cortena-ui 1.4.2 → 1.6.0

package/dist/components/admin-permissions/role-assignment.js

@@ -0,0 +1,174 @@
+"use client";
+"use client";
+import { cn } from "../../lib/cn.js";
+import { Button } from "../button.js";
+import { Spinner } from "../spinner.js";
+import { Checkbox } from "../checkbox.js";
+import { Chip } from "../chip.js";
+import { Dialog, DialogBody, DialogContent, DialogDescription, DialogFooter, DialogHeader, DialogTitle } from "../dialog.js";
+import { ErrorBanner } from "../error-banner.js";
+import { adminErrorMessage, sourceGroupOf } from "./types.js";
+import { useAdminPermissions } from "./context.js";
+import { Users } from "lucide-react";
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/admin-permissions/role-assignment.tsx
+/**
+* The effective-roles cell. Every role carries the assignment that granted it:
+* nothing for a direct one, and the group's name for an inherited one. This is
+* the whole point of §13.4 and P-43 — an administrator who cannot see why
+* somebody has a permission removes the wrong assignment and believes the job
+* is done.
+*/
+function EffectiveRoles({ roles, className }) {
+	if (roles.length === 0) return /* @__PURE__ */ jsx("span", {
+		"data-slot": "admin-effective-roles-empty",
+		className: "text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]",
+		children: "No roles"
+	});
+	return /* @__PURE__ */ jsx("div", {
+		"data-slot": "admin-effective-roles",
+		className: cn("flex flex-wrap items-center gap-1", className),
+		children: roles.map((entry, index) => {
+			const group = sourceGroupOf(entry.source);
+			return /* @__PURE__ */ jsxs(Chip, {
+				size: "sm",
+				variant: group ? "outline" : "accent",
+				"data-role": entry.role,
+				"data-source": group ? group.id : "direct",
+				title: group ? `${entry.role} — via group ${group.name}` : `${entry.role} — assigned directly`,
+				children: [entry.role, group ? /* @__PURE__ */ jsxs("span", {
+					className: "inline-flex items-center gap-1 text-[color:var(--ds-text-tertiary)]",
+					children: [
+						/* @__PURE__ */ jsx(Users, { "aria-hidden": true }),
+						"via ",
+						group.name
+					]
+				}) : null]
+			}, `${entry.role}-${group?.id ?? "direct"}-${index}`);
+		})
+	});
+}
+/** A plain list of directly assigned roles, for the group list. */
+function DirectRoles({ roles }) {
+	if (roles.length === 0) return /* @__PURE__ */ jsx("span", {
+		"data-slot": "admin-direct-roles-empty",
+		className: "text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]",
+		children: "None"
+	});
+	return /* @__PURE__ */ jsx("div", {
+		"data-slot": "admin-direct-roles",
+		className: "flex flex-wrap items-center gap-1",
+		children: roles.map((role) => /* @__PURE__ */ jsx(Chip, {
+			size: "sm",
+			variant: "accent",
+			"data-role": role,
+			children: role
+		}, role))
+	});
+}
+/**
+* The one editor for a role assignment, for both principal kinds (DESIGN-D22).
+* It offers the roles the extension declared and nothing else; a role already
+* assigned that the matrix no longer declares is still listed, marked, and
+* removable, because hiding it would leave a grant nobody can see or revoke.
+*/
+function RoleAssignmentDialog({ principal, current, onOpenChange }) {
+	const { matrix, assignRoles } = useAdminPermissions();
+	const [selected, setSelected] = React.useState(current);
+	const [saving, setSaving] = React.useState(false);
+	const [error, setError] = React.useState(null);
+	const key = principal ? `${principal.kind}:${principal.id}` : null;
+	const [seededKey, setSeededKey] = React.useState(key);
+	if (key !== seededKey) {
+		setSeededKey(key);
+		setSelected(current);
+		setError(null);
+	}
+	const declared = matrix?.roles ?? [];
+	const retired = current.filter((role) => !declared.includes(role));
+	const options = [...declared, ...retired];
+	const toggle = (role, checked) => {
+		setSelected((prev) => checked ? [...prev, role] : prev.filter((r) => r !== role));
+	};
+	const save = async () => {
+		if (!principal) return;
+		setSaving(true);
+		setError(null);
+		try {
+			await assignRoles(principal, [...selected]);
+			onOpenChange(false);
+		} catch (err) {
+			setError(adminErrorMessage(err));
+		} finally {
+			setSaving(false);
+		}
+	};
+	return /* @__PURE__ */ jsx(Dialog, {
+		open: principal !== null,
+		onOpenChange: (open) => !open && onOpenChange(false),
+		children: /* @__PURE__ */ jsxs(DialogContent, {
+			"data-slot": "admin-role-dialog",
+			children: [
+				/* @__PURE__ */ jsxs(DialogHeader, { children: [/* @__PURE__ */ jsx(DialogTitle, { children: "Edit roles" }), /* @__PURE__ */ jsx(DialogDescription, { children: principal?.kind === "group" ? /* @__PURE__ */ jsxs(Fragment, { children: [
+					"Every member of ",
+					/* @__PURE__ */ jsx("strong", { children: principal.name ?? principal.id }),
+					" inherits the roles you select here, as soon as they join."
+				] }) : /* @__PURE__ */ jsxs(Fragment, { children: [
+					"Direct assignment for ",
+					/* @__PURE__ */ jsx("strong", { children: principal?.name ?? principal?.id }),
+					". Roles inherited from a group are changed on the group, not here."
+				] }) })] }),
+				/* @__PURE__ */ jsxs(DialogBody, {
+					className: "flex flex-col gap-2",
+					children: [error ? /* @__PURE__ */ jsx(ErrorBanner, {
+						message: error,
+						"data-slot": "admin-role-dialog-error"
+					}) : null, options.length === 0 ? /* @__PURE__ */ jsx("p", {
+						className: "text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]",
+						children: "This extension has not declared any roles yet."
