Compare commits
No commits in common. "5b23410549b5718638fd5333b135f09b05d58a0d" and "ec021d1a954cacdbf42d9fe17dc6a7c7fb4c7b7f" have entirely different histories.
5b23410549
...
ec021d1a95
|
|
@ -6,5 +6,4 @@ NODEDC_PLATFORM_ENV=../../NODEDC/platform/infra/.env
|
|||
PORT=5173
|
||||
LAUNCHER_BASE_URL=http://launcher.local.nodedc
|
||||
TASK_BASE_URL=http://task.local.nodedc
|
||||
NODEDC_BIM_VIEWER_PUBLIC_URL=http://localhost:8080
|
||||
NODEDC_INTERNAL_ACCESS_TOKEN=change-me-generate-with-platform-init-dev-env
|
||||
|
|
|
|||
|
|
@ -27,7 +27,6 @@ const clientTypes = new Set(["company", "person"]);
|
|||
const clientStatuses = new Set(["active", "suspended", "demo", "expired"]);
|
||||
const userStatuses = new Set(["invited", "active", "blocked"]);
|
||||
const membershipRoles = new Set(["client_owner", "client_admin", "member"]);
|
||||
const coreAssistantRoles = new Set(["blocked", "member", "admin"]);
|
||||
const grantTargetTypes = new Set(["client", "group", "user"]);
|
||||
const appRoles = new Set(["viewer", "member", "admin", "owner"]);
|
||||
const grantStatuses = new Set(["active", "disabled"]);
|
||||
|
|
@ -63,50 +62,6 @@ const publicPoolClient = {
|
|||
createdAt: "2026-05-09T00:00:00.000Z",
|
||||
updatedAt: "2026-05-09T00:00:00.000Z",
|
||||
};
|
||||
const bimViewerService = {
|
||||
id: "service_bim_viewer",
|
||||
slug: "bim-viewer",
|
||||
title: "BIM VIEWER",
|
||||
subtitle: "BIM и CAD просмотр",
|
||||
description: "Персональный просмотр BIM/CAD моделей, версий и публичных ссылок.",
|
||||
fullDescription:
|
||||
"Standalone BIM/CAD viewer NODE.DC для рабочих моделей, вложений Operational Core, персонального модельного хранилища и безопасного внешнего просмотра по share-ссылкам.",
|
||||
url: "https://bim.nodedc.tech",
|
||||
launchUrl: "https://bim.nodedc.tech",
|
||||
logoutUrl: "https://bim.nodedc.tech/logout",
|
||||
loginSyncUrl: "https://bim.nodedc.tech/auth/login-sync",
|
||||
accentColor: "#8FE3C8",
|
||||
fallbackGradient: "linear-gradient(132deg, rgba(143, 227, 200, 0.78), rgba(24, 70, 64, 0.9) 46%, #080B0F 84%)",
|
||||
status: "active",
|
||||
order: 25,
|
||||
authentikApplicationSlug: "bim-viewer",
|
||||
authentikGroupName: "nodedc:bim:access",
|
||||
isAvailableForAllNewClients: true,
|
||||
createdAt: "2026-06-18T00:00:00.000Z",
|
||||
updatedAt: "2026-06-18T00:00:00.000Z",
|
||||
};
|
||||
const bimViewerDefaultGrants = [
|
||||
{
|
||||
id: "grant_bim_viewer_client_romashka",
|
||||
serviceId: "service_bim_viewer",
|
||||
targetType: "client",
|
||||
targetId: "client_romashka",
|
||||
appRole: "member",
|
||||
status: "active",
|
||||
createdAt: "2026-06-18T00:00:00.000Z",
|
||||
updatedAt: "2026-06-18T00:00:00.000Z",
|
||||
},
|
||||
{
|
||||
id: "grant_bim_viewer_client_public_pool",
|
||||
serviceId: "service_bim_viewer",
|
||||
targetType: "client",
|
||||
targetId: publicPoolClientId,
|
||||
appRole: "member",
|
||||
status: "active",
|
||||
createdAt: "2026-06-18T00:00:00.000Z",
|
||||
updatedAt: "2026-06-18T00:00:00.000Z",
|
||||
},
|
||||
];
|
||||
const defaultSettings = {
|
||||
brand: {
|
||||
logoLinkUrl: "/",
|
||||
|
|
@ -523,7 +478,6 @@ export function createControlPlaneStore({ projectRoot }) {
|
|||
userId: user.id,
|
||||
role: pickEnum(payload?.role, membershipRoles, "member"),
|
||||
status: pickEnum(payload?.membershipStatus, new Set(["active", "disabled"]), "active"),
|
||||
coreAssistantRole: pickEnum(payload?.coreAssistantRole, coreAssistantRoles, "member"),
|
||||
invitedByUserId: actor.id,
|
||||
inviteId: null,
|
||||
source: "launcher",
|
||||
|
|
@ -576,11 +530,9 @@ export function createControlPlaneStore({ projectRoot }) {
|
|||
|
||||
membership.role = "client_owner";
|
||||
membership.status = "active";
|
||||
membership.coreAssistantRole = "admin";
|
||||
} else {
|
||||
membership.role = pickEnum(payload?.role, membershipRoles, membership.role);
|
||||
membership.status = pickEnum(payload?.status, new Set(["active", "disabled"]), membership.status);
|
||||
membership.coreAssistantRole = pickEnum(payload?.coreAssistantRole, coreAssistantRoles, membership.coreAssistantRole ?? "member");
|
||||
}
|
||||
membership.updatedAt = isoNow();
|
||||
|
||||
|
|
@ -590,7 +542,7 @@ export function createControlPlaneStore({ projectRoot }) {
|
|||
objectName: user.email,
|
||||
