meno-core 1.0.53 → 1.1.0

package/lib/shared/types/permissions.ts

@@ -0,0 +1,139 @@
+/**
+ * Permission Types
+ *
+ * Per-resource, soft (UI-coordination) edit permissions keyed by GitHub
+ * identity. The policy lives in `.meno/permissions.json` at the project root
+ * (committed, so every clone resolves the SAME policy locally). GitHub stays
+ * the identity + grouping authority (logins, teams, repo-admin bit); this model
+ * owns what those map to in editor terms.
+ *
+ * Enforcement tier is SOFT: these types drive UI gating (read-only editor
+ * paths, disabled save), not an adversarial security boundary — a user with the
+ * clone can always edit files directly. Hard enforcement (a CI check on PRs)
+ * is a later, additive layer that reads the same policy file.
+ *
+ * This module is pure data + types; the resolver lives in `../permissions.ts`.
+ */
+
+/** Permission tiers, lowest → highest capability. */
+export type PermissionRole = 'viewer' | 'editor' | 'admin';
+
+export const PERMISSION_ROLES = ['viewer', 'editor', 'admin'] as const satisfies readonly PermissionRole[];
+
+/**
+ * The editable unit kinds of a Meno project. Mirrors the on-disk layout:
+ *   - `page`      → `src/pages/<slug>.astro`        (id = page slug, e.g. `blog/post`)
+ *   - `component` → `src/components/<Name>.astro`    (id = component name)
+ *   - `cms`       → `src/content/<collectionId>/`    (id = collection id; items inherit)
+ *   - `config`    → root config files               (id = a {@link ConfigArea})
+ */
+export type ResourceKind = 'page' | 'component' | 'cms' | 'config';
+
+export const RESOURCE_KINDS: readonly ResourceKind[] = ['page', 'component', 'cms', 'config'] as const;
+
+/**
+ * Named global-config capabilities (the `config` resource kind's id namespace):
+ *   - `project`   → `project.config.json` (site URL, breakpoints, fonts, …)
+ *   - `colors`    → `colors.json`
+ *   - `variables` → `variables.json`
+ *   - `i18n`      → locale config inside `project.config.json`
+ *
+ * NOTE: `i18n` lives *inside* `project.config.json`, so the CI checker (which
+ * maps whole files) enforces it at `project` granularity — granting `i18n`
+ * without `project` is advisory only (no file maps to it on its own), and
+ * granting `project` implies `i18n`.
+ */
+export type ConfigArea = 'project' | 'colors' | 'variables' | 'i18n';
+
+export const CONFIG_AREAS: readonly ConfigArea[] = ['project', 'colors', 'variables', 'i18n'] as const;
+
+/**
+ * A reference to one editable resource, checked against a {@link PermissionRule}.
+ * `id` is matched against the rule's glob list for `kind` (see
+ * `matchesPermissionPattern`).
+ */
+export interface ResourceRef {
+  kind: ResourceKind;
+  /** page slug | component name | collection id | config area. */
+  id: string;
+}
+
+/**
+ * Per-resource-kind allow-lists. Each entry is a glob pattern (`*` matches any
+ * run of characters, including `/`) matched against a {@link ResourceRef.id}.
+ * Only consulted for the `editor` role — `viewer` edits nothing, `admin`
+ * edits everything. An absent/empty list for a kind means "no resources of
+ * that kind".
+ */
+export interface PermissionRule {
+  /** Page slugs, e.g. `["blog/*", "about"]`. */
+  pages?: string[];
+  /** Component names, e.g. `["Card", "*Hero"]`. */
+  components?: string[];
+  /** CMS collection ids, e.g. `["posts", "*"]`. */
+  cms?: string[];
+  /** Config areas, e.g. `["colors", "variables"]` or `["*"]`. */
+  config?: string[];
+}
+
+/**
+ * One person's or team's grant. `role` defaults to `editor` when `allow` is
+ * present, otherwise `viewer`.
+ */
+export interface PermissionGrant {
+  role?: PermissionRole;
+  /** Editable resources — only meaningful for the `editor` role. */
+  allow?: PermissionRule;
+}
+
+/** Current `version` value written by this app. */
+export const CURRENT_PERMISSIONS_VERSION = 1;
+
+/**
+ * The committed `.meno/permissions.json` document. Logins/team slugs are
+ * matched case-insensitively (GitHub logins are case-insensitive).
+ */
+export interface PermissionsPolicy {
+  /** Schema version. {@link CURRENT_PERMISSIONS_VERSION} for documents this app writes. */
+  version: number;
+  /** Role for authenticated users not listed in `members`/`teams`. Defaults to `viewer`. */
+  defaultRole?: PermissionRole;
+  /** Per-GitHub-login grants. */
+  members?: Record<string, PermissionGrant>;
+  /** Per-GitHub-team-slug grants (a user's grants are the union over their teams). */
+  teams?: Record<string, PermissionGrant>;
+}
+
+/**
+ * Who is asking, resolved from the GitHub session. `login: null` means
+ * unauthenticated / no GitHub identity (a local project, or a non-electron
+ * run) — see {@link PermissionsPolicy} handling in the resolver.
+ */
+export interface PermissionIdentity {
+  /** GitHub login, or `null` when unauthenticated. */
+  login: string | null;
+  /** GitHub team slugs the user belongs to (for `teams` grants). */
+  teams?: string[];
+  /**
+   * GitHub repo `permissions.admin`. Repo admins are ALWAYS treated as admin
+   * here (bootstrap safety — a policy can't lock the repo owner out).
+   */
+  isRepoAdmin?: boolean;
+}
+
+/**
+ * The resolved capability set for one identity against one policy. Plain,
+ * serializable data (no methods) so it can live in a store; query it with
+ * `canEdit()` from `../permissions.ts`.
+ */
+export interface ResolvedPermissions {
+  login: string | null;
+  /** Effective top role after merging member + team grants (and repo-admin). */
+  role: PermissionRole;
+  /** `true` for `admin` role or a GitHub repo admin. Admins edit everything. */
+  isAdmin: boolean;
+  /** May the user edit `.meno/permissions.json` itself? Admins only. */
+  canManagePolicy: boolean;
+  /** Merged allow-lists from all matching grants (consulted for the `editor` role). */
+  allow: Required<PermissionRule>;
+}

