ankka-console 0.11.0 → 0.12.0

package/dist/routes/front.js

@@ -1,10 +1,13 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /**
  * The front page: who you are, as the control plane sees you, and the organizations you can see —
- * yours with your role in each, or every one of them for a platform administrator.
+ * yours with your role in each, or every one of them for a platform administrator — and what the
+ * installation is: its version, and its cloud when it names one (feature 044).
  */
-import { useLoaderData } from "react-router";
-import { guard, pageData, useConsoleContext, withShell } from "../context.js";
+import { redirect, useLoaderData } from "react-router";
+import { act, guard, pageData, text, useConsoleContext, withShell } from "../context.js";
+import { ConsoleForm, Submit, useConsole, when } from "../ui/console.js";
+import { Refused } from "../ui/refused.js";
 import { ConsoleErrorBoundary } from "../ui/errors.js";
 import { ConsoleLink } from "../ui/console.js";
 import { Page } from "../ui/shell.js";
@@ -13,19 +16,45 @@ export const meta = () => [{ title: "Organizations · ankka" }];
 export async function loader({ context }) {
     const ctx = useConsoleContext(context);
     return guard(ctx, async () => {
-        const [whoami, organizations] = await Promise.all([ctx.client.whoami(), ctx.client.listOrganizations()]);
+        const [whoami, organizations, installation, hold] = await Promise.all([
+            ctx.client.whoami(),
+            ctx.client.listOrganizations(),
+            ctx.client.installation(),
+            // Whether the control plane is held (feature 041); one that cannot say leaves it out.
+            ctx.client.restoreHold().catch(() => undefined),
+        ]);
         const shell = {
             area: "organizations",
             crumbs: [{ label: "Organizations" }],
             primary: { label: "Create an organization", to: "organizations/new", operation: "organization.create" },
         };
-        return { console: withShell(await pageData(ctx), shell), whoami, organizations };
+        return { console: withShell(await pageData(ctx), shell), whoami, organizations, installation, hold };
+    });
+}
+export async function action({ request, context }) {
+    const ctx = useConsoleContext(context);
+    const form = await request.formData();
+    const intent = text(form, "intent");
+    return act(ctx, intent, form, async () => {
+        if (intent !== "release")
+            throw new Response(`unknown operation '${intent}'`, { status: 400 });
+        await ctx.client.releaseRestoreHold();
+        return redirect(ctx.href(""));
     });
 }
 const roleWords = { owner: "Owner", member: "Member" };
 export default function Front() {
-    const { whoami, organizations } = useLoaderData();
+    const { whoami, organizations, installation, hold } = useLoaderData();
+    const cloud = installation.cloud ?? null;
+    const backups = installation.backups ?? null;
     const hostActions = useHostActions("organization.create");
-    return (_jsxs(Page, { inspector: hostActions ? (_jsx("div", { className: "ac-ops", children: _jsx(HostActions, { operation: "organization.create" }) })) : null, children: [_jsx("h1", { children: "Organizations" }), _jsxs("p", { className: "ac-lede", children: ["Signed in as ", _jsx("strong", { children: whoami.name ?? whoami.email ?? whoami.subject }), whoami.email && whoami.name ? ` (${whoami.email})` : null, whoami.platformAdmin ? ", a platform administrator: you see every organization in this installation." : "."] }), organizations.length === 0 ? (_jsxs("p", { className: "ac-empty", children: ["You are not a member of any organization yet. Create one, or ask an owner to invite ", whoami.email ?? "you", "."] })) : (_jsx("div", { className: "ac-card ac-table-wrap", children: _jsxs("table", { className: "ac-table", children: [_jsx("caption", { className: "ac-visually-hidden", children: "Organizations you can see" }), _jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Name" }), _jsx("th", { scope: "col", children: "Id" }), _jsx("th", { scope: "col", children: "Your role" }), _jsx("th", { scope: "col", className: "ac-num", children: "Projects" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: organizations.map((o) => (_jsxs("tr", { children: [_jsx("td", { children: _jsx(ConsoleLink, { to: `organizations/${encodeURIComponent(o.id)}`, children: o.name }) }), _jsx("td", { children: o.id }), _jsx("td", { children: o.role ? roleWords[o.role] : "Administrator (not a member)" }), _jsx("td", { className: "ac-num", children: o.projects }), _jsx("td", { children: o.disabled ? "Disabled" : "Active" })] }, o.id))) })] }) }))] }));
+    const { shows } = useConsole();
