mnote/rust/crates/mnote-web/src/ssr/pages/admin.rs

//! MNOTE 文件夹授权管理组件

use crate::routes::control_plane_status_display;
use leptos::prelude::*;

#[component]
pub fn AdminAccessPolicyPanel(
    #[prop(optional)] workspace_name: Option<String>,
    #[prop(optional)] share_grants_path: Option<String>,
    #[prop(optional, default = true)] is_admin: bool,
    #[prop(optional, default = true)] boot_script: bool,
) -> impl IntoView {
    let workspace_name = workspace_name
        .unwrap_or_else(|| "开发用户 的空间".to_string())
        .trim()
        .to_string();
    let share_grants_path = share_grants_path.unwrap_or_else(control_plane_status_display);
    let scope_text = if is_admin {
        "管理员可以授权任意本地文件夹。"
    } else {
        "普通用户只能授权自己空间下的文件夹。"
    };
    view! {
        <div
            class="mnote-admin-policy-dialog__content"
            data-testid="mnote-admin-access-policy-page"
            data-access-policy-role={if is_admin { "admin" } else { "user" }}
        >
            <header class="mnote-admin-policy-header">
                <div>
                    <div class="mnote-admin-policy-eyebrow">"授权管理"</div>
                    <h2 id="mnote-admin-policy-dialog-title">"文件夹授权"</h2>
                    <p>{scope_text}</p>
                </div>
            </header>

            <section class="mnote-admin-policy-summary">
                <div class="mnote-admin-policy-summary-item">
                    <span class="mnote-admin-policy-summary-label">"工作区"</span>
                    <strong data-testid="mnote-admin-workspace-name">{workspace_name.clone()}</strong>
                </div>
                <div class="mnote-admin-policy-summary-item">
                    <span class="mnote-admin-policy-summary-label">"控制面"</span>
                    <code data-testid="mnote-admin-share-grants-path">{share_grants_path.clone()}</code>
                </div>
            </section>

            <section class="mnote-admin-policy-grid">
                <form class="mnote-admin-policy-form" data-admin-form="create-share-grant">
                    <header><h3>"新增文件夹授权"</h3></header>
                    <label>
                        <span>"文件夹地址"</span>
                        <input data-testid="mnote-admin-share-root-path" name="rootPath" type="text" placeholder="/mnt/Data1T/Mnote_data/users/..." required=true />
                    </label>
                    <label>
                        <span>"授权用户 ID"</span>
                        <input data-testid="mnote-admin-share-target-user-id" name="targetUserId" type="text" placeholder="user_123" required=true />
                    </label>
                    <label>
                        <span>"权限"</span>
                        <select data-testid="mnote-admin-share-permission" name="sharePermission">
                            <option value="read">"read"</option>
                            <option value="write">"write"</option>
                        </select>
                    </label>
                    <button type="submit" data-testid="mnote-admin-create-share-grant-submit">"创建授权"</button>
                    <pre class="mnote-admin-policy-json" data-testid="mnote-admin-create-share-grant-result"></pre>
                </form>

                <section class="mnote-admin-policy-panel" data-testid="mnote-admin-share-grants-panel">
                    <header class="mnote-admin-policy-panel-header">
                        <div>
                            <h3>"授权列表"</h3>
                            <p class="mnote-admin-policy-note">"查看当前可管理的文件夹授权，并撤销不再需要的授权。"</p>
                        </div>
                        <button type="button" data-testid="mnote-admin-share-grants-refresh" data-admin-action="refresh-share-grants">"刷新"</button>
                    </header>
                    <div class="mnote-admin-policy-table" data-testid="mnote-admin-share-grants-list">
                        <div class="mnote-admin-policy-empty">"正在读取授权..."</div>
                    </div>
                    <details class="mnote-admin-policy-debug">
                        <summary>"查看授权 JSON"</summary>
                        <pre class="mnote-admin-policy-json" data-testid="mnote-admin-share-grants-json">{""}</pre>
                    </details>
                    <div class="mnote-admin-policy-note" data-testid="mnote-admin-share-grants-message"></div>
                    <pre class="mnote-admin-policy-json" data-testid="mnote-admin-delete-share-grant-result" hidden></pre>
                </section>
            </section>
            <script id="__MNOTE_ACCESS_POLICY_PAGE__" type="application/json">
                {format!(r#"{{"isAdmin":{}}}"#, if is_admin { "true" } else { "false" })}
            </script>
            {if boot_script {
                view! { <script>{ADMIN_POLICY_SCRIPT}</script> }.into_any()
            } else {
                view! {}.into_any()
            }}
        </div>
    }
}