+					}) : /* @__PURE__ */ jsx("ul", {
+						className: "flex flex-col gap-0.5",
+						"data-slot": "admin-role-options",
+						children: options.map((role) => {
+							const checked = selected.includes(role);
+							return /* @__PURE__ */ jsx("li", { children: /* @__PURE__ */ jsxs("label", {
+								className: cn("flex cursor-pointer items-center gap-2.5 rounded-[var(--ds-radius-md)] px-2 py-1.5", "text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-foreground)]", "transition-colors duration-[var(--ds-duration-fast)] ease-[var(--ds-ease-out)]", "hover:bg-[var(--ds-hover)]"),
+								children: [
+									/* @__PURE__ */ jsx(Checkbox, {
+										checked,
+										onCheckedChange: (next) => toggle(role, Boolean(next))
+									}),
+									/* @__PURE__ */ jsx("span", {
+										className: "flex-1",
+										children: role
+									}),
+									declared.includes(role) ? null : /* @__PURE__ */ jsx(Chip, {
+										size: "sm",
+										variant: "outline",
+										title: "Not in the declared vocabulary",
+										children: "retired"
+									})
+								]
+							}) }, role);
+						})
+					})]
+				}),
+				/* @__PURE__ */ jsxs(DialogFooter, { children: [/* @__PURE__ */ jsx(Button, {
+					variant: "outline",
+					onClick: () => onOpenChange(false),
+					disabled: saving,
+					children: "Cancel"
+				}), /* @__PURE__ */ jsxs(Button, {
+					onClick: save,
+					disabled: saving || options.length === 0,
+					children: [saving ? /* @__PURE__ */ jsx(Spinner, { tone: "inverse" }) : null, "Save roles"]
+				})] })
+			]
+		})
+	});
+}
+//#endregion
+export { DirectRoles, EffectiveRoles, RoleAssignmentDialog };
+
+//# sourceMappingURL=role-assignment.js.map

package/dist/components/admin-permissions/role-assignment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-assignment.js","names":[],"sources":["../../../src/components/admin-permissions/role-assignment.tsx"],"sourcesContent":["\"use client\";\n\nimport { Users } from \"lucide-react\";\nimport * as React from \"react\";\nimport { Button } from \"@/components/button\";\nimport { Checkbox } from \"@/components/checkbox\";\nimport { Chip } from \"@/components/chip\";\nimport {\n  Dialog,\n  DialogBody,\n  DialogContent,\n  DialogDescription,\n  DialogFooter,\n  DialogHeader,\n  DialogTitle,\n} from \"@/components/dialog\";\nimport { ErrorBanner } from \"@/components/error-banner\";\nimport { Spinner } from \"@/components/spinner\";\nimport { cn } from \"@/lib/cn\";\nimport { useAdminPermissions } from \"./context\";\nimport {\n  adminErrorMessage,\n  sourceGroupOf,\n  type AdminEffectiveRole,\n  type AdminPrincipal,\n} from \"./types\";\n\n/**\n * The effective-roles cell. Every role carries the assignment that granted it:\n * nothing for a direct one, and the group's name for an inherited one. This is\n * the whole point of §13.4 and P-43 — an administrator who cannot see why\n * somebody has a permission removes the wrong assignment and believes the job\n * is done.\n */\nexport function EffectiveRoles({\n  roles,\n  className,\n}: {\n  roles: readonly AdminEffectiveRole[];\n  className?: string;\n}) {\n  if (roles.length === 0) {\n    return (\n      <span\n        data-slot=\"admin-effective-roles-empty\"\n        className=\"text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]\"\n      >\n        No roles\n      </span>\n    );\n  }\n  return (\n    <div\n      data-slot=\"admin-effective-roles\"\n      className={cn(\"flex flex-wrap items-center gap-1\", className)}\n    >\n      {roles.map((entry, index) => {\n        const group = sourceGroupOf(entry.source);\n        return (\n          <Chip\n            key={`${entry.role}-${group?.id ?? \"direct\"}-${index}`}\n            size=\"sm\"\n            variant={group ? \"outline\" : \"accent\"}\n            data-role={entry.role}\n            data-source={group ? group.id : \"direct\"}\n            title={\n              group\n                ? `${entry.role} — via group ${group.name}`\n                : `${entry.role} — assigned directly`\n            }\n          >\n            {entry.role}\n            {group ? (\n              <span className=\"inline-flex items-center gap-1 text-[color:var(--ds-text-tertiary)]\">\n                <Users aria-hidden />\n                via {group.name}\n              </span>\n            ) : null}\n          </Chip>\n        );\n      })}\n    </div>\n  );\n}\n\n/** A plain list of directly assigned roles, for the group list. */\nexport function DirectRoles({ roles }: { roles: readonly string[] }) {\n  if (roles.length === 0) {\n    return (\n      <span\n        data-slot=\"admin-direct-roles-empty\"\n        className=\"text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]\"\n      >\n        None\n      </span>\n    );\n  }\n  return (\n    <div data-slot=\"admin-direct-roles\" className=\"flex flex-wrap items-center gap-1\">\n      {roles.map((role) => (\n        <Chip key={role} size=\"sm\" variant=\"accent\" data-role={role}>\n          {role}\n        </Chip>\n      ))}\n    </div>\n  );\n}\n\nexport interface RoleAssignmentDialogProps {\n  /** The principal being edited. A user and a group take the same dialog. */\n  principal: AdminPrincipal | null;\n  /** The principal's current direct assignment. */\n  current: readonly string[];\n  onOpenChange: (open: boolean) => void;\n}\n\n/**\n * The one editor for a role assignment, for both principal kinds (DESIGN-D22).\n * It offers the roles the extension declared and nothing else; a role already\n * assigned that the matrix no longer declares is still listed, marked, and\n * removable, because hiding it would leave a grant nobody can see or revoke.\n */\nexport function RoleAssignmentDialog({\n  principal,\n  current,\n  onOpenChange,\n}: RoleAssignmentDialogProps) {\n  const { matrix, assignRoles } = useAdminPermissions();\n  const [selected, setSelected] = React.useState<readonly string[]>(current);\n  const [saving, setSaving] = React.useState(false);\n  const [error, setError] = React.useState<string | null>(null);\n\n  // Re-seed whenever a different principal is opened — the documented\n  // adjust-state-during-render pattern, not an effect, so the dialog never\n  // paints one principal's roles under another principal's name.\n  const key = principal ? `${principal.kind}:${principal.id}` : null;\n  const [seededKey, setSeededKey] = React.useState<string | null>(key);\n  if (key !== seededKey) {\n    setSeededKey(key);\n    setSelected(current);\n    setError(null);\n  }\n\n  const declared = matrix?.roles ?? [];\n  const retired = current.filter((role) => !declared.includes(role));\n  const options = [...declared, ...retired];\n\n  const toggle = (role: string, checked: boolean) => {\n    setSelected((prev) => (checked ? [...prev, role] : prev.filter((r) => r !