+    return (_jsxs(Page, { inspector: hostActions ? (_jsx("div", { className: "ac-ops", children: _jsx(HostActions, { operation: "organization.create" }) })) : null, children: [_jsx("h1", { children: "Organizations" }), _jsxs("p", { className: "ac-lede", children: ["Signed in as ", _jsx("strong", { children: whoami.name ?? whoami.email ?? whoami.subject }), whoami.email && whoami.name ? ` (${whoami.email})` : null, whoami.platformAdmin ? ", a platform administrator: you see every organization in this installation." : "."] }), hold?.held ? (_jsxs("section", { className: "ac-card", "aria-labelledby": "hold-title", "data-held": "yes", children: [_jsx("h2", { id: "hold-title", children: "The control plane is held" }), _jsxs("p", { children: ["Its database was restored to ", hold.targetTime ? when(hold.targetTime) : "an earlier moment", ", and it changes nothing in the cluster until a platform administrator releases it."] }), hold.services.length > 0 ? (_jsx("ul", { className: "ac-topics", "aria-label": "Services that differ", children: hold.services.map((d) => (_jsxs("li", { "data-differs": `${d.project}/${d.service}`, children: [d.project, "/", d.service, ": recorded ", d.recordedImage ?? "nothing", ", the cluster runs ", d.clusterImage ?? "nothing"] }, `${d.project}/${d.service}`))) })) : null, hold.unknownProjects.length > 0 ? _jsxs("p", { children: ["Projects the database does not know: ", hold.unknownProjects.join(", "), "."] }) : null, whoami.platformAdmin && shows("installation.release") ? (_jsx(ConsoleForm, { intent: "release", children: _jsx(Submit, { intent: "release", children: "Release the control plane" }) })) : null, _jsx(Refused, { intent: "release" })] })) : hold?.releasedAt ? (_jsxs("p", { "data-held": "released", children: ["The control plane was released after its database's restore, ", when(hold.releasedAt), hold.releasedBy ? ` by ${hold.releasedBy}` : "", "."] })) : null, backups ? (_jsx("p", { className: "ac-hint", "data-backups": backups.backupTarget, children: backups.notBackedUp ??
+                    `Backups are kept at least ${backups.retentionDays} days${backups.sharesFailureDomain ? ", in the cluster they back up" : ", with a copy outside the cluster"}.` })) : null, organizations.length === 0 ? (_jsxs("p", { className: "ac-empty", children: ["You are not a member of any organization yet. Create one, or ask an owner to invite ", whoami.email ?? "you", "."] })) : (_jsx("div", { className: "ac-card ac-table-wrap", children: _jsxs("table", { className: "ac-table", children: [_jsx("caption", { className: "ac-visually-hidden", children: "Organizations you can see" }), _jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Name" }), _jsx("th", { scope: "col", children: "Id" }), _jsx("th", { scope: "col", children: "Your role" }), _jsx("th", { scope: "col", className: "ac-num", children: "Projects" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: organizations.map((o) => (_jsxs("tr", { children: [_jsx("td", { children: _jsx(ConsoleLink, { to: `organizations/${encodeURIComponent(o.id)}`, children: o.name }) }), _jsx("td", { children: o.id }), _jsx("td", { children: o.role ? roleWords[o.role] : "Administrator (not a member)" }), _jsx("td", { className: "ac-num", children: o.projects }), _jsx("td", { children: o.disabled ? "Disabled" : "Active" })] }, o.id))) })] }) })), _jsxs("section", { className: "ac-card", "aria-labelledby": "installation", children: [_jsx("h2", { id: "installation", children: "This installation" }), _jsxs("dl", { className: "ac-facts", children: [_jsx("dt", { children: "Platform version" }), _jsx("dd", { children: installation.platformVersion }), _jsx("dt", { children: "Cloud" }), _jsx("dd", { children: cloud ? `${cloud.provider}, account ${cloud.account}` : "None: everything is served by the installation itself" }), cloud ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Location" }), _jsx("dd", { children: cloud.location })] })) : null, cloud?.kmsKey ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Wrapping key" }), _jsx("dd", { children: cloud.kmsKey })] })) : null, installation.secrets ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Secrets kept in" }), _jsx("dd", { children: secretBackendWords[installation.secrets.backend] ?? installation.secrets.backend }), _jsx("dt", { children: "Record of reads kept for" }), _jsx("dd", { children: installation.secrets.recordRetention }), _jsx("dt", { children: "Access log" }), _jsx("dd", { children: installation.secrets.auditLog })] })) : null] })] })] }));
 }
+/** The installation's secret store (feature 038), in words; an unknown backend is shown as it is named. */
+const secretBackendWords = {
+    postgres: "Postgres: each service's own database",
+    "secret-manager": "Google Secret Manager",
+};
 export const ErrorBoundary = ConsoleErrorBoundary;

package/dist/routes/logs.d.ts

@@ -29,6 +29,19 @@ export declare function loader({ request, params, context }: LoaderFunctionArgs)
         processPort: number | undefined;
         broker: string | undefined;
         undeclaredTopics: string[] | undefined;
+        secretStore: {
+            backend: string;
+            keyRead: boolean;
+            move: {
+                phase: string;
+                outcome: string;
+                names: {
+                    name: string;
+                    state: string;
+                }[];
+                detail: string | undefined;
+            } | undefined;
+        } | undefined;
         topicChecks: {
             topic: string | undefined;
             service: string;
@@ -50,10 +63,54 @@ export declare function loader({ request, params, context }: LoaderFunctionArgs)
             contract: string | undefined;