clientId: membership.clientId,
|
||||
result: "success",
|
||||
details: `Role: ${membership.role}; status: ${membership.status}; coreAssistantRole: ${membership.coreAssistantRole}`,
|
||||
details: `Role: ${membership.role}; status: ${membership.status}`,
|
||||
});
|
||||
markPendingSync(data, user, "user");
|
||||
|
||||
|
|
@ -1601,7 +1553,6 @@ export function createControlPlaneStore({ projectRoot }) {
|
|||
if (membership) {
|
||||
membership.role = invite.role;
|
||||
membership.status = "active";
|
||||
membership.coreAssistantRole = normalizeCoreAssistantRole(membership.coreAssistantRole);
|
||||
membership.invitedByUserId = invite.invitedByUserId ?? membership.invitedByUserId ?? null;
|
||||
membership.inviteId = invite.id;
|
||||
membership.source = invite.source ?? membership.source ?? "launcher";
|
||||
|
|
@ -1614,7 +1565,6 @@ export function createControlPlaneStore({ projectRoot }) {
|
|||
userId: user.id,
|
||||
role: invite.role,
|
||||
status: "active",
|
||||
coreAssistantRole: "member",
|
||||
invitedByUserId: invite.invitedByUserId ?? null,
|
||||
inviteId: invite.id,
|
||||
source: invite.source ?? "launcher",
|
||||
|
|
@ -2324,7 +2274,6 @@ function normalizeData(payload) {
|
|||
...client,
|
||||
integrations: normalizeClientIntegrations(client.integrations),
|
||||
}));
|
||||
data.memberships = data.memberships.map(normalizeMembership).filter(Boolean);
|
||||
data.services = data.services.map(normalizeService);
|
||||
data.accessRequests = data.accessRequests.map(normalizeAccessRequest).filter(Boolean);
|
||||
data.revokedAccounts = data.revokedAccounts.map(normalizeRevokedAccount).filter(Boolean);
|
||||
|
|
@ -2332,90 +2281,9 @@ function normalizeData(payload) {
|
|||
data.taskerInviteRequests = data.taskerInviteRequests.map(normalizeTaskerInviteRequest).filter(Boolean);
|
||||
data.engineWorkflowAccessRequests = data.engineWorkflowAccessRequests.map(normalizeEngineWorkflowAccessRequest).filter(Boolean);
|
||||
applyProtectedLauncherUserInvariants(data);
|
||||
applyBimViewerServiceInvariants(data);
|
||||
return data;
|
||||
}
|
||||
|
||||
function applyBimViewerServiceInvariants(data) {
|
||||
let service = data.services.find(
|
||||
(candidate) => candidate.id === bimViewerService.id || candidate.slug === bimViewerService.slug
|
||||
);
|
||||
|
||||
if (!service) {
|
||||
service = normalizeService({ ...bimViewerService });
|
||||
data.services.push(service);
|
||||
} else {
|
||||
service.id = service.id || bimViewerService.id;
|
||||
service.slug = service.slug || bimViewerService.slug;
|
||||
service.title = service.title || bimViewerService.title;
|
||||
service.subtitle = service.subtitle || bimViewerService.subtitle;
|
||||
service.description = service.description || bimViewerService.description;
|
||||
service.fullDescription = service.fullDescription || bimViewerService.fullDescription;
|
||||
service.url = service.url || bimViewerService.url;
|
||||
service.launchUrl = service.launchUrl || service.url || bimViewerService.launchUrl;
|
||||
service.logoutUrl = service.logoutUrl || bimViewerService.logoutUrl;
|
||||
service.accentColor = service.accentColor || bimViewerService.accentColor;
|
||||
service.fallbackGradient = service.fallbackGradient || bimViewerService.fallbackGradient;
|
||||
service.status = service.status || bimViewerService.status;
|
||||
service.order = service.order ?? bimViewerService.order;
|
||||
service.authentikApplicationSlug = service.authentikApplicationSlug || bimViewerService.authentikApplicationSlug;
|
||||
service.authentikGroupName = service.authentikGroupName || bimViewerService.authentikGroupName;
|
||||
service.isAvailableForAllNewClients = service.isAvailableForAllNewClients ?? true;
|
||||
service.createdAt = service.createdAt || bimViewerService.createdAt;
|
||||
service.updatedAt = service.updatedAt || bimViewerService.updatedAt;
|
||||
}
|
||||
|
||||
const serviceId = service.id || bimViewerService.id;
|
||||
for (const defaultGrant of bimViewerDefaultGrants) {
|
||||
const grant = { ...defaultGrant, serviceId };
|
||||
const exists = data.grants.some(
|
||||
(candidate) =>
|
||||
candidate.serviceId === grant.serviceId &&
|
||||
candidate.targetType === grant.targetType &&
|
||||
candidate.targetId === grant.targetId
|
||||
);
|
||||
if (!exists) {
|
||||
data.grants.push({ ...grant });
