domma-cms 0.42.0 → 0.44.0

package/scripts/build.js

@@ -169,6 +169,60 @@ async function stampPluginVersions() {
     }
 }
 
+/**
+ * Domma Tools is the one Domma asset npm cannot deliver.
+ *
+ * `domma-js` does not list `domma-tools.*` in its package `files`, so the pair under
+ * `admin/dist/domma/` can only ever arrive by hand-copying it out of a domma build. Meanwhile
+ * `/dist/domma/domma.min.js` is served straight from `node_modules/domma-js` (server.js), so a
+ * `npm install domma-js@next` silently upgrades one half of the admin and leaves the other on
+ * whatever version was last copied across. The tools bundle's own banner says
+ * `Requires: domma.min.js` — it is built against a specific core and is not version-independent.
+ *
+ * That skew is invisible: both files load, no import dangles, nothing throws. It surfaces later as
+ * a Theme Roller or Page Roller that misbehaves against a core it was not built for. This is the
+ * one place that can see both versions at once, so it is the place that checks.
+ *
+ * @returns {{ok: boolean, installed: string, found: Array<{rel: string, version: string|null}>, problems: string[]}}
+ */
+function verifyDommaToolsVersion(toolsRelPaths) {
+    const installed = JSON.parse(
+        readFileSync(join(ROOT, 'node_modules/domma-js/package.json'), 'utf8'),
+    ).version;
+
+    // Banners differ between the two artefacts: "Domma Tools v0.38.0" (JS) and
+    // "Domma Tools CSS v0.38.0" (CSS). Match both rather than only the one you happened to open.
+    const BANNER = /\*\s*Domma Tools(?: CSS)? v(\d+\.\d+\.\d+)/;
+
+    const found = [];
+    const problems = [];
+
+    for (const rel of toolsRelPaths) {
+        const src = join(ROOT, rel);
+        if (!existsSync(src)) {
+            // admin/index.html loads both unconditionally, so an absent file is a dead <script>/<link>
+            // in the published admin. The copy step already tolerates absence; flag it rather than
+            // silently agreeing.
+            problems.push(`${rel} is missing — the published admin will reference a file that isn't there`);
+            continue;
+        }
+        // The banner is in the first few lines; no need to read a 230 KB bundle in full.
+        const head = readFileSync(src, 'utf8').slice(0, 512);
+        const match = head.match(BANNER);
+        if (!match) {
+            problems.push(`${rel} carries no recognisable Domma Tools banner — cannot confirm its version`);
+            found.push({rel, version: null});
+            continue;
+        }
+        found.push({rel, version: match[1]});
+        if (match[1] !== installed) {
+            problems.push(`${rel} is v${match[1]} but domma-js is v${installed}`);
+        }
+    }
+
+    return {ok: problems.length === 0, installed, found, problems};
+}
+
 async function build() {
   // Clean and recreate _publish/
   if (existsSync(OUT)) rmSync(OUT, {recursive: true, force: true});
@@ -191,6 +245,32 @@ async function build() {
   delete pkg.scripts?.prepublishOnly;
   writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + '\n');
 
+  // Scrub this machine's local config out of the staged copy. config/site.json
+  // is a working file on a development install, so it carries whatever SMTP
+  // host and site URL were last set here — published releases up to 0.43.1 put
+  // a LAN address on the public registry and handed every manual installer a
+  // mail host that does not exist for them. Same reasoning as the analytics
+  // counters in .npmignore: runtime state must not ride along in the tarball.
+  const sitePath = join(OUT, 'config', 'site.json');
+  if (existsSync(sitePath)) {
+    const site = JSON.parse(readFileSync(sitePath, 'utf8'));
+    site.url = 'http://localhost:4096';
+    if (site.smtp) {
+      site.smtp = {
+        host: '', port: 587, user: '', pass: '',
+        secure: false, fromAddress: '', fromName: '',
+      };
+    }
+    writeFileSync(sitePath, JSON.stringify(site, null, 4) + '\n');
+  }
+
+  // .bak files are migration leftovers from whichever machine built the
+  // release — never something an installer should receive.
+  for (const rel of ['config/navigation.json.bak', 'config/connections.json.bak']) {
+    const bak = join(OUT, rel);
+    if (existsSync(bak)) rmSync(bak, {force: true});
+  }
+
   // Copy plugin server-side code verbatim
   const pluginAsIs = await collectFiles('{' + PLUGIN_AS_IS_PATTERNS.join(',') + '}');
   for (const rel of pluginAsIs) {
@@ -212,6 +292,20 @@ async function build() {
     'admin/dist/domma/domma-tools.css',
     'admin/dist/domma/domma-tools.min.js',
   ];
+
+  // Version-skew gate — see verifyDommaToolsVersion() for why this cannot be left to npm.
+  const toolsCheck = verifyDommaToolsVersion(dommaTools);
+  if (toolsCheck.ok) {
+    console.log(`Domma Tools v${toolsCheck.installed} — matches installed domma-js`);
+  } else {
+    for (const problem of toolsCheck.problems) console.error(`  ${problem}`);
+    throw new Error(
+      `Domma Tools is out of step with domma-js v${toolsCheck.installed} — copy `
+      + `domma-tools.min.js and domma-tools.css from that version's build into admin/dist/domma/, `
+      + `then rebuild`,
+    );
+  }
+
   for (const rel of dommaTools) {
     const src = join(ROOT, rel);
     if (existsSync(src)) {

