okengine 0.15.2 → 0.16.0

package/src/console/ui-next/src/features/access/lib/format-when.test.ts

@@ -0,0 +1,139 @@
+import { describe, expect, test } from "bun:test";
+import {
+  accessExpiresAt,
+  accessExpiryFromAt,
+  accessRefreshExpiry,
+  formatAccessDuration,
+  formatAccessExpiry,
+  formatAccessRateLimit,
+  formatAccessWhen,
+  classifyAccessAllowEntry,
+  parseAccessAllowlist,
+  parseAccessDurationMs,
+  parseAccessRateLimit,
+  parseAccessRateParts,
+  splitAccessRatePer,
+} from "./format-when.ts";
+
+const NOW = Date.parse("2026-08-21T17:42:00.000Z");
+
+describe("formatAccessWhen", () => {
+  test("null is never", () => {
+    expect(formatAccessWhen(null, NOW)).toBe("never");
+  });
+
+  test("sub-minute is just now", () => {
+    expect(formatAccessWhen(NOW - 12_000, NOW)).toBe("just now");
+    expect(formatAccessWhen(NOW + 12_000, NOW)).toBe("just now");
+  });
+
+  test("past ages", () => {
+    expect(formatAccessWhen(NOW - 5 * 60_000, NOW)).toBe("5m ago");
+    expect(formatAccessWhen(NOW - 3 * 3_600_000, NOW)).toBe("3h ago");
+    expect(formatAccessWhen(NOW - 2 * 86_400_000, NOW)).toBe("2d ago");
+  });
+
+  test("future remaining", () => {
+    expect(formatAccessWhen(NOW + 30 * 86_400_000, NOW)).toBe("in 30d");
+    expect(formatAccessWhen(NOW + 90 * 86_400_000, NOW)).toBe("in 90d");
+  });
+});
+
+describe("formatAccessExpiry", () => {
+  test("null is never", () => {
+    expect(formatAccessExpiry(null, NOW)).toBe("never");
+  });
+
+  test("past is expired, not an age", () => {
+    expect(formatAccessExpiry(NOW - 5 * 60_000, NOW)).toBe("expired");
+  });
+
+  test("future is remaining", () => {
+    expect(formatAccessExpiry(NOW + 89 * 86_400_000, NOW)).toBe("in 89d");
+  });
+});
+
+describe("accessExpiresAt", () => {
+  test("presets", () => {
+    expect(accessExpiresAt("never", NOW)).toBeNull();
+    expect(accessExpiresAt("30d", NOW)).toBe(NOW + 30 * 86_400_000);
+    expect(accessExpiresAt("90d", NOW)).toBe(NOW + 90 * 86_400_000);
+  });
+
+  test("custom duration", () => {
+    expect(accessExpiresAt("custom", NOW, "7d")).toBe(NOW + 7 * 86_400_000);
+    expect(accessExpiresAt("custom", NOW, "12h")).toBe(NOW + 12 * 3_600_000);
+    expect(accessExpiresAt("custom", NOW, "nope")).toBeNull();
+  });
+});
+
+describe("parseAccessDurationMs", () => {
+  test("clock grammar", () => {
+    expect(parseAccessDurationMs("7d")).toBe(7 * 86_400_000);
+    expect(parseAccessDurationMs("30m")).toBe(30 * 60_000);
+    expect(parseAccessDurationMs("")).toBe(0);
+    expect(parseAccessDurationMs("90")).toBe(0);
+  });
+});
+
+describe("accessExpiryFromAt", () => {
+  test("reconstructs presets and custom remainder", () => {
+    expect(accessExpiryFromAt(null, NOW)).toEqual({ choice: "never", custom: "" });
+    expect(accessExpiryFromAt(NOW + 30 * 86_400_000, NOW)).toEqual({ choice: "30d", custom: "" });
+    expect(accessExpiryFromAt(NOW + 7 * 86_400_000, NOW)).toEqual({
+      choice: "custom",
+      custom: "7d",
+    });
+  });
+});
+
+describe("accessRefreshExpiry", () => {
+  test("never and expired default to 90d", () => {
+    expect(accessRefreshExpiry(null, NOW)).toEqual({ choice: "90d", custom: "" });
+    expect(accessRefreshExpiry(NOW - 1, NOW)).toEqual({ choice: "90d", custom: "" });
+  });
+
+  test("snaps remaining life so 89d renews as 90d", () => {