pub(crate) const ADMIN_POLICY_SCRIPT: &str = r#"
(function () {
  function initAccessPolicyPanel(scope) {
  var root = (scope || document).querySelector('[data-testid="mnote-admin-access-policy-page"]');
  if (!root) return;
  if (root.getAttribute('data-access-policy-ready') === 'true') return;
  root.setAttribute('data-access-policy-ready', 'true');
  var shareGrantsJson = root.querySelector('[data-testid="mnote-admin-share-grants-json"]');
  var shareGrantsMessage = root.querySelector('[data-testid="mnote-admin-share-grants-message"]');
  var createShareGrantResult = root.querySelector('[data-testid="mnote-admin-create-share-grant-result"]');
  var deleteShareGrantResult = root.querySelector('[data-testid="mnote-admin-delete-share-grant-result"]');
  var refreshShareGrantsButton = root.querySelector('[data-admin-action="refresh-share-grants"]');
  var shareGrantsList = root.querySelector('[data-testid="mnote-admin-share-grants-list"]');
  var currentActorId = document.body && document.body.getAttribute ? String(document.body.getAttribute('data-mnote-actor-id') || '').trim() : '';
  var pageConfig = (function () {
    var node = root.querySelector('#__MNOTE_ACCESS_POLICY_PAGE__');
    try { return JSON.parse(node ? node.textContent || '{}' : '{}'); } catch (_) { return {}; }
  })();
  var isAdmin = pageConfig.isAdmin === true;

  function setText(node, value) {
    if (!node) return;
    node.textContent = typeof value === 'string' ? value : JSON.stringify(value, null, 2);
  }

  function escapeHtml(value) {
    return String(value == null ? '' : value)
      .replace(/&/g, '&amp;')
      .replace(/</g, '&lt;')
      .replace(/>/g, '&gt;')
      .replace(/"/g, '&quot;')
      .replace(/'/g, '&#39;');
  }

  function renderBadge(value) {
    var text = String(value || '').trim() || 'read';
    return '<span class="mnote-admin-policy-badge" data-value="' + escapeHtml(text) + '">' + escapeHtml(text) + '</span>';
  }

  function readDirectoryGrants(payload) {
    if (payload && Array.isArray(payload.grants)) return payload.grants;
    if (payload && payload.policy && Array.isArray(payload.policy.grants)) return payload.policy.grants;
    return [];
  }

  function accessPolicyUrl(suffix) {
    var base = isAdmin ? '/api/admin/access-policy' : '/api/user/access-policy';
    return suffix ? base + suffix : base;
  }

  function pathToFileRootUri(value) {
    var trimmed = String(value || '').trim();
    if (!trimmed) return '';
    if (/^file:\/\//i.test(trimmed)) return trimmed;
    if (trimmed.charAt(0) !== '/') return '';
    return 'file://' + trimmed.split('/').map(function(part, index) {
      return index === 0 ? '' : encodeURIComponent(part);
    }).join('/');
  }

  function localFolderOpenHref(grant) {
    var rootUri = String(grant.rootUri || '').trim();
    if (rootUri && !/^file:\/\//i.test(rootUri)) rootUri = '';
    if (!rootUri) {
      var rootPath = String(grant.rootPath || '').trim();
      if (rootPath) rootUri = pathToFileRootUri(rootPath);
    }
    if (!rootUri) {
      rootUri = pathToFileRootUri(String(grant.rootUri || '').trim());
    }
    if (!rootUri) return '';
    var url = new URL('/', window.location.origin);
    url.searchParams.set('treeView', 'filetree');
    url.searchParams.set('sourceKind', 'local_folder');
    url.searchParams.set('rootUri', rootUri);
    return url.pathname + url.search;
  }