package/scripts/setup.js

@@ -159,8 +159,11 @@ if (!isPlaceholder) {
 // ---------------------------------------------------------------------------
 section('2. Instance Secret');
 
-const existingSecret = env.INSTANCE_SECRET ?? '';
-const isInstanceSecretSet = existingSecret && existingSecret.length >= 32;
+// Distinct name from step 1's existingSecret — both are module-scope consts,
+// so reusing the identifier made the whole file a SyntaxError and setup could
+// not run at all.
+const existingInstanceSecret = env.INSTANCE_SECRET ?? '';
+const isInstanceSecretSet = existingInstanceSecret && existingInstanceSecret.length >= 32;
 
 if (isInstanceSecretSet) {
     console.log('  ✓ INSTANCE_SECRET already configured — skipping.');
@@ -298,6 +301,24 @@ section('6. Server Port');
     console.log(`  ✓ Port set to ${port}`);
 }
 
+// ---------------------------------------------------------------------------
+// Git hooks
+// ---------------------------------------------------------------------------
+// The hooks in .githooks/ are committed, but git will not run them until this
+// clone points at that directory — core.hooksPath is local config, so it cannot
+// travel with the repository. Every clone that misses this step silently loses
+// both hooks: the commit-msg trailer strip and the pre-commit minified-source
+// guard. Enable it here so a fresh clone is protected by default.
+try {
+    const {execSync} = await import('child_process');
+    execSync('git rev-parse --git-dir', {stdio: 'ignore'});
+    execSync('git config core.hooksPath .githooks', {stdio: 'ignore'});
+    console.log('  ✓ Git hooks enabled (core.hooksPath = .githooks)');
+} catch {
+    // Not a git checkout — an npm install of the published package, most
+    // likely. Nothing to enable, and nothing worth warning about.
+}
+
 // ---------------------------------------------------------------------------
 // Done
 // ---------------------------------------------------------------------------