+    expect(accessRefreshExpiry(NOW + 89 * 86_400_000, NOW)).toEqual({
+      choice: "90d",
+      custom: "",
+    });
+    expect(accessRefreshExpiry(NOW + 23 * 86_400_000, NOW)).toEqual({
+      choice: "30d",
+      custom: "",
+    });
+  });
+
+  test("keeps custom windows that are not near a preset", () => {
+    expect(accessRefreshExpiry(NOW + 7 * 86_400_000, NOW)).toEqual({
+      choice: "custom",
+      custom: "7d",
+    });
+  });
+});
+
+describe("rate and allowlist", () => {
+  test("parse and format", () => {
+    expect(parseAccessRateLimit("")).toBeNull();
+    expect(parseAccessRateLimit("60 / 1m")).toEqual({ max: 60, per: "1m" });
+    expect(parseAccessRateLimit("nope")).toBeUndefined();
+    expect(formatAccessRateLimit({ max: 60, per: "1m" })).toBe("60 / 1m");
+    expect(parseAccessAllowlist("203.0.113.4, 198.51.100.7")).toEqual([
+      "203.0.113.4",
+      "198.51.100.7",
+    ]);
+    expect(parseAccessAllowlist("https://ci.example.com/")).toEqual(["ci.example.com"]);
+    expect(parseAccessAllowlist("google.com, sdfghjfdsd, not a host")).toEqual(["google.com"]);
+    expect(parseAccessAllowlist("localhost")).toEqual(["localhost"]);
+    expect(parseAccessAllowlist("[::1]")).toEqual(["::1"]);
+    expect(classifyAccessAllowEntry("203.0.113.4")).toBe("ip");
+    expect(classifyAccessAllowEntry("ci.example.com")).toBe("host");
+    expect(classifyAccessAllowEntry("sdfghjfdsd")).toBeNull();
+    expect(formatAccessDuration(12 * 3_600_000)).toBe("12h");
+    expect(parseAccessRateParts("", "", "m")).toBeNull();
+    expect(parseAccessRateParts("90", "", "m")).toBeUndefined();
+    expect(parseAccessRateParts("90", "1", "m")).toEqual({ max: 90, per: "1m" });
+    expect(splitAccessRatePer("90s")).toEqual({ count: "90", unit: "s" });
+    expect(splitAccessRatePer("")).toEqual({ count: "", unit: "m" });
+  });
+});

package/src/console/ui-next/src/features/access/lib/format-when.ts

@@ -0,0 +1,296 @@
+/**
+ * Relative timestamps for Access keys (create / last used / expiry).
+ */
+
+/**
+ * Age or remaining time of an Access timestamp, or `never` when null.
+ *
+ * Past → `5m ago`. Future → `in 30d`. Sub-minute → `just now`.
+ *
+ * @param at - Epoch ms, or null
+ * @param now - Clock
+ */
+export function formatAccessWhen(at: number | null, now: number): string {
+  if (at == null) return "never";
+  const delta = at - now;
+  if (Math.abs(delta) < 60_000) return "just now";
+  const abs = Math.abs(delta);
+  const unit = unitLabel(abs);
+  return delta < 0 ? `${unit} ago` : `in ${unit}`;
+}
+
+/**
+ * Remaining life of an expiry, or `expired` once the clock passes it.
+ *
+ * @param at - Epoch ms, or null
+ * @param now - Clock
+ */
+export function formatAccessExpiry(at: number | null, now: number): string {
+  if (at == null) return "never";
+  if (at <= now) return "expired";
+  return formatAccessWhen(at, now);
+}
+
+function unitLabel(abs: number): string {
+  if (abs < 3_600_000) return `${Math.floor(abs / 60_000)}m`;
+  if (abs < 86_400_000) return `${Math.floor(abs / 3_600_000)}h`;
+  const days = Math.floor(abs / 86_400_000);
+  if (days < 100) return `${days}d`;
+  return `${Math.floor(days / 30)}mo`;
+}
+
+const DAY_MS = 86_400_000;
+
+/** Expiry presets on the create sheet. */
+export type AccessExpiryChoice = "never" | "30d" | "90d" | "custom";
+
+/**
+ * Parse a Clock duration (`7d`, `12h`, `30m`). Returns `0` when invalid.
