Orgs: let any user create an organization and become its admin
Organization writes were superadmin-only, so standing up a tenant needed an out-of-band superadmin. Creating one is now self-service, and an admin manages the org they belong to. - POST /api/orgs is open to any authenticated user. A creator who isn't a superadmin must have no organization yet (a single-valued membership relation means a second one would abandon the first), and is promoted to the new org's admin and first member in the same request. If that promotion fails the org is rolled back, so it is never left stranded with nobody able to administer it. Superadmins still create tenants without joining them. - PATCH/DELETE are manager-gated and scope an admin to their own org. An admin deletes theirs only as its sole member: they are detached and demoted to a plain user before the record goes, so the org is empty when it is removed. Other members still block deletion with a 409. - /api/me now carries organization + organizationName, which the clients need to tell "no org yet" from "org you administer". The panel, Web App (new OrgManager.vue in Settings) and Phone App (new _OrganizationSection) all mirror the server's gates rather than re-deciding them. The Phone App cached its role at login and gates the Users tab on it, so AuthService.adoptRole refreshes that from the profile instead of making a freshly promoted admin sign in again. Covered by orgs_test.go, which drives the real handler + middleware chain against a stand-in PocketBase: promotion, the already-a-member refusal, superadmin staying unattached, the rollback, own-org scoping, the detach-and-demote, and the blocking-member 409. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
tajniak81andClaude Opus 5 committed
1 parent
358ee68f94
commit
cd16d4383f
30 files changed
+1193
-63
No files matched your search
@@ -1,17 +0,0 @@
|
||||
(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const i of document.querySelectorAll('link[rel="modulepreload"]'))n(i);new MutationObserver(i=>{for(const o of i)if(o.type==="childList")for(const r of o.addedNodes)r.tagName==="LINK"&&r.rel==="modulepreload"&&n(r)}).observe(document,{childList:!0,subtree:!0});function s(i){const o={};return i.integrity&&(o.integrity=i.integrity),i.referrerPolicy&&(o.referrerPolicy=i.referrerPolicy),i.crossOrigin==="use-credentials"?o.credentials="include":i.crossOrigin==="anonymous"?o.credentials="omit":o.credentials="same-origin",o}function n(i){if(i.ep)return;i.ep=!0;const o=s(i);fetch(i.href,o)}})();/**
|
||||
* @vue/shared v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/function ln(e){const t=Object.create(null);for(const s of e.split(","))t[s]=1;return s=>s in t}const Y={},xt=[],He=()=>{},gi=()=>!1,ks=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&(e.charCodeAt(2)>122||e.charCodeAt(2)<97),Ss=e=>e.startsWith("onUpdate:"),he=Object.assign,an=(e,t)=>{const s=e.indexOf(t);s>-1&&e.splice(s,1)},$o=Object.prototype.hasOwnProperty,G=(e,t)=>$o.call(e,t),L=Array.isArray,kt=e=>es(e)==="[object Map]",Rt=e=>es(e)==="[object Set]",Rn=e=>es(e)==="[object Date]",H=e=>typeof e=="function",ne=e=>typeof e=="string",Ve=e=>typeof e=="symbol",Z=e=>e!==null&&typeof e=="object",mi=e=>(Z(e)||H(e))&&H(e.then)&&H(e.catch),bi=Object.prototype.toString,es=e=>bi.call(e),Ao=e=>es(e).slice(8,-1),vi=e=>es(e)==="[object Object]",cn=e=>ne(e)&&e!=="NaN"&&e[0]!=="-"&&""+parseInt(e,10)===e,Ft=ln(",key,ref,ref_for,ref_key,onVnodeBeforeMount,onVnodeMounted,onVnodeBeforeUpdate,onVnodeUpdated,onVnodeBeforeUnmount,onVnodeUnmounted"),Ts=e=>{const t=Object.create(null);return(s=>t[s]||(t[s]=e(s)))},Oo=/-\w/g,Ce=Ts(e=>e.replace(Oo,t=>t.slice(1).toUpperCase())),Ro=/\B([A-Z])/g,ct=Ts(e=>e.replace(Ro,"-$1").toLowerCase()),_i=Ts(e=>e.charAt(0).toUpperCase()+e.slice(1)),Ms=Ts(e=>e?`on${_i(e)}`:""),Be=(e,t)=>!Object.is(e,t),fs=(e,...t)=>{for(let s=0;s<e.length;s++)e[s](...t)},yi=(e,t,s,n=!1)=>{Object.defineProperty(e,t,{configurable:!0,enumerable:!1,writable:n,value:s})},Es=e=>{const t=parseFloat(e);return isNaN(t)?e:t};let In;const Cs=()=>In||(In=typeof globalThis<"u"?globalThis:typeof self<"u"?self:typeof window<"u"?window:typeof global<"u"?global:{});function un(e){if(L(e)){const t={};for(let s=0;s<e.length;s++){const n=e[s],i=ne(n)?Mo(n):un(n);if(i)for(const o in i)t[o]=i[o]}return t}else if(ne(e)||Z(e))return e}const Io=/;(?![^(]*\))/g,Uo=/:([^]+)/,jo=/\/\*[^]*?\*\//g;function Mo(e){const t={};return e.replace(jo,"").split(Io).forEach(s=>{if(s){const n=s.split(Uo);n.length>1&&(t[n[0].trim()]=n[1].trim())}}),t}function $e(e){let t="";if(ne(e))t=e;else if(L(e))for(let s=0;s<e.length;s++){const n=$e(e[s]);n&&(t+=n+" ")}else if(Z(e))for(const s in e)e[s]&&(t+=s+" ");return t.trim()}const No="itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly",Do=ln(No);function wi(e){return!!e||e===""}function zo(e,t){if(e.length!==t.length)return!1;let s=!0;for(let n=0;s&&n<e.length;n++)s=rt(e[n],t[n]);return s}function rt(e,t){if(e===t)return!0;let s=Rn(e),n=Rn(t);if(s||n)return s&&n?e.getTime()===t.getTime():!1;if(s=Ve(e),n=Ve(t),s||n)return e===t;if(s=L(e),n=L(t),s||n)return s&&n?zo(e,t):!1;if(s=Z(e),n=Z(t),s||n){if(!s||!n)return!1;const i=Object.keys(e).length,o=Object.keys(t).length;if(i!==o)return!1;for(const r in e){const l=e.hasOwnProperty(r),a=t.hasOwnProperty(r);if(l&&!a||!l&&a||!rt(e[r],t[r]))return!1}}return String(e)===String(t)}function dn(e,t){return e.findIndex(s=>rt(s,t))}const xi=e=>!!(e&&e.__v_isRef===!0),b=e=>ne(e)?e:e==null?"":L(e)||Z(e)&&(e.toString===bi||!H(e.toString))?xi(e)?b(e.value):JSON.stringify(e,ki,2):String(e),ki=(e,t)=>xi(t)?ki(e,t.value):kt(t)?{[`Map(${t.size})`]:[...t.entries()].reduce((s,[n,i],o)=>(s[Ns(n,o)+" =>"]=i,s),{})}:Rt(t)?{[`Set(${t.size})`]:[...t.values()].map(s=>Ns(s))}:Ve(t)?Ns(t):Z(t)&&!L(t)&&!vi(t)?String(t):t,Ns=(e,t="")=>{var s;return Ve(e)?`Symbol(${(s=e.description)!=null?s:t})`:e};/**
|
||||
* @vue/reactivity v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/let ae;class Lo{constructor(t=!1){this.detached=t,this._active=!0,this._on=0,this.effects=[],this.cleanups=[],this._isPaused=!1,this._warnOnRun=!0,this.__v_skip=!0,!t&&ae&&(ae.active?(this.parent=ae,this.index=(ae.scopes||(ae.scopes=[])).push(this)-1):(this._active=!1,this._warnOnRun=!1))}get active(){return this._active}pause(){if(this._active){this._isPaused=!0;let t,s;if(this.scopes)for(t=0,s=this.scopes.length;t<s;t++)this.scopes[t].pause();for(t=0,s=this.effects.length;t<s;t++)this.effects[t].pause()}}resume(){if(this._active&&this._isPaused){this._isPaused=!1;let t,s;if(this.scopes)for(t=0,s=this.scopes.length;t<s;t++)this.scopes[t].resume();for(t=0,s=this.effects.length;t<s;t++)this.effects[t].resume()}}run(t){if(this._active){const s=ae;try{return ae=this,t()}finally{ae=s}}}on(){++this._on===1&&(this.prevScope=ae,ae=this)}off(){if(this._on>0&&--this._on===0){if(ae===this)ae=this.prevScope;else{let t=ae;for(;t;){if(t.prevScope===this){t.prevScope=this.prevScope;break}t=t.prevScope}}this.prevScope=void 0}}stop(t){if(this._active){this._active=!1;let s,n;for(s=0,n=this.effects.length;s<n;s++)this.effects[s].stop();for(this.effects.length=0,s=0,n=this.cleanups.length;s<n;s++)this.cleanups[s]();if(this.cleanups.length=0,this.scopes){for(s=0,n=this.scopes.length;s<n;s++)this.scopes[s].stop(!0);this.scopes.length=0}if(!this.detached&&this.parent&&!t){const i=this.parent.scopes.pop();i&&i!