ehoandClaude Sonnet 5
e7156c5132
Restructures into apps/ssp + apps/behandelportal (two Angular projects) plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's separate sibling repo. That split had already produced real drift: a hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree forked and silently diverging (7 files), and beheer + the styles.scss token bridge duplicated byte-for-byte across both repos. - git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/, environments/, the Storybook docs/*.mdx, and styles.scss into libs/shared + libs/beheer (all confirmed identical between the two repos before merging). auth stays deliberately duplicated per ADR-0002 (actor-specific, expected to diverge) - amended there. - One generated API client (libs/shared), no more vendored swagger.json. - .dependency-cruiser split into a base factory + one config per app, and Storybook into .storybook-ssp/.storybook-behandelportal - both forced by the @auth/* alias resolving to different directories per app. - SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/ HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies its own nav/admin-links/dev-panel instead of one being hardcoded. - CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated; WP-67 backlog entry documents the full decision trail. npm run ci green (lint, dep:check x2, 360 tests across ssp/ behandelportal/shared/beheer, both localized builds, backend tests, snippet + api-client drift); both dev servers, both Storybook instances, and docker compose verified working. The old sibling repo (/home/eho/repos/behandelportal) is left untouched, not deleted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
26 lines
1009 B
TypeScript
26 lines
1009 B
TypeScript
import { HttpInterceptorFn } from '@angular/common/http';
|
|
import { currentRole } from './role';
|
|
|
|
/**
|
|
* Dev-only: stamps role-aware requests with the current `?role=` as an `X-Role`
|
|
* header so the backend can enforce the drafter/approver/admin rules. Only the
|
|
* brief, org-template, stamdata and /me endpoints carry it (WP-23 widened the set —
|
|
* /me must see the role or `AccessStore` could never learn a capability; WP-29 added
|
|
* /stamdata, whose admin-only reads 403 without it); everything else is untouched.
|
|
* A new admin-gated endpoint MUST be added here or its page silently 403s.
|
|
*/
|
|
const ROLE_AWARE = [
|
|
'/api/v1/brief',
|
|
'/api/v1/admin/org-template',
|
|
'/api/v1/admin/cases',
|
|
'/api/v1/admin/audit',
|
|
'/api/v1/admin/flags',
|
|
'/api/v1/stamdata',
|
|
'/api/v1/me',
|
|
];
|
|
|
|
export const roleInterceptor: HttpInterceptorFn = (req, next) => {
|
|
if (!ROLE_AWARE.some((prefix) => req.url.includes(prefix))) return next(req);
|
|
return next(req.clone({ setHeaders: { 'X-Role': currentRole() } }));
|
|
};
|