ehoandClaude Sonnet 5
e7156c5132
Restructures into apps/ssp + apps/behandelportal (two Angular projects) plus libs/shared + libs/beheer (cross-app libraries), replacing WP-61's separate sibling repo. That split had already produced real drift: a hand-vendored copy of the backend's OpenAPI doc, a shared/ui+layout tree forked and silently diverging (7 files), and beheer + the styles.scss token bridge duplicated byte-for-byte across both repos. - git mv the SSP's src/app/* into apps/ssp/; fold shared/, beheer/, environments/, the Storybook docs/*.mdx, and styles.scss into libs/shared + libs/beheer (all confirmed identical between the two repos before merging). auth stays deliberately duplicated per ADR-0002 (actor-specific, expected to diverge) - amended there. - One generated API client (libs/shared), no more vendored swagger.json. - .dependency-cruiser split into a base factory + one config per app, and Storybook into .storybook-ssp/.storybook-behandelportal - both forced by the @auth/* alias resolving to different directories per app. - SiteHeaderComponent/ShellComponent gained HEADER_NAV_ITEMS/ HEADER_ADMIN_LINKS/DEBUG_PANEL injection tokens so each app supplies its own nav/admin-links/dev-panel instead of one being hardcoded. - CLAUDE.md, ARCHITECTURE.md, dependencies.md, and ADR-0002 updated; WP-67 backlog entry documents the full decision trail. npm run ci green (lint, dep:check x2, 360 tests across ssp/ behandelportal/shared/beheer, both localized builds, backend tests, snippet + api-client drift); both dev servers, both Storybook instances, and docker compose verified working. The old sibling repo (/home/eho/repos/behandelportal) is left untouched, not deleted. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
55 lines
2.3 KiB
TypeScript
55 lines
2.3 KiB
TypeScript
import { Injectable, computed, inject } from '@angular/core';
|
|
import { toObservable } from '@angular/core/rxjs-interop';
|
|
import { filter, firstValueFrom } from 'rxjs';
|
|
import { RemoteData, fromResource } from '@shared/application/remote-data';
|
|
import { Capability } from '@shared/domain/capability';
|
|
import { MeAdapter, parseMe } from '@shared/infrastructure/me.adapter';
|
|
|
|
type Err = Error | undefined;
|
|
|
|
/**
|
|
* The current principal's capabilities (PRD-0002 §6) — one root singleton, like
|
|
* `SessionStore`/`BigProfileStore`. Global capabilities load once from `GET /me`;
|
|
* a screen's own decision DTO (e.g. `BriefViewDto.decisions`) covers anything tied
|
|
* to a specific resource's live status — no extra round-trip needed for that.
|
|
*
|
|
* `can()` is deny-by-default: loading, failed, or an unrecognized capability all
|
|
* resolve to `false`. This store never derives a capability from a role — it only
|
|
* mirrors what the server already resolved.
|
|
*/
|
|
@Injectable({ providedIn: 'root' })
|
|
export class AccessStore {
|
|
private adapter = inject(MeAdapter);
|
|
private meRes = this.adapter.meResource();
|
|
|
|
private capabilities = computed<RemoteData<Err, Capability[]>>(() => {
|
|
const rd = fromResource(this.meRes);
|
|
if (rd.tag !== 'Success') return rd;
|
|
const parsed = parseMe(rd.value);
|
|
return parsed.ok
|
|
? { tag: 'Success', value: parsed.value }
|
|
: { tag: 'Failure', error: new Error(parsed.error) };
|
|
});
|
|
|
|
can(capability: Capability): boolean {
|
|
const rd = this.capabilities();
|
|
return rd.tag === 'Success' && rd.value.includes(capability);
|
|
}
|
|
|
|
/** True once `/me` has resolved (success or failure) — lets a page-level gate tell
|
|
"still loading" apart from "denied", so an admin doesn't flash the denial alert. */
|
|
readonly ready = computed(() => {
|
|
const tag = this.capabilities().tag;
|
|
return tag === 'Success' || tag === 'Failure';
|
|
});
|
|
|
|
private ready$ = toObservable(this.ready);
|
|
/** Resolves once `/me` has settled (success or failure). The `capabilityGuard` awaits
|
|
this before deciding — otherwise it reads `can()` while `/me` is still loading and
|
|
wrongly denies (deny-by-default), bouncing even an entitled user. */
|
|
async whenReady(): Promise<void> {
|
|
if (this.ready()) return;
|
|
await firstValueFrom(this.ready$.pipe(filter((r) => r)));
|
|
}
|
|
}
|