==this&&(this.parent.scopes[this.index]=i,i.index=this.index)}this.parent=void 0}}}function Fo(){return ae}let Q;const Ds=new WeakSet;class Si{constructor(t){this.fn=t,this.deps=void 0,this.depsTail=void 0,this.flags=5,this.next=void 0,this.cleanup=void 0,this.scheduler=void 0,ae&&(ae.active?ae.effects.push(this):this.flags&=-2)}pause(){this.flags|=64}resume(){this.flags&64&&(this.flags&=-65,Ds.has(this)&&(Ds.delete(this),this.trigger()))}notify(){this.flags&2&&!(this.flags&32)||this.flags&8||Ei(this)}run(){if(!(this.flags&1))return this.fn();this.flags|=2,Un(this),Ci(this);const t=Q,s=Pe;Q=this,Pe=!0;try{return this.fn()}finally{Pi(this),Q=t,Pe=s,this.flags&=-3}}stop(){if(this.flags&1){for(let t=this.deps;t;t=t.nextDep)hn(t);this.deps=this.depsTail=void 0,Un(this),this.onStop&&this.onStop(),this.flags&=-2}}trigger(){this.flags&64?Ds.add(this):this.scheduler?this.scheduler():this.runIfDirty()}runIfDirty(){qs(this)&&this.run()}get dirty(){return qs(this)}}let Ti=0,Bt,Ht;function Ei(e,t=!1){if(e.flags|=8,t){e.next=Ht,Ht=e;return}e.next=Bt,Bt=e}function fn(){Ti++}function pn(){if(--Ti>0)return;if(Ht){let t=Ht;for(Ht=void 0;t;){const s=t.next;t.next=void 0,t.flags&=-9,t=s}}let e;for(;Bt;){let t=Bt;for(Bt=void 0;t;){const s=t.next;if(t.next=void 0,t.flags&=-9,t.flags&1)try{t.trigger()}catch(n){e||(e=n)}t=s}}if(e)throw e}function Ci(e){for(let t=e.deps;t;t=t.nextDep)t.version=-1,t.prevActiveLink=t.dep.activeLink,t.dep.activeLink=t}function Pi(e){let t,s=e.depsTail,n=s;for(;n;){const i=n.prevDep;n.version===-1?(n===s&&(s=i),hn(n),Bo(n)):t=n,n.dep.activeLink=n.prevActiveLink,n.prevActiveLink=void 0,n=i}e.deps=t,e.depsTail=s}function qs(e){for(let t=e.deps;t;t=t.nextDep)if(t.dep.version!==t.version||t.dep.computed&&($i(t.dep.computed)||t.dep.version!==t.version))return!0;return!!e._dirty}function $i(e){if(e.flags&4&&!(e.flags&16)||(e.flags&=-17,e.globalVersion===qt)||(e.globalVersion=qt,!e.isSSR&&e.flags&128&&(!e.deps&&!e._dirty||!qs(e))))return;e.flags|=2;const t=e.dep,s=Q,n=Pe;Q=e,Pe=!0;try{Ci(e);const i=e.fn(e._value);(t.version===0||Be(i,e._value))&&(e.flags|=128,e._value=i,t.version++)}catch(i){throw t.version++,i}finally{Q=s,Pe=n,Pi(e),e.flags&=-3}}function hn(e,t=!1){const{dep:s,prevSub:n,nextSub:i}=e;if(n&&(n.nextSub=i,e.prevSub=void 0),i&&(i.prevSub=n,e.nextSub=void 0),s.subs===e&&(s.subs=n,!n&&s.computed)){s.computed.flags&=-5;for(let o=s.computed.deps;o;o=o.nextDep)hn(o,!0)}!t&&!--s.sc&&s.map&&s.map.delete(s.key)}function Bo(e){const{prevDep:t,nextDep:s}=e;t&&(t.nextDep=s,e.prevDep=void 0),s&&(s.prevDep=t,e.nextDep=void 0)}let Pe=!0;const Ai=[];function Ke(){Ai.push(Pe),Pe=!1}function We(){const e=Ai.pop();Pe=e===void 0?!0:e}function Un(e){const{cleanup:t}=e;if(e.cleanup=void 0,t){const s=Q;Q=void 0;try{t()}finally{Q=s}}}let qt=0;class Ho{constructor(t,s){this.sub=t,this.dep=s,this.version=s.version,this.nextDep=this.prevDep=this.nextSub=this.prevSub=this.prevActiveLink=void 0}}class gn{constructor(t){this.computed=t,this.version=0,this.activeLink=void 0,this.subs=void 0,this.map=void 0,this.key=void 0,this.sc=0,this.__v_skip=!0}track(t){if(!Q||!Pe||Q===this.computed)return;let s=this.activeLink;if(s===void 0||s.sub!==Q)s=this.activeLink=new Ho(Q,this),Q.deps?(s.prevDep=Q.depsTail,Q.depsTail.nextDep=s,Q.depsTail=s):Q.deps=Q.depsTail=s,Oi(s);else if(s.version===-1&&(s.version=this.version,s.nextDep)){const n=s.nextDep;n.prevDep=s.prevDep,s.prevDep&&(s.prevDep.nextDep=n),s.prevDep=Q.depsTail,s.nextDep=void 0,Q.depsTail.nextDep=s,Q.depsTail=s,Q.deps===s&&(Q.deps=n)}return s}trigger(t){this.version++,qt++,this.notify(t)}Line truncated
|
||||
* @vue/runtime-core v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/function ts(e,t,s,n){try{return n?e(...n):e()}catch(i){$s(i,t,s)}}function Oe(e,t,s,n){if(H(e)){const i=ts(e,t,s,n);return i&&mi(i)&&i.catch(o=>{$s(o,t,s)}),i}if(L(e)){const i=[];for(let o=0;o<e.length;o++)i.push(Oe(e[o],t,s,n));return i}}function $s(e,t,s,n=!0){const i=t?t.vnode:null,{errorHandler:o,throwUnhandledErrorInProduction:r}=t&&t.appContext.config||Y;if(t){let l=t.parent;const a=t.proxy,p=`https://vuejs.org/error-reference/#runtime-${s}`;for(;l;){const u=l.ec;if(u){for(let m=0;m<u.length;m++)if(u[m](e,a,p)===!1)return}l=l.parent}if(o){Ke(),ts(o,null,10,[e,a,p]),We();return}}hr(e,s,i,n,r)}function hr(e,t,s,n=!0,i=!1){if(i)throw e;console.error(e)}const be=[];let ze=-1;const St=[];let ot=null,wt=0;const zi=Promise.resolve();let ms=null;function Li(e){const t=ms||zi;return e?t.then(this?e.bind(this):e):t}function gr(e){let t=ze+1,s=be.length;for(;t<s;){const n=t+s>>>1,i=be[n],o=Yt(i);o<e||o===e&&i.flags&2?t=n+1:s=n}return t}function _n(e){if(!(e.flags&1)){const t=Yt(e),s=be[be.length-1];!s||!(e.flags&2)&&t>=Yt(s)?be.push(e):be.splice(gr(t),0,e),e.flags|=1,Fi()}}function Fi(){ms||(ms=zi.then(Hi))}function mr(e){L(e)?St.push(...e):ot&&e.id===-1?ot.splice(wt+1,0,e):e.flags&1||(St.push(e),e.flags|=1),Fi()}function Mn(e,t,s=ze+1){for(;s<be.length;s++){const n=be[s];if(n&&n.flags&2){if(e&&n.id!==e.uid)continue;be.splice(s,1),s--,n.flags&4&&(n.flags&=-2),n(),n.flags&4||(n.flags&=-2)}}}function Bi(e){if(St.length){const t=[...new Set(St)].sort((s,n)=>Yt(s)-Yt(n));if(St.length=0,ot){ot.push(...t);return}for(ot=t,wt=0;wt<ot.length;wt++){const s=ot[wt];s.flags&4&&(s.flags&=-2),s.flags&8||s(),s.flags&=-2}ot=null,wt=0}}const Yt=e=>e.id==null?e.flags&2?-1:1/0:e.id;function Hi(e){try{for(ze=0;ze<be.length;ze++){const t=be[ze];t&&!(t.flags&8)&&(t.flags&4&&(t.flags&=-2),ts(t,t.i,t.i?15:14),t.flags&4||(t.flags&=-2))}}finally{for(;ze<be.length;ze++){const t=be[ze];t&&(t.flags&=-2)}ze=-1,be.length=0,Bi(),ms=null,(be.length||St.length)&&Hi()}}let xe=null,Vi=null;function bs(e){const t=xe;return xe=e,Vi=e&&e.type.__scopeId||null,t}function br(e,t=xe,s){if(!t||e._n)return e;const n=(...i)=>{n._d&&Gn(-1);const o=bs(t);let r;try{r=e(...i)}finally{bs(o),n._d&&Gn(1)}return r};return n._n=!0,n._c=!0,n._d=!0,n}function re(e,t){if(xe===null)return e;const s=Is(xe),n=e.dirs||(e.dirs=[]);for(let i=0;i<t.length;i++){let[o,r,l,a=Y]=t[i];o&&(H(o)&&(o={mounted:o,updated:o}),o.deep&&Ye(r),n.push({dir:o,instance:s,value:r,oldValue:void 0,arg:l,modifiers:a}))}return e}function ht(e,t,s,n){const i=e.dirs,o=t&&t.dirs;for(let r=0;r<i.length;r++){const l=i[r];o&&(l.oldValue=o[r].value);let a=l.dir[n];a&&(Ke(),Oe(a,s,8,[e.el,l,e,t]),We())}}function vr(e,t){if(ve){let s=ve.provides;const n=ve.parent&&ve.parent.provides;n===s&&(s=ve.provides=Object.create(n)),s[e]=t}}function ps(e,t,s=!1){const n=gl();if(n||Tt){let i=Tt?Tt._context.provides:n?n.parent==null||n.ce?n.vnode.appContext&&n.vnode.appContext.provides:n.parent.provides:void 0;if(i&&e in i)return i[e];if(arguments.length>1)return s&&H(t)?t.call(n&&n.proxy):t}}const _r=Symbol.for("v-scx"),yr=()=>ps(_r);function Fs(e,t,s){return Ki(e,t,s)}function Ki(e,t,s=Y){const{immediate:n,deep:i,flush:o,once:r}=s,l=he({},s),a=t&&n||!t&&o!=="post";let p;if(Qt){if(o==="sync"){const A=yr();p=A.__watcherHandles||(A.__watcherHandles=[])}else if(!a){const A=()=>{};return A.stop=He,A.resume=He,A.pause=He,A}}const u=ve;l.call=(A,D,C)=>Oe(A,u,D,C);let m=!1;o==="post"?l.scheduler=A=>{_e(A,u&&u.suspense)}:o!