@wssto2/vue-core 0.5.0 → 0.5.2

package/dist/index-BVlbcaKs.js

@@ -0,0 +1,763 @@
+import { route as x } from "./client/index.js";
+import { d as Re, p as Te } from "./feature-DdUAfyi4.js";
+import { d as Ne } from "./context-Ch1r4fdN.js";
+import { d as Se } from "./defineRoutes-BGAdiIrt.js";
+import { useI18n as H } from "vue-i18n";
+import { hasInjectionContext as Oe, inject as Ae, defineComponent as X, ref as O, computed as T, watch as re, openBlock as m, createBlock as N, unref as n, withCtx as h, createElementVNode as S, createElementBlock as g, toDisplayString as j, createCommentVNode as A, createVNode as E, Fragment as K, renderList as B, createSlots as ge, renderSlot as De, createTextVNode as V, useTemplateRef as ie } from "vue";
+import { i as te } from "./error-Bb_dr_Ay.js";
+import { u as Ke } from "./describeError-BqGAUZgX.js";
+import { _ as J } from "./Button.vue_vue_type_script_setup_true_lang-CL9Qh5yq.js";
+import { _ as z } from "./FormGroup.vue_vue_type_script_setup_true_lang-BPchlRCl.js";
+import { g as U } from "./options-g8RwEhBk.js";
+import { _ as Pe } from "./AlertDialog.vue_vue_type_script_setup_true_lang-whA4WLdl.js";
+import { t as ae } from "./toast-CqSDTWRX.js";
+import { _ as ue } from "./AccessGate.vue_vue_type_script_setup_true_lang-DZ9GcLC1.js";
+import { _ as Be } from "./AsyncSection.vue_vue_type_script_setup_true_lang-B0NfvG3B.js";
+import { _ as Ue } from "./EmptyState.vue_vue_type_script_setup_true_lang-50p-Mp8I.js";
+import { u as Fe } from "./useLoad-W4tfxmm5.js";
+import { _ as Ge, a as Me } from "./SelectField.vue_vue_type_script_setup_true_lang-BzQC1qDQ.js";
+import { _ as Ve } from "./SegmentedField.vue_vue_type_script_setup_true_lang-BwyMvkis.js";
+import { u as ze, _ as He } from "./useCommand-CtqheKUv.js";
+import { u as We } from "./platform-Dx6STiwY.js";
+import { _ as Ie } from "./IconTile.vue_vue_type_script_setup_true_lang-_FXvaj93.js";
+import { u as Qe } from "./mediaQuery-CygcXmFW.js";
+import { _ as Ye } from "./Badge.vue_vue_type_script_setup_true_lang-DJyZc0C7.js";
+const D = {
+  rolesList: x("GET", "/v1/iam/roles", { permission: "iam.role:view" }),
+  rolesShow: x("GET", "/v1/iam/roles/:ref", { permission: "iam.role:view" }),
+  rolesHolders: x("GET", "/v1/iam/roles/:ref/holders", { permission: "iam.role:view" }),
+  rolesCompare: x("GET", "/v1/iam/roles/:ref/compare", { permission: "iam.role:view" }),
+  rolesCreate: x("POST", "/v1/iam/roles", { permission: "iam.role:manage" }),
+  rolesUpdate: x("PUT", "/v1/iam/roles/:ref", { permission: "iam.role:manage" }),
+  rolesDelete: x("DELETE", "/v1/iam/roles/:ref", { permission: "iam.role:delete" }),
+  rolesReplace: x("POST", "/v1/iam/roles/:ref/replace", { permission: "iam.role:manage" }),
+  bindable: x("GET", "/v1/iam/bindable-roles"),
+  subjectsAccess: x("GET", "/v1/iam/users/:id/access", { permission: "iam.user:view" }),
+  subjectsScopes: x("GET", "/v1/iam/users/:id/scopes", { permission: "iam.user:manage" }),
+  subjectsBind: x("POST", "/v1/iam/users/:id/bindings", { permission: "iam.user:manage" }),
+  subjectsUnbind: x("DELETE", "/v1/iam/users/:id/bindings/:binding_id", { permission: "iam.user:manage" }),
+  me: x.raw("GET", "/v1/me/access")
+}, [ye, Z] = Ne("vue-core.access"), F = {
+  viewRoles: "iam.role:view",
+  manageRoles: "iam.role:manage",
+  deleteRoles: "iam.role:delete",
+  viewAccess: "iam.user:view",
+  manageBindings: "iam.user:manage"
+}, de = Se({
+  roles: { name: "access.roles", path: "/iam/roles", component: () => import("./RolesPage-CvHrY9ZC.js"), meta: { access: F.viewRoles, titleKey: "core.access.title" } },
+  newRole: { name: "access.roles.new", path: "/iam/roles/new", component: () => import("./NewRolePage-sfr7tQs5.js"), meta: { access: F.manageRoles, titleKey: "core.access.new_title" } },
+  role: {
+    name: "access.role",
+    path: "/iam/roles/:ref",
+    component: () => import("./RolePage-ByUr3v_H.js"),
+    // A role's ref (its key, or the id of a custom one) swaps in place when a link leads to another role.