  function isDefaultWorkspaceAutoGrant(grant) {
    var source = String(grant && grant.source || '').trim();
    var workspaceId = String(grant && grant.workspaceId || '').trim();
    var rootUri = String(grant && grant.rootUri || '').trim();
    var permission = String(grant && grant.permission || '').trim();
    var createdBy = String(grant && (grant.createdBy || grant.ownerUserId) || '').trim();
    var targetUser = String(grant && (grant.userId || grant.targetUserId) || '').trim();
    return source === 'auto'
      && workspaceId
      && permission === 'write'
      && createdBy === targetUser
      && /^local:\/\/users\/.+\/workspaces\/my-space$/.test(rootUri);
  }

  function renderShareGrants(payload) {
    if (!shareGrantsList) return;
    var grants = readDirectoryGrants(payload);
    if (!grants.length) {
      shareGrantsList.innerHTML = '<div class="mnote-admin-policy-empty">暂无文件夹授权</div>';
      return;
    }
    shareGrantsList.innerHTML = grants.map(function(grant) {
      var active = grant.active === false || grant.status === 'revoked' ? '已撤销' : '有效';
      var openHref = localFolderOpenHref(grant);
      var rootLabel = escapeHtml(grant.rootPath || grant.rootUri || '');
      var createdBy = String(grant.createdBy || grant.ownerUserId || '').trim();
      var systemOwned = isDefaultWorkspaceAutoGrant(grant);
      var canRevoke = !systemOwned && (isAdmin || (createdBy && currentActorId && createdBy === currentActorId));
      var rootNode = openHref
        ? '<a class="mnote-admin-policy-root-link" data-testid="mnote-admin-open-granted-root" href="' + escapeHtml(openHref) + '">' + rootLabel + '</a>'
        : '<strong>' + rootLabel + '</strong>';
      var revokeButton = grant.active === false || !canRevoke ? '' :
        '<button type="button" data-admin-action="revoke-access-grant" data-grant-id="' + escapeHtml(grant.id || '') + '">撤销</button>';
      return '<article class="mnote-admin-policy-row">' +
        '<div>' + rootNode + '<span>授权用户 ' + escapeHtml(grant.targetUserId || grant.userId || '') + '</span></div>' +
        '<div>' + renderBadge(grant.permission) + renderBadge(active) + '</div>' +
        '<div><span>创建者 ' + escapeHtml(createdBy) + '</span><span>授权 ID ' + escapeHtml(grant.id || '') + '</span>' + revokeButton + '</div>' +
      '</article>';
    }).join('');
  }

  function shareGrantFormValues(form) {
    var data = new FormData(form);
    return {
      userId: String(data.get('targetUserId') || '').trim(),
      targetUserId: String(data.get('targetUserId') || '').trim(),
      rootPath: String(data.get('rootPath') || '').trim(),
      permission: String(data.get('sharePermission') || 'read').trim(),
    };
  }

  async function requestJson(url, options) {
    var response = await fetch(url, {
      credentials: 'include',
      headers: { 'content-type': 'application/json' },
      ...options,
    });
    var payload = await response.json().catch(function () { return {}; });
    if (!response.ok || payload.ok === false) {
      throw new Error((payload && payload.message) || ('请求失败: ' + response.status));
    }
    return payload;
  }

  async function refreshShareGrants() {
    var payload = await requestJson(accessPolicyUrl(''), { method: 'GET', headers: {} });
    setText(shareGrantsJson, payload);
    renderShareGrants(payload);
    setText(shareGrantsMessage, '已刷新授权列表');
  }

  refreshShareGrantsButton && refreshShareGrantsButton.addEventListener('click', function () {
    setText(shareGrantsMessage, '正在刷新授权列表...');
    refreshShareGrants().catch(function (error) { setText(shareGrantsMessage, error.message || '刷新失败'); });
  });