=="sync"&&(m=!0,l.scheduler=(A,D)=>{D?A():_n(A)}),l.augmentJob=A=>{t&&(A.flags|=4),m&&(A.flags|=2,u&&(A.id=u.uid,A.i=u))};const y=pr(e,t,l);return Qt&&(p?p.push(y):a&&y()),y}function wr(e,t,s){const n=this.proxy,i=ne(e)?e.includes(".")?Wi(n,e):()=>n[e]:e.bind(n,n);let o;H(t)?o=t:(o=t.handler,s=t);const r=ss(this),l=Ki(i,o.bind(n),s);return r(),l}function Wi(e,t){const s=t.split(".");return()=>{let n=e;for(let i=0;i<s.length&&n;i++)n=n[s[i]];return n}}const xr=Symbol("_vte"),kr=e=>e.__isTeleport,Bs=Symbol("_leaveCb");function yn(e,t){e.shapeFlag&6&&e.component?(e.transition=t,yn(e.component.subTree,t)):e.shapeFlag&128?(e.ssContent.transition=t.clone(e.ssContent),e.ssFallback.transition=t.clone(e.ssFallback)):e.transition=t}function Gi(e){e.ids=[e.ids[0]+e.ids[2]+++"-",0,0]}function Nn(e,t){let s;return!!((s=Object.getOwnPropertyDescriptor(e,t))&&!s.configurable)}const vs=new WeakMap;function Vt(e,t,s,n,i=!1){if(L(e)){e.forEach((C,P)=>Vt(C,t&&(L(t)?t[P]:t),s,n,i));return}if(Kt(n)&&!i){n.shapeFlag&512&&n.type.__asyncResolved&&n.component.subTree.component&&Vt(e,t,s,n.component.subTree);return}const o=n.shapeFlag&4?Is(n.component):n.el,r=i?null:o,{i:l,r:a}=e,p=t&&t.r,u=l.refs===Y?l.refs={}:l.refs,m=l.setupState,y=W(m),A=m===Y?gi:C=>Nn(u,C)?!1:G(y,C),D=(C,P)=>!(P&&Nn(u,P));if(p!=null&&p!==a){if(Dn(t),ne(p))u[p]=null,A(p)&&(m[p]=null);else if(fe(p)){const C=t;D(p,C.k)&&(p.value=null),C.k&&(u[C.k]=null)}}if(H(a)){Ke();try{ts(a,l,12,[r,u])}finally{We()}}else{const C=ne(a),P=fe(a);if(C||P){const T=()=>{if(e.f){con
Line truncated
|
||||
* @vue/runtime-dom v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/let on;const Jn=typeof window<"u"&&window.trustedTypes;if(Jn)try{on=Jn.createPolicy("vue",{createHTML:e=>e})}catch{}const _o=on?e=>on.createHTML(e):e=>e,xl="http://www.w3.org/2000/svg",kl="http://www.w3.org/1998/Math/MathML",qe=typeof document<"u"?document:null,Yn=qe&&qe.createElement("template"),Sl={insert:(e,t,s)=>{t.insertBefore(e,s||null)},remove:e=>{const t=e.parentNode;t&&t.removeChild(e)},createElement:(e,t,s,n)=>{const i=t==="svg"?qe.createElementNS(xl,e):t==="mathml"?qe.createElementNS(kl,e):s?qe.createElement(e,{is:s}):qe.createElement(e);return e==="select"&&n&&n.multiple!=null&&i.setAttribute("multiple",n.multiple),i},createText:e=>qe.createTextNode(e),createComment:e=>qe.createComment(e),setText:(e,t)=>{e.nodeValue=t},setElementText:(e,t)=>{e.textContent=t},parentNode:e=>e.parentNode,nextSibling:e=>e.nextSibling,querySelector:e=>qe.querySelector(e),setScopeId(e,t){e.setAttribute(t,"")},insertStaticContent(e,t,s,n,i,o){const r=s?s.previousSibling:t.lastChild;if(i&&(i===o||i.nextSibling))for(;t.insertBefore(i.cloneNode(!0),s),!(i===o||!(i=i.nextSibling)););else{Yn.innerHTML=_o(n==="svg"?`<svg>${e}</svg>`:n==="mathml"?`<math>${e}</math>`:e);const l=Yn.content;if(n==="svg"||n==="mathml"){const a=l.firstChild;for(;a.firstChild;)l.appendChild(a.firstChild);l.removeChild(a)}t.insertBefore(l,s)}return[r?r.nextSibling:t.firstChild,s?s.previousSibling:t.lastChild]}},Tl=Symbol("_vtc");function El(e,t,s){const n=e[Tl];n&&(t=(t?[t,...n]:[...n]).join(" ")),t==null?e.removeAttribute("class"):s?e.setAttribute("class",t):e.className=t}const Xn=Symbol("_vod"),Cl=Symbol("_vsh"),Pl=Symbol(""),$l=/(?:^|;)\s*display\s*:/;function Al(e,t,s){const n=e.style,i=ne(s);let o=!1;if(s&&!i){if(t)if(ne(t))for(const r of t.split(";")){const l=r.slice(0,r.indexOf(":")).trim();s[l]==null&&Lt(n,l,"")}else for(const r in t)s[r]==null&&Lt(n,r,"");for(const r in s){r==="display"&&(o=!0);const l=s[r];l!=null?Rl(e,r,!ne(t)&&t?t[r]:void 0,l)||Lt(n,r,l):Lt(n,r,"")}}else if(i){if(t!==s){const r=n[Pl];r&&(s+=";"+r),n.cssText=s,o=$l.test(s)}}else t&&e.removeAttribute("style");Xn in e&&(e[Xn]=o?n.display:"",e[Cl]&&(n.display="none"))}const Qn=/\s*!important$/;function Lt(e,t,s){if(L(s))s.forEach(n=>Lt(e,t,n));else if(s==null&&(s=""),t.startsWith("--"))e.setProperty(t,s);else{const n=Ol(e,t);Qn.test(s)?e.setProperty(ct(n),s.replace(Qn,""),"important"):e[n]=s}}const ei=["Webkit","Moz","ms"],Ws={};function Ol(e,t){const s=Ws[t];if(s)return s;let n=Ce(t);if(n!=="filter"&&n in e)return Ws[t]=n;n=_i(n);for(let i=0;i<ei.length;i++){const o=ei[i]+n;if(o in e)return Ws[t]=o}return t}function Rl(e,t,s,n){return e.tagName==="TEXTAREA"&&(t==="width"||t==="height")&&ne(n)&&s===n}const ti="http://www.w3.org/1999/xlink";function si(e,t,s,n,i,o=Do(t)){n&&t.startsWith("xlink:")?s==null?e.removeAttributeNS(ti,t.slice(6,t.length)):e.setAttributeNS(ti,t,s):s==null||o&&!wi(s)?e.removeAttribute(t):e.setAttribute(t,o?"":Ve(s)?String(s):s)}function ni(e,t,s,n,i){if(t==="innerHTML"||t==="textContent"){s!=null&&(e[t]=t==="innerHTML"?_o(s):s);return}const o=e.tagName;if(t==="value"&&o!=="PROGRESS"&&!o.includes("-")){const l=o==="OPTION"?e.getAttribute("value")||"":e.value,a=s==null?e.type==="checkbox"?"on":"":String(s);(l!==a||!("_value"in e))&&(e.value=a),s==null&&e.removeAttribute(t),e._value=s;return}let r=!1;if(s===""||s==null){const l=typeof e[t];l==="boolean"?s=wi(s):s==null&&l==="string"?(s="",r=!0):l==="number"&&(s=0,r=!0)}try{e[t]=s}catch{}r&&e.removeAttribute(i||t)}function Xe(e,t,s,n){e.addEventListener(t,s,n)}function Il(e,t,s,n){e.removeEventListener(t,s,n)}const ii=Symbol("_vei");function Ul(e,t,s,n,i=null){const o=e[ii]||(e[ii]={}),r=o[t];if(n&&r)r.value=n;else{const[l,a]=Nl(t);if(n){const p=o[t]=Ll(n,i);Xe(e,l,p,a)}else r&&(Il(e,l,r,a),o[t]=void 0)}}const jl=/(Once|Passive|Capture)$/,Ml=/^on:?(?:Once|Passive|Capture)$/;function Nl(e){let t,s;for(;(s=e.match(jl))&&!Ml.test(e);)t||(t={}),e=e.slice(0,e.length-s[1].length),t[s[1].toLowerCase()]=!0;return[e[2]===":"?e.slice(3):ct(e.slice(2)),t]}let Gs=0;const Dl=Promise.resolve(),zl=()=>Gs||(Dl.then(()=>Gs=0),Gs=Date.now());function Ll(e,t){const s=n=>{if(!n._vts)n._vts=Date.now();else if(n._vts<=s.attached)return;const i=s.value;if(L(i)){const o=n.stopImmediatePropagation;n.stopImmediatePropagation=()=>{o.call(n),n._stopped=!0};const r=i.slice(),l=[n];for(let a=0;a<r.length&&!n._stopped;a++){const p=r[a];p&&Oe(p,t,5,l)}}else Oe(i,t,5,[n])};return s.value=e,s.attached=zl(),s}const oi=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&e.charCodeAt(2)>96&&e.charCodeAt(2)<123,Fl=(e,t,s,n,i,o)=>{const r=i==="svg";t==="class"?El(e,n,r):t==="style"?Al(e,s,n):ks(t)?Ss(t)||Ul(e,t,s,n,o):(t[0]==="."?(t=t.slice(1),!0):t[0]==="^"?(t=t.slice(1),!1):Bl(e,t,n,r))?(ni(e,t,n),!e.tagName.includes("-")&&(t==="value"||t==="checked"||t==="selected")&&si(e,t,n,r,o,t!=="value")):e._isVueCE&&(Hl(e,t)||e._def.__asyncLoader&&(/[A-Z]/.test(t)||!ne(n)))?ni(e,Ce(t),n,o,t):(t==="true-value"?e._trueValue=n:t==="false-value"&&(e._fals
Line truncated
|
||||
@@ -0,0 +1,17 @@
|
||||
(function(){const t=document.createElement("link").relList;if(t&&t.supports&&t.supports("modulepreload"))return;for(const i of document.querySelectorAll('link[rel="modulepreload"]'))n(i);new MutationObserver(i=>{for(const o of i)if(o.type==="childList")for(const r of o.addedNodes)r.tagName==="LINK"&&r.rel==="modulepreload"&&n(r)}).observe(document,{childList:!0,subtree:!0});function s(i){const o={};return i.integrity&&(o.integrity=i.integrity),i.referrerPolicy&&(o.referrerPolicy=i.referrerPolicy),i.crossOrigin==="use-credentials"?o.credentials="include":i.crossOrigin==="anonymous"?o.credentials="omit":o.credentials="same-origin",o}function n(i){if(i.ep)return;i.ep=!0;const o=s(i);fetch(i.href,o)}})();/**
|
||||
