portal-mojo 0.2.1 → 0.2.2

package/docs/admin-credentials.md

@@ -67,10 +67,14 @@ All ordinary API-key lists force `graph=default`, discard URL/persisted
 `graph` and unsupported search params before creating a query key, and scrub
 token fields from every list/detail/save result before any cache write.
 
-Create sends only permission controls whose value is `true`. Edit compares only
-controls that were actually rendered and sends a partial permission dictionary;
-unknown or protected grants are therefore preserved, while a visible changed
-grant may send `false` to revoke it.
+The guided forms include `send_sms` and the broader `comms` permission. Create
+and edit also expose **Additional permission names** as freeform tags, so a
+new backend permission does not require a portal release before a key can use
+it. Create sends only true guided controls and named tags. Edit diffs only
+controls that were actually rendered, adds newly named tags, and sends `false`
+for removed custom tags. Hidden protected grants are preserved unless an
+operator deliberately enters their name; django-mojo remains authoritative
+for every grant and revocation.
 
 The permission catalog is live and injectable:
 
@@ -89,6 +93,11 @@ Registration replaces the same permission name and appends new names. Mounted
 editors subscribe to changes. `grantPermissions` gates the control itself; the
 backend remains authoritative on every save.
 
+`normalizeApiKeyPermissionNames()` trims and deduplicates TagInput CSV (or an
+array) and rejects the reserved `__replace` JSON update signal.
+`buildApiKeyPermissionChanges()` constructs the narrow merge patch used by the
+edit form without resending unchanged custom grants.
+
 ### Rate-limit overrides
 
 Group API keys expose the raw django-mojo JSONField shape without normalizing

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "portal-mojo",
-    "version": "0.2.1",
+    "version": "0.2.2",
     "description": "React portal toolkit for django-mojo — typed client + params store, mission-control UI, dependency-free SVG charts, admin section bundles.",
     "type": "module",
     "license": "Apache-2.0",

package/src/admin/credentials/group-api-keys.tsx

@@ -11,10 +11,11 @@ import {
 } from '../../ui';
 import {
     GLOBAL_CREDENTIAL_PERMS, GROUP_CREDENTIAL_PERMS,
-    GroupApiKeyModel, fetchApiKeyToken,
+    GroupApiKeyModel, buildApiKeyPermissionChanges, customApiKeyPermissionNames,
+    fetchApiKeyToken,
     getGroupApiKeyPermissions, grantedPermissions,
     groupApiKeyPermissionsVersion, subscribeGroupApiKeyPermissions,
-    readApiKeyRateLimits, useCreateGroupApiKey,
+    normalizeApiKeyPermissionNames, readApiKeyRateLimits, useCreateGroupApiKey,
     type ApiKeyPermissionDef, type CredentialGroup, type GroupApiKeyRow,
 } from './models';
 import { ApiKeyLimitsSummary, ApiKeyRateLimitsEditor } from './api-key-rate-limits';
@@ -60,6 +61,14 @@ function permissionSeed(
     ]));
 }
 
+const CUSTOM_PERMISSION_FIELD: Field = {
+    name: 'custom_permissions',
+    type: 'tags',
+    label: 'Additional permission names',
+    placeholder: 'Type a permission and press Enter',
+    help: 'Add permission strings that are not listed above. Remove a tag to revoke it when editing; the server authorizes every change.',
+};
+
 function TokenFooter({ permissions }: { permissions: string[] }) {
     return (
         <div className="ga-secret-footnote">
@@ -106,6 +115,7 @@ function useGroupApiKeyActions(permission: PermSpec) {
                             placeholder: 'Search groups…',
                         } satisfies Field] : []),
                         ...permissionFields(renderedPermissions),
+                        CUSTOM_PERMISSION_FIELD,
                     ]}
                     submitText="Create key"
                     onCancel={() => close(null)}
@@ -116,8 +126,16 @@ function useGroupApiKeyActions(permission: PermSpec) {
         if (!result) return;
 
         const permissions: Record<string, true> = {};
-        for (const def of renderedPermissions) {
-            if (result[`permissions.${def.name}`] === true) permissions[def.name] = true;
+        try {
+            for (const def of renderedPermissions) {
+                if (result[`permissions.${def.name}`] === true) permissions[def.name] = true;
+            }
+            for (const name of normalizeApiKeyPermissionNames(result.custom_permissions)) {
+                permissions[name] = true;
+            }
+        } catch (error) {
+            toast.error(error instanceof Error ? error.message : 'Invalid permission name');
+            return;
         }
         const group = fixedGroup?.id ?? Number(result.group);
         if (!Number.isFinite(group) || group <= 0) {
@@ -162,8 +180,14 @@ function useGroupApiKeyActions(permission: PermSpec) {
                         { name: 'name', type: 'text', label: 'Name', required: true, columns: 6 },
                         { name: 'is_active', type: 'switch', label: 'Active', columns: 6 },
                         ...renderedFields,
+                        CUSTOM_PERMISSION_FIELD,
                     ]}
-                    initial={{ name: row.name, is_active: row.is_active, ...before }}
+                    initial={{
+                        name: row.name,
+                        is_active: row.is_active,
+                        ...before,
+                        custom_permissions: customApiKeyPermissionNames(row.permissions).join(','),
+                    }}
                     submitText="Save changes"
                     onCancel={() => close(null)}
                     onSubmit={(form) => close(form)}
@@ -178,14 +202,20 @@ function useGroupApiKeyActions(permission: PermSpec) {
         const nextActive = result.is_active === true;
         if (nextActive !== row.is_active) changes.is_active = nextActive;
 
