.effective.footer")
+      }, {
+        default: h(() => [
+          j(l(U), {
+            layout: "setting",
+            label: l(a)("core.access.effective.empty")
+          }, null, 8, ["label"])
+        ]),
+        _: 1
+      }, 8, ["footer"])) : (m(), _(K, { key: 1 }, [
+        (m(!0), _(K, null, B(q.value, (v) => (m(), T(l(V), {
+          key: v.key,
+          header: l(t).groupLabel(v.key),
+          footer: v === q.value[q.value.length - 1] ? l(a)("core.access.effective.footer") : void 0
+        }, {
+          default: h(() => [
+            (m(!0), _(K, null, B(v.screens, (b) => (m(), T(l(U), {
+              key: b.key,
+              layout: "setting",
+              label: l(t).screenLabel(b.key)
+            }, {
+              sub: h(() => [
+                O("span", hs, $(L(b)), 1),
+                O("span", ws, $(l(a)("core.access.effective.from_roles", { roles: R(b) })), 1),
+                g.value[b.key] ? (m(), _("ul", ks, [
+                  (m(!0), _(K, null, B(b.actions, (x) => (m(), _("li", {
+                    key: x.permission,
+                    "data-permission": x.permission
+                  }, [
+                    O("span", xs, $(l(t).permissionLabel(x.permission)), 1),
+                    x.unavailable ? (m(), _("span", js, $(l(a)("core.access.effective.unavailable")), 1)) : D("", !0),
+                    (m(!0), _(K, null, B(x.grants, (w) => (m(), _("span", {
+                      key: `${w.binding_id}-${w.scope.level}-${w.scope.id ?? 0}`,
+                      class: "block text-content-muted"
+                    }, $(l(a)("core.access.effective.why_row", {
+                      role: l(t).roleName({ key: w.role_key, name: w.role_name }),
+                      whose: l(t).qualifierNoun(b.ownable ? w.qualifier : "all"),
+                      scope: l(t).scopeLabel(w.scope)
+                    })), 1))), 128))
+                  ], 8, $s))), 128))
+                ])) : D("", !0)
+              ]),
+              default: h(() => [
+                b.allUnavailable ? (m(), _("span", qs, [
+                  j(l(Qe), { tone: "warning" }, {
+                    default: h(() => [
+                      G($(l(a)("core.access.effective.unavailable")), 1)
+                    ]),
+                    _: 1
+                  })
+                ])) : D("", !0),
+                O("span", Ls, $(r(b)), 1),
+                O("span", {
+                  class: "contents",
+                  "data-test": `why-${b.key}`
+                }, [
+                  j(l(Y), {
+                    prominence: "secondary",
+                    size: "sm",
+                    onClick: (x) => g.value[b.key] = !g.value[b.key]
+                  }, {
+                    default: h(() => [
+                      G($(g.value[b.key] ? l(a)("core.access.effective.hide_why") : l(a)("core.access.effective.show_why")), 1)
+                    ]),
+                    _: 2
+                  }, 1032, ["onClick"])
+                ], 8, Cs)
+              ]),
+              _: 2
+            }, 1032, ["label"]))), 128))
+          ]),
+          _: 2
+        }, 1032, ["header", "footer"]))), 128)),
+        l(e) && c.value.length > 3 ? (m(), _("span", Rs, [
+          j(l(Y), {
+            prominence: "secondary",
+            class: "self-center",
+            onClick: y[0] || (y[0] = (v) => u.value = !u.value)
+          }, {
+            default: h(() => [
+              G($(u.value ? l(a)("core.access.effective.fewer_modules") : l(a)("core.access.effective.all_modules", { count: c.value.length })), 1)
+            ]),
+            _: 1
+          })
+        ])) : D("", !0)
+      ], 64))
+    ]));
+  }
+}), Ns = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "access-panel"
+}, Ss = ["data-test"], Ts = {
+  class: "contents",
+  "data-test": "add-role"
+}, uo = /* @__PURE__ */ J({
+  __name: "PersonAccess",
+  props: {
+    subject: {},
+    name: {},
+    subjectLabel: {}
+  },
+  emits: ["loaded"],
+  setup(s, { expose: o, emit: a }) {
+    const n = s, t = a, { t: e } = z(), c = H(), u = he(), q = we(), g = A(!1), L = Ue(async ({ signal: x, abandon: w }) => {
+      g.value = !1;
+      try {
+        const k = await q.access(n.subject, { signal: x });
+        return t("loaded", k.bindings.length), k;
+      } catch (k) {
+        if (!oe(k) || k.kind !== "notFound") throw k;
+        return g.value = !0, w();
+      }
+    }, { watch: () => n.subject.id }), R = re("addDialog"), r = re("removeDialog");
+    async function p(x) {
+      await q.unbind(n.subject, x.id), ee.success(e("core.access.removed")), await L.reload();
+    }