* @vue/shared v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/function cn(e){const t=Object.create(null);for(const s of e.split(","))t[s]=1;return s=>s in t}const J={},xt=[],Ke=()=>{},mi=()=>!1,Ts=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&(e.charCodeAt(2)>122||e.charCodeAt(2)<97),Es=e=>e.startsWith("onUpdate:"),he=Object.assign,un=(e,t)=>{const s=e.indexOf(t);s>-1&&e.splice(s,1)},$o=Object.prototype.hasOwnProperty,G=(e,t)=>$o.call(e,t),M=Array.isArray,kt=e=>es(e)==="[object Map]",Rt=e=>es(e)==="[object Set]",jn=e=>es(e)==="[object Date]",H=e=>typeof e=="function",ne=e=>typeof e=="string",We=e=>typeof e=="symbol",Z=e=>e!==null&&typeof e=="object",bi=e=>(Z(e)||H(e))&&H(e.then)&&H(e.catch),vi=Object.prototype.toString,es=e=>vi.call(e),Ao=e=>es(e).slice(8,-1),_i=e=>es(e)==="[object Object]",dn=e=>ne(e)&&e!=="NaN"&&e[0]!=="-"&&""+parseInt(e,10)===e,Ft=cn(",key,ref,ref_for,ref_key,onVnodeBeforeMount,onVnodeMounted,onVnodeBeforeUpdate,onVnodeUpdated,onVnodeBeforeUnmount,onVnodeUnmounted"),Cs=e=>{const t=Object.create(null);return(s=>t[s]||(t[s]=e(s)))},Oo=/-\w/g,Pe=Cs(e=>e.replace(Oo,t=>t.slice(1).toUpperCase())),Ro=/\B([A-Z])/g,ut=Cs(e=>e.replace(Ro,"-$1").toLowerCase()),yi=Cs(e=>e.charAt(0).toUpperCase()+e.slice(1)),Ds=Cs(e=>e?`on${yi(e)}`:""),Ve=(e,t)=>!Object.is(e,t),fs=(e,...t)=>{for(let s=0;s<e.length;s++)e[s](...t)},wi=(e,t,s,n=!1)=>{Object.defineProperty(e,t,{configurable:!0,enumerable:!1,writable:n,value:s})},Ps=e=>{const t=parseFloat(e);return isNaN(t)?e:t};let zn;const $s=()=>zn||(zn=typeof globalThis<"u"?globalThis:typeof self<"u"?self:typeof window<"u"?window:typeof global<"u"?global:{});function fn(e){if(M(e)){const t={};for(let s=0;s<e.length;s++){const n=e[s],i=ne(n)?Uo(n):fn(n);if(i)for(const o in i)t[o]=i[o]}return t}else if(ne(e)||Z(e))return e}const Io=/;(?![^(]*\))/g,jo=/:([^]+)/,zo=/\/\*[^]*?\*\//g;function Uo(e){const t={};return e.replace(zo,"").split(Io).forEach(s=>{if(s){const n=s.split(jo);n.length>1&&(t[n[0].trim()]=n[1].trim())}}),t}function Oe(e){let t="";if(ne(e))t=e;else if(M(e))for(let s=0;s<e.length;s++){const n=Oe(e[s]);n&&(t+=n+" ")}else if(Z(e))for(const s in e)e[s]&&(t+=s+" ");return t.trim()}const No="itemscope,allowfullscreen,formnovalidate,ismap,nomodule,novalidate,readonly",Do=cn(No);function xi(e){return!!e||e===""}function Mo(e,t){if(e.length!==t.length)return!1;let s=!0;for(let n=0;s&&n<e.length;n++)s=lt(e[n],t[n]);return s}function lt(e,t){if(e===t)return!0;let s=jn(e),n=jn(t);if(s||n)return s&&n?e.getTime()===t.getTime():!1;if(s=We(e),n=We(t),s||n)return e===t;if(s=M(e),n=M(t),s||n)return s&&n?Mo(e,t):!1;if(s=Z(e),n=Z(t),s||n){if(!s||!n)return!1;const i=Object.keys(e).length,o=Object.keys(t).length;if(i!==o)return!1;for(const r in e){const l=e.hasOwnProperty(r),a=t.hasOwnProperty(r);if(l&&!a||!l&&a||!lt(e[r],t[r]))return!1}}return String(e)===String(t)}function pn(e,t){return e.findIndex(s=>lt(s,t))}const ki=e=>!!(e&&e.__v_isRef===!0),b=e=>ne(e)?e:e==null?"":M(e)||Z(e)&&(e.toString===vi||!H(e.toString))?ki(e)?b(e.value):JSON.stringify(e,Si,2):String(e),Si=(e,t)=>ki(t)?Si(e,t.value):kt(t)?{[`Map(${t.size})`]:[...t.entries()].reduce((s,[n,i],o)=>(s[Ms(n,o)+" =>"]=i,s),{})}:Rt(t)?{[`Set(${t.size})`]:[...t.values()].map(s=>Ms(s))}:We(t)?Ms(t):Z(t)&&!M(t)&&!_i(t)?String(t):t,Ms=(e,t="")=>{var s;return We(e)?`Symbol(${(s=e.description)!=null?s:t})`:e};/**
|
||||
* @vue/reactivity v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/let ce;class Lo{constructor(t=!1){this.detached=t,this._active=!0,this._on=0,this.effects=[],this.cleanups=[],this._isPaused=!1,this._warnOnRun=!0,this.__v_skip=!0,!t&&ce&&(ce.active?(this.parent=ce,this.index=(ce.scopes||(ce.scopes=[])).push(this)-1):(this._active=!1,this._warnOnRun=!1))}get active(){return this._active}pause(){if(this._active){this._isPaused=!0;let t,s;if(this.scopes)for(t=0,s=this.scopes.length;t<s;t++)this.scopes[t].pause();for(t=0,s=this.effects.length;t<s;t++)this.effects[t].pause()}}resume(){if(this._active&&this._isPaused){this._isPaused=!1;let t,s;if(this.scopes)for(t=0,s=this.scopes.length;t<s;t++)this.scopes[t].resume();for(t=0,s=this.effects.length;t<s;t++)this.effects[t].resume()}}run(t){if(this._active){const s=ce;try{return ce=this,t()}finally{ce=s}}}on(){++this._on===1&&(this.prevScope=ce,ce=this)}off(){if(this._on>0&&--this._on===0){if(ce===this)ce=this.prevScope;else{let t=ce;for(;t;){if(t.prevScope===this){t.prevScope=this.prevScope;break}t=t.prevScope}}this.prevScope=void 0}}stop(t){if(this._active){this._active=!1;let s,n;for(s=0,n=this.effects.length;s<n;s++)this.effects[s].stop();for(this.effects.length=0,s=0,n=this.cleanups.length;s<n;s++)this.cleanups[s]();if(this.cleanups.length=0,this.scopes){for(s=0,n=this.scopes.length;s<n;s++)this.scopes[s].stop(!0);this.scopes.length=0}if(!this.detached&&this.parent&&!t){const i=this.parent.scopes.pop();i&&i!==this&&(this.parent.scopes[this.index]=i,i.index=this.index)}this.parent=void 0}}}function Fo(){return ce}let Q;const Ls=new WeakSet;class Ti{constructor(t){this.fn=t,this.deps=void 0,this.depsTail=void 0,this.flags=5,this.next=void 0,this.cleanup=void 0,this.scheduler=void 0,ce&&(ce.active?ce.effects.push(this):this.flags&=-2)}pause(){this.flags|=64}resume(){this.flags&64&&(this.flags&=-65,Ls.has(this)&&(Ls.delete(this),this.trigger()))}notify(){this.flags&2&&!(this.flags&32)||this.flags&8||Ci(this)}run(){if(!(this.flags&1))return this.fn();this.flags|=2,Un(this),Pi(this);const t=Q,s=$e;Q=this,$e=!0;try{return this.fn()}finally{$i(this),Q=t,$e=s,this.flags&=-3}}stop(){if(this.flags&1){for(let t=this.deps;t;t=t.nextDep)mn(t);this.deps=this.depsTail=void 0,Un(this),this.onStop&&this.onStop(),this.flags&=-2}}trigger(){this.flags&64?Ls.add(this):this.scheduler?this.scheduler():this.runIfDirty()}runIfDirty(){Ys(this)&&this.run()}get dirty(){return Ys(this)}}let Ei=0,Bt,Ht;function Ci(e,t=!1){if(e.flags|=8,t){e.next=Ht,Ht=e;return}e.next=Bt,Bt=e}function hn(){Ei++}function gn(){if(--Ei>0)return;if(Ht){let t=Ht;for(Ht=void 0;t;){const s=t.next;t.next=void 0,t.flags&=-9,t=s}}let e;for(;Bt;){let t=Bt;for(Bt=void 0;t;){const s=t.next;if(t.next=void 0,t.flags&=-9,t.flags&1)try{t.trigger()}catch(n){e||(e=n)}t=s}}if(e)throw e}function Pi(e){for(let t=e.deps;t;t=t.nextDep)t.version=-1,t.prevActiveLink=t.dep.activeLink,t.dep.activeLink=t}function $i(e){let t,s=e.depsTail,n=s;for(;n;){const i=n.prevDep;n.version===-1?(n===s&&(s=i),mn(n),Bo(n)):t=n,n.dep.activeLink=n.prevActiveLink,n.prevActiveLink=void 0,n=i}e.deps=t,e.depsTail=s}function Ys(e){for(let t=e.deps;t;t=t.nextDep)if(t.dep.version!==t.version||t.dep.computed&&(Ai(t.dep.computed)||t.dep.version!==t.version))return!0;return!!e._dirty}function Ai(e){if(e.flags&4&&!(e.flags&16)||(e.flags&=-17,e.globalVersion===qt)||(e.globalVersion=qt,!e.isSSR&&e.flags&128&&(!e.deps&&!e._dirty||!Ys(e))))return;e.flags|=2;const t=e.dep,s=Q,n=$e;Q=e,$e=!0;try{Pi(e);const i=e.fn(e._value);(t.version===0||Ve(i,e._value))&&(e.flags|=128,e._value=i,t.version++)}catch(i){throw t.version++,i}finally{Q=s,$e=n,$i(e),e.flags&=-3}}function mn(e,t=!1){const{dep:s,prevSub:n,nextSub:i}=e;if(n&&(n.nextSub=i,e.prevSub=void 0),i&&(i.prevSub=n,e.nextSub=void 0),s.subs===e&&(s.subs=n,!n&&s.computed)){s.computed.flags&=-5;for(let o=s.computed.deps;o;o=o.nextDep)mn(o,!0)}!t&&!