             lag: number | undefined;
             failing: string | undefined;
+            gap: {
+                partitions: {
+                    partition: number;
+                    beginning: number;
+                    earliestRetained: string | undefined;
+                }[];
+                compacted: boolean;
+                gone: boolean;
+                readAt: string | undefined;
+            } | undefined;
+        }[] | undefined;
+        warnings: {
+            kind: string;
+            component: string;
+            topic: string;
+            message: string;
         }[] | undefined;
         objectStorage: string | undefined;
         bucket: string | undefined;
         bucketAddress: string | undefined;
+        objectStore: string | undefined;
+        bucketLocation: string | undefined;
+        softDeleteDays: number | undefined;
+        storageMove: string | undefined;
+        databaseCluster: string | undefined;
+        grants: string | undefined;
+        crossProjectTopics: {
+            project: string;
+            topic: string;
+            right: string;
+            status: string;
+        }[] | undefined;
+        customHostnames: {
+            hostname: string;
+            state: string;
+            reason: string | undefined;
+            record: {
+                name: string;
+                kind: string;
+                value: string;
+            } | undefined;
+            note: string | undefined;
+        }[];
+        proofRecord: {
+            name: string;
+            kind: string;
+            value: string;
+        } | undefined;
     };
     project: {
         id: string;

package/dist/routes/machines.d.ts

@@ -0,0 +1,78 @@
+/**
+ * An organization's machines (feature 040): programs outside the installation that hold a grant —
+ * an affiliate network reading a topic, say — each with a client id and a secret it trades for a
+ * token. A new machine's secret is shown exactly once, as a deploy token's is: the registration
+ * redirects (so a reload can never register twice), carrying the secret across in a sealed cookie
+ * that this page reads and clears on its next render.
+ */
+import { type ActionFunctionArgs, type LoaderFunctionArgs, type MetaFunction } from "react-router";
+import { ConsoleErrorBoundary } from "../ui/errors.tsx";
+export declare const meta: MetaFunction;
+export declare function loader({ request, params, context }: LoaderFunctionArgs): Promise<{
+    console: import("../context.ts").ConsolePageData;
+    organization: {
+        id: string;
+        name: string;
+        projects: number;
+        disabled: boolean;
+        role: NonNullable<"member" | "owner"> | undefined;
+        quota: {
+            projects: number | undefined;
+            services: number | undefined;
+            instances: number | undefined;
+        } | undefined;
+        usage: {
+            projects: number;
+            services: number;
+            instances: number;
+        };
+    };
+    machines: {
+        name: string;
+        clientId: string;
+        registeredBy: string | undefined;
+        registeredAt: string | undefined;
+        byteRates: {
+            produceBytesPerSecond: number;
+            consumeBytesPerSecond: number;
+            requestPercentage: number;
+        } | undefined;
+    }[];
+    grants: {
+        id: string;
+        grantingProject: string;
+        grantingOrganization: string;
+        grantee: string;
+        target: {
+            kind: string;
+            service: string | undefined;
+            method: string | undefined;
+            path: string | undefined;
+            topic: string | undefined;
+            right: string | undefined;
+            decrypt: boolean;
+        };
+        state: string;
+        changes: {
+            change: string;
+            by: string | undefined;
+            at: string | undefined;
+        }[];
+        topic: {
+            partitions: number;
+            compacted: boolean;
+            retention: string | undefined;
+            copies: number | undefined;
+        } | undefined;
+    }[];
+    registered: {
+        name: string;
+        clientId: string;
+        clientSecret: string;
+        tokenUrl: string;
+        brokerBootstrap: string | undefined;
+    } | null;
+}>;
+export declare function action({ request, params, context }: ActionFunctionArgs): Promise<import("react-router").UNSAFE_DataWithResponseInit<import("../context.ts").ActionRefusal> | Response>;
+export default function Machines(): import("react").JSX.Element;
+export declare const ErrorBoundary: typeof ConsoleErrorBoundary;

package/dist/routes/machines.js

@@ -0,0 +1,78 @@
+import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+/**
+ * An organization's machines (feature 040): programs outside the installation that hold a grant —
+ * an affiliate network reading a topic, say — each with a client id and a secret it trades for a
+ * token. A new machine's secret is shown exactly once, as a deploy token's is: the registration
+ * redirects (so a reload can never register twice), carrying the secret across in a sealed cookie
+ * that this page reads and clears on its next render.