+    meta: { access: F.viewRoles, titleKey: "core.access.title", remountOnParam: "ref" }
+  }
+}), na = {
+  access: F.viewAccess,
+  section: { labelKey: "core.access.person_roles", icon: "shieldStarFill" }
+};
+function la(s) {
+  return Re({
+    id: "access",
+    routes: de.records,
+    context: Te(ye, {
+      catalogue: s.catalogue,
+      subjectRoute: s.subjectRoute ?? (() => null),
+      constraints: s.roleConstraints ?? [],
+      problems: s.problems ?? {},
+      subjects: s.subjects ?? {},
+      scopes: s.scopes ?? null
+    }),
+    navigation: s.destination ? [{ destination: s.destination, to: de.roles, within: ["access.role", "access.roles.new"] }] : []
+  });
+}
+const G = "system", me = ["view", "create", "update", "manage", "delete"], fe = (s) => {
+  const l = me.indexOf(s);
+  return l === -1 ? me.length : l;
+}, oe = (s) => s.system ? G : s.module, he = (s) => s.resource === "" ? s.module : `${s.module}_${s.resource.replace(/\./g, "_")}`;
+function ca(s) {
+  const l = /* @__PURE__ */ new Map();
+  for (const [c, t] of Object.entries(s)) {
+    const o = l.get(oe(t)) ?? /* @__PURE__ */ new Map(), a = he(t);
+    o.set(a, [...o.get(a) ?? [], { ...t, id: c }]), l.set(oe(t), o);
+  }
+  return [...l.keys()].sort((c, t) => +(c === G) - +(t === G) || c.localeCompare(t)).map((c) => ({
+    key: c,
+    screens: [...l.get(c) ?? []].map(([t, o]) => ({ key: t, permissions: o.sort((a, u) => fe(a.verb) - fe(u.verb) || a.verb.localeCompare(u.verb)) })).sort((t, o) => t.key.localeCompare(o.key))
+  }));
+}
+function Je(s, l) {
+  const e = /* @__PURE__ */ new Set(), c = (t) => {
+    for (const o of s[t]?.requires ?? [])
+      e.has(o) || (e.add(o), c(o));
+  };
+  return c(l), [...e];
+}
+function Xe(s, l) {
+  const e = /* @__PURE__ */ new Set(), c = (t) => {
+    for (const [o, a] of Object.entries(s))
+      e.has(o) || !a.requires.includes(t) || (e.add(o), c(o));
+  };
+  return c(l), [...e];
+}
+function Ze(s, l, e) {
+  const c = Object.entries(s).filter(([o, a]) => a.ownable === e && o in l), t = c.find(([, o]) => o.verb === "view") ?? c[0];
+  return t ? l[t[0]] ?? null : null;
+}
+function es(s, l, e) {
+  for (const c of [e, ...Je(s, e)]) {
+    if (c in l || !(c in s)) continue;
+    const t = s[c]?.ownable;
+    l[c] = t ? Ze(s, l, t) ?? "own" : "all";
+  }
+}
+function ra(s, l, e) {
+  for (const c of [e, ...Xe(s, e)]) delete l[c];
+}
+function ia(s, l, e, c) {
+  for (const [t, o] of Object.entries(s)) o.ownable === e && t in l && (l[t] = c);
+}
+function ua(s, l) {
+  const e = new Set(Object.keys(l));
+  for (const c of e) es(s, l, c);
+  return Object.keys(l).filter((c) => !e.has(c));
+}
+function W() {
+  const { t: s, te: l } = H(), { catalogue: e, constraints: c } = Z(), t = (a, u) => {
+    const $ = a.find((p) => l(p));
+    return $ ? s($) : u;
+  }, o = (a) => t([`access.levels.${a}`, `core.access.levels.${a}`], a);
+  return {
+    roleName: (a) => a.key ? t([`access.roles.${a.key}`], a.name) : a.name,
+    permissionLabel: (a) => t(e[a]?.labelKey ? [e[a].labelKey] : [], a),
+    permissionDescription: (a) => t(e[a]?.descriptionKey ? [e[a].descriptionKey] : [], ""),
+    groupLabel: (a) => t([`access.modules.${a}`, ...a === G ? ["core.access.system_group"] : []], a),
+    screenLabel: (a) => t([`access.resources.${a}`], a),
+    ownableLabel: (a) => t([`access.ownable.${a.replace(/\./g, "_")}`], a),
+    qualifierLabel: (a) => s(`core.access.qualifier.${a}`),
+    qualifierHint: (a) => s(`core.access.qualifier_hint.${a}`),
+    qualifierNoun: (a) => s(`core.access.qualifier_noun.${a}`),
+    levelLabel: o,
+    /** A place: the level and its name (`Dealer · Auto Zagreb`); the root, which has no name, by its level. */
+    scopeLabel: (a) => a.name ? `${o(a.level)} · ${a.name}` : o(a.level),
+    /** A role's constraint as the application worded it (`Used only`); an attribute or value it gave no text for stays as `attribute: value`. */
+    constraintLabel: (a) => {
+      const u = c.find((p) => p.attribute === a.attribute)?.options ?? [], $ = a.values.map((p) => u.find((q) => q.value === p)?.labelKey);
+      return $.every((p) => p !== void 0 && l(p)) ? $.map((p) => s(p)).join(", ") : `${a.attribute}: ${a.values.join(", ")}`;
+    },
+    roleKind: (a) => s(`core.access.role_kind.${a.computed ? "computed" : a.predefined ? "predefined" : "custom"}`)