--s.sc&&s.map&&s.map.delete(s.key)}function Bo(e){const{prevDep:t,nextDep:s}=e;t&&(t.nextDep=s,e.prevDep=void 0),s&&(s.prevDep=t,e.nextDep=void 0)}let $e=!0;const Oi=[];function Ge(){Oi.push($e),$e=!1}function qe(){const e=Oi.pop();$e=e===void 0?!0:e}function Un(e){const{cleanup:t}=e;if(e.cleanup=void 0,t){const s=Q;Q=void 0;try{t()}finally{Q=s}}}let qt=0;class Ho{constructor(t,s){this.sub=t,this.dep=s,this.version=s.version,this.nextDep=this.prevDep=this.nextSub=this.prevSub=this.prevActiveLink=void 0}}class bn{constructor(t){this.computed=t,this.version=0,this.activeLink=void 0,this.subs=void 0,this.map=void 0,this.key=void 0,this.sc=0,this.__v_skip=!0}track(t){if(!Q||!$e||Q===this.computed)return;let s=this.activeLink;if(s===void 0||s.sub!==Q)s=this.activeLink=new Ho(Q,this),Q.deps?(s.prevDep=Q.depsTail,Q.depsTail.nextDep=s,Q.depsTail=s):Q.deps=Q.depsTail=s,Ri(s);else if(s.version===-1&&(s.version=this.version,s.nextDep)){const n=s.nextDep;n.prevDep=s.prevDep,s.prevDep&&(s.prevDep.nextDep=n),s.prevDep=Q.depsTail,s.nextDep=void 0,Q.depsTail.nextDep=s,Q.depsTail=s,Q.deps===s&&(Q.deps=n)}return s}trigger(t){this.version++,qt++,this.notify(t)}Line truncated
|
||||
* @vue/runtime-core v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/function ts(e,t,s,n){try{return n?e(...n):e()}catch(i){Os(i,t,s)}}function Ie(e,t,s,n){if(H(e)){const i=ts(e,t,s,n);return i&&bi(i)&&i.catch(o=>{Os(o,t,s)}),i}if(M(e)){const i=[];for(let o=0;o<e.length;o++)i.push(Ie(e[o],t,s,n));return i}}function Os(e,t,s,n=!0){const i=t?t.vnode:null,{errorHandler:o,throwUnhandledErrorInProduction:r}=t&&t.appContext.config||J;if(t){let l=t.parent;const a=t.proxy,p=`https://vuejs.org/error-reference/#runtime-${s}`;for(;l;){const u=l.ec;if(u){for(let m=0;m<u.length;m++)if(u[m](e,a,p)===!1)return}l=l.parent}if(o){Ge(),ts(o,null,10,[e,a,p]),qe();return}}hr(e,s,i,n,r)}function hr(e,t,s,n=!0,i=!1){if(i)throw e;console.error(e)}const be=[];let Fe=-1;const St=[];let rt=null,wt=0;const Li=Promise.resolve();let bs=null;function Fi(e){const t=bs||Li;return e?t.then(this?e.bind(this):e):t}function gr(e){let t=Fe+1,s=be.length;for(;t<s;){const n=t+s>>>1,i=be[n],o=Jt(i);o<e||o===e&&i.flags&2?t=n+1:s=n}return t}function wn(e){if(!(e.flags&1)){const t=Jt(e),s=be[be.length-1];!s||!(e.flags&2)&&t>=Jt(s)?be.push(e):be.splice(gr(t),0,e),e.flags|=1,Bi()}}function Bi(){bs||(bs=Li.then(Vi))}function mr(e){M(e)?St.push(...e):rt&&e.id===-1?rt.splice(wt+1,0,e):e.flags&1||(St.push(e),e.flags|=1),Bi()}function Dn(e,t,s=Fe+1){for(;s<be.length;s++){const n=be[s];if(n&&n.flags&2){if(e&&n.id!==e.uid)continue;be.splice(s,1),s--,n.flags&4&&(n.flags&=-2),n(),n.flags&4||(n.flags&=-2)}}}function Hi(e){if(St.length){const t=[...new Set(St)].sort((s,n)=>Jt(s)-Jt(n));if(St.length=0,rt){rt.push(...t);return}for(rt=t,wt=0;wt<rt.length;wt++){const s=rt[wt];s.flags&4&&(s.flags&=-2),s.flags&8||s(),s.flags&=-2}rt=null,wt=0}}const Jt=e=>e.id==null?e.flags&2?-1:1/0:e.id;function Vi(e){try{for(Fe=0;Fe<be.length;Fe++){const t=be[Fe];t&&!(t.flags&8)&&(t.flags&4&&(t.flags&=-2),ts(t,t.i,t.i?15:14),t.flags&4||(t.flags&=-2))}}finally{for(;Fe<be.length;Fe++){const t=be[Fe];t&&(t.flags&=-2)}Fe=-1,be.length=0,Hi(),bs=null,(be.length||St.length)&&Vi()}}let ke=null,Ki=null;function vs(e){const t=ke;return ke=e,Ki=e&&e.type.__scopeId||null,t}function br(e,t=ke,s){if(!t||e._n)return e;const n=(...i)=>{n._d&&Zn(-1);const o=vs(t);let r;try{r=e(...i)}finally{vs(o),n._d&&Zn(1)}return r};return n._n=!0,n._c=!0,n._d=!0,n}function le(e,t){if(ke===null)return e;const s=zs(ke),n=e.dirs||(e.dirs=[]);for(let i=0;i<t.length;i++){let[o,r,l,a=J]=t[i];o&&(H(o)&&(o={mounted:o,updated:o}),o.deep&&Qe(r),n.push({dir:o,instance:s,value:r,oldValue:void 0,arg:l,modifiers:a}))}return e}function gt(e,t,s,n){const i=e.dirs,o=t&&t.dirs;for(let r=0;r<i.length;r++){const l=i[r];o&&(l.oldValue=o[r].value);let a=l.dir[n];a&&(Ge(),Ie(a,s,8,[e.el,l,e,t]),qe())}}function vr(e,t){if(ve){let s=ve.provides;const n=ve.parent&&ve.parent.provides;n===s&&(s=ve.provides=Object.create(n)),s[e]=t}}function ps(e,t,s=!1){const n=gl();if(n||Tt){let i=Tt?Tt._context.provides:n?n.parent==null||n.ce?n.vnode.appContext&&n.vnode.appContext.provides:n.parent.provides:void 0;if(i&&e in i)return i[e];if(arguments.length>1)return s&&H(t)?t.call(n&&n.proxy):t}}const _r=Symbol.for("v-scx"),yr=()=>ps(_r);function Hs(e,t,s){return Wi(e,t,s)}function Wi(e,t,s=J){const{immediate:n,deep:i,flush:o,once:r}=s,l=he({},s),a=t&&n||!t&&o!=="post";let p;if(Qt){if(o==="sync"){const O=yr();p=O.__watcherHandles||(O.__watcherHandles=[])}else if(!a){const O=()=>{};return O.stop=Ke,O.resume=Ke,O.pause=Ke,O}}const u=ve;l.call=(O,F,_)=>Ie(O,u,F,_);let m=!1;o==="post"?l.scheduler=O=>{_e(O,u&&u.suspense)}:o!=="sync"&&(m=!0,l.scheduler=(O,F)=>{F?O():wn(O)}),l.augmentJob=O=>{t&&(O.flags|=4),m&&(O.flags|=2,u&&(O.id=u.uid,O.i=u))};const P=pr(e,t,l);return Qt&&(p?p.push(P):a&&P()),P}function wr(e,t,s){const n=this.proxy,i=ne(e)?e.includes(".")?Gi(n,e):()=>n[e]:e.bind(n,n);let o;H(t)?o=t:(o=t.handler,s=t);const r=ss(this),l=Wi(i,o.bind(n),s);return r(),l}function Gi(e,t){const s=t.split(".");return()=>{let n=e;for(let i=0;i<s.length&&n;i++)n=n[s[i]];return n}}const xr=Symbol("_vte"),kr=e=>e.__isTeleport,Vs=Symbol("_leaveCb");function xn(e,t){e.shapeFlag&6&&e.component?(e.transition=t,xn(e.component.subTree,t)):e.shapeFlag&128?(e.ssContent.transition=t.clone(e.ssContent),e.ssFallback.transition=t.clone(e.ssFallback)):e.transition=t}function qi(e){e.ids=[e.ids[0]+e.ids[2]+++"-",0,0]}function Mn(e,t){let s;return!!((s=Object.getOwnPropertyDescriptor(e,t))&&!s.configurable)}const _s=new WeakMap;function Vt(e,t,s,n,i=!1){if(M(e)){e.forEach((_,E)=>Vt(_,t&&(M(t)?t[E]:t),s,n,i));return}if(Kt(n)&&!i){n.shapeFlag&512&&n.type.__asyncResolved&&n.component.subTree.component&&Vt(e,t,s,n.component.subTree);return}const o=n.shapeFlag&4?zs(n.component):n.el,r=i?null:o,{i:l,r:a}=e,p=t&&t.r,u=l.refs===J?l.refs={}:l.refs,m=l.setupState,P=W(m),O=m===J?mi:_=>Mn(u,_)?!1:G(P,_),F=(_,E)=>!(E&&Mn(u,E));if(p!=null&&p!==a){if(Ln(t),ne(p))u[p]=null,O(p)&&(m[p]=null);else if(fe(p)){const _=t;F(p,_.k)&&(p.value=null),_.k&&(u[_.k]=null)}}if(H(a)){Ge();try{ts(a,l,12,[r,u])}finally{qe()}}else{const _=ne(a),E=fe(a);if(_||E){const y=()=>{if(e.f){con
Line truncated
|
||||
* @vue/runtime-dom v3.5.39
|
||||
* (c) 2018-present Yuxi (Evan) You and Vue contributors
|
||||
* @license MIT
|
||||