-        // Diff only controls that were actually rendered. Unknown and
-        // protected grants remain absent from the partial JSONField update.
-        const permissionChanges: Record<string, boolean> = {};
-        for (const def of renderedPermissions) {
-            const key = `permissions.${def.name}`;
-            const was = before[key] === true;
-            const now = result[key] === true;
-            if (was !== now) permissionChanges[def.name] = now;
+        // Diff only guided controls that were actually rendered, plus the
+        // explicit freeform set. Protected hidden grants remain absent unless
+        // the operator deliberately types one (the server is authoritative).
+        let permissionChanges: Record<string, boolean>;
+        try {
+            permissionChanges = buildApiKeyPermissionChanges(
+                row.permissions,
+                renderedPermissions,
+                result,
+                result.custom_permissions,
+            );
+        } catch (error) {
+            toast.error(error instanceof Error ? error.message : 'Invalid permission name');
+            return;
         }
         if (Object.keys(permissionChanges).length) changes.permissions = permissionChanges;
         if (!Object.keys(changes).length) return;
@@ -378,7 +408,9 @@ function AuthorizedGroupApiKeyDetail({ id, onClose }: { id: number; onClose: ()
                                     ? permissions.map((permission) => <Badge key={permission} tone="info">{permission}</Badge>)
                                     : <span className="dim-italic">No permissions granted</span>}
                             </div>
-                            <p className="dim">Only controls visible to the operator are diffed when editing; unknown grants are preserved.</p>
+                            <p className="dim">
+                                Use Edit to add or remove arbitrary permission names. Hidden protected controls are never changed implicitly.
+                            </p>
                         </>
                     ),
                 },

package/src/admin/credentials/models.ts

@@ -329,6 +329,16 @@ registerGroupApiKeyPermissions([
     { name: 'view_members', label: 'View Members' },
     { name: 'manage_members', label: 'Manage Members' },
     { name: 'view_billing', label: 'View Billing' },
+    {
+        name: 'send_sms',
+        label: 'Send SMS',
+        tooltip: 'Send outbound SMS messages for this key\'s group.',
+    },
+    {
+        name: 'comms',
+        label: 'Communications',
+        tooltip: 'Broad communications access, including SMS. Prefer Send SMS when that is all the integration needs.',
+    },
     {
         name: 'geoip_sync',
         label: 'GeoIP Federation Sync',
@@ -344,6 +354,60 @@ export function grantedPermissions(dict: Record<string, unknown> | null | undefi
         .map(([name]) => name);
 }
 
+/** TagInput CSV or array to unique permission names. */
+export function normalizeApiKeyPermissionNames(raw: unknown): string[] {
+    const values = Array.isArray(raw) ? raw : typeof raw === 'string' ? raw.split(',') : [];
+    const names: string[] = [];
+    for (const value of values) {
+        let name = String(value ?? '').trim();
+        if (name.startsWith('permissions.')) name = name.slice('permissions.'.length).trim();
+        if (!name) continue;
+        if (name === '__replace') {
+            throw new Error('Permission "__replace" is reserved and cannot be granted.');
+        }
+        if (!names.includes(name)) names.push(name);
+    }
+    return names;
+}
+
+/** Truthy stored grants that have no registered guided control. */
+export function customApiKeyPermissionNames(
+    dict: Record<string, unknown> | null | undefined,
+): string[] {
+    const registered = new Set(getGroupApiKeyPermissions().map((permission) => permission.name));
+    return grantedPermissions(dict).filter((name) => !registered.has(name)).sort();
+}
+
+/**
+ * Build a merge-safe permissions patch from rendered switches and freeform
+ * tags. Only rendered switches are diffed, so protected controls hidden from
+ * this operator remain untouched. Missing previously-custom tags are revoked.
+ */
+export function buildApiKeyPermissionChanges(
+    current: Record<string, unknown> | null | undefined,
+    rendered: ApiKeyPermissionDef[],
+    form: Record<string, unknown>,
+    customRaw: unknown,
+): Record<string, boolean> {
+    const currentGranted = new Set(grantedPermissions(current));
+    const changes: Record<string, boolean> = {};
+
+    for (const permission of rendered) {
+        const next = form[`permissions.${permission.name}`] === true;
+        if (currentGranted.has(permission.name) !== next) changes[permission.name] = next;
+    }
+
+    const beforeCustom = new Set(customApiKeyPermissionNames(current));
+    const afterCustom = normalizeApiKeyPermissionNames(customRaw);
+    for (const name of afterCustom) {
+        if (!currentGranted.has(name)) changes[name] = true;
+    }
+    for (const name of beforeCustom) {
+        if (!afterCustom.includes(name)) changes[name] = false;
+    }
+    return changes;
+}
+
 export interface WebhookSubscriptionRow {
     id: number;
     created: number;