package/lib/shared/types/styles.ts

@@ -80,4 +80,3 @@ export interface InteractiveStyleRule {
  * Each rule has a selector and associated styles
  */
 export type InteractiveStyles = InteractiveStyleRule[];
-

package/lib/shared/types/variables.test.ts

@@ -1,15 +1,10 @@
 import { describe, expect, it } from 'bun:test';
-import {
-  getGroupAbbreviation,
-  getDefaultScalingType,
-  generateShortCssVar,
-  VARIABLE_TYPES,
-} from './variables';
+import { getGroupAbbreviation, getDefaultScalingType, generateShortCssVar, VARIABLE_TYPES } from './variables';
 import type { CSSVariable } from './variables';
 
 describe('VARIABLE_TYPES', () => {
   it('has all expected scaling types', () => {
-    const values = VARIABLE_TYPES.map(t => t.value);
+    const values = VARIABLE_TYPES.map((t) => t.value);
     expect(values).toEqual(['fontSize', 'padding', 'margin', 'gap', 'borderRadius', 'size', 'none']);
   });
 });
@@ -97,9 +92,7 @@ describe('generateShortCssVar', () => {
   });
 
   it('extends prefix on collision', () => {
-    const existing: CSSVariable[] = [
-      { name: 'H', cssVar: '--h-ls', value: '1px', type: 'none' },
-    ];
+    const existing: CSSVariable[] = [{ name: 'H', cssVar: '--h-ls', value: '1px', type: 'none' }];
     const result = generateShortCssVar('Heading', 'letter-spacing', existing);
     expect(result).toBe('--he-ls');
   });
@@ -130,9 +123,7 @@ describe('generateShortCssVar', () => {
   });
 
   it('adds numeric suffix for no-group collisions', () => {
-    const existing: CSSVariable[] = [
-      { name: '', cssVar: '--my-var', value: '1px', type: 'none' },
-    ];
+    const existing: CSSVariable[] = [{ name: '', cssVar: '--my-var', value: '1px', type: 'none' }];
     const result = generateShortCssVar('My Var', '', existing);
     expect(result).toBe('--my-var-2');
   });