**/let ln;const Xn=typeof window<"u"&&window.trustedTypes;if(Xn)try{ln=Xn.createPolicy("vue",{createHTML:e=>e})}catch{}const yo=ln?e=>ln.createHTML(e):e=>e,xl="http://www.w3.org/2000/svg",kl="http://www.w3.org/1998/Math/MathML",Ye=typeof document<"u"?document:null,Qn=Ye&&Ye.createElement("template"),Sl={insert:(e,t,s)=>{t.insertBefore(e,s||null)},remove:e=>{const t=e.parentNode;t&&t.removeChild(e)},createElement:(e,t,s,n)=>{const i=t==="svg"?Ye.createElementNS(xl,e):t==="mathml"?Ye.createElementNS(kl,e):s?Ye.createElement(e,{is:s}):Ye.createElement(e);return e==="select"&&n&&n.multiple!=null&&i.setAttribute("multiple",n.multiple),i},createText:e=>Ye.createTextNode(e),createComment:e=>Ye.createComment(e),setText:(e,t)=>{e.nodeValue=t},setElementText:(e,t)=>{e.textContent=t},parentNode:e=>e.parentNode,nextSibling:e=>e.nextSibling,querySelector:e=>Ye.querySelector(e),setScopeId(e,t){e.setAttribute(t,"")},insertStaticContent(e,t,s,n,i,o){const r=s?s.previousSibling:t.lastChild;if(i&&(i===o||i.nextSibling))for(;t.insertBefore(i.cloneNode(!0),s),!(i===o||!(i=i.nextSibling)););else{Qn.innerHTML=yo(n==="svg"?`<svg>${e}</svg>`:n==="mathml"?`<math>${e}</math>`:e);const l=Qn.content;if(n==="svg"||n==="mathml"){const a=l.firstChild;for(;a.firstChild;)l.appendChild(a.firstChild);l.removeChild(a)}t.insertBefore(l,s)}return[r?r.nextSibling:t.firstChild,s?s.previousSibling:t.lastChild]}},Tl=Symbol("_vtc");function El(e,t,s){const n=e[Tl];n&&(t=(t?[t,...n]:[...n]).join(" ")),t==null?e.removeAttribute("class"):s?e.setAttribute("class",t):e.className=t}const ei=Symbol("_vod"),Cl=Symbol("_vsh"),Pl=Symbol(""),$l=/(?:^|;)\s*display\s*:/;function Al(e,t,s){const n=e.style,i=ne(s);let o=!1;if(s&&!i){if(t)if(ne(t))for(const r of t.split(";")){const l=r.slice(0,r.indexOf(":")).trim();s[l]==null&&Lt(n,l,"")}else for(const r in t)s[r]==null&&Lt(n,r,"");for(const r in s){r==="display"&&(o=!0);const l=s[r];l!=null?Rl(e,r,!ne(t)&&t?t[r]:void 0,l)||Lt(n,r,l):Lt(n,r,"")}}else if(i){if(t!==s){const r=n[Pl];r&&(s+=";"+r),n.cssText=s,o=$l.test(s)}}else t&&e.removeAttribute("style");ei in e&&(e[ei]=o?n.display:"",e[Cl]&&(n.display="none"))}const ti=/\s*!important$/;function Lt(e,t,s){if(M(s))s.forEach(n=>Lt(e,t,n));else if(s==null&&(s=""),t.startsWith("--"))e.setProperty(t,s);else{const n=Ol(e,t);ti.test(s)?e.setProperty(ut(n),s.replace(ti,""),"important"):e[n]=s}}const si=["Webkit","Moz","ms"],qs={};function Ol(e,t){const s=qs[t];if(s)return s;let n=Pe(t);if(n!=="filter"&&n in e)return qs[t]=n;n=yi(n);for(let i=0;i<si.length;i++){const o=si[i]+n;if(o in e)return qs[t]=o}return t}function Rl(e,t,s,n){return e.tagName==="TEXTAREA"&&(t==="width"||t==="height")&&ne(n)&&s===n}const ni="http://www.w3.org/1999/xlink";function ii(e,t,s,n,i,o=Do(t)){n&&t.startsWith("xlink:")?s==null?e.removeAttributeNS(ni,t.slice(6,t.length)):e.setAttributeNS(ni,t,s):s==null||o&&!xi(s)?e.removeAttribute(t):e.setAttribute(t,o?"":We(s)?String(s):s)}function oi(e,t,s,n,i){if(t==="innerHTML"||t==="textContent"){s!=null&&(e[t]=t==="innerHTML"?yo(s):s);return}const o=e.tagName;if(t==="value"&&o!=="PROGRESS"&&!o.includes("-")){const l=o==="OPTION"?e.getAttribute("value")||"":e.value,a=s==null?e.type==="checkbox"?"on":"":String(s);(l!==a||!("_value"in e))&&(e.value=a),s==null&&e.removeAttribute(t),e._value=s;return}let r=!1;if(s===""||s==null){const l=typeof e[t];l==="boolean"?s=xi(s):s==null&&l==="string"?(s="",r=!0):l==="number"&&(s=0,r=!0)}try{e[t]=s}catch{}r&&e.removeAttribute(i||t)}function et(e,t,s,n){e.addEventListener(t,s,n)}function Il(e,t,s,n){e.removeEventListener(t,s,n)}const ri=Symbol("_vei");function jl(e,t,s,n,i=null){const o=e[ri]||(e[ri]={}),r=o[t];if(n&&r)r.value=n;else{const[l,a]=Nl(t);if(n){const p=o[t]=Ll(n,i);et(e,l,p,a)}else r&&(Il(e,l,r,a),o[t]=void 0)}}const zl=/(Once|Passive|Capture)$/,Ul=/^on:?(?:Once|Passive|Capture)$/;function Nl(e){let t,s;for(;(s=e.match(zl))&&!Ul.test(e);)t||(t={}),e=e.slice(0,e.length-s[1].length),t[s[1].toLowerCase()]=!0;return[e[2]===":"?e.slice(3):ut(e.slice(2)),t]}let Zs=0;const Dl=Promise.resolve(),Ml=()=>Zs||(Dl.then(()=>Zs=0),Zs=Date.now());function Ll(e,t){const s=n=>{if(!n._vts)n._vts=Date.now();else if(n._vts<=s.attached)return;const i=s.value;if(M(i)){const o=n.stopImmediatePropagation;n.stopImmediatePropagation=()=>{o.call(n),n._stopped=!0};const r=i.slice(),l=[n];for(let a=0;a<r.length&&!n._stopped;a++){const p=r[a];p&&Ie(p,t,5,l)}}else Ie(i,t,5,[n])};return s.value=e,s.attached=Ml(),s}const li=e=>e.charCodeAt(0)===111&&e.charCodeAt(1)===110&&e.charCodeAt(2)>96&&e.charCodeAt(2)<123,Fl=(e,t,s,n,i,o)=>{const r=i==="svg";t==="class"?El(e,n,r):t==="style"?Al(e,s,n):Ts(t)?Es(t)||jl(e,t,s,n,o):(t[0]==="."?(t=t.slice(1),!0):t[0]==="^"?(t=t.slice(1),!1):Bl(e,t,n,r))?(oi(e,t,n),!e.tagName.includes("-")&&(t==="value"||t==="checked"||t==="selected")&&ii(e,t,n,r,o,t!=="value")):e._isVueCE&&(Hl(e,t)||e._def.__asyncLoader&&(/[A-Z]/.test(t)||!ne(n)))?oi(e,Pe(t),n,o,t):(t==="true-value"?e._trueValue=n:t==="false-value"&&(e._fals
Line truncated
|
||||
+1
-1
@@ -6,7 +6,7 @@
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||||
<meta name="theme-color" content="#2563eb" />
|
||||
<title>DriverVault · API Server</title>
|
||||
<script type="module" crossorigin src="/assets/index-D-rTgBao.js"></script>
|
||||
<script type="module" crossorigin src="/assets/index-OHZkxAdj.js"></script>
|
||||
<link rel="stylesheet" crossorigin href="/assets/index-D3MeNcl7.css">
|
||||
</head>
|
||||
<body>
|
||||
|
||||
@@ -33,6 +33,7 @@ type userRecord struct {
|
||||
FontSize string `json:"font_size"`
|
||||
DeletionRequestedAt string `json:"deletion_requested_at"`
|
||||
Role string `json:"role"`
|
||||
Organization string `json:"organization"`
|
||||
Created string `json:"created"`
|
||||
}
|
||||
|
||||
@@ -51,6 +52,8 @@ func (rec userRecord) toModel() models.User {
|
||||
FontSize: orDefault(rec.FontSize, "medium"),
|
||||
Role: orDefault(rec.Role, "user"),
|
||||
Created: rec.Created,
|
||||
|
||||
Organization: rec.Organization,
|
||||
}
|
||||
if t := parsePBDate(rec.DeletionRequestedAt); !t.IsZero() {
|
||||
u.DeletionRequestedAt = &t
|
||||
@@ -65,6 +68,17 @@ func orDefault(v, fallback string) string {
|
||||
return v
|
||||
}
|
||||
|
||||
// profileOf builds the profile payload for a user record, resolving their
|
||||
// organization's name so the clients can label the membership without a second
|
||||
// round trip. The lookup is best effort — an unresolvable name leaves the id.
|
||||
func (s *Server) profileOf(r *http.Request, rec *userRecord) models.User {
|
||||
u := rec.toModel()
|
||||
if u.Organization != "" {
|
||||
u.OrganizationName = s.orgName(r.Context(), u.Organization)
|
||||
}
|
||||
return u
|
||||
}
|
||||
|
||||
func (s *Server) fetchUser(r *http.Request, id string) (*userRecord, error) {
|
||||
var rec userRecord
|
||||
if err := s.pb.GetOne(r.Context(), s.usersCollection(), id, &rec); err != nil {
|
||||
@@ -84,7 +98,7 @@ func (s *Server) handleGetMe(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, rec))
|
||||
}
|
||||
|
||||
type updateMeRequest struct {
|
||||
@@ -181,7 +195,7 @@ func (s *Server) handleUpdateMe(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, &rec))
|
||||
}
|
||||
|
||||
type changePasswordRequest struct {
|
||||
@@ -256,7 +270,7 @@ func (s *Server) handleUploadAvatar(w http.ResponseWriter, r *http.Request) {
|
||||
writePBError(w, err)
|
||||
return
|
||||
}
|
||||
writeJSON(w, http.StatusOK, rec.toModel())
|
||||
writeJSON(w, http.StatusOK, s.profileOf(r, rec))
|
||||
}
|
||||
|
||||
func (s *Server) handleDeleteAvatar(w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
@@ -81,8 +81,24 @@ func (s *Server) handleListOrgs(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusOK, map[string]any{"organizations": list.Items})
|
||||
}
|
||||
|
||||
// POST /api/orgs — create an organization (superadmin only). Body: {name}.
|
||||
// POST /api/orgs — create an organization. Body: {name}. A superadmin may create
|
||||
// any number of organizations and is not attached to them (they manage every
|
||||
// tenant centrally). Any other user may create one only if they don't already
|
||||
// belong to an organization, and they become its admin and first member — the
|
||||
// self-service path for standing up a new tenant.