+ */
+import { redirect, useLoaderData } from "react-router";
+import { act, guard, organizationShell, pageData, text, useConsoleContext } from "../context.js";
+import { targetText } from "../ui/grants.js";
+import { ConsoleErrorBoundary } from "../ui/errors.js";
+import { ConsoleForm, Field, Submit, useConsole, when } from "../ui/console.js";
+import { Page, SectionTitle } from "../ui/shell.js";
+import { Refused, useRefusal } from "../ui/refused.js";
+import { HostActions } from "../extensions/render.js";
+export const meta = () => [{ title: "Machines · ankka" }];
+export async function loader({ request, params, context }) {
+    const ctx = useConsoleContext(context);
+    const id = params.organizationId;
+    return guard(ctx, async () => {
+        const [organization, machines, grants, projects, page] = await Promise.all([
+            ctx.client.getOrganization(id),
+            ctx.client.machines(id),
+            ctx.client.organizationGrants(id),
+            ctx.client.listProjects(),
+            pageData(ctx),
+        ]);
+        const registered = await ctx.runtime.machineFlash.take(request, ctx.headers);
+        // Shown from the one-time cookie alone: the listing is a projection and may not show the new machine yet.
+        return {
+            console: organizationShell(page, organization, projects, "machines", [{ label: "Machines" }]),
+            organization,
+            machines,
+            grants,
+            registered,
+        };
+    });
+}
+export async function action({ request, params, context }) {
+    const ctx = useConsoleContext(context);
+    const id = params.organizationId;
+    const form = await request.formData();
+    const intent = text(form, "intent");
+    const self = ctx.href(`organizations/${encodeURIComponent(id)}/machines`);
+    return act(ctx, intent, form, async () => {
+        if (intent === "register") {
+            const registered = await ctx.client.registerMachine(id, text(form, "machineName"));
+            await ctx.runtime.machineFlash.write(registered, ctx.headers);
+            return redirect(self);
+        }
+        if (intent === "delete") {
+            await ctx.client.deleteMachine(id, text(form, "machineName"));
+            return redirect(self);
+        }
+        if (intent === "byte-rates") {
+            await ctx.client.setMachineByteRates(id, text(form, "rateMachine"), {
+                produceBytesPerSecond: Number(text(form, "produceBytesPerSecond")),
+                consumeBytesPerSecond: Number(text(form, "consumeBytesPerSecond")),
+                requestPercentage: Number(text(form, "requestPercentage")),
+            });
+            return redirect(self);
+        }
+        throw new Response(`unknown operation '${intent}'`, { status: 400 });
+    });
+}
+export default function Machines() {
+    const { organization: o, machines, grants, registered } = useLoaderData();
+    const { shows, shell } = useConsole();
+    const manages = shell.organization?.manages ?? false;
+    const registerRefusal = useRefusal("register");
+    const ratesRefusal = useRefusal("byte-rates");
+    const inspector = manages ? (_jsxs(_Fragment, { children: [shows("machine.register") ? (_jsxs("section", { "aria-labelledby": "register-machine", className: "ac-form", children: [_jsx(SectionTitle, { children: _jsx("span", { id: "register-machine", children: "Register a machine" }) }), _jsxs(ConsoleForm, { intent: "register", className: "ac-inline", children: [_jsx(Field, { label: "Machine name", name: "machineName", required: true, placeholder: "affiliate-network", hint: "Lowercase letters, digits and '-'. A grant names it as machine:<organization>/<name>.", defaultValue: registerRefusal?.values.machineName, autoComplete: "off" }), _jsx(Submit, { intent: "register", primary: true, children: "Register machine" })] }), _jsx(Refused, { intent: "register" }), _jsx("div", { className: "ac-ops", children: _jsx(HostActions, { operation: "machine.register", entity: o }) })] })) : null, shows("machine.byte-rates") && machines.length > 0 ? (_jsxs("section", { "aria-labelledby": "byte-rates-title", className: "ac-form", children: [_jsx(SectionTitle, { children: _jsx("span", { id: "byte-rates-title", children: "Byte rates" }) }), _jsxs("details", { className: "ac-more", open: ratesRefusal !== undefined || undefined, children: [_jsx("summary", { children: "Limit a machine on the broker" }), _jsxs(ConsoleForm, { intent: "byte-rates", className: "ac-form", children: [_jsxs("div", { className: "ac-field", children: [_jsx("label", { htmlFor: "rateMachine", children: "Machine" }), _jsx("select", { id: "rateMachine", name: "rateMachine", defaultValue: ratesRefusal?.values.rateMachine ?? machines[0]?.name, children: machines.map((m) => (_jsx("option", { value: m.name, children: m.name }, m.name))) })] }), _jsx(Field, { label: "Produce bytes a second", name: "produceBytesPerSecond", type: "number", required: true, min: 1, defaultValue: ratesRefusal?.values.produceBytesPerSecond }), _jsx(Field, { label: "Consume bytes a second", name: "consumeBytesPerSecond", type: "number", required: true, min: 1, defaultValue: ratesRefusal?.values.consumeBytesPerSecond }), _jsx(Field, { label: "Request percentage", name: "requestPercentage", type: "number", required: true, min: 1, max: 100, hint: "The share of a broker thread's time its requests may take, 1 to 100.", defaultValue: ratesRefusal?.values.requestPercentage }), _jsx(Refused, { intent: "byte-rates" }), _jsx("div", { children: _jsx(Submit, { intent: "byte-rates", children: "Set byte rates" }) })] })] })] })) : null] })) : null;