|
||||
}
|
||||
}
|
||||
|
||||
ensureStaticSyncStatus(data, {
|
||||
id: "sync_bim_viewer_authentik",
|
||||
objectId: serviceId,
|
||||
objectName: bimViewerService.title,
|
||||
objectType: "service",
|
||||
});
|
||||
for (const defaultGrant of bimViewerDefaultGrants) {
|
||||
const grant = { ...defaultGrant, serviceId };
|
||||
ensureStaticSyncStatus(data, {
|
||||
id: `sync_${grant.id}`,
|
||||
objectId: grant.id,
|
||||
objectName: `${bimViewerService.slug}:${grant.targetType}:${grant.targetId}`,
|
||||
objectType: "grant",
|
||||
});
|
||||
}
|
||||
}
|
||||
|
||||
function ensureStaticSyncStatus(data, status) {
|
||||
const exists = data.syncStatuses.some(
|
||||
(candidate) => candidate.target === "authentik" && candidate.objectType === status.objectType && candidate.objectId === status.objectId
|
||||
);
|
||||
if (exists) {
|
||||
return;
|
||||
}
|
||||
data.syncStatuses.push({
|
||||
id: status.id,
|
||||
objectId: status.objectId,
|
||||
objectName: status.objectName,
|
||||
objectType: status.objectType,
|
||||
target: "authentik",
|
||||
state: "pending",
|
||||
lastSyncAt: null,
|
||||
error: null,
|
||||
updatedAt: "2026-06-18T00:00:00.000Z",
|
||||
});
|
||||
}
|
||||
|
||||
function applyProtectedLauncherUserInvariants(data) {
|
||||
const rootUser = data.users.find((user) => isProtectedLauncherUserId(user.id));
|
||||
if (!rootUser) return;
|
||||
|
|
@ -2428,10 +2296,9 @@ function applyProtectedLauncherUserInvariants(data) {
|
|||
|
||||
for (const membership of data.memberships) {
|
||||
if (membership.userId !== rootUser.id) continue;
|
||||
if (membership.role !== "client_owner" || membership.status !== "active" || membership.coreAssistantRole !== "admin") {
|
||||
if (membership.role !== "client_owner" || membership.status !== "active") {
|
||||
membership.role = "client_owner";
|
||||
membership.status = "active";
|
||||
membership.coreAssistantRole = "admin";
|
||||
membership.updatedAt = now;
|
||||
}
|
||||
}
|
||||
|
|
@ -2491,21 +2358,6 @@ function upsertSystemProtectedUserGrant(data, user, service, appRole, now) {
|
|||
|
||||
function normalizeService(service) {
|
||||
if (typeof service !== "object" || service === null) return service;
|
||||
if (service.id === "service_bim_viewer" || service.slug === "bim-viewer" || service.authentikApplicationSlug === "bim-viewer") {
|
||||
const legacyLocalUrl = (value) => value === "http://localhost:8080" || value === "http://127.0.0.1:8080";
|
||||
return {
|
||||
...service,
|
||||
url: !service.url || legacyLocalUrl(service.url) ? "https://bim.nodedc.tech" : service.url,
|
||||
launchUrl:
|
||||
!service.launchUrl || legacyLocalUrl(service.launchUrl)
|
||||
? "https://bim.nodedc.tech"
|
||||
: service.launchUrl,
|
||||
logoutUrl: service.logoutUrl || "https://bim.nodedc.tech/logout",
|
||||
loginSyncUrl: service.loginSyncUrl || "https://bim.nodedc.tech/auth/login-sync",
|
||||
authentikApplicationSlug: service.authentikApplicationSlug || "bim-viewer",
|
||||
authentikGroupName: service.authentikGroupName || "nodedc:bim:access",
|
||||
};
|
||||
}
|
||||
if (service.id !== "service_nodedc" && service.slug !== "nodedc" && service.authentikApplicationSlug !== "nodedc") return service;
|
||||
|
||||
return {
|
||||
|
|
@ -2528,26 +2380,6 @@ function normalizeService(service) {
|
|||
};
|
||||
}
|
||||
|
||||
function normalizeMembership(payload) {
|
||||
if (typeof payload !== "object" || payload === null) return null;
|
||||
const now = isoNow();
|
||||
const userId = optionalString(payload.userId, "");
|
||||
const fallbackAssistantRole = isProtectedLauncherUserId(userId) ? "admin" : "member";
|
||||
|
||||
return {
|
||||
...payload,
|
||||
role: pickEnum(payload.role, membershipRoles, "member"),
|
||||
status: pickEnum(payload.status, new Set(["active", "disabled"]), "active"),
|
||||
coreAssistantRole: normalizeCoreAssistantRole(payload.coreAssistantRole, fallbackAssistantRole),
|
||||
createdAt: optionalString(payload.createdAt, now),
|
||||
updatedAt: optionalString(payload.updatedAt, now),
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeCoreAssistantRole(value, fallback = "member") {
|
||||
return pickEnum(value, coreAssistantRoles, fallback);
|
||||
}
|
||||
|
||||
function normalizeServiceModuleEntitlement(payload) {
|
||||