== role)));\n  };\n\n  const save = async () => {\n    if (!principal) return;\n    setSaving(true);\n    setError(null);\n    try {\n      await assignRoles(principal, [...selected]);\n      onOpenChange(false);\n    } catch (err) {\n      // The envelope's own message, not a house one (§15.6). The optimistic\n      // write has already been rolled back by `assignRoles`.\n      setError(adminErrorMessage(err));\n    } finally {\n      setSaving(false);\n    }\n  };\n\n  return (\n    <Dialog open={principal !== null} onOpenChange={(open) => !open && onOpenChange(false)}>\n      <DialogContent data-slot=\"admin-role-dialog\">\n        <DialogHeader>\n          <DialogTitle>Edit roles</DialogTitle>\n          <DialogDescription>\n            {principal?.kind === \"group\" ? (\n              <>\n                Every member of <strong>{principal.name ?? principal.id}</strong> inherits the roles\n                you select here, as soon as they join.\n              </>\n            ) : (\n              <>\n                Direct assignment for <strong>{principal?.name ?? principal?.id}</strong>. Roles\n                inherited from a group are changed on the group, not here.\n              </>\n            )}\n          </DialogDescription>\n        </DialogHeader>\n        <DialogBody className=\"flex flex-col gap-2\">\n          {error ? <ErrorBanner message={error} data-slot=\"admin-role-dialog-error\" /> : null}\n          {options.length === 0 ? (\n            <p className=\"text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-muted-foreground)]\">\n              This extension has not declared any roles yet.\n            </p>\n          ) : (\n            <ul className=\"flex flex-col gap-0.5\" data-slot=\"admin-role-options\">\n              {options.map((role) => {\n                const checked = selected.includes(role);\n                return (\n                  <li key={role}>\n                    <label\n                      className={cn(\n                        \"flex cursor-pointer items-center gap-2.5 rounded-[var(--ds-radius-md)] px-2 py-1.5\",\n                        \"text-[length:var(--ds-text-body-sm)] text-[color:var(--ds-foreground)]\",\n                        \"transition-colors duration-[var(--ds-duration-fast)] ease-[var(--ds-ease-out)]\",\n                        \"hover:bg-[var(--ds-hover)]\",\n                      )}\n                    >\n                      {/* No `aria-label`: the wrapping <label> already names\n                          the box, and Base UI points `aria-labelledby` at it.\n                          Both would compute the name as \"author author\". */}\n                      <Checkbox\n                        checked={checked}\n                        onCheckedChange={(next) => toggle(role, Boolean(next))}\n                      />\n                      <span className=\"flex-1\">{role}</span>\n                      {declared.includes(role) ? null : (\n                        <Chip size=\"sm\" variant=\"outline\" title=\"Not in the declared vocabulary\">\n                          retired\n                        </Chip>\n                      )}\n                    </label>\n                  </li>\n                );\n              })}\n            </ul>\n          )}\n        </DialogBody>\n        <DialogFooter>\n          <Button variant=\"outline\" onClick={() => onOpenChange(false)} disabled={saving}>\n            Cancel\n          </Button>\n          <Button onClick={save} disabled={saving || options.length === 0}>\n            {saving ? <Spinner tone=\"inverse\" /> : null}\n            Save roles\n          </Button>\n        </DialogFooter>\n      </DialogContent>\n    </Dialog>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAkCA,SAAgB,eAAe,EAC7B,OACA,aAIC;CACD,IAAI,MAAM,WAAW,GACnB,OACE,oBAAC,QAAD;EACE,aAAU;EACV,WAAU;EACX,UAAA;CAEK,CAAA;CAGV,OACE,oBAAC,OAAD;EACE,aAAU;EACV,WAAW,GAAG,qCAAqC,SAAS;EAE3D,UAAA,MAAM,KAAK,OAAO,UAAU;GAC3B,MAAM,QAAQ,cAAc,MAAM,MAAM;GACxC,OACE,qBAAC,MAAD;IAEE,MAAK;IACL,SAAS,QAAQ,YAAY;IAC7B,aAAW,MAAM;IACjB,eAAa,QAAQ,MAAM,KAAK;IAChC,OACE,QACI,GAAG,MAAM,KAAK,eAAe,MAAM,SACnC,GAAG,MAAM,KAAK;IATtB,UAAA,CAYG,MAAM,MACN,QACC,qBAAC,QAAD;KAAM,WAAU;KAAhB,UAAA;MACE,oBAAC,OAAD,EAAO,eAAA,KAAa,CAAA;MAAC;MAChB,MAAM;KACP;IACJ,CAAA,IAAA,IACA;GAlBC,GAAA,GAAG,MAAM,KAAK,GAAG,OAAO,MAAM,SAAS,GAAG,OAkB3C;EAEV,CAAC;CACE,CAAA;AAET;;AAGA,SAAgB,YAAY,EAAE,SAAuC;CACnE,IAAI,MAAM,WAAW,GACnB,OACE,oBAAC,QAAD;EACE,aAAU;EACV,WAAU;EACX,UAAA;CAEK,CAAA;CAGV,OACE,oBAAC,OAAD;EAAK,aAAU;EAAqB,WAAU;EAC3C,UAAA,MAAM,KAAK,SACV,oBAAC,MAAD;GAAiB,MAAK;GAAK,SAAQ;GAAS,aAAW;GACpD,UAAA;EACG,GAFK,IAEL,CACP;CACE,CAAA;AAET;;;;;;;AAgBA,SAAgB,qBAAqB,EACnC,WACA,SACA,gBAC4B;CAC5B,MAAM,EAAE,QAAQ,gBAAgB,oBAAoB;CACpD,MAAM,CAAC,UAAU,eAAe,MAAM,SAA4B,OAAO;CACzE,MAAM,CAAC,QAAQ,aAAa,MAAM,SAAS,KAAK;CAChD,MAAM,CAAC,OAAO,YAAY,MAAM,SAAwB,IAAI;CAK5D,MAAM,MAAM,YAAY,GAAG,UAAU,KAAK,GAAG,UAAU,OAAO;CAC9D,MAAM,CAAC,WAAW,gBAAgB,MAAM,SAAwB,GAAG;CACnE,IAAI,QAAQ,WAAW;EACrB,aAAa,GAAG;EAChB,YAAY,OAAO;EACnB,SAAS,IAAI;CACf;CAEA,MAAM,WAAW,QAAQ,SAAS,CAAC;CACnC,MAAM,UAAU,QAAQ,QAAQ,SAAS,CAAC,SAAS,SAAS,IAAI,CAAC;CACjE,MAAM,UAAU,CAAC,GAAG,UAAU,GAAG,OAAO;CAExC,MAAM,UAAU,MAAc,YAAqB;EACjD,aAAa,SAAU,UAAU,CAAC,GAAG,MAAM,IAAI,IAAI,KAAK,QAAQ,MAAM,MAAM,IAAI,CAAE;CACpF;CAEA,MAAM,OAAO,YAAY;EACvB,IAAI,CAAC,WAAW;EAChB,UAAU,IAAI;EACd,SAAS,IAAI;EACb,IAAI;GACF,MAAM,YAAY,WAAW,CAAC,GAAG,QAAQ,CAAC;GAC1C,aAAa,KAAK;EACpB,SAAS,KAAK;GAGZ,SAAS,kBAAkB,GAAG,CAAC;EACjC,UAAU;GACR,UAAU,KAAK;EACjB;CACF;CAEA,OACE,oBAAC,QAAD;EAAQ,MAAM,cAAc;EAAM,eAAe,SAAS,CAAC,QAAQ,aAAa,KAAK;EACnF,UAAA,qBAAC,eAAD;GAAe,aAAU;GAAzB,UAAA;IACE,qBAAC,cAAD,EAAA,UAAA,CACE,oBAAC,aAAD,EAAA,UAAa,aAAuB,CAAA,GACpC,oBAAC,mBAAD,EAAA,UACG,WAAW,SAAS,UACnB,qBAAA,UAAA,EAAA,UAAA;KAAE;KACgB,oBAAC,UAAD,EAAA,UAAS,UAAU,QAAQ,UAAU,GAAW,CAAA;KAAC;IAEjE,EAAA,CAAA,IAEF,qBAAA,UAAA,EAAA,UAAA;KAAE;KACsB,oBAAC,UAAD,EAAA,UAAS,WAAW,QAAQ,WAAW,GAAW,CAAA;KAAC;IAEzE,EAAA,CAAA,EAEa,CAAA,CACP,EAAA,CAAA;IACd,qBAAC,YAAD;KAAY,WAAU;KAAtB,UAAA,CACG,QAAQ,oBAAC,aAAD;MAAa,SAAS;MAAO,aAAU;KAA2B,CAAA,IAAI,MAC9E,QAAQ,WAAW,IAClB,oBAAC,KAAD;MAAG,WAAU;MAA+E,UAAA;KAEzF,CAAA,IAEH,oBAAC,MAAD;MAAI,WAAU;MAAwB,aAAU;MAC7C,UAAA,QAAQ,KAAK,SAAS;OACrB,MAAM,UAAU,SAAS,SAAS,IAAI;OACtC,OACE,oBAAC,MAAD,EAAA,UACE,qBAAC,SAAD;QACE,WAAW,GACT,sFACA,0EACA,kFACA,4BACF;QANF,UAAA;SAWE,oBAAC,UAAD;UACW;UACT,kBAAkB,SAAS,OAAO,MAAM,QAAQ,IAAI,CAAC;SACtD,CAAA;SACD,oBAAC,QAAD;UAAM,WAAU;UAAU,UAAA;SAAW,CAAA;SACpC,SAAS,SAAS,IAAI,IAAI,OACzB,oBAAC,MAAD;UAAM,MAAK;UAAK,SAAQ;UAAU,OAAM;UAAiC,UAAA;SAEnE,CAAA;QAEH;OACL,CAAA,EAAA,GAvBK,IAuBL;MAER,CAAC;KACC,CAAA,CAEI;;IACZ,qBAAC,cAAD,EAAA,UAAA,CACE,oBAAC,QAAD;KAAQ,SAAQ;KAAU,eAAe,aAAa,KAAK;KAAG,UAAU;KAAQ,UAAA;IAExE,CAAA,GACR,qBAAC,QAAD;KAAQ,SAAS;KAAM,UAAU,UAAU,QAAQ,WAAW;KAA9D,UAAA,CACG,SAAS,oBAAC,SAAD,EAAS,MAAK,UAAW,CAAA,IAAI,MAAK,YAEtC;IACI,CAAA,CAAA,EAAA,CAAA;GACD;;CACT,CAAA;AAEZ"}

package/dist/components/admin-permissions/roles.d.ts

@@ -0,0 +1,25 @@
+"use client";
+import * as React from "react";
+//#region src/components/admin-permissions/roles.d.ts
+/**
+ * `/admin/roles` — the extension's own vocabulary, and the group principals
+ * that hold it.