+    return (_jsxs(Page, { inspector: inspector, children: [_jsxs("h1", { children: ["Machines of ", o.name] }), _jsx("p", { className: "ac-lede", children: "A machine is a program outside the installation that another project can grant a route, a method or a topic. It signs in with its client id and secret; owners register, limit and delete machines, and every member can see them." }), registered ? (_jsxs("div", { className: "ac-notice", role: "status", children: [_jsxs("p", { children: [_jsxs("strong", { children: ["Copy the client secret for ", registered.name, " now."] }), " It is shown this once and cannot be retrieved later."] }), _jsxs("dl", { className: "ac-facts", children: [_jsx("dt", { children: "Client id" }), _jsx("dd", { children: _jsx("code", { children: registered.clientId }) }), _jsx("dt", { children: "Token address" }), _jsx("dd", { children: _jsx("code", { children: registered.tokenUrl }) }), registered.brokerBootstrap ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Broker" }), _jsx("dd", { children: _jsx("code", { children: registered.brokerBootstrap }) })] })) : null] }), _jsx("code", { className: "ac-secret", "data-secret": true, children: registered.clientSecret })] })) : null, _jsxs("section", { className: "ac-card", "aria-label": "Machines", children: [machines.length === 0 ? (_jsx("p", { className: "ac-empty", children: "No machines registered." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", children: [_jsx("caption", { className: "ac-visually-hidden", children: "Machines" }), _jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Name" }), _jsx("th", { scope: "col", children: "Client id" }), _jsx("th", { scope: "col", children: "Registered" }), _jsx("th", { scope: "col", children: "Byte rates" }), _jsx("th", { scope: "col", children: _jsx("span", { className: "ac-visually-hidden", children: "Actions" }) })] }) }), _jsx("tbody", { children: machines.map((m) => (_jsxs("tr", { "data-machine": m.name, children: [_jsx("td", { children: m.name }), _jsx("td", { children: _jsx("code", { children: m.clientId }) }), _jsxs("td", { children: [m.registeredAt ? when(m.registeredAt) : "—", m.registeredBy ? ` by ${m.registeredBy}` : ""] }), _jsx("td", { "data-byte-rates": true, children: m.byteRates
+                                                    ? `produce ${m.byteRates.produceBytesPerSecond} B/s, consume ${m.byteRates.consumeBytesPerSecond} B/s, ${m.byteRates.requestPercentage}% of requests`
+                                                    : "The installation's default" }), _jsx("td", { children: manages && shows("machine.delete") ? (_jsxs(ConsoleForm, { intent: "delete", children: [_jsx("input", { type: "hidden", name: "machineName", value: m.name }), _jsx(Submit, { intent: "delete", className: "ac-button ac-button-small ac-button-danger", label: `Delete ${m.name}`, children: "Delete" })] })) : null })] }, m.name))) })] }) })), _jsx(Refused, { intent: "delete" })] }), _jsxs("section", { className: "ac-card", "aria-labelledby": "held", children: [_jsx("h2", { id: "held", children: "Grants held" }), grants.length === 0 ? (_jsx("p", { className: "ac-empty", children: "Nothing is granted to this organization's machines or services by another project." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", "aria-describedby": "held", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "From" }), _jsx("th", { scope: "col", children: "Grantee" }), _jsx("th", { scope: "col", children: "Target" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: grants.map((g) => (_jsxs("tr", { "data-held": g.id, children: [_jsxs("td", { children: [g.grantingProject, " ", _jsxs("span", { className: "ac-hint", children: ["of ", g.grantingOrganization] })] }), _jsx("td", { children: _jsx("code", { children: g.grantee }) }), _jsx("td", { children: targetText(g.target) }), _jsx("td", { children: g.state })] }, g.id))) })] }) }))] })] }));
+}
+export const ErrorBoundary = ConsoleErrorBoundary;

package/dist/routes/organization.d.ts

@@ -1,5 +1,6 @@
 /**
- * An organization: its projects, and what its owners and the platform administrator may do to it.
+ * An organization: its projects, the grants other organizations' projects offer it (feature 040), and
+ * what its owners and the platform administrator may do to it.