|
||||
//
|
||||
// This handler carries no requireRole gate (any authenticated caller may reach
|
||||
// it), so it checks the service account itself.
|
||||
func (s *Server) handleCreateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
if !s.pb.Configured() {
|
||||
writeError(w, http.StatusServiceUnavailable, "organizations are not configured on the server")
|
||||
return
|
||||
}
|
||||
who := caller(r)
|
||||
if !who.isSuperadmin() && who.OrgID != "" {
|
||||
writeError(w, http.StatusForbidden, "you already belong to an organization")
|
||||
return
|
||||
}
|
||||
name, ok := decodeOrgName(w, r)
|
||||
if !ok {
|
||||
return
|
||||
@@ -100,16 +116,42 @@ func (s *Server) handleCreateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
var org orgView
|
||||
_ = json.Unmarshal(data, &org)
|
||||
|
||||
// A non-superadmin creator becomes the admin of, and first member of, the org
|
||||
// they just made. If that promotion fails, roll the org back so we never leave
|
||||
// a stranded organization that nobody can administer.
|
||||
if !who.isSuperadmin() {
|
||||
data, status, err = s.pb.Raw(r.Context(), http.MethodPatch,
|
||||
"/api/collections/"+s.usersCollection()+"/records/"+url.PathEscape(who.ID),
|
||||
map[string]any{"organization": org.ID, "role": roleAdmin})
|
||||
if err != nil || status != http.StatusOK {
|
||||
_, _, _ = s.pb.Raw(r.Context(), http.MethodDelete,
|
||||
"/api/collections/"+colOrgs+"/records/"+url.PathEscape(org.ID), nil)
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
return
|
||||
}
|
||||
relay(w, status, data)
|
||||
return
|
||||
}
|
||||
}
|
||||
writeJSON(w, http.StatusCreated, map[string]any{"organization": org})
|
||||
}
|
||||
|
||||
// PATCH /api/orgs/{id} — rename an organization (superadmin only). Body: {name}.
|
||||
// PATCH /api/orgs/{id} — rename an organization (manager only). A superadmin may
|
||||
// rename any organization; an admin may rename only their own. Body: {name}.
|
||||
func (s *Server) handleUpdateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
who := caller(r)
|
||||
id := r.PathValue("id")
|
||||
if id == "" {
|
||||
writeError(w, http.StatusBadRequest, "missing organization id")
|
||||
return
|
||||
}
|
||||
// An admin is scoped to their own organization; a superadmin spans all.
|
||||
if !who.isSuperadmin() && (who.OrgID == "" || id != who.OrgID) {
|
||||
writeError(w, http.StatusForbidden, "you can only rename your own organization")
|
||||
return
|
||||
}
|
||||
name, ok := decodeOrgName(w, r)
|
||||
if !ok {
|
||||
return
|
||||
@@ -129,18 +171,35 @@ func (s *Server) handleUpdateOrg(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, http.StatusOK, map[string]any{"organization": org})
|
||||
}
|
||||
|
||||
// DELETE /api/orgs/{id} — delete an organization (superadmin only). Refused
|
||||
// while the org still has members, to avoid silently orphaning users.
|
||||
// DELETE /api/orgs/{id} — delete an organization (manager only). A superadmin may
|
||||
// delete any organization, but only once it has no members. An admin may delete
|
||||
// only their own organization, and only when they are its sole member: the admin
|
||||
// is detached and demoted back to a plain user, then the org is removed. Either
|
||||
// path refuses to silently orphan other members.
|
||||
func (s *Server) handleDeleteOrg(w http.ResponseWriter, r *http.Request) {
|
||||
who := caller(r)
|
||||
id := r.PathValue("id")
|
||||
if id == "" {
|
||||
writeError(w, http.StatusBadRequest, "missing organization id")
|
||||
return
|
||||
}
|
||||
|
||||
// Guard: block deletion if any user still belongs to this org.
|
||||
// Count the members that block deletion. A superadmin is blocked by anyone at
|
||||
// all; an admin deleting their own org is blocked only by *other* members,
|
||||
// since they detach themselves below.
|
||||
filter := "organization = \"" + id + "\""
|
||||
blocked := "organization still has members; reassign or remove them first"
|
||||
if !who.isSuperadmin() {
|
||||
// An admin is scoped to their own organization.
|
||||
if who.OrgID == "" || id != who.OrgID {
|
||||
writeError(w, http.StatusForbidden, "you can only delete your own organization")
|
||||
return
|
||||
}
|
||||
filter += " && id != \"" + who.ID + "\""
|
||||
blocked = "organization still has other members; reassign or remove them first"
|
||||
}
|
||||
countPath := "/api/collections/" + s.usersCollection() + "/records?perPage=1&fields=id&filter=" +
|
||||
url.QueryEscape("organization = \""+id+"\"")
|
||||
url.QueryEscape(filter)
|
||||
data, status, err := s.pb.Raw(r.Context(), http.MethodGet, countPath, nil)
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
@@ -152,7 +211,25 @@ func (s *Server) handleDeleteOrg(w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
_ = json.Unmarshal(data, &page)
|
||||
if page.TotalItems > 0 {
|
||||
writeError(w, http.StatusConflict, "organization still has members; reassign or remove them first")
|
||||
writeError(w, http.StatusConflict, blocked)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Detach and demote the admin so the org is empty before it is removed. Done
|
||||
// before the delete because users.organization does not cascade: a failed
|
||||
// delete leaves an empty org a superadmin can clean up, which beats leaving a
|
||||
// member pointing at an organization that no longer exists.
|
||||
if !who.isSuperadmin() {
|
||||
data, status, err = s.pb.Raw(r.Context(), http.MethodPatch,
|
||||
"/api/collections/"+s.usersCollection()+"/records/"+url.PathEscape(who.ID),
|
||||
map[string]any{"organization": "", "role": roleUser})
|
||||
if err != nil {
|
||||
writeUpstreamDown(w, err)
|
||||
return
|
||||
}
|
||||
if status != http.StatusOK {
|
||||
relay(w, status, data)
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,333 @@
|
||||
package api
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"drivervault/apiserver/internal/config"
|
||||
"drivervault/apiserver/internal/pb"
|
||||
)
|
||||
|
||||
// These tests cover the self-service organization flows through the real
|
||||
// Handler + middleware chain: an org-less user creating an org and being
|
||||
// promoted to its admin (including the rollback when that promotion fails), and
|
||||
// an admin renaming or deleting only their own organization. A stand-in
|
||||
// PocketBase (orgFakePB) serves exactly the endpoints those paths hit.
|
||||
|
||||
const (
|
||||
orgTestUserID = "u1"
|
||||
orgTestBearer = "user-bearer-token"
|
||||
orgTestNewID = "neworg1"
|
||||
)
|
||||
|
||||
// orgFakePB answers the identity, organization and user-record calls the org
|
||||
// handlers make, and records the writes so tests can assert on them.
|
||||
type orgFakePB struct {
|
||||
mu sync.Mutex
|
||||
|
||||
// Identity returned by auth-refresh.
|
||||
callerRole string
|
||||
callerOrg string
|
||||
|
||||
// Behaviour switches.
|
||||
userPatchStatus int // status for a caller promotion/demotion (200 when 0)
|
||||
memberCount int // totalItems for the blocking-member query
|
||||
|
||||
// Recorded effects.
|
||||
createdOrgs []string
|
||||
orgPatches []map[string]any
|
||||
orgDeletes []string
|
||||
userPatches []map[string]any
|
||||
}
|
||||
|
||||
func (f *orgFakePB) handler(t *testing.T) http.Handler {
|
||||
t.Helper()
|
||||
mux := http.NewServeMux()
|
||||
|
||||
// Service-account auth (pb.Client.Authenticate).
|
||||
mux.HandleFunc("POST /api/collections/_superusers/auth-with-password", func(w http.ResponseWriter, r *http.Request) {
|
||||
writeJSON(w, 200, map[string]any{"token": "svc-token"})
|
||||
})
|
||||
|
||||
// Identify the bearer (withAuth → identify → AuthRefresh).
|
||||
mux.HandleFunc("POST /api/collections/users/auth-refresh", func(w http.ResponseWriter, r *http.Request) {
|
||||
if r.Header.Get("Authorization") == "" {
|
||||
writeJSON(w, 401, map[string]any{})
|
||||
return
|
||||
}
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"record": map[string]any{
|
||||
"id": orgTestUserID, "email": "owner@test.local", "name": "Owner",
|
||||
"role": f.callerRole, "organization": f.callerOrg,
|
||||
}})
|
||||
})
|
||||
|
||||
// Organization create / rename / delete.
|
||||
mux.HandleFunc("POST /api/collections/organizations/records", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.createdOrgs = append(f.createdOrgs, orgTestNewID)
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"id": orgTestNewID, "name": body["name"], "created": "2026-08-17 10:00:00Z"})
|
||||
})
|
||||
mux.HandleFunc("PATCH /api/collections/organizations/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.orgPatches = append(f.orgPatches, body)
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"id": r.PathValue("id"), "name": body["name"]})
|
||||
})
|
||||
mux.HandleFunc("DELETE /api/collections/organizations/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
f.mu.Lock()
|
||||
f.orgDeletes = append(f.orgDeletes, r.PathValue("id"))
|
||||
f.mu.Unlock()
|
||||
writeJSON(w, 204, nil)
|
||||
})
|
||||
|
||||
// Blocking-member count for a delete.
|
||||
mux.HandleFunc("GET /api/collections/users/records", func(w http.ResponseWriter, r *http.Request) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
writeJSON(w, 200, map[string]any{"totalItems": f.memberCount, "items": []any{}})
|
||||
})
|
||||
|
||||
// Caller promotion / demotion.
|
||||
mux.HandleFunc("PATCH /api/collections/users/records/{id}", func(w http.ResponseWriter, r *http.Request) {
|
||||
var body map[string]any
|
||||
_ = json.NewDecoder(r.Body).Decode(&body)
|
||||
f.mu.Lock()
|
||||
f.userPatches = append(f.userPatches, body)
|
||||
status := f.userPatchStatus
|
||||
f.mu.Unlock()
|
||||
if status != 0 && status != 200 {
|
||||
writeJSON(w, status, map[string]any{"message": "cannot update user"})
|
||||
return
|
||||
}
|
||||
writeJSON(w, 200, map[string]any{"id": r.PathValue("id")})
|
||||
})
|
||||
|
||||
return mux
|
||||
}
|
||||
|
||||
// newOrgTestServer wires the fake PocketBase to a real Handler and returns the
|
||||
// app's base URL.
