dhkatz
2cbedd26fc
Phase 1 of `docs/console.md` (builds on #6, whose docs commit it includes; merge #6 first). **API** - `permissions.ts`: `resource:action` permissions, built-in roles as bundles at a scope (hub, catalog, product), `can`/`require`, "may give" checks. A missing permission answers 403 with `missing: {permission, scope}`. - Catalog management: settings (incl. rating ceiling, upload policy, mirroring), key rotation, operators, membership (open / approval / invite links, bans), delisting, suspension by moderators, and `GET /api/v1/catalog/changes` for catalogs. - Membership is enforced: getting a product (403 `members_only` with the catalogs to join), the library list, and outfits relayed to others. Seeing products still needs no membership. - Console for everyone who controls a catalog, product or hosted room; `/console/audit` (tagged entries, scoped by permission, with filters), `/console/permissions`; `/me` says whether the console is for them. - Migration 0010: `role_assignment`, `catalog_member`, `catalog_invite`, `catalog_change`, catalog settings, audit `tags` (backfilled from old entries). **Website** - Console overview by what you manage; audit log page with filters; catalog list scoped to your teams; a catalog management page (settings, key, team, members, invitations, products, moderation, recent changes). - Public catalog pages with join / ask / accept invitation / leave; product pages say "members only" and link the catalogs. **Checked**: 43 API tests pass (8 new in `catalogs.test.ts`); API, web and db type checks; every new page rendered against a local hub for owner, operator, member, outsider and admin; the Eden DELETE-with-query calls tested against the API. Server-action forms weren't clicked through in a browser. Not in this PR (later phases): catalog deletion requests (with cases), drafts and moderator product edits, notifications, API tokens, two-factor, imports, charts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Phase 1 of `docs/console.md` (builds on #6, whose docs commit it includes; merge #6 first). **API** - `permissions.ts`: `resource:action` permissions, built-in roles as bundles at a scope (hub, catalog, product), `can`/`require`, "may give" checks. A missing permission answers 403 with `missing: {permission, scope}`. - Catalog management: settings (incl. rating ceiling, upload policy, mirroring), key rotation, operators, membership (open / approval / invite links, bans), delisting, suspension by moderators, and `GET /api/v1/catalog/changes` for catalogs. - Membership is enforced: getting a product (403 `members_only` with the catalogs to join), the library list, and outfits relayed to others. Seeing products still needs no membership. - Console for everyone who controls a catalog, product or hosted room; `/console/audit` (tagged entries, scoped by permission, with filters), `/console/permissions`; `/me` says whether the console is for them. - Migration 0010: `role_assignment`, `catalog_member`, `catalog_invite`, `catalog_change`, catalog settings, audit `tags` (backfilled from old entries). **Website** - Console overview by what you manage; audit log page with filters; catalog list scoped to your teams; a catalog management page (settings, key, team, members, invitations, products, moderation, recent changes). - Public catalog pages with join / ask / accept invitation / leave; product pages say "members only" and link the catalogs. **Checked**: 43 API tests pass (8 new in `catalogs.test.ts`); API, web and db type checks; every new page rendered against a local hub for owner, operator, member, outsider and admin; the Eden DELETE-with-query calls tested against the API. Server-action forms weren't clicked through in a browser. Not in this PR (later phases): catalog deletion requests (with cases), drafts and moderator product edits, notifications, API tokens, two-factor, imports, charts. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: dhkatz <[email protected]>
58 lines
2.2 KiB
TypeScript
58 lines
2.2 KiB
TypeScript
import { notFound, redirect } from "next/navigation";
|
|
import { cache } from "react";
|
|
import { NavLink } from "@/components/header-client";
|
|
import { api, getMe, isModerator, unwrap, type ConsoleData, type Person } from "@/lib/api";
|
|
|
|
/** The signed-in moderator, or off to sign in; others get not found (these pages aren't for them). */
|
|
export async function requireModerator(path: string): Promise<Person> {
|
|
const me = await getMe();
|
|
if (!me) redirect(`/signin?next=${encodeURIComponent(path)}`);
|
|
if (!isModerator(me)) notFound();
|
|
return me;
|
|
}
|
|
|
|
/** The console as this person sees it (once per request); undefined if it isn't for them. */
|
|
const loadConsole = cache(async (): Promise<ConsoleData | undefined> => {
|
|
const answer = await api.console.get();
|
|
if (answer.error) return undefined;
|
|
return unwrap(answer);
|
|
});
|
|
|
|
/**
|
|
* The signed-in person and their console, or off to sign in. People who manage nothing get not found: the console
|
|
* is for those controlling a product, catalog or room.
|
|
*/
|
|
export async function requireConsole(path: string): Promise<{ me: Person; console: ConsoleData }> {
|
|
const me = await getMe();
|
|
if (!me) redirect(`/signin?next=${encodeURIComponent(path)}`);
|
|
const data = await loadConsole();
|
|
if (!data) notFound();
|
|
return { me, console: data };
|
|
}
|
|
|
|
type Section = ConsoleData["sections"][number];
|
|
|
|
// Products are managed on their own pages for now; settings are on the overview.
|
|
const tabs: { section: Section; href: string; label: string }[] = [
|
|
{ section: "overview", href: "/console", label: "Overview" },
|
|
{ section: "catalogs", href: "/console/catalogs", label: "Catalogs" },
|
|
{ section: "people", href: "/console/people", label: "People" },
|
|
{ section: "audit", href: "/console/audit", label: "Audit" },
|
|
];
|
|
|
|
/** The console's sections this person may see. */
|
|
export async function ConsoleNav() {
|
|
const sections = new Set<Section>((await loadConsole())?.sections ?? ["overview"]);
|
|
return (
|
|
<nav className="mb-8 flex gap-1 border-b pb-3 text-sm">
|
|
{tabs
|
|
.filter((t) => sections.has(t.section))
|
|
.map((t) => (
|
|
<NavLink key={t.section} href={t.href} exact={t.section === "overview"}>
|
|
{t.label}
|
|
</NavLink>
|
|
))}
|
|
</nav>
|
|
);
|
|
}
|