if (typeof payload !== "object" || payload === null) return null;
|
||||
const clientId = nullableString(payload.clientId);
|
||||
|
|
@ -3163,7 +2995,6 @@ function ensureEngineWorkflowPublicPoolMembership(data, user, request, actor, no
|
|||
membership.status = "active";
|
||||
if (!wasActive) {
|
||||
membership.role = "member";
|
||||
membership.coreAssistantRole = normalizeCoreAssistantRole(membership.coreAssistantRole);
|
||||
membership.source = "engine_workflow_access_request";
|
||||
membership.sourceEngineWorkflowAccessRequestId = request.id;
|
||||
} else {
|
||||
|
|
@ -3182,7 +3013,6 @@ function ensureEngineWorkflowPublicPoolMembership(data, user, request, actor, no
|
|||
userId: user.id,
|
||||
role: "member",
|
||||
status: "active",
|
||||
coreAssistantRole: "member",
|
||||
invitedByUserId,
|
||||
inviteId: null,
|
||||
source: "engine_workflow_access_request",
|
||||
|
|
@ -3206,7 +3036,6 @@ function ensurePublicPoolMembershipActiveForServiceAccess(data, user, actor, now
|
|||
|
||||
membership.role = "member";
|
||||
membership.status = "active";
|
||||
membership.coreAssistantRole = normalizeCoreAssistantRole(membership.coreAssistantRole);
|
||||
membership.invitedByUserId = membership.invitedByUserId ?? actor?.id ?? null;
|
||||
membership.source = membership.source ?? "launcher";
|
||||
membership.updatedAt = now;
|
||||
|
|
@ -3377,7 +3206,6 @@ function applyInviteRegistration(data, token, payload, { commit, provisioning =
|
|||
if (membership) {
|
||||
membership.role = invite.role;
|
||||
membership.status = "active";
|
||||
membership.coreAssistantRole = normalizeCoreAssistantRole(membership.coreAssistantRole);
|
||||
membership.invitedByUserId = invite.invitedByUserId ?? membership.invitedByUserId ?? null;
|
||||
membership.inviteId = invite.id;
|
||||
membership.source = invite.source ?? membership.source ?? "launcher";
|
||||
|
|
@ -3390,7 +3218,6 @@ function applyInviteRegistration(data, token, payload, { commit, provisioning =
|
|||
userId: user.id,
|
||||
role: invite.role,
|
||||
status: "active",
|
||||
coreAssistantRole: "member",
|
||||
invitedByUserId: invite.invitedByUserId ?? null,
|
||||
inviteId: invite.id,
|
||||
source: invite.source ?? "launcher",
|
||||
|
|
@ -3549,7 +3376,6 @@ function upsertAccessRequestMembership(data, user, requestPayload, options = {})
|
|||
if (existingMembership) {
|
||||
existingMembership.role = role;
|
||||
existingMembership.status = options.status ?? existingMembership.status;
|
||||
existingMembership.coreAssistantRole = normalizeCoreAssistantRole(existingMembership.coreAssistantRole);
|
||||
existingMembership.invitedByUserId = options.invitedByUserId ?? existingMembership.invitedByUserId ?? null;
|
||||
existingMembership.source = existingMembership.source ?? "access_request";
|
||||
existingMembership.updatedAt = now;
|
||||
|
|
@ -3562,7 +3388,6 @@ function upsertAccessRequestMembership(data, user, requestPayload, options = {})
|
|||
userId: user.id,
|
||||
role,
|
||||
status: options.status ?? "disabled",
|
||||
coreAssistantRole: "member",
|
||||
invitedByUserId: options.invitedByUserId ?? null,
|
||||
inviteId: null,
|
||||
source: "access_request",
|
||||
|
|
@ -3665,7 +3490,6 @@ function sanitizeServicePatch(payload, service) {
|
|||
"url",
|
||||
"launchUrl",
|
||||
"logoutUrl",
|
||||
"loginSyncUrl",
|
||||
"iconUrl",
|
||||
"coverImageUrl",
|
||||
"coverMediaKind",
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load Diff
|
|
@ -339,7 +339,7 @@ export function LauncherApp() {
|
|||
if (isRedirecting) return;
|
||||
|
||||
isRedirecting = true;
|
||||
redirectToLogin("/auth/login");
|
||||
redirectToLogin("/auth/login?prompt=login");
|
||||
});
|
||||
}, []);
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,6 @@ export interface Service {
|
|||
url: string;
|
||||
launchUrl?: string | null;
|
||||
logoutUrl?: string | null;
|
||||
loginSyncUrl?: string | null;
|
||||
iconUrl?: string | null;
|
||||
coverImageUrl?: string | null;
|
||||
coverMediaKind?: MediaKind | null;
|
||||
|
|
|
|||
|
|
@ -1,88 +0,0 @@
|
|||
import { readFileSync } from "node:fs";
|
||||
import { resolve } from "node:path";
|
||||
import { describe, expect, it } from "vitest";
|
||||
|
||||
const source = readFileSync(resolve(process.cwd(), "server", "dev-server.mjs"), "utf8");
|
||||
|
||||