package/server/middleware/auth.js

@@ -1,253 +1,253 @@
-/**
- * Authentication Middleware
- * JWT-based authentication with role guards for Domma CMS.
- * Role data is read from the roles cache (not config.auth.roles).
- */
-import {getPermissionsFor, getPermissionsForRole, getRoleHierarchy, getRoleLevel} from '../services/roles.js';
-import {getEffectiveLevel, getEffectiveRoles} from '../services/userRoles.js';
-
-/**
- * Verify JWT Bearer token. Populates request.user on success.
- *
- * @param {FastifyRequest} request
- * @param {FastifyReply} reply
- * @returns {Promise<void>}
- */
-export async function authenticate(request, reply) {
-    try {
-        const decoded = await request.jwtVerify();
-        if (decoded.type !== 'access') {
-            return reply.code(401).send({
-                statusCode: 401,
-                error: 'Unauthorised',
-                message: 'Invalid token type'
-            });
-        }
-    } catch {
-        return reply.code(401).send({
-            statusCode: 401,
-            error: 'Unauthorised',
-            message: 'Invalid or missing authentication token'
-        });
-    }
-}
-
-/**
- * Return a preHandler that enforces one of the specified roles.
- * Must be used after authenticate.
- *
- * @param {string[]} allowedRoles
- * @returns {Function}
- */
-export function requireRole(allowedRoles) {
-    const allowed = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
-
-    return async (request, reply) => {
-        if (!request.user) {
-            return reply.code(401).send({
-                statusCode: 401,
-                error: 'Unauthorised',
-                message: 'Authentication required'
-            });
-        }
-
-        if (!allowed.includes(request.user.role)) {
-            return reply.code(403).send({
-                statusCode: 403,
-                error: 'Forbidden',
-                message: `Access denied. Required role: ${allowed.join(' or ')}`
-            });
-        }
-    };
-}
-
-/**
- * Return a preHandler that checks the current user's role has access to a resource.
- * Reads from the roles cache at request time — reflects live role changes.
- *
- * @param {string}  resource - Resource key (e.g. 'pages', 'users')
- * @param {string} [action]  - Optional action (read | create | update | delete)
- * @returns {Function}
- */
-export function requirePermission(resource, action) {
-    return async (request, reply) => {
-        if (!request.user) {
-            return reply.code(401).send({
-                statusCode: 401,
-                error: 'Unauthorised',
-                message: 'Authentication required'
-            });
-        }
-
-        // Check ANY of the user's effective roles (primary + additional) against
-        // the resource's permission list — union semantics so a user with both
-        // candidate and recruiter roles can do either role's actions.
-        const allowed = getPermissionsFor(resource, action);
-        const roles   = getEffectiveRoles(request.user);
-        if (!roles.some(r => allowed.includes(r))) {
-            return reply.code(403).send({
-                statusCode: 403,
-                error: 'Forbidden',
-                message: 'Insufficient permissions'
-            });
-        }
-    };
-}
-
-/**
- * Export getPermissionsForRole for use in route handlers.
- *
- * @param {string} roleName
- * @returns {string[]}
- */
-export {getPermissionsForRole};
-
-/**
- * Shorthand preHandler — admin-tier role (level ≤ 1) or above.
- * Matches the base role hierarchy documented in roles.js:
- *   super-admin (0), admin (1), user (2).
- * Both super-admin and admin pass; regular users and anything below do not.
- *
- * @param {FastifyRequest} request
- * @param {FastifyReply} reply
- * @returns {Promise<void>}
- */
-export async function requireAdmin(request, reply) {
-    if (!request.user) {
-        return reply.code(401).send({ statusCode: 401, error: 'Unauthorised', message: 'Authentication required' });
-    }
-    // Use effective level — a user with "additionalRoles: ['admin']" can do admin work
-    // even if their primary role is something lower-privilege.
-    if (getEffectiveLevel(request.user) > 1) {
-        return reply.code(403).send({ statusCode: 403, error: 'Forbidden', message: 'Admin access required' });
-    }
-}
-
-/**
- * Determine whether an actor can manage a target user.
- * Managers cannot create, edit, or delete users with a lower level number (higher privilege).
- *
- * Accepts either user objects (preferred — uses effective level across all roles)
- * or bare role-name strings (legacy compat). Strings are looked up via
- * `getRoleLevel`; objects via `getEffectiveLevel` so multi-role actors and
- * targets are compared by their HIGHEST-privilege role.
- *
- * @param {string|object} actor   - Role name OR user object
