mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-10 05:12:14 +00:00
Marc-André Bombeck
e2eea55b6e
The dead-code gate has been red on this branch since the sharing refusal contracts landed. Neither name is new and neither was noticed, because knip is not in the local gate. consentRequiredResponse lost its last caller when every delegable route started sharing one 403 description through recordRefusal(); the AI consent sentence it wrapped is still used and stays, with a note at the constant saying why there is no response object beside it any more. mutateThenRestore was written with the sharing security fixtures and has never been called. No ignore entries: an export with no consumer is the thing the gate is for.
63 lines
1.9 KiB
TypeScript
63 lines
1.9 KiB
TypeScript
export type ExternalOrigin = "owner-request" | "delegated-request";
|
|
export type GrantState = "active" | "revoked" | "not-required";
|
|
|
|
export interface SecurityPrincipalFixture {
|
|
readonly identities: {
|
|
readonly actorUserId: string;
|
|
readonly recordUserId: string;
|
|
readonly recipientUserId: string;
|
|
};
|
|
readonly origin: ExternalOrigin;
|
|
readonly grant: {
|
|
readonly id: string | null;
|
|
readonly state: GrantState;
|
|
};
|
|
readonly job: {
|
|
readonly id: string;
|
|
readonly origin: ExternalOrigin;
|
|
};
|
|
}
|
|
|
|
export const SECURITY_PRINCIPALS = {
|
|
activeDelegation: {
|
|
identities: {
|
|
actorUserId: "guardian-alpha",
|
|
recordUserId: "managed-profile-alpha",
|
|
recipientUserId: "guardian-beta",
|
|
},
|
|
origin: "delegated-request",
|
|
grant: { id: "grant-active-alpha", state: "active" },
|
|
job: { id: "job-active-alpha", origin: "delegated-request" },
|
|
},
|
|
revokedDelegation: {
|
|
identities: {
|
|
actorUserId: "guardian-alpha",
|
|
recordUserId: "managed-profile-alpha",
|
|
recipientUserId: "guardian-beta",
|
|
},
|
|
origin: "delegated-request",
|
|
grant: { id: "grant-revoked-alpha", state: "revoked" },
|
|
job: { id: "job-revoked-alpha", origin: "delegated-request" },
|
|
},
|
|
ownerProviderPositiveControl: {
|
|
identities: {
|
|
actorUserId: "owner-alpha",
|
|
recordUserId: "owner-alpha",
|
|
recipientUserId: "owner-alpha",
|
|
},
|
|
origin: "owner-request",
|
|
grant: { id: null, state: "not-required" },
|
|
job: { id: "job-owner-provider", origin: "owner-request" },
|
|
},
|
|
ownerIdempotencyPositiveControl: {
|
|
identities: {
|
|
actorUserId: "owner-beta",
|
|
recordUserId: "owner-beta",
|
|
recipientUserId: "owner-beta",
|
|
},
|
|
origin: "owner-request",
|
|
grant: { id: null, state: "not-required" },
|
|
job: { id: "job-owner-idempotency", origin: "owner-request" },
|
|
},
|
|
} as const satisfies Record<string, SecurityPrincipalFixture>;
|