+  };
+}
+function ss(s) {
+  if (!te(s) || s.code !== "authz.invalid") return [];
+  const l = s.params?.problems;
+  return Array.isArray(l) ? l.flatMap((e) => {
+    if (typeof e != "object" || e === null || typeof e.code != "string") return [];
+    const { code: c, permission: t, detail: o } = e;
+    return [{ code: c, ...typeof t == "string" ? { permission: t } : {}, ...typeof o == "string" ? { detail: o } : {} }];
+  }) : [];
+}
+function we() {
+  const { t: s, te: l } = H(), e = Ke(), c = Oe() ? Ae(ye, null) : null, t = c ? W() : null;
+  return (o, a) => {
+    const u = ss(o);
+    if (u.length === 0) return e(o, a);
+    const $ = u.map((p) => {
+      const q = [c?.problems[p.code], `core.access.problems.${p.code}`].find((r) => r && l(r)), R = { code: p.code, permission: p.permission ? t?.permissionLabel(p.permission) ?? p.permission : "", detail: p.detail ?? "" };
+      return s(q ?? "core.access.problems.unknown", R);
+    });
+    return [...new Set($)].join(" ");
+  };
+}
+function as() {
+  const s = we();
+  return (l, e) => te(e) && e.code?.startsWith("authz.") ? s(e) : void 0;
+}
+function M(s, l) {
+  if (l === "user") return D;
+  const e = s[l];
+  if (!e) throw new Error(`vue-core access: no routes for ${l} subjects; pass accessFeature({ subjects: { ${l}: { base, bindable } } })`);
+  return {
+    bindable: x("GET", e.bindable),
+    subjectsAccess: x("GET", `${e.base}/:id/access`),
+    subjectsScopes: x("GET", `${e.base}/:id/scopes`),
+    subjectsBind: x("POST", `${e.base}/:id/bindings`),
+    subjectsUnbind: x("DELETE", `${e.base}/:id/bindings/:binding_id`)
+  };
+}
+function os(s, l = {}) {
+  return {
+    roles: async (e) => (await s.request(D.rolesList, void 0, e)).data.roles,
+    role: async (e, c) => (await s.request(D.rolesShow, { ref: e }, c)).data,
+    holders: async (e, c) => (await s.request(D.rolesHolders, { ref: e }, c)).data.holders,
+    compare: async (e, c, t) => (await s.request(D.rolesCompare, { ref: e, with: c }, t)).data,
+    create: async (e) => (await s.request(D.rolesCreate, e)).data,
+    update: async (e) => (await s.request(D.rolesUpdate, e)).data,
+    remove: async (e) => void await s.request(D.rolesDelete, { ref: e }),
+    replace: async (e, c) => (await s.request(D.rolesReplace, { ref: e, with: c })).data.rebound,
+    access: async (e, c) => (await s.request(M(l, e.kind).subjectsAccess, { id: e.id }, c)).data,
+    scopes: async (e, c) => (await s.request(M(l, e.kind).subjectsScopes, { id: e.id }, c)).data,
+    bindable: async (e, c, t, o) => (await s.request(M(l, e.kind).bindable, { level: c, scope_id: t ?? 0 }, o)).data.roles,
+    bind: async (e, c) => (await s.request(M(l, e.kind).subjectsBind, { id: e.id, ...c })).data,
+    unbind: async (e, c) => void await s.request(M(l, e.kind).subjectsUnbind, { id: e.id, binding_id: c })
+  };
+}
+const ke = () => os(We().http, Z().subjects);
+function ts(s) {
+  const l = /* @__PURE__ */ new Map();
+  for (const t of s.places) l.set(t.level, t.parent_level);
+  const e = (t) => {
+    const o = [t], a = new Set(o);
+    for (let u = l.get(t); u !== void 0 && u !== s.root_level && l.has(u) && !a.has(u); u = l.get(u))
+      o.unshift(u), a.add(u);
+    return o;
+  }, c = [...l.keys()].map((t) => ({ level: t, chain: e(t) })).sort((t, o) => o.chain.length - t.chain.length || t.level.localeCompare(o.level));
+  return s.root ? [...c, { level: s.root_level, chain: [] }] : c;
+}
+const ns = (s) => s.filter((l) => l.chain.length > 0).sort((l, e) => l.chain.length - e.chain.length)[0] ?? s[0] ?? null;
+function pe(s, l, e, c) {
+  const t = l.chain[e], o = l.chain[e + 1];
+  return s.places.filter(
+    (a) => a.level === t && (e === 0 || a.parent_level === l.chain[e - 1] && a.parent_id === c[e - 1]) && (o === void 0 || s.places.some((u) => u.level === o && u.parent_id === a.id))
+  );
+}
+const ls = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "add-role-sheet"
+}, cs = {
+  key: 0,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "scopes-failed"
+}, rs = {
+  key: 1,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "no-places"
+}, is = {
+  key: 0,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-loading"
+}, us = {
+  key: 1,
+  class: "px-row-inset text-body text-content-destructive",