+    const y = (x) => ee.error(u(x, { fallback: e("core.access.remove_failed") })), v = A(null), b = N(() => v.value ? e("core.access.remove_body", { name: n.name, role: c.roleName(v.value.role), scope: c.scopeLabel(v.value.scope) }) : "");
+    return o({ reload: L.reload }), (x, w) => (m(), _("div", Ns, [
+      g.value ? (m(), T(l(Be), {
+        key: 0,
+        title: l(e)("core.resource.not_found.title"),
+        description: l(e)("core.resource.not_found.body"),
+        icon: "errorWarningLine",
+        "data-test": "access-not-found"
+      }, null, 8, ["title", "description"])) : (m(), T(l(Pe), {
+        key: 1,
+        state: l(L).state.value,
+        "skeleton-rows": 6,
+        "is-empty": () => !1,
+        onRetry: w[1] || (w[1] = (k) => l(L).reload())
+      }, {
+        default: h(({ value: k }) => [
+          j(l(V), {
+            header: l(e)("core.access.person_roles"),
+            footer: l(e)("core.access.roles_footer")
+          }, {
+            default: h(() => [
+              k.bindings.length === 0 ? (m(), T(l(U), {
+                key: 0,
+                layout: "setting",
+                label: l(e)("core.access.no_roles_title"),
+                sub: l(e)("core.access.no_roles_description")
+              }, null, 8, ["label", "sub"])) : D("", !0),
+              (m(!0), _(K, null, B(k.bindings, (C) => (m(), T(bs, {
+                key: C.id,
+                binding: C
+              }, _e({ _: 2 }, [
+                k.can_manage ? {
+                  name: "trailing",
+                  fn: h(() => [
+                    j(l(ie), {
+                      permission: l(F).manageBindings
+                    }, {
+                      default: h(() => [
+                        O("span", {
+                          class: "contents",
+                          "data-test": `remove-binding-${C.id}`
+                        }, [
+                          j(l(Y), {
+                            tone: "critical",
+                            prominence: "secondary",
+                            size: "sm",
+                            onClick: (te) => (v.value = C, r.value?.present(C))
+                          }, {
+                            default: h(() => [
+                              G($(l(e)("core.access.remove")), 1)
+                            ]),
+                            _: 1
+                          }, 8, ["onClick"])
+                        ], 8, Ss)
+                      ]),
+                      _: 2
+                    }, 1032, ["permission"])
+                  ]),
+                  key: "0"
+                } : void 0
+              ]), 1032, ["binding"]))), 128)),
+              k.can_manage ? (m(), T(l(ie), {
+                key: 1,
+                permission: l(F).manageBindings
+              }, {
+                default: h(() => [
+                  j(l(U), { layout: "stacked" }, {
+                    default: h(() => [
+                      O("span", Ts, [
+                        j(l(Y), {
+                          prominence: "secondary",
+                          icon: "addLine",
+                          onClick: w[0] || (w[0] = (C) => R.value?.present())
+                        }, {
+                          default: h(() => [
+                            G($(l(e)("core.access.add_role")), 1)
+                          ]),
+                          _: 1
+                        })
+                      ])
+                    ]),
+                    _: 1
+                  })
+                ]),
+                _: 1
+              }, 8, ["permission"])) : D("", !0)
+            ]),
+            _: 2
+          }, 1032, ["header", "footer"]),
+          j(Es, {
+            effective: k.effective,
+            name: n.name
+          }, null, 8, ["effective", "name"])
+        ]),
+        _: 1
+      }, 8, ["state"])),
+      j(ps, {
+        ref_key: "addDialog",
+        ref: R,
+        subject: n.subject,
+        "subject-label": n.subjectLabel ?? n.name,
+        onAdded: w[2] || (w[2] = (k) => l(L).reload())
+      }, null, 8, ["subject", "subject-label"]),
+      j(l(Ke), {
+        ref_key: "removeDialog",
+        ref: r,
+        tone: "critical",
+        title: l(e)("core.access.remove_title"),
+        message: b.value,
+        "confirm-label": l(e)("core.access.remove"),
+        action: p,
+        onFailed: y
+      }, null, 8, ["title", "message", "confirm-label"])
+    ]));
+  }
+});
+export {
+  bs as _,
+  we as a,
+  F as b,
+  ue as c,
+  ae as d,
+  se as e,
+  ss as f,
+  Ze as g,
+  io as h,
+  he as i,
+  uo as j,
+  lo as k,
+  S as l,
+  Je as m,
+  to as n,
+  Xe as o,
+  no as p,
+  Ye as q,
+  co as r,
+  ro as s,
+  es as t,
+  H as u
+};