  */
 import { type ActionFunctionArgs, type LoaderFunctionArgs, type MetaFunction } from "react-router";
 import { ConsoleErrorBoundary } from "../ui/errors.tsx";
@@ -35,6 +36,33 @@ export declare function loader({ params, context }: LoaderFunctionArgs): Promise
             setBy: string | undefined;
         } | undefined;
     }[];
+    offered: {
+        id: string;
+        grantingProject: string;
+        grantingOrganization: string;
+        grantee: string;
+        target: {
+            kind: string;
+            service: string | undefined;
+            method: string | undefined;
+            path: string | undefined;
+            topic: string | undefined;
+            right: string | undefined;
+            decrypt: boolean;
+        };
+        state: string;
+        changes: {
+            change: string;
+            by: string | undefined;
+            at: string | undefined;
+        }[];
+        topic: {
+            partitions: number;
+            compacted: boolean;
+            retention: string | undefined;
+            copies: number | undefined;
+        } | undefined;
+    }[];
     ownerless: boolean;
     panels: import("../extensions/render.tsx").LoadedPanels;
 }>;

package/dist/routes/organization.js

@@ -1,20 +1,27 @@
 import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /**
- * An organization: its projects, and what its owners and the platform administrator may do to it.
+ * An organization: its projects, the grants other organizations' projects offer it (feature 040), and
+ * what its owners and the platform administrator may do to it.
  */
 import { redirect, useLoaderData } from "react-router";
 import { act, guard, organizationShell, pageData, text, useConsoleContext } from "../context.js";
 import { ConsoleErrorBoundary } from "../ui/errors.js";
-import { ConsoleForm, ConsoleLink, Field, Submit, useConsole } from "../ui/console.js";
+import { ConsoleForm, ConsoleLink, Field, Submit, useConsole, when } from "../ui/console.js";
 import { Page } from "../ui/shell.js";
 import { Refused, useRefusal } from "../ui/refused.js";
 import { HostActions, loadPanels, Panels } from "../extensions/render.js";
+import { targetText } from "../ui/grants.js";
 export const meta = ({ loaderData }) => [{ title: `${loaderData?.organization.name ?? "Organization"} · ankka` }];
 export async function loader({ params, context }) {
     const ctx = useConsoleContext(context);
     const id = params.organizationId;
     return guard(ctx, async () => {
-        const [organization, projects, page] = await Promise.all([ctx.client.getOrganization(id), ctx.client.listProjects(), pageData(ctx)]);
+        const [organization, projects, offered, page] = await Promise.all([
+            ctx.client.getOrganization(id),
+            ctx.client.listProjects(),
+            ctx.client.organizationGrants(id),
+            pageData(ctx),
+        ]);
         // An organization whose owners have all left can be given one by an administrator.
         const ownerless = page.principal?.platformAdmin ? !(await ctx.client.members(id)).members.some((m) => m.role === "owner") : false;
         const own = projects.filter((p) => p.organizationId === id);
@@ -26,6 +33,7 @@ export async function loader({ params, context }) {
             }),
             organization,
             projects: own,
+            offered,
             ownerless,
             panels: await loadPanels(ctx, "organization", organization),
         };
@@ -66,14 +74,25 @@ export async function action({ request, params, context }) {
             case "repair":
                 await ctx.client.repair(id, text(form, "subject"), "owner");
                 return redirect(self);
+            case "grant-accept":
+                await ctx.client.answerGrant(id, text(form, "grantId"), "accept");
+                return redirect(self);
+            case "grant-decline":
+                await ctx.client.answerGrant(id, text(form, "grantId"), "decline");
+                return redirect(self);
+            case "grant-relinquish":
+                await ctx.client.answerGrant(id, text(form, "grantId"), "relinquish");
+                return redirect(self);
             default:
                 throw new Response(`unknown operation '${intent}'`, { status: 400 });
         }
     });
 }
 const limit = (n, what) => (n === undefined ? `any number of ${what}` : `${n} ${what}`);
+/** A grant in one phrase for a control's accessible name: what it opens, to whom, from where. */
+const grantName = (g) => `${targetText(g.target)} to ${g.grantee} from ${g.grantingProject}`;
 export default function Organization() {
-    const { organization: o, projects, ownerless, panels, console: page } = useLoaderData();
+    const { organization: o, projects, offered, ownerless, panels, console: page } = useLoaderData();
     const { shows } = useConsole();
     const admin = page.principal?.platformAdmin ?? false;
     const owner = o.role === "owner" || admin;