+ *
+ * @param raw - Duration string
+ */
+export function parseAccessDurationMs(raw: string): number {
+  const match = /^(\d+)(ms|s|m|h|d)$/.exec(raw.trim());
+  if (!match) return 0;
+  const n = Number(match[1]);
+  switch (match[2]) {
+    case "ms":
+      return n;
+    case "s":
+      return n * 1000;
+    case "m":
+      return n * 60_000;
+    case "h":
+      return n * 3_600_000;
+    case "d":
+      return n * DAY_MS;
+    default:
+      return 0;
+  }
+}
+
+/**
+ * Epoch ms for a create-sheet expiry choice.
+ *
+ * @param choice - Preset or custom
+ * @param now - Clock
+ * @param custom - Duration when {@link AccessExpiryChoice} is `custom`
+ */
+export function accessExpiresAt(
+  choice: AccessExpiryChoice,
+  now: number,
+  custom = "",
+): number | null {
+  if (choice === "never") return null;
+  if (choice === "30d") return now + 30 * DAY_MS;
+  if (choice === "90d") return now + 90 * DAY_MS;
+  const ms = parseAccessDurationMs(custom);
+  return ms > 0 ? now + ms : null;
+}
+
+const HOUR_MS = 3_600_000;
+
+/**
+ * Reconstruct an expiry choice from a stored timestamp.
+ *
+ * @param expiresAt - Epoch ms, or null
+ * @param now - Clock
+ */
+export function accessExpiryFromAt(
+  expiresAt: number | null,
+  now: number,
+): { readonly choice: AccessExpiryChoice; readonly custom: string } {
+  if (expiresAt == null) return { choice: "never", custom: "" };
+  const remaining = expiresAt - now;
+  if (remaining <= 0) return { choice: "never", custom: "" };
+  if (Math.abs(remaining - 30 * DAY_MS) < HOUR_MS) return { choice: "30d", custom: "" };
+  if (Math.abs(remaining - 90 * DAY_MS) < HOUR_MS) return { choice: "90d", custom: "" };
+  return { choice: "custom", custom: formatAccessDuration(remaining) };
+}
+
+/** Snap remaining life to 30d / 90d so weekly refresh does not shrink the window. */
+const REFRESH_SNAP_MS = 7 * DAY_MS;
+
+/**
+ * Seed a Refresh sheet: snap remaining life to 30d / 90d. Expired or never
+ * defaults to 90d. The secret is unchanged — only `expiresAt` moves.
+ *
+ * @param expiresAt - Epoch ms, or null
+ * @param now - Clock
+ */
+export function accessRefreshExpiry(
+  expiresAt: number | null,
+  now: number,
+): { readonly choice: AccessExpiryChoice; readonly custom: string } {
+  if (expiresAt == null || expiresAt <= now) return { choice: "90d", custom: "" };
+  const remaining = expiresAt - now;
+  if (Math.abs(remaining - 30 * DAY_MS) <= REFRESH_SNAP_MS) return { choice: "30d", custom: "" };
+  if (Math.abs(remaining - 90 * DAY_MS) <= REFRESH_SNAP_MS) return { choice: "90d", custom: "" };
+  return { choice: "custom", custom: formatAccessDuration(remaining) };
+}
+
+/**
+ * Clock duration for a remaining span (`7d` · `12h` · `30m`).
+ *
+ * @param ms - Remaining milliseconds
+ */
+export function formatAccessDuration(ms: number): string {
+  if (ms <= 0) return "";
+  if (ms >= DAY_MS && ms % DAY_MS === 0) return `${ms / DAY_MS}d`;
+  if (ms >= HOUR_MS && ms % HOUR_MS === 0) return `${ms / HOUR_MS}h`;
+  if (ms >= 60_000 && ms % 60_000 === 0) return `${ms / 60_000}m`;
+  if (ms >= DAY_MS) return `${Math.max(1, Math.round(ms / DAY_MS))}d`;
+  if (ms >= HOUR_MS) return `${Math.max(1, Math.round(ms / HOUR_MS))}h`;
+  return `${Math.max(1, Math.round(ms / 60_000))}m`;
+}
+
+/**
+ * Parse `60 / 1m`. Empty is no limit.