+  role: "alert",
+  "data-test": "roles-failed"
+}, ds = {
+  key: 2,
+  class: "px-row-inset text-body text-content-muted",
+  "data-test": "roles-none"
+}, ms = {
+  key: 3,
+  "data-test": "bindable-roles"
+}, fs = { class: "px-row-inset pb-1.5 text-footnote uppercase tracking-wide text-content-muted" }, ps = {
+  key: 4,
+  "data-test": "chosen-role"
+}, vs = /* @__PURE__ */ X({
+  __name: "AddRoleDialog",
+  props: {
+    subject: {},
+    subjectLabel: {}
+  },
+  emits: ["added"],
+  setup(s, { expose: l, emit: e }) {
+    const c = s, t = e, { t: o } = H(), a = W(), u = ke(), { catalogue: $, scopes: p } = Z(), R = ze({
+      defaults: () => ({ level: null, place: null, role: null }),
+      validator: {
+        safeParse(i) {
+          const f = i, d = [
+            ...f.level === null || f.level !== v.value?.root_level && f.place === null ? [{ path: ["level"], message: o("core.access.add.choose_place") }] : [],
+            ...f.role === null ? [{ path: ["role"], message: o("core.access.add.choose_role") }] : []
+          ];
+          return d.length === 0 ? { success: !0, data: { level: f.level, place: f.place, role: f.role } } : { success: !1, error: { issues: d } };
+        }
+      },
+      failureMessage: as(),
+      run: (i) => u.bind(c.subject, { role_ref: i.role, level: i.level, scope_id: i.place }),
+      done: (i) => {
+        ae.success(o("core.access.added")), t("added", i);
+      }
+    }), r = R.form.values, v = O(null), y = O(!1), b = O([]), _ = O([]), L = O(!1), w = O(!1), k = T(() => v.value ? ts(v.value) : []), C = T(() => k.value.find((i) => i.level === r.level) ?? null), ne = T(() => k.value.length > 1), $e = T(() => {
+      const i = v.value, f = C.value;
+      return i && f ? f.chain.map((d, P) => ({ name: d, places: pe(i, f, P, b.value) })) : [];
+    }), xe = T(() => {
+      const i = C.value?.chain.length ?? 0, f = i ? b.value[i - 1] : null;
+      return v.value?.places.find((d) => d.level === C.value?.level && d.id === f)?.name ?? null;
+    }), ee = T(() => C.value !== null && C.value.chain.every((i, f) => b.value[f] != null));
+    function le(i) {
+      r.level = i, b.value = [], r.place = null;
+    }
+    function ce(i, f) {
+      const d = b.value.slice(0, i);
+      d[i] = f, b.value = d;
+    }
+    re([() => r.level, b, v], () => {
+      const i = v.value, f = C.value;
+      if (!(!i || !f)) {
+        for (let d = 0; d < f.chain.length; d++) {
+          if (b.value[d] != null) continue;
+          const P = pe(i, f, d, b.value);
+          P.length === 1 && P[0] && ce(d, P[0].id);
+          break;
+        }
+        r.place = f.chain.length === 0 ? null : b.value[f.chain.length - 1] ?? null;
+      }
+    }, { deep: !0 });
+    async function je() {
+      if (r.role = null, _.value = [], w.value = !1, !C.value || !ee.value) return;
+      L.value = !0;
+      const i = `${r.level}:${r.place}`;
+      try {
+        const f = await u.bindable(c.subject, C.value.level, r.place);
+        i === `${r.level}:${r.place}` && (_.value = f);
+      } catch {
+        i === `${r.level}:${r.place}` && (w.value = !0);
+      } finally {
+        L.value = !1;
+      }
+    }
+    re([() => r.level, () => r.place, ee], () => void je());
+    const qe = T(() => _.value.map((i) => ({ value: i.ref, label: a.roleName(i), description: a.roleKind(i) }))), I = T(() => _.value.find((i) => i.ref === r.role) ?? null), Le = T(() => {
+      const i = /* @__PURE__ */ new Map();
+      for (const f of I.value?.grants ?? []) {
+        const d = $[f.permission]?.ownable;
+        d && (!i.has(d) || f.permission.endsWith(":view")) && i.set(d, f.qualifier);
+      }
+      return [...i].map(([f, d]) => ({ ownable: f, qualifier: d }));
+    }), Ee = T(() => a.scopeLabel({ level: r.level ?? v.value?.root_level ?? "", name: xe.value }));
+    async function Ce() {
+      v.value = null, y.value = !1, b.value = [], _.value = [], R.present();
+      try {
+        v.value = p ? await p(c.subject, new AbortController().signal) : await u.scopes(c.subject);
+      } catch {
+        y.value = !0;
+        return;
+      }
+      const i = ns(k.value);
+      i && le(i.level);
+    }
+    return l({ present: Ce }), (i, f) => (m(), N(n(He), {
+      command: n(R),