function sourceBlock(startMarker: string, endMarker: string) {
|
||||
const start = source.indexOf(startMarker);
|
||||
expect(start, `Missing source marker: ${startMarker}`).toBeGreaterThanOrEqual(0);
|
||||
const end = source.indexOf(endMarker, start + startMarker.length);
|
||||
expect(end, `Missing end marker after: ${startMarker}`).toBeGreaterThan(start);
|
||||
return source.slice(start, end);
|
||||
}
|
||||
|
||||
describe("assistant-ready Launcher admin routes", () => {
|
||||
it("keeps control-plane read behind Launcher admin guard", () => {
|
||||
expect(source).toContain('app.get("/api/admin/control-plane", requireLauncherAdmin');
|
||||
expect(source).toContain("res.json(scopeAdminSnapshot(req));");
|
||||
});
|
||||
|
||||
it("keeps assistant gateway auth narrow and route-allowlisted", () => {
|
||||
expect(source).toContain('const assistantGatewayName = "ontology-core"');
|
||||
expect(source).toContain("const assistantGatewayAdminRouteAllowlist = [");
|
||||
expect(source).toContain('{ method: "GET", pattern: /^\\/api\\/admin\\/control-plane$/ }');
|
||||
expect(source).toContain('{ method: "PATCH", pattern: /^\\/api\\/admin\\/users\\/[^/?#]+\\/profile$/ }');
|
||||
expect(source).toContain('{ method: "PATCH", pattern: /^\\/api\\/admin\\/memberships\\/[^/?#]+$/ }');
|
||||
expect(source).toContain("resolveAssistantGatewayAdminContext(req)");
|
||||
expect(source).toContain("assistant_gateway_route_not_allowlisted");
|
||||
expect(source).toContain('readRequestHeader(req, "x-nodedc-assistant-actor-user-id")');
|
||||
});
|
||||
|
||||
it("routes browser assistant actions through session-owned Launcher proxy context", () => {
|
||||
const block = sourceBlock('app.post("/api/assistant/actions"', 'app.get("/api/events"');
|
||||
const builderBlock = sourceBlock("function buildAssistantActionProxyCommand", "function getAiWorkspaceAssistantBaseUrl");
|
||||
|
||||
expect(block).toContain("requireSession");
|
||||
expect(block).toContain("getLauncherProfileContext(req.nodedcSession)");
|
||||
expect(block).toContain("getRuntimeSessionContext(req.nodedcSession)");
|
||||
expect(block).toContain("buildAssistantActionProxyCommand");
|
||||
expect(block).toContain("requestAiWorkspaceAssistantJson");
|
||||
expect(builderBlock).toContain("stripClientAssistantContext");
|
||||
expect(builderBlock).toContain('"actorUserId"');
|
||||
expect(builderBlock).toContain('"assistantRole"');
|
||||
expect(builderBlock).toContain('"groups"');
|
||||
expect(builderBlock).toContain('"removesOwnAccess"');
|
||||
expect(builderBlock).toContain('"hasAlternativeAdminPath"');
|
||||
expect(builderBlock).toContain("resolveAssistantActionOwnerContext");
|
||||
expect(builderBlock).toContain("assistantActionRemovesOwnAccess");
|
||||
expect(builderBlock).toContain("hasAlternativeAssistantAdminPath");
|
||||
});
|
||||
|
||||
it("keeps user profile mutation guarded, idempotent, audited, and scoped", () => {
|
||||
const block = sourceBlock('app.patch("/api/admin/users/:userId/profile"', 'app.delete("/api/admin/users/:userId"');
|
||||
|
||||
expect(block).toContain("requireLauncherAdmin");
|
||||
expect(block).toContain("assertAdminCanManageUser(req, res, req.params.userId)");
|
||||
expect(block).toContain("sendAdminIdempotentJson(req, res");
|
||||
expect(block).toContain("controlPlaneStore.updateUserProfile");
|
||||
expect(block).toContain('publishControlPlaneEvent("admin.user.updated"');
|
||||
expect(block).toContain("scopeAdminMutationResult");
|
||||
});
|
||||
|
||||
it("keeps membership mutation guarded, idempotent, audited, and scoped", () => {
|
||||
const block = sourceBlock('app.patch("/api/admin/memberships/:membershipId"', 'app.delete("/api/admin/memberships/:membershipId"');
|
||||
|
||||
expect(block).toContain("requireLauncherAdmin");
|
||||
expect(block).toContain("assertAdminCanManageMembership(req, res, membership)");
|
||||
expect(block).toContain("sendAdminIdempotentJson(req, res");
|
||||
expect(block).toContain("controlPlaneStore.updateMembership");
|
||||
expect(block).toContain('publishControlPlaneEvent("admin.membership.updated"');
|
||||
expect(block).toContain("scopeAdminMutationResult");
|
||||
});
|
||||
|
||||
it("keeps hard delete routes outside assistant-ready routes and root-guarded where available", () => {
|
||||