+ *
+ * @param raw - Inspector-style rate
+ */
+export function parseAccessRateLimit(raw: string): { max: number; per: string } | null | undefined {
+  const t = raw.trim();
+  if (t.length === 0) return null;
+  const match = /^(\d+)\s*\/\s*(\d+(?:ms|s|m|h|d))$/.exec(t);
+  if (!match) return undefined;
+  return { max: Number(match[1]), per: match[2]! };
+}
+
+/**
+ * Format a stored rate for the edit field.
+ *
+ * @param rate - Stored limit
+ */
+export function formatAccessRateLimit(rate: { max: number; per: string } | null): string {
+  return rate ? `${rate.max} / ${rate.per}` : "";
+}
+
+/** Clock units for the rate window. */
+export const ACCESS_RATE_UNITS = ["s", "m", "h", "d", "ms"] as const;
+
+/** One {@link ACCESS_RATE_UNITS} token. */
+export type AccessRateUnit = (typeof ACCESS_RATE_UNITS)[number];
+
+/** Default window unit — minutes. */
+export const DEFAULT_ACCESS_RATE_UNIT: AccessRateUnit = "m";
+
+/** Hover labels for {@link ACCESS_RATE_UNITS}. */
+export const ACCESS_RATE_UNIT_LABELS: Readonly<Record<AccessRateUnit, string>> = {
+  s: "Seconds",
+  m: "Minutes",
+  h: "Hours",
+  d: "Days",
+  ms: "Milliseconds",
+};
+
+/**
+ * Parse max + window + unit. Both count fields empty is none.
+ *
+ * @param maxRaw - Hit count
+ * @param countRaw - Window count
+ * @param unit - Window unit
+ */
+export function parseAccessRateParts(
+  maxRaw: string,
+  countRaw: string,
+  unit: AccessRateUnit,
+): { max: number; per: string } | null | undefined {
+  const maxT = maxRaw.trim();
+  const countT = countRaw.trim();
+  if (maxT.length === 0 && countT.length === 0) return null;
+  if (maxT.length === 0 || countT.length === 0) return undefined;
+  if (!/^\d+$/.test(maxT) || !/^\d+$/.test(countT)) return undefined;
+  const max = Number(maxT);
+  const count = Number(countT);
+  if (max <= 0 || count <= 0) return undefined;
+  const per = `${count}${unit}`;
+  if (parseAccessDurationMs(per) <= 0) return undefined;
+  return { max, per };
+}
+
+/**
+ * Split a stored `1m` window into count + unit.
+ *
+ * @param per - Stored window
+ */
+export function splitAccessRatePer(per: string): {
+  readonly count: string;
+  readonly unit: AccessRateUnit;
+} {
+  const match = /^(\d+)(ms|s|m|h|d)$/.exec(per.trim());
+  if (!match) return { count: "", unit: DEFAULT_ACCESS_RATE_UNIT };
+  return { count: match[1]!, unit: match[2] as AccessRateUnit };
+}
+
+/** Kind of a valid allow entry. */
+export type AccessAllowKind = "ip" | "host";
+
+/**
+ * Classify a stored or draft allow entry. `null` is junk.
+ *
+ * @param raw - IP, hostname, or URL
+ */
+export function classifyAccessAllowEntry(raw: string): AccessAllowKind | null {
+  const part = normalizeAllowlistPart(raw);
+  if (part.length === 0) return null;
+  if (isAllowIp(part)) return "ip";
+  if (isAllowHost(part)) return "host";
+  return null;
+}
+
+/**
+ * Split an allowlist field on commas or whitespace. Drops invalid parts.