@@ -84,6 +103,9 @@ export default function Organization() {
     const inspector = (_jsxs(_Fragment, { children: [_jsx(HostActions, { operation: "project.create", entity: o }), admin ? (_jsxs("details", { className: "ac-more", open: adminRefused || undefined, children: [_jsx("summary", { children: "Platform administration" }), _jsx("div", { className: "ac-ops", children: o.disabled
                             ? shows("organization.enable") && (_jsx(ConsoleForm, { intent: "enable", children: _jsx(Submit, { intent: "enable", children: "Enable organization" }) }))
                             : shows("organization.disable") && (_jsx(ConsoleForm, { intent: "disable", children: _jsx(Submit, { intent: "disable", danger: true, children: "Disable organization" }) })) }), _jsx(Refused, { intent: "disable" }), _jsx(Refused, { intent: "enable" }), shows("organization.quota.set") ? (_jsxs(ConsoleForm, { intent: "quota-set", className: "ac-inline", "aria-label": "Quota", children: [_jsx(Field, { label: "Projects", name: "projects", type: "number", min: 0, defaultValue: o.quota?.projects, hint: "Empty for no limit" }), _jsx(Field, { label: "Services", name: "services", type: "number", min: 0, defaultValue: o.quota?.services }), _jsx(Field, { label: "Instances", name: "instances", type: "number", min: 0, defaultValue: o.quota?.instances }), _jsx(Submit, { intent: "quota-set", children: "Set quota" })] })) : null, _jsx(Refused, { intent: "quota-set" }), o.quota && shows("organization.quota.clear") ? (_jsx(ConsoleForm, { intent: "quota-clear", children: _jsx(Submit, { intent: "quota-clear", children: "Clear quota" }) })) : null, ownerless && shows("member.repair") ? (_jsxs(ConsoleForm, { intent: "repair", className: "ac-inline", children: [_jsx(Field, { label: "Subject to make owner", name: "subject", required: true, hint: "This organization has no owner. Name the subject of the person to make one." }), _jsx(Submit, { intent: "repair", children: "Add owner" })] })) : null, _jsx(Refused, { intent: "repair" })] })) : null, owner && (shows("organization.rename") || shows("organization.delete")) ? (_jsxs("details", { className: "ac-more", open: renameRefusal !== undefined || deleteRefusal !== undefined || undefined, children: [_jsx("summary", { children: "Rename or delete" }), shows("organization.rename") ? (_jsxs(ConsoleForm, { intent: "rename", className: "ac-inline", children: [_jsx(Field, { label: "New name", name: "name", required: true, defaultValue: renameRefusal?.values.name ?? o.name }), _jsx(Submit, { intent: "rename", children: "Rename" })] })) : null, _jsx(Refused, { intent: "rename" }), shows("organization.delete") ? (_jsxs("div", { className: "ac-danger-zone", children: [_jsxs("p", { children: ["Deleting ", o.name, " is permanent, and its id can never be used again. It must have no projects."] }), _jsx(ConsoleForm, { intent: "delete", children: _jsx(Submit, { intent: "delete", danger: true, children: "Delete organization" }) }), _jsx(Refused, { intent: "delete" })] })) : null, _jsx(HostActions, { operation: "organization.delete", entity: o })] })) : null] }));
-    return (_jsxs(Page, { inspector: inspector, children: [_jsx("h1", { children: o.name }), _jsxs("dl", { className: "ac-card ac-facts", children: [_jsx("dt", { children: "Id" }), _jsx("dd", { children: o.id }), _jsx("dt", { children: "Your role" }), _jsx("dd", { children: o.role === "owner" ? "Owner" : o.role === "member" ? "Member" : "Administrator (not a member)" }), _jsx("dt", { children: "State" }), _jsx("dd", { children: o.disabled ? "Disabled: its services are suspended and every change is refused" : "Active" }), _jsx("dt", { children: "Holds" }), _jsxs("dd", { children: [o.usage.projects, " projects, ", o.usage.services, " services, ", o.usage.instances, " instances"] }), o.quota ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Quota" }), _jsxs("dd", { children: [limit(o.quota.projects, "projects"), ", ", limit(o.quota.services, "services"), ", ", limit(o.quota.instances, "instances")] })] })) : null] }), _jsxs("section", { className: "ac-card", children: [_jsx("h2", { children: "Projects" }), projects.length === 0 ? (_jsx("p", { className: "ac-empty", children: "No projects yet. A project groups services and gives them a namespace of their own." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", children: [_jsxs("caption", { className: "ac-visually-hidden", children: ["Projects in ", o.name] }), _jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Name" }), _jsx("th", { scope: "col", children: "Id" }), _jsx("th", { scope: "col", className: "ac-num", children: "Services" }), _jsx("th", { scope: "col", children: "Registry" })] }) }), _jsx("tbody", { children: projects.map((p) => (_jsxs("tr", { children: [_jsx("td", { children: _jsx(ConsoleLink, { to: `projects/${encodeURIComponent(p.id)}`, children: p.name }) }), _jsx("td", { children: p.id }), _jsx("td", { className: "ac-num", children: p.services }), _jsx("td", { children: p.registry ? p.registry.server : "Public images only" })] }, p.id))) })] }) }))] }), _jsx(Panels, { kind: "organization", entity: o, loaded: panels })] }));
