cabloy 5.1.153 → 5.1.154

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/test/ssrMenuEligibility.test.ts

@@ -0,0 +1,135 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import {
+  checkSsrBinding,
+  resolveSsrMenuCatalog,
+  resolveSsrMenuEligibility,
+} from '../src/lib/ssrMenuEligibility.ts';
+
+function createMenus() {
+  return [
+    {
+      name: 'test:omitted',
+      beanOptions: {
+        options: {
+          item: { roles: [] },
+          locale: ['en-us'],
+        },
+      },
+    },
+    {
+      name: 'test:keyed',
+      beanOptions: {
+        options: {
+          site: ['test:admin', 'test:web'],
+          items: {
+            static: { roles: ['systemAdmin'] },
+            public: {},
+          },
+        },
+      },
+    },
+    {
+      name: 'test:malformed',
+      beanOptions: {},
+    },
+  ] as any;
+}
+
+describe('ssrMenuEligibility.test.ts', () => {
+  it('matches unset, scalar, or array bindings', () => {
+    assert.equal(checkSsrBinding('test:admin', undefined), true);
+    assert.equal(checkSsrBinding('test:admin', null), true);
+    assert.equal(checkSsrBinding('test:admin', ''), true);
+    assert.equal(checkSsrBinding('test:admin', 'test:admin'), true);
+    assert.equal(checkSsrBinding('test:web', 'test:admin'), false);
+    assert.equal(checkSsrBinding('test:web', ['test:admin', 'test:web']), true);
+    assert.equal(checkSsrBinding('en-us', ['zh-cn', 'en-us']), true);
+    assert.equal(checkSsrBinding('en-us', []), false);
+  });
+
+  it('derives every enabled-site partition with site and onion identities', () => {
+    const catalog = resolveSsrMenuCatalog(
+      [
+        { ssrSiteName: 'test:admin', title: 'Admin' },
+        { ssrSiteName: 'test:web', title: 'Web' },
+      ],
+      createMenus(),
+    );
+    assert.deepEqual(catalog.sites, [
+      { ssrSiteName: 'test:admin', title: 'Admin' },
+      { ssrSiteName: 'test:web', title: 'Web' },
+    ]);
+    assert.deepEqual(catalog.menus, [
+      {
+        ssrSiteName: 'test:admin',
+        ssrMenuName: 'test:omitted',
+        onionName: 'test:omitted',
+        roles: [],
+      },
+      {
+        ssrSiteName: 'test:admin',
+        ssrMenuName: 'test:keyed#static',
+        onionName: 'test:keyed',
+        roles: ['systemAdmin'],
+      },
+      {
+        ssrSiteName: 'test:admin',
+        ssrMenuName: 'test:keyed#public',
+        onionName: 'test:keyed',
+        roles: undefined,
+      },
+      {
+        ssrSiteName: 'test:web',
+        ssrMenuName: 'test:omitted',
+        onionName: 'test:omitted',
+        roles: [],
+      },
+      {
+        ssrSiteName: 'test:web',
+        ssrMenuName: 'test:keyed#static',
+        onionName: 'test:keyed',
+        roles: ['systemAdmin'],
+      },
+      {
+        ssrSiteName: 'test:web',
+        ssrMenuName: 'test:keyed#public',
+        onionName: 'test:keyed',
+        roles: undefined,
+      },
+    ]);
+  });
+
+  it('resolves final leaves independently of locale', () => {
+    const menus = createMenus();
+    assert.deepEqual(resolveSsrMenuEligibility('test:admin', 'test:omitted', menus), {
+      ssrSiteName: 'test:admin',
+      ssrMenuName: 'test:omitted',
+      rolesDefined: true,
+    });
+    assert.deepEqual(resolveSsrMenuEligibility('test:web', 'test:omitted', menus), {
+      ssrSiteName: 'test:web',
+      ssrMenuName: 'test:omitted',
+      rolesDefined: true,
+    });
+  });
+
+  it('distinguishes dynamic/static leaves from public leaves and exact keyed names', () => {
+    const menus = createMenus();
+    assert.deepEqual(resolveSsrMenuEligibility('test:admin', 'test:keyed#static', menus), {
+      ssrSiteName: 'test:admin',
+      ssrMenuName: 'test:keyed#static',
+      rolesDefined: true,
+    });
+    assert.deepEqual(resolveSsrMenuEligibility('test:web', 'test:keyed#public', menus), {
+      ssrSiteName: 'test:web',
+      ssrMenuName: 'test:keyed#public',
+      rolesDefined: false,
+    });
+    assert.equal(resolveSsrMenuEligibility('test:admin', 'test:keyed', menus), undefined);
+    assert.equal(resolveSsrMenuEligibility('test:other', 'test:keyed#static', menus), undefined);
+    assert.equal(resolveSsrMenuEligibility('test:admin', 'test:missing', menus), undefined);
+    assert.equal(resolveSsrMenuEligibility('test:admin', 'test:malformed', menus), undefined);
+  });
+});

