okengine 0.14.1 → 0.16.0

package/src/console/server/dev-identities.ts

@@ -0,0 +1,229 @@
+/**
+ * Default invoke-as identities — ten rungs from owner to guest.
+ *
+ * `user_demo` (owner) and `user_member` keep their historic ids so Call API
+ * tests and Access fixtures stay stable. Owner scopes follow the Manifest;
+ * lower rungs intersect a named profile with that catalog. Keel (`app ===
+ * "keel"`) always unions {@link KEEL_SCOPES} so seeding is not missing a
+ * declared Gate. No leftover app catalog is invented for other apps.
+ */
+
+import { setRoleGrants, upsertRole, type RoleStore } from "../../auth/index.ts";
+import type { Manifest } from "../../manifest/types.ts";
+
+/**
+ * Every Keel user-plane scope — `gate.policy("member")` plus `gate.scope`.
+ * Seeded onto the owner → guest ladder when the Manifest app is `keel`.
+ */
+export const KEEL_SCOPES = [
+  "member",
+  "task:write",
+  "comment:write",
+  "files:write",
+  "project:admin",
+  "member:admin",
+  "webhook:admin",
+] as const;
+
+/** One seeded development identity. */
+export interface SeededDevIdentity {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  readonly status: "active";
+  readonly scopes: readonly string[];
+}
+
+/** Stable person for one authorization rung. */
+export interface DevIdentityPerson {
+  readonly id: string;
+  readonly email: string;
+  readonly name: string;
+  /** Workspace / Access role label, owner → guest. */
+  readonly role: string;
+}
+
+/**
+ * Ten people, owner → guest. Demo and Member keep historic ids.
+ */
+export const DEV_IDENTITY_LADDER = [
+  { id: "user_demo", email: "demo@example.com", name: "Demo User", role: "owner" },
+  { id: "user_admin", email: "admin@example.com", name: "Admin", role: "admin" },
+  {
+    id: "user_workspace",
+    email: "workspace@example.com",
+    name: "Workspace Admin",
+    role: "workspace_admin",
+  },
+  { id: "user_pm", email: "pm@example.com", name: "Project Manager", role: "project_manager" },
+  { id: "user_lead", email: "lead@example.com", name: "Lead", role: "lead" },
+  { id: "user_dev", email: "developer@example.com", name: "Developer", role: "developer" },
+  { id: "user_writer", email: "writer@example.com", name: "Contributor", role: "contributor" },
+  { id: "user_member", email: "member@example.com", name: "Member", role: "member" },
+  { id: "user_commenter", email: "commenter@example.com", name: "Commenter", role: "commenter" },
+  { id: "user_guest", email: "guest@example.com", name: "Guest", role: "guest" },
+] as const satisfies readonly DevIdentityPerson[];
+
+/** One Keel ladder role and the scopes it holds. */
+export type KeelLadderRole = (typeof DEV_IDENTITY_LADDER)[number]["role"];
+
+/**
+ * Owner → guest grants. Owner and admin hold {@link KEEL_SCOPES}.
+ */
+export const KEEL_LADDER_GRANTS: Readonly<Record<KeelLadderRole, readonly string[]>> = {
+  owner: KEEL_SCOPES,
+  admin: KEEL_SCOPES,
+  workspace_admin: [
+    "member",
+    "task:write",
+    "comment:write",
+    "files:write",
+    "project:admin",
+    "member:admin",
+  ],
+  project_manager: ["member", "task:write", "comment:write", "files:write", "project:admin"],
+  lead: ["member", "task:write", "comment:write", "project:admin"],
+  developer: ["member", "task:write", "comment:write", "files:write"],
+  contributor: ["member", "task:write", "comment:write"],
+  member: ["member"],
+  commenter: ["member", "comment:write"],
+  guest: [],
+};
+
+/** `*` = every catalog scope (owner). Other rungs follow {@link KEEL_LADDER_GRANTS}. */
+const LADDER_SCOPE_PROFILES: readonly (readonly string[] | "*")[] = [
+  "*",
+  ...DEV_IDENTITY_LADDER.slice(1).map((person) => KEEL_LADDER_GRANTS[person.role]),
+];
+
+/**
+ * Whether this Manifest is the Keel example (full scope seed applies).
+ *
+ * @param manifest - Optional Manifest
+ */
+export function isKeelManifest(manifest?: Manifest | null): boolean {
+  return manifest?.app === "keel";
+}
+
+/**
+ * Application scopes implied by a Manifest — gate `scopes`, scoped gate
+ * ids, and flow gate refs. Always includes `member`.
+ *
+ * @param manifest - Optional Manifest