const userDeleteBlock = sourceBlock('app.delete("/api/admin/users/:userId"', 'app.post("/api/admin/users/:userId/provision-authentik"');
|
||||
|
||||
expect(userDeleteBlock).toContain("requireRootLauncherAdmin");
|
||||
expect(userDeleteBlock).toContain("controlPlaneStore.deleteUser");
|
||||
});
|
||||
|
||||
it("keeps admin mutation idempotency conflict and replay behavior", () => {
|
||||
expect(source).toContain("sendAdminIdempotentJson");
|
||||
expect(source).toContain("idempotency_key_conflict");
|
||||
expect(source).toContain('res.setHeader("Idempotency-Replayed", "true")');
|
||||
expect(source).toContain("buildAdminMutationFingerprint");
|
||||
expect(source).toContain("stableJson(req.body ?? null)");
|
||||
});
|
||||
});
|
||||
|
|
@ -23,7 +23,6 @@ export interface LauncherUser {
|
|||
|
||||
export type ClientMembershipRole = "client_owner" | "client_admin" | "member";
|
||||
export type ClientMembershipStatus = "active" | "disabled";
|
||||
export type CoreAssistantAccessRole = "blocked" | "member" | "admin";
|
||||
|
||||
export interface ClientMembership {
|
||||
id: string;
|
||||
|
|
@ -31,7 +30,6 @@ export interface ClientMembership {
|
|||
userId: string;
|
||||
role: ClientMembershipRole;
|
||||
status: ClientMembershipStatus;
|
||||
coreAssistantRole?: CoreAssistantAccessRole;
|
||||
invitedByUserId?: string | null;
|
||||
inviteId?: string | null;
|
||||
source?: "launcher" | "access_request" | "tasker_workspace_invite" | "engine_workflow_access_request" | null;
|
||||
|
|
|
|||
|
|
@ -50,7 +50,6 @@ export interface MeResponse {
|
|||
clientName: string;
|
||||
role: ClientMembershipRole;
|
||||
status: ClientMembership["status"];
|
||||
coreAssistantRole: ClientMembership["coreAssistantRole"];
|
||||
}>;
|
||||
activeClientId: string;
|
||||
permissions: LauncherPermissions;
|
||||
|
|
@ -215,7 +214,7 @@ export function normalizeLauncherData(data: Partial<LauncherData> | null | undef
|
|||
return {
|
||||
clients: Array.isArray(payload.clients) ? payload.clients : mockClients,
|
||||
users: Array.isArray(payload.users) ? payload.users : mockUsers,
|
||||
memberships: Array.isArray(payload.memberships) ? payload.memberships.map(normalizeMembership) : mockMemberships.map(normalizeMembership),
|
||||
memberships: Array.isArray(payload.memberships) ? payload.memberships : mockMemberships,
|
||||
groups: Array.isArray(payload.groups) ? payload.groups : mockGroups,
|
||||
services: Array.isArray(payload.services) ? payload.services : mockServices,
|
||||
grants: Array.isArray(payload.grants) ? payload.grants : mockGrants,
|
||||
|
|
@ -260,7 +259,6 @@ export function buildMe(data: LauncherData, userId: string, requestedClientId?:
|
|||
clientName: client.name,
|
||||
role: "client_owner" as const,
|
||||
status: "active" as const,
|
||||
coreAssistantRole: "admin" as const,
|
||||
}))
|
||||
: data.memberships
|
||||
.filter((membership) => membership.userId === user.id)
|
||||
|
|
@ -269,7 +267,6 @@ export function buildMe(data: LauncherData, userId: string, requestedClientId?:
|
|||
clientName: getClient(data, membership.clientId).name,
|
||||
role: membership.role,
|
||||
status: membership.status,
|
||||
coreAssistantRole: normalizeCoreAssistantRole(membership.coreAssistantRole),
|
||||
}));
|
||||
|
||||
const fallbackClientId =
|
||||
|
|
@ -307,21 +304,6 @@ export function buildMe(data: LauncherData, userId: string, requestedClientId?:
|
|||
};
|
||||
}
|
||||
|
||||
function normalizeMembership(membership: ClientMembership): ClientMembership {
|
||||
return {
|
||||
...membership,
|
||||
coreAssistantRole: normalizeCoreAssistantRole(membership.coreAssistantRole, membership.userId === "user_root" ? "admin" : "member"),
|
||||
};
|
||||
}
|
||||
|
||||
function normalizeCoreAssistantRole(
|
||||
value: ClientMembership["coreAssistantRole"] | null | undefined,
|
||||
fallback: NonNullable<ClientMembership["coreAssistantRole"]> = "member"
|
||||
): NonNullable<ClientMembership["coreAssistantRole"]> {
|
||||
if (value === "blocked" || value === "member" || value === "admin") return value;
|
||||
return fallback;
|
||||
}
|
||||
|
||||
export function buildLauncherServices(data: LauncherData, userId: string, activeClientId: string): LauncherServiceView[] {
|
||||
const me = buildMe(data, userId, activeClientId);
|
||||
const user = getUser(data, userId);