+ *
+ * Two halves. The first is what each declared role grants, read straight off
+ * the matrix, so an administrator deciding whether to hand somebody "editor"
+ * can see what "editor" means without leaving the screen. The second is group
+ * assignment: the other kind of principal a role attaches to (DESIGN-D22,
+ * P-42), on the same screen as the users because it is the same decision.
+ *
+ * The groups list is a **client** source, and the members list is not, for one
+ * reason: an org's groups are a short, bounded list that arrives in a single
+ * `groups.list()`, so paging it server-side would be a round-trip per keypress
+ * for nothing. Where the groups come from — a directory sync, or somebody
+ * typing them into cortena-auth — is invisible here by design.
+ *
+ * The whole section disappears when the api has no `groups`, and equally when
+ * it has some and the org has none.
+ */
+export declare function AdminRoles(): React.JSX.Element;
+//#endregion
+//# sourceMappingURL=roles.d.ts.map

package/dist/components/admin-permissions/roles.js

@@ -0,0 +1,168 @@
+"use client";
+"use client";
+import { Button } from "../button.js";
+import { Chip } from "../chip.js";
+import { EmptyState } from "../empty-state.js";
+import { ErrorBanner } from "../error-banner.js";
+import { SectionCard } from "../section-card.js";
+import { createColumnHelper } from "../data-table/features.js";
+import { DataTable } from "../data-table/data-table.js";
+import { useAdminPermissions } from "./context.js";
+import { DirectRoles, RoleAssignmentDialog } from "./role-assignment.js";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+//#region src/components/admin-permissions/roles.tsx
+const helper = /* @__PURE__ */ createColumnHelper();
+/**
+* `/admin/roles` — the extension's own vocabulary, and the group principals
+* that hold it.
+*
+* Two halves. The first is what each declared role grants, read straight off
+* the matrix, so an administrator deciding whether to hand somebody "editor"
+* can see what "editor" means without leaving the screen. The second is group
+* assignment: the other kind of principal a role attaches to (DESIGN-D22,
+* P-42), on the same screen as the users because it is the same decision.
+*
+* The groups list is a **client** source, and the members list is not, for one
+* reason: an org's groups are a short, bounded list that arrives in a single
+* `groups.list()`, so paging it server-side would be a round-trip per keypress
+* for nothing. Where the groups come from — a directory sync, or somebody
+* typing them into cortena-auth — is invisible here by design.
+*
+* The whole section disappears when the api has no `groups`, and equally when
+* it has some and the org has none.
+*/
+function AdminRoles() {
+	const { matrix, hasGroups, groups, groupsState, groupRoles } = useAdminPermissions();
+	const [editing, setEditing] = React.useState(null);
+	const [editingRoles, setEditingRoles] = React.useState([]);
+	const columns = React.useMemo(() => helper.columns([
+		helper.accessor("name", {
+			header: "Group",
+			cell: ({ row }) => /* @__PURE__ */ jsx("span", {
+				className: "font-medium text-[color:var(--ds-foreground)]",
+				children: row.original.name
+			}),
+			meta: { label: "Group" }
+		}),
+		helper.accessor("memberCount", {
+			header: "Members",
+			cell: ({ row }) => row.original.memberCount ?? "—",
+			meta: {
+				align: "end",
+				label: "Members"
+			}
+		}),
+		helper.display({
+			id: "roles",
+			header: "Roles",
+			cell: ({ row }) => /* @__PURE__ */ jsx(DirectRoles, { roles: groupRoles[row.original.id] ?? [] }),
+			meta: {
+				label: "Roles",
+				exportValue: (row) => (groupRoles[row.id] ?? []).join(", ")
+			},
+			enableSorting: false
+		}),
+		helper.display({
+			id: "actions",
+			header: () => /* @__PURE__ */ jsx("span", {
+				className: "sr-only",
+				children: "Actions"
+			}),
+			cell: ({ row }) => /* @__PURE__ */ jsx("div", {
+				className: "flex justify-end",
+				children: /* @__PURE__ */ jsx(Button, {
+					variant: "outline",
+					size: "sm",
+					"aria-label": `Edit roles for ${row.original.name}`,
+					onClick: () => {
+						setEditingRoles(groupRoles[row.original.id] ?? []);
+						setEditing({
+							kind: "group",
+							id: row.original.id,
+							name: row.original.name
+						});
+					},
+					children: "Edit roles"
+				})
+			}),
+			meta: {
+				align: "end",
+				exportable: false
+			},
+			enableSorting: false,
+			enableHiding: false
+		})
+	]), [groupRoles]);
+	const roles = matrix?.roles ?? [];
+	return /* @__PURE__ */ jsxs("div", {
+		"data-slot": "admin-roles",
+		className: "flex flex-col gap-6",
+		children: [
+			/* @__PURE__ */ jsx(SectionCard, {
+				title: "Roles",
+				description: "Declared by this extension. Nothing on the platform reads these names, so they are the extension's to choose.",
+				children: roles.length === 0 ? /* @__PURE__ */ jsx(EmptyState, {
+					size: "compact",
+					title: "No roles declared",
+					description: "Roles come from this extension's permissions document. Until it declares some, there is nothing to assign."
+				}) : /* @__PURE__ */ jsx("ul", {
+					"data-slot": "admin-role-list",
+					className: "flex flex-col gap-2",
+					children: roles.map((role) => {
+						const granted = matrix?.grants[role] ?? [];
+						return /* @__PURE__ */ jsxs("li", {
+							"data-slot": "admin-role-summary",
+							"data-role": role,
+							className: "flex flex-col gap-1.5 rounded-[var(--ds-radius-md)] border border-[var(--ds-border-subtle)] bg-[var(--ds-muted)] px-3 py-2.5",
+							children: [/* @__PURE__ */ jsx("span", {
+								className: "text-[length:var(--ds-text-body-sm)] font-semibold text-[color:var(--ds-foreground)]",
+								children: role
+							}), granted.length === 0 ? /* @__PURE__ */ jsx("span", {
+								className: "text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]",
+								children: "Grants nothing yet"
+							}) : /* @__PURE__ */ jsx("div", {
+								className: "flex flex-wrap items-center gap-1",
+								children: granted.map((action) => /* @__PURE__ */ jsx(Chip, {
+									size: "sm",
+									variant: "outline",
+									"data-action": action,
+									children: action
+								}, action))
+							})]
+						}, role);
+					})
+				})
+			}),
+			groupsState.error ? /* @__PURE__ */ jsx(ErrorBanner, {
+				message: groupsState.error.message,
+				onRetry: groupsState.reload
+			}) : null,
+			hasGroups ? /* @__PURE__ */ jsx(SectionCard, {
+				title: "Groups",
+				description: "Groups are cortena-auth's and read-only here. Every member of a group inherits the roles assigned to it, with no assignment write of their own.",