+      title: n(o)("core.access.add_role"),
+      subtitle: c.subjectLabel,
+      size: "lg",
+      "confirm-label": n(o)("core.access.add.confirm")
+    }, {
+      default: h(() => [
+        S("div", ls, [
+          y.value ? (m(), g("p", cs, j(n(o)("core.access.add.scopes_failed")), 1)) : v.value && k.value.length === 0 ? (m(), g("p", rs, j(n(o)("core.access.add.no_places")), 1)) : A("", !0),
+          ne.value ? (m(), N(n(z), {
+            key: 2,
+            header: n(o)("core.access.add.scope_header")
+          }, {
+            default: h(() => [
+              E(n(Ve), {
+                "model-value": n(r).level,
+                label: n(o)("core.access.add.scope_level"),
+                options: k.value.map((d) => ({ value: d.level, label: n(a).levelLabel(d.level) })),
+                "onUpdate:modelValue": f[0] || (f[0] = (d) => le(d))
+              }, null, 8, ["model-value", "label", "options"]),
+              (m(!0), g(K, null, B($e.value, (d, P) => (m(), N(n(Ge), {
+                key: d.name,
+                "model-value": b.value[P] ?? null,
+                label: n(a).levelLabel(d.name),
+                options: d.places.map((Q) => ({ value: Q.id, label: Q.name })),
+                "onUpdate:modelValue": (Q) => ce(P, Q)
+              }, null, 8, ["model-value", "label", "options", "onUpdate:modelValue"]))), 128))
+            ]),
+            _: 1
+          }, 8, ["header"])) : A("", !0),
+          ee.value ? (m(), g(K, { key: 3 }, [
+            L.value ? (m(), g("p", is, j(n(o)("core.access.add.roles_loading")), 1)) : w.value ? (m(), g("p", us, j(n(o)("core.access.add.roles_failed")), 1)) : _.value.length === 0 ? (m(), g("p", ds, j(n(o)("core.access.add.no_roles")), 1)) : (m(), g("div", ms, [
+              S("p", fs, j(n(o)("core.access.add.role")), 1),
+              E(n(Me), {
+                options: qe.value,
+                "model-value": n(r).role,
+                onSelect: f[1] || (f[1] = (d) => n(r).role = d)
+              }, null, 8, ["options", "model-value"])
+            ]))
+          ], 64)) : A("", !0),
+          I.value ? (m(), g("div", ps, [
+            E(n(z), {
+              header: n(o)("core.access.add.role_gives"),
+              footer: n(o)("core.access.add.role_gives_footer")
+            }, {
+              default: h(() => [
+                E(n(U), {
+                  layout: "setting",
+                  label: n(a).roleName(I.value),
+                  sub: I.value.description
+                }, null, 8, ["label", "sub"]),
+                (m(!0), g(K, null, B(Le.value, (d) => (m(), N(n(U), {
+                  key: d.ownable,
+                  layout: "setting",
+                  label: n(a).ownableLabel(d.ownable),
+                  value: `${n(a).qualifierNoun(d.qualifier)} · ${Ee.value}`
+                }, null, 8, ["label", "value"]))), 128))
+              ]),
+              _: 1
+            }, 8, ["header", "footer"])
+          ])) : A("", !0)
+        ])
+      ]),
+      _: 1
+    }, 8, ["command", "title", "subtitle", "confirm-label"]));
+  }
+}), bs = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "binding-scope"
+}, _s = /* @__PURE__ */ X({
+  __name: "BindingRow",
+  props: {
+    binding: {}
+  },
+  setup(s) {
+    const l = s, e = W(), c = T(() => [e.roleKind(l.binding.role), ...l.binding.role.attrs.map(e.constraintLabel)].join(" · "));
+    return (t, o) => (m(), N(n(U), {
+      layout: "setting",
+      label: n(e).roleName(l.binding.role),
+      sub: c.value
+    }, ge({
+      leading: h(() => [
+        E(n(Ie), {
+          tone: l.binding.role.predefined ? "anchor" : "brand",
+          icon: "shieldStarFill"
+        }, null, 8, ["tone"])
+      ]),
+      default: h(() => [
+        S("span", bs, j(n(e).scopeLabel(l.binding.scope)), 1)
+      ]),
+      _: 2
+    }, [
+      t.$slots.trailing ? {
+        name: "trailing",
+        fn: h(() => [
+          De(t.$slots, "trailing")
+        ]),
+        key: "0"
+      } : void 0
+    ]), 1032, ["label", "sub"]));
+  }
+}), ve = { own: 0, own_location: 1, all: 2 }, be = (s, l) => ve[l] > ve[s] ? l : s, Y = (s) => `${s.level}:${s.id ?? ""}`, se = ["view", "create", "update", "manage", "delete"], _e = (s) => se.includes(s) ? se.indexOf(s) : se.length;
+function gs(s, l) {