|
||||
|
|
|
|||
|
|
@ -113,27 +113,6 @@ export const mockServices: Service[] = [
|
|||
createdAt: "2026-04-01T10:00:00Z",
|
||||
updatedAt: now,
|
||||
},
|
||||
{
|
||||
id: "service_bim_viewer",
|
||||
slug: "bim-viewer",
|
||||
title: "BIM VIEWER",
|
||||
subtitle: "BIM и CAD просмотр",
|
||||
description: "Персональный просмотр BIM/CAD моделей, версий и публичных ссылок.",
|
||||
fullDescription:
|
||||
"Standalone BIM/CAD viewer NODE.DC для рабочих моделей, вложений Operational Core, персонального модельного хранилища и безопасного внешнего просмотра по share-ссылкам.",
|
||||
url: "https://bim.nodedc.tech",
|
||||
launchUrl: "https://bim.nodedc.tech",
|
||||
logoutUrl: "https://bim.nodedc.tech/logout",
|
||||
accentColor: "#8FE3C8",
|
||||
fallbackGradient: "linear-gradient(132deg, rgba(143, 227, 200, 0.78), rgba(24, 70, 64, 0.9) 46%, #080B0F 84%)",
|
||||
status: "active",
|
||||
order: 25,
|
||||
authentikApplicationSlug: "bim-viewer",
|
||||
authentikGroupName: "nodedc:bim:access",
|
||||
isAvailableForAllNewClients: true,
|
||||
createdAt: "2026-06-18T00:00:00.000Z",
|
||||
updatedAt: now,
|
||||
},
|
||||
{
|
||||
id: "service_1c",
|
||||
slug: "1c-assistant",
|
||||
|
|
@ -232,8 +211,6 @@ export const mockGrants: ServiceGrant[] = [
|
|||
grant("grant_dctouch_nodedc_admins", "service_nodedc", "group", "group_dctouch_admins", "admin"),
|
||||
grant("grant_engine_user_silver_psih_yahoo_com", "service_nodedc", "user", "user_silver_psih", "member"),
|
||||
grant("grant_engine_user_constr_dc_yahoo_com", "service_nodedc", "user", "user_constr_dc_yahoo_com", "viewer"),
|
||||
grant("grant_bim_viewer_client_romashka", "service_bim_viewer", "client", "client_romashka", "member"),
|
||||
grant("grant_bim_viewer_client_public_pool", "service_bim_viewer", "client", "client_public_pool", "member"),
|
||||
];
|
||||
|
||||
export const mockExceptions: ServiceAccessException[] = [];
|
||||
|
|
@ -258,23 +235,6 @@ export const mockSyncStatuses: SyncStatus[] = [
|
|||
),
|
||||
sync("sync_dctouch_groups_authentik", "client_romashka:groups", "DCTOUCH groups", "group", "authentik", "pending"),
|
||||
sync("sync_task_manager_authentik", "service_task_manager", "OPERATIONAL CORE", "service", "authentik", "synced"),
|
||||
sync("sync_bim_viewer_authentik", "service_bim_viewer", "BIM VIEWER", "service", "authentik", "pending"),
|
||||
sync(
|
||||
"sync_grant_bim_viewer_client_romashka",
|
||||
"grant_bim_viewer_client_romashka",
|
||||
"bim-viewer:client:client_romashka",
|
||||
"grant",
|
||||
"authentik",
|
||||
"pending"
|
||||
),
|
||||
sync(
|
||||
"sync_grant_bim_viewer_client_public_pool",
|
||||
"grant_bim_viewer_client_public_pool",
|
||||
"bim-viewer:client:client_public_pool",
|
||||
"grant",
|
||||
"authentik",
|
||||
"pending"
|
||||
),
|
||||
];
|
||||
|
||||
export const mockAuditEvents: AuditEvent[] = [
|
||||
|
|
@ -298,15 +258,12 @@ function membership(
|
|||
role: ClientMembership["role"],
|
||||
status: ClientMembership["status"] = "active"
|
||||
): ClientMembership {
|
||||
const coreAssistantRole: ClientMembership["coreAssistantRole"] = userId === "user_root" ? "admin" : "member";
|
||||
|
||||
return {
|
||||
id,
|
||||
clientId,
|
||||
userId,
|
||||
role,
|
||||
status,
|
||||
coreAssistantRole,
|
||||
createdAt: "2026-04-01T10:00:00Z",
|
||||
updatedAt: now,
|
||||
};
|
||||
|
|
|
|||
|
|
@ -3761,11 +3761,6 @@ code {
|
|||
color: #ffd0d0;
|
||||
}
|
||||
|
||||
.access-cell--assistant-admin {
|
||||
background: rgba(199, 166, 255, 0.16);
|
||||
color: #e6d8ff;
|
||||
}
|
||||
|
||||
.access-cell--active {
|
||||
background: rgba(255, 255, 255, 0.12);
|
||||
box-shadow: none;
|
||||
|
|
|
|||
|
|
@ -55,7 +55,6 @@ import type {
|
|||
ClientMembership,
|
||||
ClientMembershipRole,
|
||||
ClientMembershipStatus,
|
||||
CoreAssistantAccessRole,
|
||||
LauncherUser,
|
||||
LauncherUserStatus,
|
||||
} from "../../entities/user/types";
|
||||
|
|
@ -1415,12 +1414,6 @@ const membershipRoleOptions: Array<NodeDcSelectOption<ClientMembershipRole>> = [
|
|||
{ value: "member", label: "Member", description: "Пользователь" },
|
||||
];
|
||||
|
||||
const coreAssistantAccessRoleOptions: Array<NodeDcSelectOption<CoreAssistantAccessRole>> = [
|
||||
{ value: "blocked", label: "Нет доступа", description: "Ассистент скрыт и недоступен", tone: "red" },