+				flush: true,
+				children: /* @__PURE__ */ jsx(DataTable, {
+					columns,
+					dataSource: {
+						kind: "client",
+						rows: groups
+					},
+					getRowId: (row) => row.id,
+					searchPlaceholder: "Search groups…",
+					emptyMessage: "No groups",
+					exportFileName: "groups"
+				})
+			}) : null,
+			/* @__PURE__ */ jsx(RoleAssignmentDialog, {
+				principal: editing,
+				current: editingRoles,
+				onOpenChange: (open) => !open && setEditing(null)
+			})
+		]
+	});
+}
+//#endregion
+export { AdminRoles };
+
+//# sourceMappingURL=roles.js.map

package/dist/components/admin-permissions/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","names":[],"sources":["../../../src/components/admin-permissions/roles.tsx"],"sourcesContent":["\"use client\";\n\nimport * as React from \"react\";\nimport { Button } from \"@/components/button\";\nimport { Chip } from \"@/components/chip\";\nimport { DataTable, createColumnHelper } from \"@/components/data-table\";\nimport { EmptyState } from \"@/components/empty-state\";\nimport { ErrorBanner } from \"@/components/error-banner\";\nimport { SectionCard } from \"@/components/section-card\";\nimport { useAdminPermissions } from \"./context\";\nimport { DirectRoles, RoleAssignmentDialog } from \"./role-assignment\";\nimport type { AdminGroupRow, AdminPrincipal } from \"./types\";\n\nconst helper = /* @__PURE__ */ createColumnHelper<AdminGroupRow>();\n\n/**\n * `/admin/roles` — the extension's own vocabulary, and the group principals\n * that hold it.\n *\n * Two halves. The first is what each declared role grants, read straight off\n * the matrix, so an administrator deciding whether to hand somebody \"editor\"\n * can see what \"editor\" means without leaving the screen. The second is group\n * assignment: the other kind of principal a role attaches to (DESIGN-D22,\n * P-42), on the same screen as the users because it is the same decision.\n *\n * The groups list is a **client** source, and the members list is not, for one\n * reason: an org's groups are a short, bounded list that arrives in a single\n * `groups.list()`, so paging it server-side would be a round-trip per keypress\n * for nothing. Where the groups come from — a directory sync, or somebody\n * typing them into cortena-auth — is invisible here by design.\n *\n * The whole section disappears when the api has no `groups`, and equally when\n * it has some and the org has none.\n */\nexport function AdminRoles() {\n  const { matrix, hasGroups, groups, groupsState, groupRoles } = useAdminPermissions();\n  const [editing, setEditing] = React.useState<AdminPrincipal | null>(null);\n  const [editingRoles, setEditingRoles] = React.useState<readonly string[]>([]);\n\n  const columns = React.useMemo(\n    () =>\n      helper.columns([\n        helper.accessor(\"name\", {\n          header: \"Group\",\n          cell: ({ row }) => (\n            <span className=\"font-medium text-[color:var(--ds-foreground)]\">\n              {row.original.name}\n            </span>\n          ),\n          meta: { label: \"Group\" },\n        }),\n        helper.accessor(\"memberCount\", {\n          header: \"Members\",\n          cell: ({ row }) => row.original.memberCount ?? \"—\",\n          meta: { align: \"end\", label: \"Members\" },\n        }),\n        helper.display({\n          id: \"roles\",\n          header: \"Roles\",\n          cell: ({ row }) => <DirectRoles roles={groupRoles[row.original.id] ?? []} />,\n          meta: {\n            label: \"Roles\",\n            exportValue: (row: AdminGroupRow) => (groupRoles[row.id] ?? []).join(\", \"),\n          },\n          enableSorting: false,\n        }),\n        helper.display({\n          id: \"actions\",\n          header: () => <span className=\"sr-only\">Actions</span>,\n          cell: ({ row }) => (\n            <div className=\"flex justify-end\">\n              <Button\n                variant=\"outline\"\n                size=\"sm\"\n                aria-label={`Edit roles for ${row.original.name}`}\n                onClick={() => {\n                  setEditingRoles(groupRoles[row.original.id] ?? []);\n                  setEditing({ kind: \"group\", id: row.original.id, name: row.original.name });\n                }}\n              >\n                Edit roles\n              </Button>\n            </div>\n          ),\n          meta: { align: \"end\", exportable: false },\n          enableSorting: false,\n          enableHiding: false,\n        }),\n      ]),\n    [groupRoles],\n  );\n\n  const roles = matrix?.roles ?? [];\n\n  return (\n    <div data-slot=\"admin-roles\" className=\"flex flex-col gap-6\">\n      <SectionCard\n        title=\"Roles\"\n        description=\"Declared by this extension. Nothing on the platform reads these names, so they are the extension's to choose.\"\n      >\n        {roles.length === 0 ? (\n          <EmptyState\n            size=\"compact\"\n            title=\"No roles declared\"\n            description=\"Roles come from this extension's permissions document. Until it declares some, there is nothing to assign.\"\n          />\n        ) : (\n          <ul data-slot=\"admin-role-list\" className=\"flex flex-col gap-2\">\n            {roles.map((role) => {\n              const granted = matrix?.grants[role] ?? [];\n              return (\n                <li\n                  key={role}\n                  data-slot=\"admin-role-summary\"\n                  data-role={role}\n                  className=\"flex flex-col gap-1.5 rounded-[var(--ds-radius-md)] border border-[var(--ds-border-subtle)] bg-[var(--ds-muted)] px-3 py-2.5\"\n                >\n                  <span className=\"text-[length:var(--ds-text-body-sm)] font-semibold text-[color:var(--ds-foreground)]\">\n                    {role}\n                  </span>\n                  {granted.length === 0 ? (\n                    <span className=\"text-[length:var(--ds-text-caption)] text-[color:var(--ds-text-tertiary)]\">\n                      Grants nothing yet\n                    </span>\n                  ) : (\n                    <div className=\"flex flex-wrap items-center gap-1\">\n                      {granted.map((action) => (\n                        <Chip key={action} size=\"sm\" variant=\"outline\" data-action={action}>\n                          {action}\n                        </Chip>\n                      ))}\n                    </div>\n                  )}\n                </li>\n              );\n            })}\n          </ul>\n        )}\n      </SectionCard>\n\n      {groupsState.error ? (\n        <ErrorBanner message={groupsState.error.message} onRetry={groupsState.reload} />\n      ) : null}\n\n      {hasGroups ? (\n        <SectionCard\n          title=\"Groups\"\n          description=\"Groups are cortena-auth's and read-only here. Every member of a group inherits the roles assigned to it, with no assignment write of their own.