+  const e = /* @__PURE__ */ new Map();
+  for (const t of l) {
+    if (t.grants.length === 0) continue;
+    const o = s[t.permission], [a = t.permission, u = ""] = t.permission.split(":"), $ = o ? oe(o) : a.split(".")[0] ?? a, p = o ? he(o) : a.replace(/\./g, "_"), q = o?.ownable != null, R = e.get($) ?? /* @__PURE__ */ new Map(), r = R.get(p) ?? { key: p, actions: [], sources: [], qualifier: null, scopes: [], ownable: !1, allUnavailable: !0 };
+    r.actions.push({ permission: t.permission, verb: o?.verb ?? u, unavailable: t.unavailable, grants: t.grants }), r.ownable || (r.ownable = q), r.allUnavailable && (r.allUnavailable = t.unavailable);
+    for (const v of t.grants) {
+      const y = q ? v.qualifier : "all";
+      r.scopes.some((_) => Y(_) === Y(v.scope)) || r.scopes.push(v.scope), q && (r.qualifier = r.qualifier ? be(r.qualifier, y) : y);
+      const b = r.sources.find((_) => _.roleName === v.role_name && Y(_.scope) === Y(v.scope));
+      b ? q && (r.sources[r.sources.indexOf(b)] = { ...b, qualifier: be(b.qualifier, y) }) : r.sources.push({ roleKey: v.role_key, roleName: v.role_name, qualifier: y, scope: v.scope });
+    }
+    R.set(p, r), e.set($, R);
+  }
+  return [...e.keys()].sort((t, o) => +(t === G) - +(o === G) || t.localeCompare(o)).map((t) => ({
+    key: t,
+    screens: [...e.get(t)?.values() ?? []].map((o) => ({
+      ...o,
+      actions: [...o.actions].sort((a, u) => _e(a.verb) - _e(u.verb) || a.verb.localeCompare(u.verb)),
+      // the root (the place without an id) first: what applies everywhere is what a reader looks for
+      scopes: [...o.scopes].sort((a, u) => +(u.id === null) - +(a.id === null))
+    })).sort((o, a) => o.key.localeCompare(a.key))
+  }));
+}
+const ys = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "effective-access"
+}, hs = { class: "px-row-inset text-title3 font-semibold text-content-strong" }, ws = {
+  class: "block",
+  "data-test": "effective-actions"
+}, ks = {
+  class: "block",
+  "data-test": "effective-sources"
+}, $s = {
+  key: 0,
+  class: "mt-2 flex flex-col gap-1.5 border-l border-border-separator pl-3",
+  "data-test": "effective-why"
+}, xs = ["data-permission"], js = { class: "text-content" }, qs = {
+  key: 0,
+  class: "ml-2 text-content-muted"
+}, Ls = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-unavailable"
+}, Es = {
+  class: "text-right text-footnote text-content-muted",
+  "data-test": "effective-reach"
+}, Cs = ["data-test"], Rs = {
+  key: 0,
+  class: "contents",
+  "data-test": "effective-show-all"
+}, Ts = /* @__PURE__ */ X({
+  __name: "EffectiveAccess",
+  props: {
+    effective: {},
+    name: {}
+  },
+  setup(s) {
+    const l = s, { t: e } = H(), { catalogue: c } = Z(), t = W(), o = Qe(), a = T(() => gs(c, l.effective)), u = O(!1), $ = T(() => o.value && !u.value ? a.value.slice(0, 3) : a.value), p = O({}), q = (v) => v.actions.map((y) => t.permissionLabel(y.permission)).join(" · "), R = (v) => v.sources.map((y) => {
+      const b = t.roleName({ key: y.roleKey, name: y.roleName });
+      return v.ownable ? `${b} (${t.qualifierNoun(y.qualifier).toLowerCase()})` : b;
+    }).join(", "), r = (v) => [v.qualifier ? t.qualifierNoun(v.qualifier) : "", v.scopes.map((y) => t.scopeLabel(y)).join(", ")].filter(Boolean).join(" · ");
+    return (v, y) => (m(), g("section", ys, [
+      S("h2", hs, j(n(e)("core.access.effective.title", { name: l.name })), 1),
+      a.value.length === 0 ? (m(), N(n(z), {
+        key: 0,
+        footer: n(e)("core.access.effective.footer")
+      }, {
+        default: h(() => [
+          E(n(U), {
+            layout: "setting",
+            label: n(e)("core.access.effective.empty")
+          }, null, 8, ["label"])
+        ]),
+        _: 1
+      }, 8, ["footer"])) : (m(), g(K, { key: 1 }, [
+        (m(!0), g(K, null, B($.value, (b) => (m(), N(n(z), {
+          key: b.key,
+          header: n(t).groupLabel(b.key),
+          footer: b === $.value[$.value.length - 1] ? n(e)("core.access.effective.footer") : void 0
+        }, {
+          default: h(() => [
+            (m(!0), g(K, null, B(b.screens, (_) => (m(), N(n(U), {
+              key: _.key,
+              layout: "setting",
+              label: n(t).screenLabel(_.key)
+            }, {
+              sub: h(() => [
+                S("span", ws, j(q(_)), 1),