+ */
+export function demoScopesFromManifest(manifest?: Manifest | null): string[] {
+  const scopes = new Set<string>(["member"]);
+  if (isKeelManifest(manifest)) {
+    for (const scope of KEEL_SCOPES) scopes.add(scope);
+  }
+  if (!manifest) return [...scopes].sort();
+  for (const [gateId, gate] of Object.entries(manifest.gates ?? {})) {
+    for (const scope of gate.scopes ?? []) scopes.add(scope);
+    if (gateId.includes(":") && !gateId.startsWith("rate:")) scopes.add(gateId);
+  }
+  for (const flow of Object.values(manifest.flows ?? {})) {
+    for (const gate of flow.gates ?? []) {
+      if (gate.includes(":") && !gate.startsWith("rate:")) scopes.add(gate);
+    }
+  }
+  return [...scopes].sort();
+}
+
+/**
+ * Scopes for one ladder rung — owner is the full catalog; others intersect
+ * their profile. `member` stays on every signed-in rung.
+ *
+ * @param rung - 0 (owner) … 9 (guest)
+ * @param catalog - Manifest-derived scopes
+ */
+export function scopesForDevIdentityRung(rung: number, catalog: readonly string[]): string[] {
+  const profile = LADDER_SCOPE_PROFILES[rung];
+  if (profile === undefined) return [];
+  if (profile === "*") return [...catalog].sort((a, b) => a.localeCompare(b));
+  const allowed = new Set(catalog);
+  return [...new Set(profile.filter((scope) => scope === "member" || allowed.has(scope)))].sort(
+    (a, b) => a.localeCompare(b),
+  );
+}
+
+/**
+ * Default development identities for the invoke-as picker.
+ *
+ * @param manifest - Optional Manifest used to derive application scopes
+ */
+export function defaultDevIdentities(manifest?: Manifest | null): SeededDevIdentity[] {
+  const catalog = demoScopesFromManifest(manifest);
+  return DEV_IDENTITY_LADDER.map((person, rung) => ({
+    id: person.id,
+    email: person.email,
+    name: person.name,
+    status: "active",
+    scopes: scopesForDevIdentityRung(rung, catalog),
+  }));
+}
+
+/**
+ * Whether the live list is still the built-in ladder (safe to refresh).
+ *
+ * @param identities - Live identity list
+ */
+export function isDefaultIdentitySeed(identities: readonly { readonly id: string }[]): boolean {
+  if (identities.length !== DEV_IDENTITY_LADDER.length) return false;
+  const ids = new Set(identities.map((row) => row.id));
+  return DEV_IDENTITY_LADDER.every((person) => ids.has(person.id));
+}
+
+/**
+ * Signed-in ladder ids (guest excluded) — default `role_member` holders.
+ */
+export function defaultMemberIdentityIds(): string[] {
+  return DEV_IDENTITY_LADDER.filter((person) => person.role !== "guest").map((person) => person.id);
+}
+
+/**
+ * Replace the default ladder when a Manifest arrives.
+ *
+ * @param identities - Live identity list
+ * @param manifest - New Manifest
+ */
+export function refreshSeededIdentities(
+  identities: Array<{
+    id: string;
+    email: string;
+    name: string;
+    status: "active" | "disabled";
+    scopes: readonly string[];
+  }>,
+  manifest: Manifest | null,
+): void {
+  if (!isDefaultIdentitySeed(identities)) return;
+  const next = defaultDevIdentities(manifest);
+  identities.splice(0, identities.length, ...next);
+}
+
+/**
+ * Seed Access roles for Keel — every {@link KEEL_SCOPES} pair lands on the
+ * owner / admin rung; lower rungs use {@link KEEL_LADDER_GRANTS}.
+ *
+ * @param roles - Role store
+ * @param roleMembers - roleId → principal ids
+ */
+export function seedKeelAccessRoles(roles: RoleStore, roleMembers: Map<string, string[]>): void {
+  for (const person of DEV_IDENTITY_LADDER) {
+    const roleId = `role_${person.role}`;
+    upsertRole(roles, {
+      id: roleId,
+      name: person.role,
+      plane: "user",
+      description:
+        person.role === "owner"
+          ? "Full workspace authorization"
+          : person.role === "guest"
+            ? "Least authorization — no write scopes"
+            : `Keel ${person.role.replaceAll("_", " ")}`,
+    });
+    setRoleGrants(roles, roleId, KEEL_LADDER_GRANTS[person.role]);
+    roleMembers.set(roleId, person.role === "guest" ? [] : [person.id]);
+  }
+  roleMembers.set("role_member", defaultMemberIdentityIds());
+}