package/lib/shared/types/variables.ts

@@ -15,18 +15,25 @@ export type VariableType = 'fontSize' | 'padding' | 'margin' | 'gap' | 'borderRa
  * Controls which variables appear in the picker based on the CSS property being edited.
  */
 export type VariableGroup =
-  | 'font-family' | 'font-size' | 'font-weight'
-  | 'line-height' | 'letter-spacing'
-  | 'margin' | 'padding' | 'gap'
+  | 'font-family'
+  | 'font-size'
+  | 'font-weight'
+  | 'line-height'
+  | 'letter-spacing'
+  | 'margin'
+  | 'padding'
+  | 'gap'
   | 'size'
   | 'position'
-  | 'border-radius' | 'border-width'
+  | 'border-radius'
+  | 'border-width'
   | 'outline'
   | 'shadow'
   | 'filter'
   | 'duration'
   | 'aspect-ratio'
-  | 'opacity' | 'z-index'
+  | 'opacity'
+  | 'z-index'
   | 'text-align'
   | 'other';
 
@@ -56,7 +63,7 @@ export const VARIABLE_GROUPS: { value: VariableGroup; label: string }[] = [
 ];
 
 /** All valid group string values */
-export const VARIABLE_GROUP_VALUES: VariableGroup[] = VARIABLE_GROUPS.map(g => g.value);
+export const VARIABLE_GROUP_VALUES: VariableGroup[] = VARIABLE_GROUPS.map((g) => g.value);
 
 /** Maps CSS property names to variable groups */
 const CSS_PROPERTY_TO_GROUP: Record<string, VariableGroup> = {
@@ -66,13 +73,13 @@ const CSS_PROPERTY_TO_GROUP: Record<string, VariableGroup> = {
   'line-height': 'line-height',
   'letter-spacing': 'letter-spacing',
   'text-align': 'text-align',
-  'opacity': 'opacity',
+  opacity: 'opacity',
   'z-index': 'z-index',
-  'top': 'position',
-  'right': 'position',
-  'bottom': 'position',
-  'left': 'position',
-  'inset': 'position',
+  top: 'position',
+  right: 'position',
+  bottom: 'position',
+  left: 'position',
+  inset: 'position',
   'inset-block': 'position',
   'inset-inline': 'position',
   'inset-block-start': 'position',
@@ -81,7 +88,7 @@ const CSS_PROPERTY_TO_GROUP: Record<string, VariableGroup> = {
   'inset-inline-end': 'position',
   'box-shadow': 'shadow',
   'text-shadow': 'shadow',
-  'filter': 'filter',
+  filter: 'filter',
   'backdrop-filter': 'filter',
   'aspect-ratio': 'aspect-ratio',
   'transition-duration': 'duration',
@@ -123,15 +130,15 @@ const CSS_PROPERTY_PREFIX_GROUPS: { prefix: string; group: VariableGroup }[] = [
  */
 export function getGroupForProperty(prop: string): VariableGroup | null {
   // Normalize camelCase to kebab-case (e.g., "fontFamily" → "font-family")
-  const normalized = prop.replace(/[A-Z]/g, letter => `-${letter.toLowerCase()}`);
+  const normalized = prop.replace(/[A-Z]/g, (letter) => `-${letter.toLowerCase()}`);
 
   // Exact match first
   if (normalized in CSS_PROPERTY_TO_GROUP) {
-    return CSS_PROPERTY_TO_GROUP[normalized];
+    return CSS_PROPERTY_TO_GROUP[normalized] ?? null;
   }
   // Prefix-based match (handles margin-top, padding-left, etc.)
   for (const { prefix, group } of CSS_PROPERTY_PREFIX_GROUPS) {
-    if (normalized === prefix || normalized.startsWith(prefix + '-')) {
+    if (normalized === prefix || normalized.startsWith(`${prefix}-`)) {
       return group;
     }
   }
@@ -177,20 +184,23 @@ export const VARIABLE_TYPES: { value: VariableType; label: string }[] = [
 ];
 
