nucleus-core-ts 0.10.35 → 0.10.37

package/dist/.build-ok

@@ -1 +1 @@
-0.10.35
+0.10.37

package/dist/fe/components/AuthGuard/store.d.ts

@@ -1,2 +1,24 @@
 import type { AuthActions, AuthState } from './types';
+export declare const GODMIN_ROLE_NAME = "godmin";
+export declare function hasGodminRole(roles: {
+    name: string;
+}[]): boolean;
+/**
+ * The one place that decides whether a claim lookup is even reached.
+ *
+ * `allow`  — the actor bypasses claims entirely (matches the backend).
+ * `deny`   — the hydrated state failed its integrity check; answer nothing.
+ * `claims` — no bypass; the caller must consult the claim list.
+ *
+ * Order matters and is asserted in the tests: `is_god` short-circuits before
+ * integrity (it always has), while the godmin ROLE is honoured only after
+ * integrity passes, because `roles` is part of the integrity hash and a
+ * tampered roles array must not buy a bypass.
+ */
+export declare function resolveClaimGate(actor: {
+    isGod?: boolean | null;
+    roles: {
+        name: string;
+    }[];
+}, integrityOk: boolean): 'allow' | 'deny' | 'claims';
 export declare const useAuthGuardStore: () => import("h-state").StoreType<AuthState, AuthActions>;

package/dist/fe/components/AuthGuard/store.js

@@ -16,6 +16,36 @@ function computeIntegrityHash(roles, claims) {
     }
     return hash.toString(36);
 }
+// ─── Godmin ─────────────────────────────────────────────────────────────────
+// The backend treats the `godmin` ROLE as a full bypass
+// (Services/Authorization/Middleware: `isGodmin` -> `authorized: true`), and it
+// does so for the role alone — `users.is_god` is a separate, additional flag.
+// The claim helpers below must agree with that, or a user the API authorises is
+// shown an empty panel: every menu entry and card is hidden by `hasClaim`, and
+// only the accounts that happen to carry `is_god` can see anything. Measured on
+// DijitalKt: the `godmin` role owns zero rows in `role_claims`, so the whole
+// admin panel rendered empty for it.
+export const GODMIN_ROLE_NAME = 'godmin';
+export function hasGodminRole(roles) {
+    return roles.some((r)=>r.name === GODMIN_ROLE_NAME);
+}
+/**
+ * The one place that decides whether a claim lookup is even reached.
+ *
+ * `allow`  — the actor bypasses claims entirely (matches the backend).
+ * `deny`   — the hydrated state failed its integrity check; answer nothing.
+ * `claims` — no bypass; the caller must consult the claim list.
+ *
+ * Order matters and is asserted in the tests: `is_god` short-circuits before
+ * integrity (it always has), while the godmin ROLE is honoured only after
+ * integrity passes, because `roles` is part of the integrity hash and a
+ * tampered roles array must not buy a bypass.
+ */ export function resolveClaimGate(actor, integrityOk) {
+    if (actor.isGod) return 'allow';
+    if (!integrityOk) return 'deny';
+    if (hasGodminRole(actor.roles)) return 'allow';
+    return 'claims';
+}
 // ─── Claim Matching ─────────────────────────────────────────────────────────
 // Mirrors nucleus-core backend's claimMatches logic:
 // "get.users" matches "get.users.firstName" (prefix/hierarchical match)
@@ -99,7 +129,7 @@ export const { useStore: useAuthGuardStore } = createStore({
         },
     isGodmin: (store)=>()=>{
             if (store.user?.isGod) return true;
-            return store.roles.some((r)=>r.name === 'godmin');
+            return hasGodminRole(store.roles);
         },
     hasRole: (store)=>(roleName)=>{
             if (store.user?.isGod) return true;
@@ -114,23 +144,35 @@ export const { useStore: useAuthGuardStore } = createStore({
             return roleNames.every((name)=>store.roles.some((r)=>r.name === name));
         },
     hasClaim: (store)=>(claimAction, scope)=>{
-            if (store.user?.isGod) return true;
-            if (!store.verifyIntegrity()) return false;
+            const gate = resolveClaimGate({
+                isGod: store.user?.isGod,
+                roles: store.roles
+            }, store.verifyIntegrity());
+            if (gate !== 'claims') return gate === 'allow';
             return userHasClaim(store.claims, claimAction, scope);
         },
     hasAnyClaim: (store)=>(claimActions, scope)=>{
-            if (store.user?.isGod) return true;
-            if (!store.verifyIntegrity()) return false;
+            const gate = resolveClaimGate({
+                isGod: store.user?.isGod,
+                roles: store.roles
+            }, store.verifyIntegrity());
+            if (gate !== 'claims') return gate === 'allow';
             return claimActions.some((action)=>userHasClaim(store.claims, action, scope));
         },
     hasAllClaims: (store)=>(claimActions, scope)=>{
-            if (store.user?.isGod) return true;
-            if (!store.verifyIntegrity()) return false;
+            const gate = resolveClaimGate({
+                isGod: store.user?.isGod,
+                roles: store.roles
+            }, store.verifyIntegrity());
+            if (gate !== 'claims') return gate === 'allow';
             return claimActions.every((action)=>userHasClaim(store.claims, action, scope));
         },
     checkPermission: (store)=>(roles, claims, options)=>{
-            if (store.user?.isGod) return true;
-            if (!store.verifyIntegrity()) return false;
+            const gate = resolveClaimGate({
+                isGod: store.user?.isGod,
+                roles: store.roles
+            }, store.verifyIntegrity());
+            if (gate !== 'claims') return gate === 'allow';
             const mode = options?.mode ?? 'any';
             const scope = options?.scope;
             const rolePass = roles.length === 0 ? false : roles.some((name)=>store.roles.some((r)=>r.name === name));