package/src/console/server/flows-invoke.test.ts

@@ -15,12 +15,29 @@ import { http } from "../../kernel/triggers.ts";
 import { field, store } from "../../elements/store.ts";
 import { PII_MASK } from "../../elements/store/classify.ts";
 import { createTestApp } from "../../test/create-test-app.ts";
+import type { Manifest } from "../../manifest/types.ts";
 import { FLOWS_TEST_MANIFEST } from "../ui-next/src/features/flows/fixture.ts";
 import { bindHostInvokeUserFlow } from "./invoke-user-flow.ts";
 import { startConsoleApp } from "./serve.ts";
 import { setManifest } from "./state.ts";
 import type { InvokeUserFlowInput } from "./invoke-user-flow.ts";
 
+/** Fixture plus the booking gate the host actually enforces. */
+const BOOKING_INVOKE_MANIFEST: Manifest = {
+  ...FLOWS_TEST_MANIFEST,
+  gates: {
+    member: { kind: "policy", scopes: ["member"] },
+    "booking:create": { kind: "policy", scopes: ["booking:create"] },
+  },
+  flows: {
+    ...FLOWS_TEST_MANIFEST.flows,
+    "bookings.create": {
+      ...FLOWS_TEST_MANIFEST.flows!["bookings.create"]!,
+      gates: ["member", "booking:create"],
+    },
+  },
+};
+
 const memoryDrivers = {
   store: { kv: { dev: "memory", test: "memory", prod: "memory" } },
   signal: { dev: "memory", test: "memory", prod: "memory" },
@@ -147,11 +164,11 @@ describe("console flows invoke", () => {
       secret: "test-secret-flows",
       silentClaim: true,
       production: false,
-      manifest: FLOWS_TEST_MANIFEST,
+      manifest: BOOKING_INVOKE_MANIFEST,
     });
     const host = await bootInvokeHost();
     try {
-      setManifest(handle.state, FLOWS_TEST_MANIFEST);
+      setManifest(handle.state, BOOKING_INVOKE_MANIFEST);
       handle.state.invokeUserFlow = bindHostInvokeUserFlow(host);
       const auth = await claimOperator(handle);
 
@@ -214,12 +231,12 @@ describe("console flows invoke", () => {
       secret: "test-secret-flows-adv",
       silentClaim: true,
       production: false,
-      manifest: FLOWS_TEST_MANIFEST,
+      manifest: BOOKING_INVOKE_MANIFEST,
     });
     const host = await bootInvokeHost();
     const seen: InvokeUserFlowInput[] = [];
     try {
-      setManifest(handle.state, FLOWS_TEST_MANIFEST);
+      setManifest(handle.state, BOOKING_INVOKE_MANIFEST);
       const bound = bindHostInvokeUserFlow(host);
       handle.state.invokeUserFlow = async (input) => {
         seen.push(input);