\"\n          flush\n        >\n          <DataTable\n            columns={columns}\n            dataSource={{ kind: \"client\", rows: groups }}\n            getRowId={(row) => row.id}\n            searchPlaceholder=\"Search groups…\"\n            emptyMessage=\"No groups\"\n            exportFileName=\"groups\"\n          />\n        </SectionCard>\n      ) : null}\n\n      <RoleAssignmentDialog\n        principal={editing}\n        current={editingRoles}\n        onOpenChange={(open) => !open && setEditing(null)}\n      />\n    </div>\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;AAaA,MAAM,SAAyB,mCAAkC;;;;;;;;;;;;;;;;;;;;AAqBjE,SAAgB,aAAa;CAC3B,MAAM,EAAE,QAAQ,WAAW,QAAQ,aAAa,eAAe,oBAAoB;CACnF,MAAM,CAAC,SAAS,cAAc,MAAM,SAAgC,IAAI;CACxE,MAAM,CAAC,cAAc,mBAAmB,MAAM,SAA4B,CAAC,CAAC;CAE5E,MAAM,UAAU,MAAM,cAElB,OAAO,QAAQ;EACb,OAAO,SAAS,QAAQ;GACtB,QAAQ;GACR,OAAO,EAAE,UACP,oBAAC,QAAD;IAAM,WAAU;IACb,UAAA,IAAI,SAAS;GACV,CAAA;GAER,MAAM,EAAE,OAAO,QAAQ;EACzB,CAAC;EACD,OAAO,SAAS,eAAe;GAC7B,QAAQ;GACR,OAAO,EAAE,UAAU,IAAI,SAAS,eAAe;GAC/C,MAAM;IAAE,OAAO;IAAO,OAAO;GAAU;EACzC,CAAC;EACD,OAAO,QAAQ;GACb,IAAI;GACJ,QAAQ;GACR,OAAO,EAAE,UAAU,oBAAC,aAAD,EAAa,OAAO,WAAW,IAAI,SAAS,OAAO,CAAC,EAAI,CAAA;GAC3E,MAAM;IACJ,OAAO;IACP,cAAc,SAAwB,WAAW,IAAI,OAAO,CAAC,EAAA,CAAG,KAAK,IAAI;GAC3E;GACA,eAAe;EACjB,CAAC;EACD,OAAO,QAAQ;GACb,IAAI;GACJ,cAAc,oBAAC,QAAD;IAAM,WAAU;IAAU,UAAA;GAAa,CAAA;GACrD,OAAO,EAAE,UACP,oBAAC,OAAD;IAAK,WAAU;IACb,UAAA,oBAAC,QAAD;KACE,SAAQ;KACR,MAAK;KACL,cAAY,kBAAkB,IAAI,SAAS;KAC3C,eAAe;MACb,gBAAgB,WAAW,IAAI,SAAS,OAAO,CAAC,CAAC;MACjD,WAAW;OAAE,MAAM;OAAS,IAAI,IAAI,SAAS;OAAI,MAAM,IAAI,SAAS;MAAK,CAAC;KAC5E;KACD,UAAA;IAEO,CAAA;GACL,CAAA;GAEP,MAAM;IAAE,OAAO;IAAO,YAAY;GAAM;GACxC,eAAe;GACf,cAAc;EAChB,CAAC;CACH,CAAC,GACH,CAAC,UAAU,CACb;CAEA,MAAM,QAAQ,QAAQ,SAAS,CAAC;CAEhC,OACE,qBAAC,OAAD;EAAK,aAAU;EAAc,WAAU;EAAvC,UAAA;GACE,oBAAC,aAAD;IACE,OAAM;IACN,aAAY;IAEX,UAAA,MAAM,WAAW,IAChB,oBAAC,YAAD;KACE,MAAK;KACL,OAAM;KACN,aAAY;IACb,CAAA,IAED,oBAAC,MAAD;KAAI,aAAU;KAAkB,WAAU;KACvC,UAAA,MAAM,KAAK,SAAS;MACnB,MAAM,UAAU,QAAQ,OAAO,SAAS,CAAC;MACzC,OACE,qBAAC,MAAD;OAEE,aAAU;OACV,aAAW;OACX,WAAU;OAJZ,UAAA,CAME,oBAAC,QAAD;QAAM,WAAU;QACb,UAAA;OACG,CAAA,GACL,QAAQ,WAAW,IAClB,oBAAC,QAAD;QAAM,WAAU;QAA4E,UAAA;OAEtF,CAAA,IAEN,oBAAC,OAAD;QAAK,WAAU;QACZ,UAAA,QAAQ,KAAK,WACZ,oBAAC,MAAD;SAAmB,MAAK;SAAK,SAAQ;SAAU,eAAa;SACzD,UAAA;QACG,GAFK,MAEL,CACP;OACE,CAAA,CAEL;MArBG,GAAA,IAqBH;KAER,CAAC;IACC,CAAA;GAEK,CAAA;GAEZ,YAAY,QACX,oBAAC,aAAD;IAAa,SAAS,YAAY,MAAM;IAAS,SAAS,YAAY;GAAS,CAAA,IAC7E;GAEH,YACC,oBAAC,aAAD;IACE,OAAM;IACN,aAAY;IACZ,OAAA;IAEA,UAAA,oBAAC,WAAD;KACW;KACT,YAAY;MAAE,MAAM;MAAU,MAAM;KAAO;KAC3C,WAAW,QAAQ,IAAI;KACvB,mBAAkB;KAClB,cAAa;KACb,gBAAe;IAChB,CAAA;GACU,CAAA,IACX;GAEJ,oBAAC,sBAAD;IACE,WAAW;IACX,SAAS;IACT,eAAe,SAAS,CAAC,QAAQ,WAAW,IAAI;GACjD,CAAA;EACE;;AAET"}

package/dist/components/admin-permissions/types.d.ts

@@ -0,0 +1,152 @@
+"use client";
+import { TableQuery, TableResult } from "../data-table/types.js";
+import "../data-table/index.js";
+//#region src/components/admin-permissions/types.d.ts
+/**
+ * A role is assigned to a principal, never to a user id (DESIGN-D22, §13.4).
+ * Both kinds are edited on the same screen and through the same dialog; only
+ * the method underneath differs.
+ */
+export interface AdminPrincipal {
+  kind: "user" | "group";
+  /** cortena-auth user id, or cortena-auth group id. */
+  id: string;
+  /** Display name, for the dialog title. */
+  name?: string;
+}
+/** A group, as a member's row refers to it. Defined and maintained in cortena-auth. */
+export interface AdminGroupRef {
+  id: string;
+  name: string;
+}
+/**
+ * Why a member holds an effective role: assigned to them directly, or carried
+ * by a group they belong to. Never dropped from the rendering — an
+ * administrator who cannot see *why* somebody has a permission removes the
+ * wrong assignment and believes the job is done (P-43).
+ */
+export type AdminRoleSource = "direct" | {
+  group: AdminGroupRef;
+};
+/** One entry of `effectiveRoles`: the role, and the assignment that granted it. */
+export interface AdminEffectiveRole {
+  role: string;
+  source: AdminRoleSource;
+}
+/**
+ * A row of `members.list`. A join: the person and their groups are
+ * cortena-auth's and read-only; `extensionRoles` is the extension's own direct
+ * assignment; `effectiveRoles` is the per-request resolution of direct +
+ * inherited that `may()` performs, rendered — never a stored table (P-43).
+ */
+export interface AdminMemberRow {
+  userId: string;
+  name: string;
+  email: string;
+  status: string;
+  /** ISO timestamp, or null when the user has never signed in. */
+  lastActiveAt: string | null;
+  groups: AdminGroupRef[];
+  extensionRoles: string[];
+  effectiveRoles: AdminEffectiveRole[];
+}
+/**
+ * A row of `groups.list` — read-only as to the group itself. The roles a group
+ * carries are the extension's and come back separately from `groups.roles()`,
+ * because the group list is identity's and the assignment map is not.
+ */
+export interface AdminGroupRow {
+  id: string;
+  name: string;
+  memberCount: number;
+}
+/** `licence.get` — a read-through display of cortena-auth's licence. */
+export interface AdminLicence {
+  plan: string;
+  seats: number | null;
+  seatsUsed: number | null;
+  features: string[];
+}
+/**
+ * `permissions.get` / `permissions.put` — the extension's own matrix, in the
+ * extension's own database. This is the source of truth that both the REST
+ * routes and the MCP tools enforce through one `may()` (§13.2, P-14).
+ */
+export interface AdminPermissionMatrix {
+  roles: string[];
+  actions: string[];
+  /** role → the actions it grants. A role absent from the map grants nothing. */
+  grants: Record<string, string[]>;
+}
+/**
+ * Everything the composition talks to, one namespace per resource in §13.3.
+ *
+ * `groups` is the only optional member, and it is optional for a reason rather
+ * than for convenience: an extension whose cortena-auth tenant has no groups
+ * omits it, and every group affordance disappears instead of rendering empty.
+ * It disappears equally when `groups.list()` comes back empty — an empty
+ * "Groups" section reads as a broken feature, and there is nothing an
+ * administrator can do about it from here.