|
||||
{ value: "member", label: "Есть доступ", description: "Личный ассистент в разрешённых контурах", tone: "green" },
|
||||
{ value: "admin", label: "Админ", description: "Admin-команды в рамках Launcher scope", tone: "violet" },
|
||||
];
|
||||
|
||||
const inviteRoleOptions: Array<NodeDcSelectOption<ClientMembershipRole>> = [
|
||||
{ value: "member", label: "Member" },
|
||||
{ value: "client_admin", label: "Client Admin" },
|
||||
|
|
@ -1566,14 +1559,6 @@ function membershipRoleLabel(role: ClientMembershipRole): string {
|
|||
return membershipRoleOptions.find((option) => option.value === role)?.label ?? role;
|
||||
}
|
||||
|
||||
function resolveCoreAssistantRole(membership: ClientMembership): CoreAssistantAccessRole {
|
||||
return membership.coreAssistantRole ?? "member";
|
||||
}
|
||||
|
||||
function coreAssistantAccessRoleLabel(role: CoreAssistantAccessRole): string {
|
||||
return coreAssistantAccessRoleOptions.find((option) => option.value === role)?.label ?? role;
|
||||
}
|
||||
|
||||
function inviteSourceLabel(invite: Invite): string {
|
||||
if (invite.source === "access_request") return "Заявка доступа";
|
||||
if (invite.source === "tasker_workspace_invite") return "Workspace-инвайт";
|
||||
|
|
@ -3164,7 +3149,7 @@ function AccessSection({
|
|||
);
|
||||
}
|
||||
|
||||
const accessGridTemplateColumns = `15rem repeat(2, 9.7rem) 12.6rem repeat(${matrix.services.length}, 11.25rem)`;
|
||||
const accessGridTemplateColumns = `15rem repeat(2, 9.7rem) repeat(${matrix.services.length}, 11.25rem)`;
|
||||
|
||||
return (
|
||||
<div className={cn("access-layout", isPublicPoolContext && "access-layout--single")}>
|
||||
|
|
@ -3184,9 +3169,6 @@ function AccessSection({
|
|||
<div className="access-grid-head" role="columnheader">
|
||||
MAIN ROLE
|
||||
</div>
|
||||
<div className="access-grid-head" role="columnheader">
|
||||
NDC Core Assistant
|
||||
</div>
|
||||
{matrix.services.map((service) => (
|
||||
<div key={service.id} className="access-grid-head" role="columnheader">
|
||||
{service.title}
|
||||
|
|
@ -3229,13 +3211,6 @@ function AccessSection({
|
|||
onChange={(role) => onUpdateMembership(membership.id, { role })}
|
||||
/>
|
||||
</div>
|
||||
<div className="access-grid-cell" role="cell">
|
||||
<CoreAssistantAccessControl
|
||||
value={resolveCoreAssistantRole(membership)}
|
||||
protectedUser={protectedUser || protectedFromActor}
|
||||
onChange={(coreAssistantRole) => onUpdateMembership(membership.id, { coreAssistantRole })}
|
||||
/>
|
||||
</div>
|
||||
{matrix.services.map((service) => {
|
||||
const cell = matrix.cells.find((item) => item.userId === user.id && item.serviceId === service.id)!;
|
||||
const active = selectedCell?.userId === user.id && selectedCell.serviceId === service.id;
|
||||
|
|
@ -3565,50 +3540,6 @@ function MainRoleControl({
|
|||
);
|
||||
}
|
||||
|
||||
function CoreAssistantAccessControl({
|
||||
value,
|
||||
protectedUser,
|
||||
onChange,
|
||||
}: {
|
||||
value: CoreAssistantAccessRole;
|
||||
protectedUser: boolean;
|
||||
onChange: (value: CoreAssistantAccessRole) => void;
|
||||
}) {
|
||||
const label = coreAssistantAccessRoleLabel(value);
|
||||
const toneClass =
|
||||
value === "blocked"
|
||||
? "access-cell--exception"
|
||||
: value === "admin"
|
||||
? "access-cell--assistant-admin"
|
||||
: "access-cell--allowed";
|
||||
|
||||
if (protectedUser) {
|
||||
return (
|
||||
<span className={cn("access-cell access-cell--main access-cell--readonly", toneClass)}>
|
||||
<strong>{label}</strong>
|
||||
<span>Assistant</span>
|
||||
</span>
|
||||
);
|
||||
}
|
||||
|
||||
return (
|
||||
<NodeDcSelect
|
||||
value={value}
|
||||
options={coreAssistantAccessRoleOptions}
|
||||
label="NDC Core Assistant"
|
||||
minMenuWidth={244}
|
||||
menuClassName="access-cell-menu"
|
||||
onChange={onChange}
|
||||
trigger={({ open, toggle, setTriggerRef, selectedOption }) => (
|
||||
<button ref={setTriggerRef} className={cn("access-cell access-cell--main", toneClass)} type="button" aria-expanded={open} onClick={toggle}>
|
||||
<strong>{selectedOption.label}</strong>
|
||||
<span>Assistant</span>
|
||||
</button>
|
||||
)}
|
||||
/>
|
||||
);
|
||||
}
|
||||
|
||||
function OperationalCoreAccessModal({
|
||||
data,
|
||||
me,
|
||||
|
|
|
|||
Loading…
Reference in New Issue