- * @param {string|object} target  - Role name OR user object
- * @returns {boolean}
- */
-export function canManageUser(actor, target) {
-    const actorLevel  = typeof actor  === 'string' ? getRoleLevel(actor)  : getEffectiveLevel(actor);
-    const targetLevel = typeof target === 'string' ? getRoleLevel(target) : getEffectiveLevel(target);
-    return actorLevel < targetLevel;
-}
-
-/**
- * Check whether a user role satisfies a visibility requirement.
- * Used by both requireVisibility() and the public page renderer.
- *
- * Visibility may be either:
- *   - A single string ('public', 'private', or a role name)
- *   - An array of role names — granted if ANY entry passes the per-role check
- *
- * Per-role semantics are unchanged: each role check passes if the visitor's
- * role level is at or above the required role (lower or equal level number).
- * 'private' resolves to super-admin only (Infinity → level 0).
- *
- * The "any of" semantics for arrays means siblings at different tiers of the
- * hierarchy are all granted access — e.g. `visibility: [candidate, employer]`
- * lets both roles in, plus anyone more privileged than either (typically
- * admins inherit access automatically via the level comparison).
- *
- * @param {string|null}      userRole   - The visitor's role, or null if unauthenticated
- * @param {string|string[]}  visibility - Required visibility — single value or array
- * @returns {boolean} true if access is granted
- */
-export function checkVisibility(userRoleOrObj, visibility) {
-    if (!visibility) return true;
-
-    // Accept either a bare role name (legacy) or a user object with multi-role
-    // support. When given an object we walk every effective role and grant
-    // access if ANY satisfies — same union semantics as permissions.
-    const roles = typeof userRoleOrObj === 'string'
-        ? (userRoleOrObj ? [userRoleOrObj] : [])
-        : getEffectiveRoles(userRoleOrObj);
-
-    if (Array.isArray(visibility)) {
-        if (visibility.length === 0) return true;
-        if (visibility.includes('public')) return true;
-        if (!roles.length) return false;
-        return roles.some(r => visibility.some(v => checkSingleVisibility(r, v)));
-    }
-
-    if (visibility === 'public') return true;
-    if (!roles.length) return false;
-    return roles.some(r => checkSingleVisibility(r, visibility));
-}
-
-/**
- * Internal helper — single-role visibility check.
- * Returns true if the user role is at or above the required role's level.
- *
- * @param {string} userRole   - Must not be null
- * @param {string} visibility - Single visibility token (role name or 'private')
- * @returns {boolean}
- */
-function checkSingleVisibility(userRole, visibility) {
-    const userLevel     = getRoleLevel(userRole);
-    const requiredLevel = getRoleLevel(visibility);
-    const threshold     = requiredLevel === Infinity ? 0 : requiredLevel;
-    return userLevel <= threshold;
-}
-
-/**
- * Fastify preHandler factory — gates a route by visibility level.
- * Works identically to the content-page visibility system; accepts the same
- * single-string or array-of-roles syntax as checkVisibility().
- *
- * Returns a no-op for 'public' (or any array containing 'public') so it is
- * safe to apply unconditionally.
- *
- * @param {string|string[]} visibility - 'public' | 'private' | role name | array of role names
- * @returns {Function} Fastify preHandler
- */
-export function requireVisibility(visibility) {
-    const isPublic = !visibility
-        || visibility === 'public'
-        || (Array.isArray(visibility) && (visibility.length === 0 || visibility.includes('public')));
-
-    if (isPublic) {
-        return (_request, _reply, done) => { if (done) done(); };
-    }
-
-    return async (request, reply) => {
-        // Build a user-shaped object so checkVisibility can see multi-role
-        // (primary + additional). Unauthenticated → null → public-only access.
-        let userObj = null;
-        try {
-            const decoded = await request.jwtVerify();
-            if (decoded.type === 'access') {
-                userObj = { role: decoded.role, additionalRoles: decoded.additionalRoles || [] };
-            }
-        } catch { /* unauthenticated */ }
-
-        if (!checkVisibility(userObj, visibility)) {
-            const code = userObj ? 403 : 401;
-            return reply.code(code).send({
-                statusCode: code,
-                error:      code === 403 ? 'Forbidden' : 'Unauthorised',
-                message:    code === 403 ? 'Insufficient role for this resource' : 'Authentication required'
-            });
-        }
-    };
-}
-
-/**
- * Return role names ordered from most to least privileged.
- * Computed from the roles cache.
- *
- * @returns {string[]}
- */
-export function getRoleHierarchyList() {