package/vona/src/suite-vendor/a-cabloy/modules/a-ssr/test/ssrMenuVisibility.test.ts

@@ -0,0 +1,64 @@
+import assert from 'node:assert';
+import { describe, it } from 'node:test';
+
+import {
+  projectPublicSsrMenuGroups,
+  projectPublicSsrMenus,
+  resolveSsrMenuVisibilityDefault,
+  resolveVisibleSsrMenuGroups,
+} from '../src/lib/ssrMenuVisibility.ts';
+
+function createMenus() {
+  return [
+    { name: 'test:public', title: 'Public', group: 'root' },
+    { name: 'test:dynamic', title: 'Dynamic', roles: [], group: 'root' },
+    { name: 'test:static', title: 'Static', roles: ['member'] },
+  ] as any;
+}
+
+describe('ssrMenuVisibility.test.ts', () => {
+  it('distinguishes public, dynamic-only, and static leaves', () => {
+    const menus = createMenus();
+    assert.deepEqual(
+      resolveSsrMenuVisibilityDefault(menus, roles => roles.includes('member')),
+      [menus[0], menus[2]],
+    );
+    assert.deepEqual(
+      resolveSsrMenuVisibilityDefault(menus, () => false),
+      [menus[0]],
+    );
+  });
+
+  it('retains only groups that contain a visible descendant', () => {
+    const groups = [
+      { name: 'root', title: 'Root' },
+      { name: 'nested', title: 'Nested', group: 'root' },
+      { name: 'empty', title: 'Empty' },
+    ];
+    const menus = [{ name: 'test:visible', group: 'nested' }] as any;
+    assert.deepEqual(resolveVisibleSsrMenuGroups(menus, groups), [groups[0], groups[1]]);
+  });
+
+  it('projects only public menu and group fields', () => {
+    const menus = [
+      {
+        name: 'test:private',
+        title: 'Private',
+        roles: ['member'],
+        policyRevision: 'private',
+        associationState: 'private',
+      },
+    ] as any;
+    const groups = [{ name: 'root', title: 'Root', catalogState: 'private' }] as any;
+    const result = {
+      menus: projectPublicSsrMenus(menus),
+      groups: projectPublicSsrMenuGroups(groups),
+    };
+    assert.deepEqual(result.menus, [{ name: 'test:private', title: 'Private' }]);
+    assert.deepEqual(result.groups, [{ name: 'root', title: 'Root' }]);
+    const serialized = JSON.stringify(result);
+    for (const forbidden of ['roles', 'policyRevision', 'associationState', 'catalogState']) {
+      assert.equal(serialized.includes(forbidden), false, forbidden);
+    }
+  });
+});

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.47",
+  "version": "5.1.48",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -9,7 +9,7 @@
   "dependencies": {
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.1",
+    "vona-module-a-rbac": "^5.0.2",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"

package/vona/src/suite-vendor/a-vona/modules/a-openapiutils/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-openapiutils",
-  "version": "5.1.21",
+  "version": "5.1.22",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-openapiutils/src/lib/const/index.ts

@@ -1,2 +1,3 @@
 export * from './database.ts';
 export * from './decorator.ts';
+export * from './site.ts';

package/vona/src/suite-vendor/a-vona/modules/a-openapiutils/src/lib/const/site.ts