+ *
+ * @param raw - Field value
+ */
+export function parseAccessAllowlist(raw: string): readonly string[] {
+  const seen = new Set<string>();
+  const next: string[] = [];
+  for (const chunk of raw.split(/[\s,]+/)) {
+    const part = normalizeAllowlistPart(chunk);
+    if (part.length === 0 || seen.has(part)) continue;
+    if (classifyAccessAllowEntry(part) == null) continue;
+    seen.add(part);
+    next.push(part);
+  }
+  return next;
+}
+
+function normalizeAllowlistPart(raw: string): string {
+  let part = raw.trim().toLowerCase();
+  part = part.replace(/^https?:\/\//, "");
+  if (part.startsWith("[") && part.includes("]")) {
+    const end = part.indexOf("]");
+    const inner = part.slice(1, end);
+    const rest = part.slice(end + 1);
+    part = rest.startsWith(":") || rest.startsWith("/") ? inner : `${inner}${rest}`;
+  }
+  const slash = part.indexOf("/");
+  if (slash >= 0) part = part.slice(0, slash);
+  if (part.endsWith(".")) part = part.slice(0, -1);
+  return part;
+}
+
+function isAllowIp(entry: string): boolean {
+  if (/^\d{1,3}(?:\.\d{1,3}){3}$/.test(entry)) {
+    return entry.split(".").every((octet) => Number(octet) <= 255);
+  }
+  if (!entry.includes(":")) return false;
+  if (!/^[0-9a-f:]+$/.test(entry)) return false;
+  if (entry.split("::").length > 2) return false;
+  return entry.split(":").filter((part) => part.length > 0).length >= 1;
+}
+
+function isAllowHost(entry: string): boolean {
+  if (entry === "localhost") return true;
+  if (entry.length > 253 || entry.includes(":")) return false;
+  const labels = entry.split(".");
+  if (labels.length < 2) return false;
+  return labels.every((label, index) => {
+    if (label.length === 0 || label.length > 63) return false;
+    if (!/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(label)) return false;
+    if (index === labels.length - 1 && !/^[a-z]{2,63}$/.test(label)) return false;
+    return true;
+  });
+}

package/src/console/ui-next/src/features/access/lib/scope-groups.test.ts

@@ -0,0 +1,34 @@
+import { describe, expect, test } from "bun:test";
+import { groupAccessScopes } from "./scope-groups.ts";
+
+describe("groupAccessScopes", () => {
+  test("groups Module:Action by the first segment", () => {
+    expect(
+      groupAccessScopes([
+        "booking:create",
+        "comment:write",
+        "member",
+        "member:admin",
+        "console:flows:invoke-as",
+      ]),
+    ).toEqual([
+      { group: "booking", items: [{ scope: "booking:create", action: "create" }] },
+      { group: "comment", items: [{ scope: "comment:write", action: "write" }] },
+      {
+        group: "member",
+        items: [
+          { scope: "member", action: "member" },
+          { scope: "member:admin", action: "admin" },
+        ],
+      },
+      {
+        group: "console",
+        items: [{ scope: "console:flows:invoke-as", action: "flows:invoke-as" }],
+      },
+    ]);
+  });
+
+  test("empty catalog", () => {
+    expect(groupAccessScopes([])).toEqual([]);
+  });
+});

package/src/console/ui-next/src/features/access/lib/scope-groups.ts

@@ -0,0 +1,40 @@
+/**
+ * Group Access scopes by Module:Action prefix.
+ */
+
+/** One Module:Action (or bare) scope inside a group. */
+export interface AccessScopeItem {
+  readonly scope: string;
+  readonly action: string;
+}
+
+/** Scopes that share a module prefix. */
+export interface AccessScopeGroup {
+  readonly group: string;
+  readonly items: readonly AccessScopeItem[];
+}
+
+/**
+ * Preserve catalog order; same-prefix scopes share a band.
+ * `member` and `member:admin` land under `member`. Nested colons
+ * (`console:flows:invoke-as`) stay under the first segment.
+ *
+ * @param scopes - Grantable or current scopes
+ */
+export function groupAccessScopes(scopes: readonly string[]): readonly AccessScopeGroup[] {
+  const order: string[] = [];
+  const map = new Map<string, AccessScopeItem[]>();
+  for (const scope of scopes) {
+    const i = scope.indexOf(":");
+    const group = i <= 0 ? scope : scope.slice(0, i);
+    const action = i <= 0 ? scope : scope.slice(i + 1);
+    const existing = map.get(group);
+    if (existing) {
+      existing.push({ scope, action });
+      continue;
+    }
+    order.push(group);
+    map.set(group, [{ scope, action }]);
+  }
+  return order.map((group) => ({ group, items: map.get(group) ?? [] }));
+}