-    return getRoleHierarchy();
-}
+/**
+ * Authentication Middleware
+ * JWT-based authentication with role guards for Domma CMS.
+ * Role data is read from the roles cache (not config.auth.roles).
+ */
+import {getPermissionsFor, getPermissionsForRole, getRoleHierarchy, getRoleLevel} from '../services/roles.js';
+import {getEffectiveLevel, getEffectiveRoles} from '../services/userRoles.js';
+
+/**
+ * Verify JWT Bearer token. Populates request.user on success.
+ *
+ * @param {FastifyRequest} request
+ * @param {FastifyReply} reply
+ * @returns {Promise<void>}
+ */
+export async function authenticate(request, reply) {
+    try {
+        const decoded = await request.jwtVerify();
+        if (decoded.type !== 'access') {
+            return reply.code(401).send({
+                statusCode: 401,
+                error: 'Unauthorised',
+                message: 'Invalid token type'
+            });
+        }
+    } catch {
+        return reply.code(401).send({
+            statusCode: 401,
+            error: 'Unauthorised',
+            message: 'Invalid or missing authentication token'
+        });
+    }
+}
+
+/**
+ * Return a preHandler that enforces one of the specified roles.
+ * Must be used after authenticate.
+ *
+ * @param {string[]} allowedRoles
+ * @returns {Function}
+ */
+export function requireRole(allowedRoles) {
+    const allowed = Array.isArray(allowedRoles) ? allowedRoles : [allowedRoles];
+
+    return async (request, reply) => {
+        if (!request.user) {
+            return reply.code(401).send({
+                statusCode: 401,
+                error: 'Unauthorised',
+                message: 'Authentication required'
+            });
+        }
+
+        if (!allowed.includes(request.user.role)) {
+            return reply.code(403).send({
+                statusCode: 403,
+                error: 'Forbidden',
+                message: `Access denied. Required role: ${allowed.join(' or ')}`
+            });
+        }
+    };
+}
+
+/**
+ * Return a preHandler that checks the current user's role has access to a resource.
+ * Reads from the roles cache at request time — reflects live role changes.
+ *
+ * @param {string}  resource - Resource key (e.g. 'pages', 'users')
+ * @param {string} [action]  - Optional action (read | create | update | delete)
+ * @returns {Function}
+ */
+export function requirePermission(resource, action) {
+    return async (request, reply) => {
+        if (!request.user) {
+            return reply.code(401).send({
+                statusCode: 401,
+                error: 'Unauthorised',
+                message: 'Authentication required'
+            });
+        }
+
+        // Check ANY of the user's effective roles (primary + additional) against
+        // the resource's permission list — union semantics so a user with both
+        // candidate and recruiter roles can do either role's actions.
+        const allowed = getPermissionsFor(resource, action);
+        const roles   = getEffectiveRoles(request.user);
+        if (!roles.some(r => allowed.includes(r))) {
+            return reply.code(403).send({
+                statusCode: 403,
+                error: 'Forbidden',
+                message: 'Insufficient permissions'
+            });
+        }
+    };
+}
+
+/**
+ * Export getPermissionsForRole for use in route handlers.
+ *
+ * @param {string} roleName
+ * @returns {string[]}
+ */
+export {getPermissionsForRole};
+
+/**
+ * Shorthand preHandler — admin-tier role (level ≤ 1) or above.
+ * Matches the base role hierarchy documented in roles.js:
+ *   super-admin (0), admin (1), user (2).
+ * Both super-admin and admin pass; regular users and anything below do not.
+ *
+ * @param {FastifyRequest} request
+ * @param {FastifyReply} reply
+ * @returns {Promise<void>}
+ */
+export async function requireAdmin(request, reply) {
+    if (!request.user) {
+        return reply.code(401).send({ statusCode: 401, error: 'Unauthorised', message: 'Authentication required' });
+    }
+    // Use effective level — a user with "additionalRoles: ['admin']" can do admin work
+    // even if their primary role is something lower-privilege.
+    if (getEffectiveLevel(request.user) > 1) {
+        return reply.code(403).send({ statusCode: 403, error: 'Forbidden', message: 'Admin access required' });
+    }
+}
+
+/**
+ * Determine whether an actor can manage a target user.
+ * Managers cannot create, edit, or delete users with a lower level number (higher privilege).
+ *
+ * Accepts either user objects (preferred — uses effective level across all roles)
+ * or bare role-name strings (legacy compat). Strings are looked up via
+ * `getRoleLevel`; objects via `getEffectiveLevel` so multi-role actors and
+ * targets are compared by their HIGHEST-privilege role.
+ *
+ * @param {string|object} actor   - Role name OR user object