+                S("span", ks, j(n(e)("core.access.effective.from_roles", { roles: R(_) })), 1),
+                p.value[_.key] ? (m(), g("ul", $s, [
+                  (m(!0), g(K, null, B(_.actions, (L) => (m(), g("li", {
+                    key: L.permission,
+                    "data-permission": L.permission
+                  }, [
+                    S("span", js, j(n(t).permissionLabel(L.permission)), 1),
+                    L.unavailable ? (m(), g("span", qs, j(n(e)("core.access.effective.unavailable")), 1)) : A("", !0),
+                    (m(!0), g(K, null, B(L.grants, (w) => (m(), g("span", {
+                      key: `${w.binding_id}-${w.scope.level}-${w.scope.id ?? 0}`,
+                      class: "block text-content-muted"
+                    }, j(n(e)("core.access.effective.why_row", {
+                      role: n(t).roleName({ key: w.role_key, name: w.role_name }),
+                      whose: n(t).qualifierNoun(_.ownable ? w.qualifier : "all"),
+                      scope: n(t).scopeLabel(w.scope)
+                    })), 1))), 128))
+                  ], 8, xs))), 128))
+                ])) : A("", !0)
+              ]),
+              default: h(() => [
+                _.allUnavailable ? (m(), g("span", Ls, [
+                  E(n(Ye), { tone: "warning" }, {
+                    default: h(() => [
+                      V(j(n(e)("core.access.effective.unavailable")), 1)
+                    ]),
+                    _: 1
+                  })
+                ])) : A("", !0),
+                S("span", Es, j(r(_)), 1),
+                S("span", {
+                  class: "contents",
+                  "data-test": `why-${_.key}`
+                }, [
+                  E(n(J), {
+                    prominence: "secondary",
+                    size: "sm",
+                    onClick: (L) => p.value[_.key] = !p.value[_.key]
+                  }, {
+                    default: h(() => [
+                      V(j(p.value[_.key] ? n(e)("core.access.effective.hide_why") : n(e)("core.access.effective.show_why")), 1)
+                    ]),
+                    _: 2
+                  }, 1032, ["onClick"])
+                ], 8, Cs)
+              ]),
+              _: 2
+            }, 1032, ["label"]))), 128))
+          ]),
+          _: 2
+        }, 1032, ["header", "footer"]))), 128)),
+        n(o) && a.value.length > 3 ? (m(), g("span", Rs, [
+          E(n(J), {
+            prominence: "secondary",
+            class: "self-center",
+            onClick: y[0] || (y[0] = (b) => u.value = !u.value)
+          }, {
+            default: h(() => [
+              V(j(u.value ? n(e)("core.access.effective.fewer_modules") : n(e)("core.access.effective.all_modules", { count: a.value.length })), 1)
+            ]),
+            _: 1
+          })
+        ])) : A("", !0)
+      ], 64))
+    ]));
+  }
+}), Ns = {
+  class: "flex min-w-0 flex-col gap-group-gap",
+  "data-test": "access-panel"
+}, Ss = ["data-test"], Os = {
+  class: "contents",
+  "data-test": "add-role"
+}, da = /* @__PURE__ */ X({
+  __name: "PersonAccess",
+  props: {
+    subject: {},
+    name: {},
+    subjectLabel: {}
+  },
+  emits: ["loaded"],
+  setup(s, { expose: l, emit: e }) {
+    const c = s, t = e, { t: o } = H(), a = W(), u = we(), $ = ke(), p = O(!1), q = Fe(async ({ signal: L, abandon: w }) => {
+      p.value = !1;
+      try {
+        const k = await $.access(c.subject, { signal: L });
+        return t("loaded", k.bindings.length), k;
+      } catch (k) {
+        if (!te(k) || k.kind !== "notFound") throw k;
+        return p.value = !0, w();
+      }
+    }, { watch: () => c.subject.id }), R = ie("addDialog"), r = ie("removeDialog");
+    async function v(L) {
+      await $.unbind(c.subject, L.id), ae.success(o("core.access.removed")), await q.reload();
+    }
+    const y = (L) => ae.error(u(L, { fallback: o("core.access.remove_failed") })), b = O(null), _ = T(() => b.value ? o("core.access.remove_body", { name: c.name, role: a.roleName(b.value.role), scope: a.scopeLabel(b.value.scope) }) : "");
+    return l({ reload: q.reload }), (L, w) => (m(), g("div", Ns, [
+      p.value ? (m(), N(n(Ue), {
+        key: 0,
+        title: n(o)("core.resource.not_found.title"),
+        description: n(o)("core.resource.not_found.body"),