@@ -0,0 +1 @@
+export const roleSiteIdAll = '*';

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.17",
+  "version": "5.1.18",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-user/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-user",
-  "version": "5.1.23",
+  "version": "5.1.24",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-user/src/types/role.ts

@@ -15,6 +15,7 @@ export interface IRole {
   title: string;
   titleLocales?: LocalizedTextMap;
   siteIds: string[];
+  builtin?: boolean;
 }
 
 export interface IRoleAdapter {

package/vona/src/suite-vendor/a-vona/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-vona",
-  "version": "5.1.81",
+  "version": "5.1.82",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",

package/zova/pnpm-lock.yaml

@@ -977,7 +977,7 @@ importers:
         specifier: ^5.0.1
         version: link:modules/a-rbac
       zova-module-rest-resource:
-        specifier: ^5.1.47
+        specifier: ^5.1.48
         version: link:modules/rest-resource
 
   src/suite-vendor/a-cabloy/modules/a-rbac:

package/zova/src/suite/a-home/modules/home-api/mock/passport.fake.ts

@@ -416,14 +416,14 @@ export default defineFakeRoute([
                 name: 'registeredUser',
                 title: 'Registered User',
                 titleLocales: { 'zh-cn': '注册用户' },
-                siteIds: ['web'],
+                siteIds: ['*'],
               },
               {
                 id: 2,
                 name: 'systemAdmin',
                 title: 'System Administrator',
                 titleLocales: { 'zh-cn': '系统管理员' },
-                siteIds: ['web', 'admin'],
+                siteIds: ['*'],
               },
             ],
           },
@@ -461,15 +461,15 @@ export default defineFakeRoute([
               id: 1,
               name: 'registeredUser',
               title: 'Registered User',
-              locales: { 'zh-cn': '注册用户' },
-              siteIds: ['web'],
+              titleLocales: { 'zh-cn': '注册用户' },
+              siteIds: ['*'],
             },
             {
               id: 2,
               name: 'systemAdmin',
               title: 'System Administrator',
-              locales: { 'zh-cn': '系统管理员' },
-              siteIds: ['web', 'admin'],
+              titleLocales: { 'zh-cn': '系统管理员' },
+              siteIds: ['*'],
             },
           ],
         },

package/zova/src/suite/a-home/modules/home-base/src/lib/index.ts

@@ -1 +1,2 @@
+export * from './roleSiteAdmission.js';
 export * from './utils.js';

package/zova/src/suite/a-home/modules/home-base/src/lib/roleSiteAdmission.ts

@@ -0,0 +1,15 @@
+export const roleSiteIdAll = '*';
+
+export interface RoleSiteAdmission {
+  siteIds: string[];
+}
+
+export function isRoleSiteAdmitted(
+  siteId: string | undefined,
+  roles: RoleSiteAdmission[] | undefined,
+): boolean {
+  if (!siteId) return false;
+  return !!roles?.some(
+    role => role.siteIds.includes(siteId) || role.siteIds.includes(roleSiteIdAll),
+  );
+}

package/zova/src/suite/a-home/modules/home-base/src/service/routerGuards.ts

@@ -4,6 +4,8 @@ import { catchError } from '@cabloy/utils';
 import { Service } from 'zova-module-a-bean';
 import { BeanRouterGuardsBase } from 'zova-module-a-router';
 
+import { isRoleSiteAdmitted } from '../lib/roleSiteAdmission.js';
+
 @Service()
 export class ServiceRouterGuards extends BeanRouterGuardsBase {
   protected onRouterGuards(router: BeanRouter) {
@@ -31,9 +33,7 @@ export class ServiceRouterGuards extends BeanRouterGuardsBase {
         }
         return pagePath;
       }
-      const siteId = this.sys.env.SITE_ID;
-      const siteAdmitted =
-        !!siteId && !!this.$passport.roles?.some(role => role.siteIds.includes(siteId));
+      const siteAdmitted = isRoleSiteAdmitted(this.sys.env.SITE_ID, this.$passport.roles);
       if (!siteAdmitted) {
         const pagePath = this.app.$getPagePathAccessDenied();
         if (process.env.SERVER) {

