Refuse a stale permission save, confirm or report it, show View to read-only holders, keep an absolute return_to beside a locale

2026-10-31 09:34:05 +01:00
parent 76995008eb
commit f4969d5c1f
17 changed files with 303 additions and 46 deletions
@@ -7,7 +7,7 @@
 // each returning a RouteResult.

 import { can, type KetoClient, type KratosAdmin, paginate, parseListQuery, type RelationQuery, type RelationTuple, type RequestContext, type RouteHandler, type RouteResult, type SubjectSet, type Translate, type User } from "@plainpages/plugin-api";
-import { applyGrants, buildPermissionPicker, effectivePermissions, grantDiff, grantTuple, groupSubject, heldPermissions, type PermissionPicker, PERMISSIONS_FIELD } from "./admin-grants.ts";
+import { applyGrants, buildPermissionPicker, effectivePermissions, grantDiff, grantTuple, groupSubject, heldPermissions, isStale, type PermissionPicker, PERMISSIONS_FIELD, SAVED_NOTICE } from "./admin-grants.ts";
 import { ADMIN_EN, type AdminAction, ADMIN_GROUPS_BASE, buildConfirmModel, guardedForm, notFound, permissionName, requirePermission, unavailable } from "./admin-shared.ts";
 import type { FieldConfig } from "./admin-users.ts";

@@ -347,36 +347,50 @@ export const groupsCreate = withGroups(async (deps) => {
 // GET /admin/groups/new — the create form.
 export const groupsNewForm = withGroups((deps) => groupFormResult(deps, {}), "write");

-// GET /admin/groups/:name — the detail + membership page.
-export const groupsDetail = withGroupName(async ({ ctx, keto, kratosAdmin }, name) => {
+// The detail + membership page. `notice` and `error` ride the permission picker, which is where a save reports.
+async function groupDetailPage({ ctx, keto, kratosAdmin }: GroupsDeps, name: string, say: { error?: string; notice?: string } = {}): Promise<RouteResult> {
  const { emailById, options } = await memberCandidates(keto, kratosAdmin);
  const members = (await pagedTuples(keto, { namespace: GROUP_NS, object: name, relation: MEMBERS })).map((t) => memberView(t, emailById));
  const subject = groupSubject(name);
  const [direct, effective] = await Promise.all([heldPermissions(keto, subject), effectivePermissions(keto, subject, ctx.declaredPermissions)]);
-  const permissions = buildPermissionPicker({
-    action: `${detailHref(name)}/permissions`,
-    declared: ctx.declaredPermissions,
-    direct,
-    effective, // a group nested in another group inherits its permissions too
-    readOnly: !can(ctx, permissionName("groups", "write")),
-    t: ctx.t,
-    transitive: true, // members inherit, so a change here lands at their next re-mint, not at once
-  });
+  const permissions: PermissionPicker = {
+    ...buildPermissionPicker({
+      action: `${detailHref(name)}/permissions`,
+      declared: ctx.declaredPermissions,
+      direct,
+      effective, // a group nested in another group inherits its permissions too
+      readOnly: !can(ctx, permissionName("groups", "write")),
+      t: ctx.t,
+      transitive: true, // members inherit, so a change here lands at their next re-mint, not at once
+    }),
+    ...(say.error ? { error: say.error } : {}),
+    ...(say.notice ? { notice: say.notice } : {}),
+  };
  return { data: { chrome: ctx.chrome, model: buildGroupDetailModel({ canWrite: !permissions.readOnly, candidates: options, csrfToken: ctx.chrome.csrfToken, group: { name }, members, permissions, t: ctx.t }) }, view: "group-detail" };
-});
+}
+
+// GET /admin/groups/:name — the detail + membership page; `info-msg` is read as on the user page.
+export const groupsDetail = withGroupName((deps, name) =>
+  groupDetailPage(deps, name, deps.ctx.url.searchParams.get("info-msg") === SAVED_NOTICE ? { notice: deps.ctx.t("admin.grants.saved") } : {}));

 // POST /admin/groups/:name/permissions — the submitted checkboxes are the desired set. Members hold
 // a group's permissions transitively, so the change reaches them at their next login or re-mint —
 // the documented instant-revoke tradeoff for anything held through a group.
-export const groupsPermissions = withGroupName(async ({ ctx, keto, user }, name) => {
+export const groupsPermissions = withGroupName(async (deps, name) => {
+  const { ctx, keto, user } = deps;
  const form = (await guardedForm(ctx))!;
  const subject = groupSubject(name);
-  const diff = grantDiff(ctx.declaredPermissions, await heldPermissions(keto, subject), form.getAll(PERMISSIONS_FIELD));
-  await applyGrants(keto, subject, diff);
-  if (diff.grant.length > 0 || diff.revoke.length > 0) {
-    ctx.log.info("admin: group permissions changed", { actor: user.id, granted: diff.grant.join(","), group: name, revoked: diff.revoke.join(",") });
+  const held = await heldPermissions(keto, subject);
+  if (isStale(form, ctx.declaredPermissions, held)) return { ...(await groupDetailPage(deps, name, { error: ctx.t("admin.grants.stale") })), status: 409 };
+  const { applied, error } = await applyGrants(keto, subject, grantDiff(ctx.declaredPermissions, held, form.getAll(PERMISSIONS_FIELD)));
+  if (applied.grant.length > 0 || applied.revoke.length > 0) {
+    ctx.log.info("admin: group permissions changed", { actor: user.id, granted: applied.grant.join(","), group: name, revoked: applied.revoke.join(",") });
  }
-  return { redirect: detailHref(name) };
+  if (error) {
+    ctx.log.error("admin: group permissions only partly saved", { actor: user.id, error: String(error), group: name });
+    return { ...(await groupDetailPage(deps, name, { error: ctx.t("admin.grants.partial") })), status: 502 };
+  }
+  return { redirect: `${detailHref(name)}?info-msg=${SAVED_NOTICE}` };
 });

 // POST /admin/groups/:name/members — add a member (skip an invalid member or a self-nest).