+ * @param {string|object} target  - Role name OR user object
+ * @returns {boolean}
+ */
+export function canManageUser(actor, target) {
+    const actorLevel  = typeof actor  === 'string' ? getRoleLevel(actor)  : getEffectiveLevel(actor);
+    const targetLevel = typeof target === 'string' ? getRoleLevel(target) : getEffectiveLevel(target);
+    return actorLevel < targetLevel;
+}
+
+/**
+ * Check whether a user role satisfies a visibility requirement.
+ * Used by both requireVisibility() and the public page renderer.
+ *
+ * Visibility may be either:
+ *   - A single string ('public', 'private', or a role name)
+ *   - An array of role names — granted if ANY entry passes the per-role check
+ *
+ * Per-role semantics are unchanged: each role check passes if the visitor's
+ * role level is at or above the required role (lower or equal level number).
+ * 'private' resolves to super-admin only (Infinity → level 0).
+ *
+ * The "any of" semantics for arrays means siblings at different tiers of the
+ * hierarchy are all granted access — e.g. `visibility: [candidate, employer]`
+ * lets both roles in, plus anyone more privileged than either (typically
+ * admins inherit access automatically via the level comparison).
+ *
+ * @param {string|null}      userRole   - The visitor's role, or null if unauthenticated
+ * @param {string|string[]}  visibility - Required visibility — single value or array
+ * @returns {boolean} true if access is granted
+ */
+export function checkVisibility(userRoleOrObj, visibility) {
+    if (!visibility) return true;
+
+    // Accept either a bare role name (legacy) or a user object with multi-role
+    // support. When given an object we walk every effective role and grant
+    // access if ANY satisfies — same union semantics as permissions.
+    const roles = typeof userRoleOrObj === 'string'
+        ? (userRoleOrObj ? [userRoleOrObj] : [])
+        : getEffectiveRoles(userRoleOrObj);
+
+    if (Array.isArray(visibility)) {
+        if (visibility.length === 0) return true;
+        if (visibility.includes('public')) return true;
+        if (!roles.length) return false;
+        return roles.some(r => visibility.some(v => checkSingleVisibility(r, v)));
+    }
+
+    if (visibility === 'public') return true;
+    if (!roles.length) return false;
+    return roles.some(r => checkSingleVisibility(r, visibility));
+}
+
+/**
+ * Internal helper — single-role visibility check.
+ * Returns true if the user role is at or above the required role's level.
+ *
+ * @param {string} userRole   - Must not be null
+ * @param {string} visibility - Single visibility token (role name or 'private')
+ * @returns {boolean}
+ */
+function checkSingleVisibility(userRole, visibility) {
+    const userLevel     = getRoleLevel(userRole);
+    const requiredLevel = getRoleLevel(visibility);
+    const threshold     = requiredLevel === Infinity ? 0 : requiredLevel;
+    return userLevel <= threshold;
+}
+
+/**
+ * Fastify preHandler factory — gates a route by visibility level.
+ * Works identically to the content-page visibility system; accepts the same
+ * single-string or array-of-roles syntax as checkVisibility().
+ *
+ * Returns a no-op for 'public' (or any array containing 'public') so it is
+ * safe to apply unconditionally.
+ *
+ * @param {string|string[]} visibility - 'public' | 'private' | role name | array of role names
+ * @returns {Function} Fastify preHandler
+ */
+export function requireVisibility(visibility) {
+    const isPublic = !visibility
+        || visibility === 'public'
+        || (Array.isArray(visibility) && (visibility.length === 0 || visibility.includes('public')));
+
+    if (isPublic) {
+        return (_request, _reply, done) => { if (done) done(); };
+    }
+
+    return async (request, reply) => {
+        // Build a user-shaped object so checkVisibility can see multi-role
+        // (primary + additional). Unauthenticated → null → public-only access.
+        let userObj = null;
+        try {
+            const decoded = await request.jwtVerify();
+            if (decoded.type === 'access') {
+                userObj = { role: decoded.role, additionalRoles: decoded.additionalRoles || [] };
+            }
+        } catch { /* unauthenticated */ }
+
+        if (!checkVisibility(userObj, visibility)) {
+            const code = userObj ? 403 : 401;
+            return reply.code(code).send({
+                statusCode: code,
+                error:      code === 403 ? 'Forbidden' : 'Unauthorised',
+                message:    code === 403 ? 'Insufficient role for this resource' : 'Authentication required'
+            });
+        }
+    };
+}
+
+/**
+ * Return role names ordered from most to least privileged.
+ * Computed from the roles cache.
+ *
+ * @returns {string[]}
+ */
+export function getRoleHierarchyList() {
+    return getRoleHierarchy();
+}