+ */
+export interface AdminPermissionsApi {
+  members: {
+    /** `GET .../admin/members` — the DataTable server source. */
+    list: (query: TableQuery, signal?: AbortSignal) => Promise<TableResult<AdminMemberRow>>;
+    /** `PATCH .../admin/members/:userId { extensionRoles }` — direct assignment only. */
+    setRoles: (userId: string, roles: string[]) => Promise<void>;
+  };
+  groups?: {
+    /** `GET .../admin/groups` — read-only; the whole list, small enough to be a client source. */
+    list: (signal?: AbortSignal) => Promise<AdminGroupRow[]>;
+    /** The extension's assignment: group id → the roles that group carries. */
+    roles: (signal?: AbortSignal) => Promise<Record<string, string[]>>;
+    /** `PATCH .../admin/groups/:groupId { extensionRoles }` */
+    setRoles: (groupId: string, roles: string[]) => Promise<void>;
+  };
+  licence: {
+    /** `GET .../admin/licence` — read-only, always. */
+    get: (signal?: AbortSignal) => Promise<AdminLicence>;
+  };
+  permissions: {
+    /** `GET .../admin/permissions` */
+    get: (signal?: AbortSignal) => Promise<AdminPermissionMatrix>;
+    /** `PUT .../admin/permissions` */
+    put: (matrix: AdminPermissionMatrix, signal?: AbortSignal) => Promise<AdminPermissionMatrix | void>;
+  };
+}
+/** The four screens, named after their paths under `admin/`. */
+export type AdminRoute = "members" | "roles" | "licence" | "permissions";
+export declare const ADMIN_ROUTES: readonly AdminRoute[];
+export declare const ADMIN_ROUTE_LABELS: Record<AdminRoute, string>;
+/**
+ * The broker's error envelope (§15.6). A failed mutation must show what the
+ * server said — "assigneeId: Required" and "Invalid input" cost the same to
+ * produce and differ by a whole round-trip — so the rejection is unwrapped
+ * rather than replaced with a house message.
+ */
+export interface AdminErrorEnvelope {
+  ok: false;
+  status?: number;
+  code?: string;
+  message: string;
+  details?: unknown;
+}
+/**
+ * The message to show for a rejection.
+ *
+ * A fetch wrapper usually rejects with an `Error` and hangs the parsed
+ * envelope off it, so the envelope is preferred over the generic
+ * `"HTTP 403"` the Error itself carries. A rejection that *is* the envelope,
+ * and a plain `Error`, both work as well.
+ */
+export declare function adminErrorMessage(error: unknown): string;
+/**
+ * The effective roles to render. When the server sends none, the direct
+ * assignments are shown as direct — which is what they are — rather than the
+ * screen inventing an inheritance it cannot know about.
+ */
+export declare function effectiveRolesOf(row: AdminMemberRow): AdminEffectiveRole[];
+/** The group behind an effective role, or `null` for a direct assignment. */
+export declare function sourceGroupOf(source: AdminRoleSource): AdminGroupRef | null;
+//#endregion
+//# sourceMappingURL=types.d.ts.map

package/dist/components/admin-permissions/types.js

@@ -0,0 +1,63 @@
+"use client";
+//#region src/components/admin-permissions/types.ts
+const ADMIN_ROUTES = [
+	"members",
+	"roles",
+	"licence",
+	"permissions"
+];
+const ADMIN_ROUTE_LABELS = {
+	members: "Members",
+	roles: "Roles",
+	licence: "Licence",
+	permissions: "Permissions"
+};
+function envelopeMessage(value) {
+	if (!value || typeof value !== "object") return null;
+	const message = value.message;
+	return typeof message === "string" && message.length > 0 ? message : null;
+}
+/**
+* The message to show for a rejection.
+*
+* A fetch wrapper usually rejects with an `Error` and hangs the parsed
+* envelope off it, so the envelope is preferred over the generic
+* `"HTTP 403"` the Error itself carries. A rejection that *is* the envelope,
+* and a plain `Error`, both work as well.
+*/
+function adminErrorMessage(error) {
+	if (error && typeof error === "object") {
+		const carrier = error;
+		const nested = envelopeMessage(carrier.envelope) ?? envelopeMessage(carrier.body) ?? envelopeMessage(carrier.error);
+		if (nested) return nested;
+	}
+	if (error instanceof Error) return error.message || "Something went wrong";
+	const direct = envelopeMessage(error);
+	if (direct) return direct;
+	return String(error);
+}
+/** Tolerates a server that omits an array the contract says is required. */
+function groupsOf(row) {
+	return row.groups ?? [];
+}
+/**
+* The effective roles to render. When the server sends none, the direct
+* assignments are shown as direct — which is what they are — rather than the
+* screen inventing an inheritance it cannot know about.
+*/
+function effectiveRolesOf(row) {
+	if (row.effectiveRoles?.length) return row.effectiveRoles;
+	return (row.extensionRoles ?? []).map((role) => ({
+		role,
+		source: "direct"
+	}));
+}
+/** The group behind an effective role, or `null` for a direct assignment. */
+function sourceGroupOf(source) {
+	if (source === "direct" || !source) return null;
+	return source.group ?? null;
+}
+//#endregion
+export { ADMIN_ROUTES, ADMIN_ROUTE_LABELS, adminErrorMessage, effectiveRolesOf, groupsOf, sourceGroupOf };
+
+//# sourceMappingURL=types.js.map

package/dist/components/admin-permissions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","names":[],"sources":["../../../src/components/admin-permissions/types.ts"],"sourcesContent":["/**\n * The contract AdminPermissions renders, from §13.3 of\n * \"How to create a Cortena extension\" (DESIGN-D11, amended by DESIGN-D22).\n *\n * The composition ships **no vocabulary of its own**. Every role, every action\n * and every grant on screen arrives through the `api` prop; every principal\n * arrives through it too. That is what lets two extensions with completely\n * different role models look like one product — and it is why nothing in this\n * folder has a default role list, a default action list, or an opinion about\n * what \"admin\" means.\n *\n * The split the screen is built around:\n *\n * | cortena-auth owns | the extension owns |\n * | --- | --- |\n * | who the user is, their org membership and status | every role it recognises |\n * | the groups, their names and their membership | the roles × actions matrix |\n * | the licence | which principal holds which role |\n *\n * So the person half of the members list is read-only here, the group half is\n * read-only too, and the roles beside them are the only editable thing.\n *\n * Where the groups come from is deliberately invisible: an extension asks\n * `api.groups` for `{ id, name, memberCount }` and never learns whether that\n * is a directory sync, an SCIM push or a hand-made list in cortena-auth.\n */\n\nimport type { TableQuery, TableResult } from \"@/components/data-table\";\n\n/**\n * A role is assigned to a principal, never to a user id (DESIGN-D22, §13.4).\n * Both kinds are edited on the same screen and through the same dialog; only\n * the method underneath differs.\n */\nexport interface AdminPrincipal {\n  kind: \"user\" | \"group\";\n  /** cortena-auth user id, or cortena-auth group id. */\n  id: string;\n  /** Display name, for the dialog title. */\n  name?: string;\n}\n\n/** A group, as a member's row refers to it. Defined and maintained in cortena-auth. */\nexport interface AdminGroupRef {\n  id: string;\n  name: string;\n}\n\n/**\n * Why a member holds an effective role: assigned to them directly, or carried\n * by a group they belong to. Never dropped from the rendering — an\n * administrator who cannot see *why* somebody has a permission removes the\n * wrong assignment and believes the job is done (P-43).