package/zova/src/suite/a-home/modules/home-layoutadmin/src/model/menu.ts

@@ -28,7 +28,7 @@ export class ModelMenu extends BeanModelBase {
     // event
     if (process.env.CLIENT && this.sys.config.ssr.hmr) {
       this._eventSsrHmrReload = this.sys.meta.event.on('a-ssrhmr:reload', async (_data, next) => {
-        await this._refetchRetrieveMenus();
+        await this.refreshMenus();
         return next();
       });
     }
@@ -78,8 +78,9 @@ export class ModelMenu extends BeanModelBase {
     });
   }
 
-  private _refetchRetrieveMenus(): Promise<void> {
-    return this.$refetchQueries({ queryKey: this._getQueryKeyRetrieveMenus() });
+  async refreshMenus(): Promise<void> {
+    const queryMenus = this.retrieveMenus();
+    await queryMenus.refetch({ bypassPersister: true });
   }
 
   private _getQueryKeyRetrieveMenus(): [string, string | undefined, string | undefined] {

package/zova/src/suite/a-home/modules/home-layoutweb/src/model/menu.ts

@@ -28,7 +28,7 @@ export class ModelMenu extends BeanModelBase {
     // event
     if (process.env.CLIENT && this.sys.config.ssr.hmr) {
       this._eventSsrHmrReload = this.sys.meta.event.on('a-ssrhmr:reload', async (_data, next) => {
-        await this._refetchRetrieveMenus();
+        await this.refreshMenus();
         return next();
       });
     }
@@ -78,8 +78,9 @@ export class ModelMenu extends BeanModelBase {
     });
   }
 
-  private _refetchRetrieveMenus(): Promise<void> {
-    return this.$refetchQueries({ queryKey: this._getQueryKeyRetrieveMenus() });
+  async refreshMenus(): Promise<void> {
+    const queryMenus = this.retrieveMenus();
+    await queryMenus.refetch({ bypassPersister: true });
   }
 
   private _getQueryKeyRetrieveMenus(): [string, string | undefined, string | undefined] {

package/zova/src/suite/a-home/modules/home-passport/package.json

@@ -54,7 +54,8 @@
       "monkey": true
     },
     "dependencies": {
-      "a-zova": "5.0.0"
+      "a-zova": "5.0.0",
+      "home-base": "5.0.0"
     }
   }
 }

package/zova/src/suite/a-home/modules/home-passport/src/model/passport.ts

@@ -17,6 +17,7 @@ import {
   TypeOpenapiPermissions,
 } from 'zova-module-a-openapi';
 import { ApiApiHomeUserPassportloginOauthPath, OpenApiBaseURL } from 'zova-module-home-api';
+import { isRoleSiteAdmitted } from 'zova-module-home-base';
 
 import { matchPermissionAction } from '../lib/permissionActionMatcher.js';
 
@@ -143,8 +144,7 @@ export class ModelPassport extends BeanModelBase {
   }
 
   isPassportSiteAdmitted(passport?: ApiApiHomeUserPassportloginResponseBody['passport']) {
-    const siteId = this.sys.env.SITE_ID;
-    return !!siteId && !!passport?.roles.some(role => role.siteIds.includes(siteId));
+    return isRoleSiteAdmitted(this.sys.env.SITE_ID, passport?.roles);
   }
 
   logout() {

package/zova/src/suite/a-home/modules/home-passport/test/lib/roleSiteAdmission.test.ts