|
||||
func newOrgTestServer(t *testing.T, f *orgFakePB) string {
|
||||
t.Helper()
|
||||
pbSrv := httptest.NewServer(f.handler(t))
|
||||
t.Cleanup(pbSrv.Close)
|
||||
|
||||
s := New(config.Config{UsersCollection: "users"}, pb.New(pbSrv.URL, "admin@test.local", "pw"))
|
||||
appSrv := httptest.NewServer(s.Handler())
|
||||
t.Cleanup(appSrv.Close)
|
||||
return appSrv.URL
|
||||
}
|
||||
|
||||
// orgReq issues an authenticated request and returns the status and decoded body.
|
||||
func orgReq(t *testing.T, base, method, path string, body any) (int, map[string]any) {
|
||||
t.Helper()
|
||||
var buf bytes.Buffer
|
||||
if body != nil {
|
||||
if err := json.NewEncoder(&buf).Encode(body); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
req, err := http.NewRequest(method, base+path, &buf)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
req.Header.Set("Authorization", "Bearer "+orgTestBearer)
|
||||
req.Header.Set("Content-Type", "application/json")
|
||||
resp, err := http.DefaultClient.Do(req)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
out := map[string]any{}
|
||||
_ = json.NewDecoder(resp.Body).Decode(&out)
|
||||
return resp.StatusCode, out
|
||||
}
|
||||
|
||||
func TestCreateOrgPromotesCreatorToAdmin(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Acme Inc."})
|
||||
if status != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201 (body %v)", status, body)
|
||||
}
|
||||
org, _ := body["organization"].(map[string]any)
|
||||
if org["id"] != orgTestNewID || org["name"] != "Acme Inc." {
|
||||
t.Fatalf("organization = %v, want id %q name %q", org, orgTestNewID, "Acme Inc.")
|
||||
}
|
||||
|
||||
if len(f.userPatches) != 1 {
|
||||
t.Fatalf("user patches = %d, want 1 (%v)", len(f.userPatches), f.userPatches)
|
||||
}
|
||||
patch := f.userPatches[0]
|
||||
if patch["organization"] != orgTestNewID {
|
||||
t.Errorf("patched organization = %v, want %q", patch["organization"], orgTestNewID)
|
||||
}
|
||||
if patch["role"] != roleAdmin {
|
||||
t.Errorf("patched role = %v, want %q", patch["role"], roleAdmin)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org was rolled back unexpectedly: %v", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateOrgRejectedWhenCallerAlreadyHasOne(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "existing1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Second Org"})
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403 (body %v)", status, body)
|
||||
}
|
||||
if len(f.createdOrgs) != 0 {
|
||||
t.Errorf("created orgs = %v, want none", f.createdOrgs)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
// A superadmin manages every tenant centrally, so creating one must not move
|
||||
// them into it or change their role.
|
||||
func TestCreateOrgLeavesSuperadminUnattached(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleSuperadmin, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Tenant A"})
|
||||
if status != http.StatusCreated {
|
||||
t.Fatalf("status = %d, want 201 (body %v)", status, body)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none for a superadmin", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
// If the creator cannot be promoted, the new org must not survive — otherwise it
|
||||
// is stranded with nobody able to administer it.
|
||||
func TestCreateOrgRollsBackWhenPromotionFails(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "", userPatchStatus: http.StatusBadRequest}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": "Doomed"})
|
||||
if status == http.StatusCreated {
|
||||
t.Fatalf("status = %d, want a failure", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 1 || f.orgDeletes[0] != orgTestNewID {
|
||||
t.Errorf("org deletes = %v, want rollback of %q", f.orgDeletes, orgTestNewID)
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateOrgRejectsBadName(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: ""}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodPost, "/api/orgs", map[string]any{"name": " "})
|
||||
if status != http.StatusBadRequest {
|
||||
t.Fatalf("status = %d, want 400", status)
|
||||
}
|
||||
if len(f.createdOrgs) != 0 {
|
||||
t.Errorf("created orgs = %v, want none", f.createdOrgs)
|
||||
}
|
||||
}
|
||||
|
||||
func TestUpdateOrgAdminScopedToOwnOrg(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
// Someone else's organization is off limits.
|
||||
status, _ := orgReq(t, base, http.MethodPatch, "/api/orgs/o2", map[string]any{"name": "Hijack"})
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("foreign org status = %d, want 403", status)
|
||||
}
|
||||
if len(f.orgPatches) != 0 {
|
||||
t.Fatalf("org patches = %v, want none", f.orgPatches)
|
||||
}
|
||||
|
||||
// Their own is fine.
|
||||
status, body := orgReq(t, base, http.MethodPatch, "/api/orgs/o1", map[string]any{"name": "Renamed"})
|
||||
if status != http.StatusOK {
|
||||
t.Fatalf("own org status = %d, want 200 (body %v)", status, body)
|
||||
}
|
||||
if len(f.orgPatches) != 1 || f.orgPatches[0]["name"] != "Renamed" {
|
||||
t.Errorf("org patches = %v, want one rename to %q", f.orgPatches, "Renamed")
|
||||
}
|
||||
}
|
||||
|
||||
// An admin deleting their own org is detached and demoted first, so the org is
|
||||
// empty by the time it is removed.
|
||||
func TestDeleteOrgAdminSoleMemberIsDetachedAndDemoted(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1", memberCount: 0}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, body := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil)
|
||||
if status != http.StatusOK {
|
||||
t.Fatalf("status = %d, want 200 (body %v)", status, body)
|
||||
}
|
||||
if len(f.userPatches) != 1 {
|
||||
t.Fatalf("user patches = %d, want 1 (%v)", len(f.userPatches), f.userPatches)
|
||||
}
|
||||
patch := f.userPatches[0]
|
||||
if patch["organization"] != "" {
|
||||
t.Errorf("patched organization = %v, want cleared", patch["organization"])
|
||||
}
|
||||
if patch["role"] != roleUser {
|
||||
t.Errorf("patched role = %v, want %q", patch["role"], roleUser)
|
||||
}
|
||||
if len(f.orgDeletes) != 1 || f.orgDeletes[0] != "o1" {
|
||||
t.Errorf("org deletes = %v, want [o1]", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteOrgBlockedByOtherMembers(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1", memberCount: 2}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil)
|
||||
if status != http.StatusConflict {
|
||||
t.Fatalf("status = %d, want 409", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org deletes = %v, want none", f.orgDeletes)
|
||||
}
|
||||
if len(f.userPatches) != 0 {
|
||||
t.Errorf("user patches = %v, want none — the admin must stay put", f.userPatches)
|
||||
}
|
||||
}
|
||||
|
||||
func TestDeleteOrgAdminCannotDeleteForeignOrg(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleAdmin, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o2", nil)
|
||||
if status != http.StatusForbidden {
|
||||
t.Fatalf("status = %d, want 403", status)
|
||||
}
|
||||
if len(f.orgDeletes) != 0 {
|
||||
t.Errorf("org deletes = %v, want none", f.orgDeletes)
|
||||
}
|
||||
}
|
||||
|
||||
// A plain user is not a manager, so rename/delete stay closed to them even for
|
||||
// the org they belong to.
|
||||
func TestPlainUserCannotManageOrgs(t *testing.T) {
|
||||
f := &orgFakePB{callerRole: roleUser, callerOrg: "o1"}
|
||||
base := newOrgTestServer(t, f)
|
||||
|
||||
if status, _ := orgReq(t, base, http.MethodPatch, "/api/orgs/o1", map[string]any{"name": "Nope"}); status != http.StatusForbidden {
|
||||
t.Errorf("rename status = %d, want 403", status)
|
||||
}
|
||||
if status, _ := orgReq(t, base, http.MethodDelete, "/api/orgs/o1", nil); status != http.StatusForbidden {
|
||||
t.Errorf("delete status = %d, want 403", status)
|
||||
}
|
||||
}
|
||||
@@ -28,7 +28,7 @@
|
||||
// GET /api/me/export POST /api/me/import
|
||||
// POST /api/me/delete POST /api/me/delete/cancel
|
||||
//
|
||||
// # users + organizations (manager; writes to orgs are superadmin-only)
|
||||
// # users + organizations (manager; POST /api/orgs is open to any user)
|
||||
// GET /api/users POST /api/users
|
||||
// PATCH /api/users/{id} DELETE /api/users/{id}
|
||||
// GET /api/orgs POST /api/orgs
|
||||
@@ -285,12 +285,15 @@ func (s *Server) Handler() http.Handler {
|
||||
mux.HandleFunc("PATCH /api/users/{id}", s.requireManager(s.handleUpdateUser))
|
||||
mux.HandleFunc("DELETE /api/users/{id}", s.requireManager(s.handleDeleteUser))
|
||||
|
||||
// Organizations — listing is manager-scoped; create/edit/delete are
|
||||
// superadmin-only (a superadmin spans all organizations).
|
||||
// Organizations — the tenants users belong to. Listing is manager-scoped (an
|
||||
// admin sees only their own org). Any org-less user may create an org and
|
||||
// becomes its admin; an admin may rename or delete their own org; a superadmin
|
||||
// spans every organization. Create carries no role gate, so it checks the
|
||||
// service account itself.
|
||||
mux.HandleFunc("GET /api/orgs", s.requireManager(s.handleListOrgs))
|
||||
mux.HandleFunc("POST /api/orgs", s.requireSuperadmin(s.handleCreateOrg))
|
||||
mux.HandleFunc("PATCH /api/orgs/{id}", s.requireSuperadmin(s.handleUpdateOrg))
|
||||
mux.HandleFunc("DELETE /api/orgs/{id}", s.requireSuperadmin(s.handleDeleteOrg))
|
||||
mux.HandleFunc("POST /api/orgs", s.handleCreateOrg)
|
||||
mux.HandleFunc("PATCH /api/orgs/{id}", s.requireManager(s.handleUpdateOrg))
|
||||
mux.HandleFunc("DELETE /api/orgs/{id}", s.requireManager(s.handleDeleteOrg))
|
||||
|
||||
// PocketBase connection settings — superadmin only. These do NOT require the
|
||||
// service account to already be configured (they exist to configure it).
|
||||
|
||||
Reference in new issue
Block a user