\n */\nexport type AdminRoleSource = \"direct\" | { group: AdminGroupRef };\n\n/** One entry of `effectiveRoles`: the role, and the assignment that granted it. */\nexport interface AdminEffectiveRole {\n  role: string;\n  source: AdminRoleSource;\n}\n\n/**\n * A row of `members.list`. A join: the person and their groups are\n * cortena-auth's and read-only; `extensionRoles` is the extension's own direct\n * assignment; `effectiveRoles` is the per-request resolution of direct +\n * inherited that `may()` performs, rendered — never a stored table (P-43).\n */\nexport interface AdminMemberRow {\n  userId: string;\n  name: string;\n  email: string;\n  status: string;\n  /** ISO timestamp, or null when the user has never signed in. */\n  lastActiveAt: string | null;\n  groups: AdminGroupRef[];\n  extensionRoles: string[];\n  effectiveRoles: AdminEffectiveRole[];\n}\n\n/**\n * A row of `groups.list` — read-only as to the group itself. The roles a group\n * carries are the extension's and come back separately from `groups.roles()`,\n * because the group list is identity's and the assignment map is not.\n */\nexport interface AdminGroupRow {\n  id: string;\n  name: string;\n  memberCount: number;\n}\n\n/** `licence.get` — a read-through display of cortena-auth's licence. */\nexport interface AdminLicence {\n  plan: string;\n  seats: number | null;\n  seatsUsed: number | null;\n  features: string[];\n}\n\n/**\n * `permissions.get` / `permissions.put` — the extension's own matrix, in the\n * extension's own database. This is the source of truth that both the REST\n * routes and the MCP tools enforce through one `may()` (§13.2, P-14).\n */\nexport interface AdminPermissionMatrix {\n  roles: string[];\n  actions: string[];\n  /** role → the actions it grants. A role absent from the map grants nothing. */\n  grants: Record<string, string[]>;\n}\n\n/**\n * Everything the composition talks to, one namespace per resource in §13.3.\n *\n * `groups` is the only optional member, and it is optional for a reason rather\n * than for convenience: an extension whose cortena-auth tenant has no groups\n * omits it, and every group affordance disappears instead of rendering empty.\n * It disappears equally when `groups.list()` comes back empty — an empty\n * \"Groups\" section reads as a broken feature, and there is nothing an\n * administrator can do about it from here.\n */\nexport interface AdminPermissionsApi {\n  members: {\n    /** `GET .../admin/members` — the DataTable server source. */\n    list: (query: TableQuery, signal?: AbortSignal) => Promise<TableResult<AdminMemberRow>>;\n    /** `PATCH .../admin/members/:userId { extensionRoles }` — direct assignment only. */\n    setRoles: (userId: string, roles: string[]) => Promise<void>;\n  };\n  groups?: {\n    /** `GET .../admin/groups` — read-only; the whole list, small enough to be a client source. */\n    list: (signal?: AbortSignal) => Promise<AdminGroupRow[]>;\n    /** The extension's assignment: group id → the roles that group carries. */\n    roles: (signal?: AbortSignal) => Promise<Record<string, string[]>>;\n    /** `PATCH .../admin/groups/:groupId { extensionRoles }` */\n    setRoles: (groupId: string, roles: string[]) => Promise<void>;\n  };\n  licence: {\n    /** `GET .../admin/licence` — read-only, always. */\n    get: (signal?: AbortSignal) => Promise<AdminLicence>;\n  };\n  permissions: {\n    /** `GET .../admin/permissions` */\n    get: (signal?: AbortSignal) => Promise<AdminPermissionMatrix>;\n    /** `PUT .../admin/permissions` */\n    put: (\n      matrix: AdminPermissionMatrix,\n      signal?: AbortSignal,\n    ) => Promise<AdminPermissionMatrix | void>;\n  };\n}\n\n/** The four screens, named after their paths under `admin/`. */\nexport type AdminRoute = \"members\" | \"roles\" | \"licence\" | \"permissions\";\n\nexport const ADMIN_ROUTES: readonly AdminRoute[] = [\n  \"members\",\n  \"roles\",\n  \"licence\",\n  \"permissions\",\n];\n\nexport const ADMIN_ROUTE_LABELS: Record<AdminRoute, string> = {\n  members: \"Members\",\n  roles: \"Roles\",\n  licence: \"Licence\",\n  permissions: \"Permissions\",\n};\n\n/**\n * The broker's error envelope (§15.6). A failed mutation must show what the\n * server said — \"assigneeId: Required\" and \"Invalid input\" cost the same to\n * produce and differ by a whole round-trip — so the rejection is unwrapped\n * rather than replaced with a house message.\n */\nexport interface AdminErrorEnvelope {\n  ok: false;\n  status?: number;\n  code?: string;\n  message: string;\n  details?: unknown;\n}\n\nfunction envelopeMessage(value: unknown): string | null {\n  if (!value || typeof value !== \"object\") return null;\n  const message = (value as { message?: unknown }).message;\n  return typeof message === \"string\" && message.length > 0 ? message : null;\n}\n\n/**\n * The message to show for a rejection.\n *\n * A fetch wrapper usually rejects with an `Error` and hangs the parsed\n * envelope off it, so the envelope is preferred over the generic\n * `\"HTTP 403\"` the Error itself carries. A rejection that *is* the envelope,\n * and a plain `Error`, both work as well.\n */\nexport function adminErrorMessage(error: unknown): string {\n  if (error && typeof error === \"object\") {\n    const carrier = error as { envelope?: unknown; body?: unknown; error?: unknown };\n    const nested =\n      envelopeMessage(carrier.envelope) ??\n      envelopeMessage(carrier.body) ??\n      envelopeMessage(carrier.error);\n    if (nested) return nested;\n  }\n  if (error instanceof Error) return error.message || \"Something went wrong\";\n  const direct = envelopeMessage(error);\n  if (direct) return direct;\n  return String(error);\n}\n\n/** Tolerates a server that omits an array the contract says is required. */\nexport function groupsOf(row: AdminMemberRow): AdminGroupRef[] {\n  return row.groups ?? [];\n}\n\n/**\n * The effective roles to render. When the server sends none, the direct\n * assignments are shown as direct — which is what they are — rather than the\n * screen inventing an inheritance it cannot know about.\n */\nexport function effectiveRolesOf(row: AdminMemberRow): AdminEffectiveRole[] {\n  if (row.effectiveRoles?.length) return row.effectiveRoles;\n  return (row.extensionRoles ?? []).map((role) => ({ role, source: \"direct\" as const }));\n}\n\n/** The group behind an effective role, or `null` for a direct assignment. */\nexport function sourceGroupOf(source: AdminRoleSource): AdminGroupRef | null {\n  if (source === \"direct\" || !source) return null;\n  return source.group ?? null;\n}\n"],"mappings":";;AA0JA,MAAa,eAAsC;CACjD;CACA;CACA;CACA;AACF;AAEA,MAAa,qBAAiD;CAC5D,SAAS;CACT,OAAO;CACP,SAAS;CACT,aAAa;AACf;AAgBA,SAAS,gBAAgB,OAA+B;CACtD,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,MAAM,UAAW,MAAgC;CACjD,OAAO,OAAO,YAAY,YAAY,QAAQ,SAAS,IAAI,UAAU;AACvE;;;;;;;;;AAUA,SAAgB,kBAAkB,OAAwB;CACxD,IAAI,SAAS,OAAO,UAAU,UAAU;EACtC,MAAM,UAAU;EAChB,MAAM,SACJ,gBAAgB,QAAQ,QAAQ,KAChC,gBAAgB,QAAQ,IAAI,KAC5B,gBAAgB,QAAQ,KAAK;EAC/B,IAAI,QAAQ,OAAO;CACrB;CACA,IAAI,iBAAiB,OAAO,OAAO,MAAM,WAAW;CACpD,MAAM,SAAS,gBAAgB,KAAK;CACpC,IAAI,QAAQ,OAAO;CACnB,OAAO,OAAO,KAAK;AACrB;;AAGA,SAAgB,SAAS,KAAsC;CAC7D,OAAO,IAAI,UAAU,CAAC;AACxB;;;;;;AAOA,SAAgB,iBAAiB,KAA2C;CAC1E,IAAI,IAAI,gBAAgB,QAAQ,OAAO,IAAI;CAC3C,QAAQ,IAAI,kBAAkB,CAAC,EAAA,CAAG,KAAK,UAAU;EAAE;EAAM,QAAQ;CAAkB,EAAE;AACvF;;AAGA,SAAgB,cAAc,QAA+C;CAC3E,IAAI,WAAW,YAAY,CAAC,QAAQ,OAAO;CAC3C,OAAO,OAAO,SAAS;AACzB"}