+        icon: "errorWarningLine",
+        "data-test": "access-not-found"
+      }, null, 8, ["title", "description"])) : (m(), N(n(Be), {
+        key: 1,
+        state: n(q).state.value,
+        "skeleton-rows": 6,
+        "is-empty": () => !1,
+        onRetry: w[1] || (w[1] = (k) => n(q).reload())
+      }, {
+        default: h(({ value: k }) => [
+          E(n(z), {
+            header: n(o)("core.access.person_roles"),
+            footer: n(o)("core.access.roles_footer")
+          }, {
+            default: h(() => [
+              k.bindings.length === 0 ? (m(), N(n(U), {
+                key: 0,
+                layout: "setting",
+                label: n(o)("core.access.no_roles_title"),
+                sub: n(o)("core.access.no_roles_description")
+              }, null, 8, ["label", "sub"])) : A("", !0),
+              (m(!0), g(K, null, B(k.bindings, (C) => (m(), N(_s, {
+                key: C.id,
+                binding: C
+              }, ge({ _: 2 }, [
+                k.can_manage ? {
+                  name: "trailing",
+                  fn: h(() => [
+                    E(n(ue), {
+                      permission: n(F).manageBindings
+                    }, {
+                      default: h(() => [
+                        S("span", {
+                          class: "contents",
+                          "data-test": `remove-binding-${C.id}`
+                        }, [
+                          E(n(J), {
+                            tone: "critical",
+                            prominence: "secondary",
+                            size: "sm",
+                            onClick: (ne) => (b.value = C, r.value?.present(C))
+                          }, {
+                            default: h(() => [
+                              V(j(n(o)("core.access.remove")), 1)
+                            ]),
+                            _: 1
+                          }, 8, ["onClick"])
+                        ], 8, Ss)
+                      ]),
+                      _: 2
+                    }, 1032, ["permission"])
+                  ]),
+                  key: "0"
+                } : void 0
+              ]), 1032, ["binding"]))), 128)),
+              k.can_manage ? (m(), N(n(ue), {
+                key: 1,
+                permission: n(F).manageBindings
+              }, {
+                default: h(() => [
+                  E(n(U), { layout: "stacked" }, {
+                    default: h(() => [
+                      S("span", Os, [
+                        E(n(J), {
+                          prominence: "secondary",
+                          icon: "addLine",
+                          onClick: w[0] || (w[0] = (C) => R.value?.present())
+                        }, {
+                          default: h(() => [
+                            V(j(n(o)("core.access.add_role")), 1)
+                          ]),
+                          _: 1
+                        })
+                      ])
+                    ]),
+                    _: 1
+                  })
+                ]),
+                _: 1
+              }, 8, ["permission"])) : A("", !0)
+            ]),
+            _: 2
+          }, 1032, ["header", "footer"]),
+          E(Ts, {
+            effective: k.effective,
+            name: c.name
+          }, null, 8, ["effective", "name"])
+        ]),
+        _: 1
+      }, 8, ["state"])),
+      E(vs, {
+        ref_key: "addDialog",
+        ref: R,
+        subject: c.subject,
+        "subject-label": c.subjectLabel ?? c.name,
+        onAdded: w[2] || (w[2] = (k) => n(q).reload())
+      }, null, 8, ["subject", "subject-label"]),
+      E(n(Pe), {
+        ref_key: "removeDialog",
+        ref: r,
+        tone: "critical",
+        title: n(o)("core.access.remove_title"),
+        message: _.value,
+        "confirm-label": n(o)("core.access.remove"),
+        action: v,
+        onFailed: y
+      }, null, 8, ["title", "message", "confirm-label"])
+    ]));
+  }
+});
+export {
+  _s as _,
+  ke as a,
+  F as b,
+  de as c,
+  Z as d,
+  oe as e,
+  as as f,
+  es as g,
+  ua as h,
+  we as i,
+  da as j,
+  la as k,
+  D as l,
+  Xe as m,
+  na as n,
+  Ze as o,
+  ca as p,
+  Je as q,
+  ra as r,
+  ia as s,
+  ss as t,
+  W as u
+};