+    return (_jsxs(Page, { inspector: inspector, children: [_jsx("h1", { children: o.name }), _jsxs("dl", { className: "ac-card ac-facts", children: [_jsx("dt", { children: "Id" }), _jsx("dd", { children: o.id }), _jsx("dt", { children: "Your role" }), _jsx("dd", { children: o.role === "owner" ? "Owner" : o.role === "member" ? "Member" : "Administrator (not a member)" }), _jsx("dt", { children: "State" }), _jsx("dd", { children: o.disabled ? "Disabled: its services are suspended and every change is refused" : "Active" }), _jsx("dt", { children: "Holds" }), _jsxs("dd", { children: [o.usage.projects, " projects, ", o.usage.services, " services, ", o.usage.instances, " instances"] }), o.quota ? (_jsxs(_Fragment, { children: [_jsx("dt", { children: "Quota" }), _jsxs("dd", { children: [limit(o.quota.projects, "projects"), ", ", limit(o.quota.services, "services"), ", ", limit(o.quota.instances, "instances")] })] })) : null] }), _jsxs("section", { className: "ac-card", children: [_jsx("h2", { children: "Projects" }), projects.length === 0 ? (_jsx("p", { className: "ac-empty", children: "No projects yet. A project groups services and gives them a namespace of their own." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", children: [_jsxs("caption", { className: "ac-visually-hidden", children: ["Projects in ", o.name] }), _jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Name" }), _jsx("th", { scope: "col", children: "Id" }), _jsx("th", { scope: "col", className: "ac-num", children: "Services" }), _jsx("th", { scope: "col", children: "Registry" })] }) }), _jsx("tbody", { children: projects.map((p) => (_jsxs("tr", { children: [_jsx("td", { children: _jsx(ConsoleLink, { to: `projects/${encodeURIComponent(p.id)}`, children: p.name }) }), _jsx("td", { children: p.id }), _jsx("td", { className: "ac-num", children: p.services }), _jsx("td", { children: p.registry ? p.registry.server : "Public images only" })] }, p.id))) })] }) }))] }), _jsxs("section", { className: "ac-card", "aria-labelledby": "offered", children: [_jsx("h2", { id: "offered", children: "Offered grants" }), offered.length === 0 ? (_jsx("p", { className: "ac-empty", children: "No other organization's project offers this organization's machines or services anything. A grant from another organization waits here until an owner accepts it." })) : (_jsx("div", { className: "ac-table-wrap", children: _jsxs("table", { className: "ac-table", "aria-describedby": "offered", children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "From" }), _jsx("th", { scope: "col", children: "Grantee" }), _jsx("th", { scope: "col", children: "Target" }), _jsx("th", { scope: "col", children: "State" }), _jsx("th", { scope: "col", children: "Last change" }), _jsx("th", { scope: "col", children: _jsx("span", { className: "ac-visually-hidden", children: "Actions" }) })] }) }), _jsx("tbody", { children: offered.map((g) => {
+                                        const last = g.changes[g.changes.length - 1];
+                                        return (_jsxs("tr", { "data-offered": g.id, "data-state": g.state, children: [_jsxs("td", { children: [g.grantingProject, " ", _jsxs("span", { className: "ac-hint", children: ["of ", g.grantingOrganization] })] }), _jsx("td", { children: _jsx("code", { children: g.grantee }) }), _jsx("td", { children: targetText(g.target) }), _jsx("td", { children: g.state }), _jsx("td", { children: last ? (_jsxs(_Fragment, { children: [last.change, last.at ? ` ${when(last.at)}` : "", last.by ? ` by ${last.by}` : ""] })) : ("—") }), _jsxs("td", { children: [owner && g.state === "pending" && shows("grant.answer") ? (_jsxs("div", { className: "ac-ops", children: [_jsxs(ConsoleForm, { intent: "grant-accept", className: "ac-inline", children: [_jsx("input", { type: "hidden", name: "grantId", value: g.id }), _jsx(Submit, { intent: "grant-accept", label: `Accept ${grantName(g)}`, children: "Accept" })] }), _jsxs(ConsoleForm, { intent: "grant-decline", className: "ac-inline", children: [_jsx("input", { type: "hidden", name: "grantId", value: g.id }), _jsx(Submit, { intent: "grant-decline", label: `Decline ${grantName(g)}`, children: "Decline" })] })] })) : null, owner && g.state === "accepted" && shows("grant.relinquish") ? (_jsxs(ConsoleForm, { intent: "grant-relinquish", className: "ac-inline", children: [_jsx("input", { type: "hidden", name: "grantId", value: g.id }), _jsx(Submit, { intent: "grant-relinquish", danger: true, label: `Relinquish ${grantName(g)}`, children: "Relinquish" })] })) : null] })] }, g.id));
+                                    }) })] }) })), _jsx(Refused, { intent: "grant-accept" }), _jsx(Refused, { intent: "grant-decline" }), _jsx(Refused, { intent: "grant-relinquish" })] }), _jsx(Panels, { kind: "organization", entity: o, loaded: panels })] }));
 }
 export const ErrorBoundary = ConsoleErrorBoundary;