@@ -0,0 +1,23 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { isRoleSiteAdmitted } from 'zova-module-home-base';
+
+test('admits an exact site match', () => {
+  assert.equal(isRoleSiteAdmitted('web', [{ siteIds: ['web'] }]), true);
+  assert.equal(isRoleSiteAdmitted('admin', [{ siteIds: ['web'] }]), false);
+});
+
+test('admits every non-empty site through the wildcard', () => {
+  assert.equal(isRoleSiteAdmitted('web', [{ siteIds: ['*'] }]), true);
+  assert.equal(isRoleSiteAdmitted('admin', [{ siteIds: ['*'] }]), true);
+  assert.equal(isRoleSiteAdmitted(undefined, [{ siteIds: ['*'] }]), false);
+  assert.equal(isRoleSiteAdmitted('', [{ siteIds: ['*'] }]), false);
+});
+
+test('combines site admission across roles', () => {
+  assert.equal(isRoleSiteAdmitted('admin', [{ siteIds: ['web'] }, { siteIds: ['admin'] }]), true);
+  assert.equal(
+    isRoleSiteAdmitted('web', [{ siteIds: ['storefront'] }, { siteIds: ['admin'] }]),
+    false,
+  );
+});

package/vona/src/suite/a-commerce/modules/commerce-siteadmin/src/bean/meta.version.ts

@@ -1,32 +0,0 @@
-import type {
-  IMetaVersionInit,
-  IMetaVersionInitOptions,
-  IMetaVersionUpdate,
-  IMetaVersionUpdateOptions,
-} from 'vona-module-a-version';
-
-import { BeanBase } from 'vona';
-import { Meta } from 'vona-module-a-meta';
-
-const roleSiteIds = {
-  registeredUser: ['commerce'],
-  systemAdmin: ['commerce', 'commerceAdmin'],
-};
-
-@Meta()
-export class MetaVersion extends BeanBase implements IMetaVersionUpdate, IMetaVersionInit {
-  async update(_options: IMetaVersionUpdateOptions) {}
-
-  async init(options: IMetaVersionInitOptions) {
-    if (options.version !== 1) return;
-    const modelRole = this.app.scope('home-user').model.role;
-    for (const [roleName, requiredSiteIds] of Object.entries(roleSiteIds)) {
-      const role = await modelRole.getByName(roleName);
-      if (!role) continue;
-
-      const siteIds = [...new Set([...role.siteIds, ...requiredSiteIds])];
-      if (siteIds.length === role.siteIds.length) continue;
-      await modelRole.updateById(role.id, { siteIds });
-    }
-  }
-}

package/vona/src/suite/a-commerce/modules/commerce-siteadmin/test/meta.version.test.ts

@@ -1,44 +0,0 @@
-import assert from 'node:assert';
-import { describe, it } from 'node:test';
-import { app } from 'vona-mock';
-
-describe('meta.version.test.ts', () => {
-  it('init:version:1 preserves existing grants and appends Commerce site access once', async () => {
-    await app.bean.executor.mockCtx(async () => {
-      const modelRole = app.scope('home-user').model.role;
-      const roleRegisteredUser = await modelRole.getByName('registeredUser');
-      const roleSystemAdmin = await modelRole.getByName('systemAdmin');
-      assert.ok(roleRegisteredUser);
-      assert.ok(roleSystemAdmin);
-      const registeredUserSiteIdsOriginal = roleRegisteredUser.siteIds;
-      const systemAdminSiteIdsOriginal = roleSystemAdmin.siteIds;
-      try {
-        await modelRole.updateById(roleRegisteredUser.id, { siteIds: ['web', 'customSite'] });
-        await modelRole.updateById(roleSystemAdmin.id, {
-          siteIds: ['web', 'admin', 'customSite', 'commerce'],
-        });
-
-        const metaVersion = app.scope('commerce-siteadmin').meta.version;
-        await metaVersion.init({ version: 1 });
-        await metaVersion.init({ version: 1 });
-
-        const registeredUser = await modelRole.getByName('registeredUser');
-        assert.deepEqual(registeredUser?.siteIds, ['web', 'customSite', 'commerce']);
-
-        const systemAdmin = await modelRole.getByName('systemAdmin');
-        assert.deepEqual(systemAdmin?.siteIds, [
-          'web',
-          'admin',
-          'customSite',
-          'commerce',
-          'commerceAdmin',
-        ]);
-      } finally {
-        await modelRole.updateById(roleRegisteredUser.id, {
-          siteIds: registeredUserSiteIdsOriginal,
-        });
-        await modelRole.updateById(roleSystemAdmin.id, { siteIds: systemAdminSiteIdsOriginal });
-      }
-    });
-  });
-});