 /** All valid variable scaling type values */
-export const VARIABLE_TYPE_VALUES: VariableType[] = VARIABLE_TYPES.map(t => t.value);
+export const VARIABLE_TYPE_VALUES: VariableType[] = VARIABLE_TYPES.map((t) => t.value);
 
 /**
  * Returns an abbreviation for a variable group by taking the first letter of each word.
  * e.g. 'letter-spacing' -> 'ls', 'font-size' -> 'fs', 'spacing' -> 's'
  */
 export function getGroupAbbreviation(group: string): string {
-  return group.split('-').map(w => w[0] || '').join('');
+  return group
+    .split('-')
+    .map((w) => w[0] || '')
+    .join('');
 }
 
 /**
  * Infers a default scaling type from a variable group and optional CSS property.
  */
-export function getDefaultScalingType(group: string, cssProperty?: string): VariableType {
+export function getDefaultScalingType(group: string, _cssProperty?: string): VariableType {
   if (group === 'font-size') return 'fontSize';
   if (group === 'margin') return 'margin';
   if (group === 'padding') return 'padding';
@@ -205,34 +215,45 @@ export function getDefaultScalingType(group: string, cssProperty?: string): Vari
  * e.g. name="Heading", group="letter-spacing" -> "--h-ls"
  * If taken, extends prefix: "--he-ls", "--hea-ls", etc.
  */
-export function generateShortCssVar(
-  name: string,
-  group: string,
-  existingVariables: CSSVariable[]
-): string {
+export function generateShortCssVar(name: string, group: string, existingVariables: CSSVariable[]): string {
   const trimmed = name.trim();
   if (!trimmed) return '--';
   if (!group) {
     // No group: just kebab-case the name
-    const base = '--' + trimmed.toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
+    const base =
+      '--' +
+      trimmed
+        .toLowerCase()
+        .replace(/\s+/g, '-')
+        .replace(/[^a-z0-9-]/g, '');
     return ensureUnique(base, existingVariables);
   }
 
   const groupAbbr = getGroupAbbreviation(group);
-  const kebabName = trimmed.toLowerCase().replace(/\s+/g, '-').replace(/[^a-z0-9-]/g, '');
+  const kebabName = trimmed
+    .toLowerCase()
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9-]/g, '');
   const words = kebabName.split('-').filter(Boolean);
-  const existingNames = new Set(existingVariables.map(v => v.cssVar));
+  const existingNames = new Set(existingVariables.map((v) => v.cssVar));
 
   // Try progressively longer prefixes from the name
   // Start with first letter of each word, then extend first word
-  const initials = words.map(w => w[0] || '').join('');
+  const initials = words.map((w) => w[0] || '').join('');
   const initialCandidate = `--${initials}-${groupAbbr}`;
   if (!existingNames.has(initialCandidate)) return initialCandidate;
 
   // Extend first word progressively
   const firstWord = words[0] || '';
   for (let len = 2; len <= firstWord.length; len++) {
-    const prefix = firstWord.slice(0, len) + (words.length > 1 ? words.slice(1).map(w => w[0] || '').join('') : '');
+    const prefix =
+      firstWord.slice(0, len) +
+      (words.length > 1
+        ? words
+            .slice(1)
+            .map((w) => w[0] || '')
+            .join('')
+        : '');
     const candidate = `--${prefix}-${groupAbbr}`;
     if (!existingNames.has(candidate)) return candidate;
   }
@@ -248,7 +269,7 @@ export function generateShortCssVar(
 }
 
 function ensureUnique(base: string, existingVariables: CSSVariable[]): string {
-  const existingNames = new Set(existingVariables.map(v => v.cssVar));
+  const existingNames = new Set(existingVariables.map((v) => v.cssVar));
   if (!existingNames.has(base)) return base;
   let i = 2;
   while (existingNames.has(`${base}-${i}`)) i++;

package/lib/shared/types.ts

@@ -1,11 +1,10 @@
 /**
  * Shared TypeScript types and interfaces
  * Used by both client and server code
- * 
+ *
  * This file maintains backward compatibility while using the new modular type system.
  * All types are re-exported from the organized type modules.
  */
 
 // Re-export all types from the new modular structure
 export * from './types/index';
-