  root.querySelector('[data-admin-form="create-share-grant"]').addEventListener('submit', function (event) {
    event.preventDefault();
    var form = event.currentTarget;
    var values = shareGrantFormValues(form);
    setText(createShareGrantResult, '正在创建...');
    requestJson(accessPolicyUrl('/grants'), {
      method: 'POST',
      body: JSON.stringify(values),
    }).then(function (payload) {
      setText(createShareGrantResult, payload);
      setText(shareGrantsMessage, '文件夹授权已创建');
      form.reset();
      return refreshShareGrants();
    }).catch(function (error) {
      setText(createShareGrantResult, { ok: false, error: error.message || '创建失败' });
      setText(shareGrantsMessage, error.message || '创建失败');
    });
  });

  shareGrantsList && shareGrantsList.addEventListener('click', function(event) {
    var button = event.target && event.target.closest ? event.target.closest('[data-admin-action="revoke-access-grant"]') : null;
    if (!button) return;
    event.preventDefault();
    var grantId = String(button.getAttribute('data-grant-id') || '').trim();
    if (!grantId) return;
    setText(deleteShareGrantResult, '正在撤销...');
    requestJson(accessPolicyUrl('/grants/') + encodeURIComponent(grantId), {
      method: 'DELETE',
      headers: {},
    }).then(function (payload) {
      setText(deleteShareGrantResult, payload);
      setText(shareGrantsMessage, '文件夹授权已撤销');
      return refreshShareGrants();
    }).catch(function (error) {
      setText(deleteShareGrantResult, { ok: false, error: error.message || '撤销失败' });
      setText(shareGrantsMessage, error.message || '撤销失败');
    });
  });

  refreshShareGrants().catch(function (error) {
    setText(shareGrantsMessage, error.message || '加载授权失败');
    renderShareGrants(null);
  });
  }
  window.MNOTEInitAccessPolicyPanel = initAccessPolicyPanel;
  var shell = document.body && document.body.getAttribute('data-mnote-shell');
  if (shell === 'admin' || shell === 'user-access-policy') {
    initAccessPolicyPanel(document);
  }
})();
"#;

#[cfg(test)]
mod tests {
    use super::*;
    use crate::ssr::render_view;

    #[test]
    fn admin_access_policy_panel_renders_minimal_folder_grant_controls() {
        let html = render_view(view! {
            <AdminAccessPolicyPanel
                workspace_name={"我的空间".to_string()}
                is_admin=true
            />
        });
        assert!(html.contains("mnote-admin-access-policy-page"));
        assert!(html.contains("文件夹授权"));
        assert!(html.contains("文件夹地址"));
        assert!(html.contains("授权用户 ID"));
        assert!(html.contains("read"));
        assert!(html.contains("write"));
        assert!(html.contains("mnote-admin-share-grants-panel"));
        assert!(html.contains("mnote-admin-share-grants-json"));
        assert!(html.contains("mnote-admin-create-share-grant-submit"));
        assert!(html.contains("/api/admin/access-policy"));
        assert!(html.contains("/api/user/access-policy"));
        assert!(html.contains("data-mnote-shell"));
        assert!(!html.contains("/api/admin/share-grants"));
        assert!(!html.contains("/api/user/share-grants"));
        assert!(
            html.contains("data-admin-action=&quot;revoke-access-grant&quot;")
                || html.contains("revoke-access-grant")
        );
        assert!(!html.contains("name=\"grantId\""));
        assert!(!html.contains("name=\"shareId\""));
        assert!(!html.contains("share_xxx"));
        assert!(!html.contains("name=\"ownerUserId\""));
        assert!(!html.contains("documentId"));
        assert!(!html.contains("allowedResourceIds"));
        assert!(!html.contains("capabilities"));
        assert!(!html.contains("mnote-admin-validate-root-submit"));
    }

    #[test]
    fn admin_policy_script_keeps_form_reference_for_async_reset() {
        assert!(ADMIN_POLICY_SCRIPT.contains("var form = event.currentTarget;"));
        assert!(ADMIN_POLICY_SCRIPT.contains("form.reset();"));
        assert!(!ADMIN_POLICY_SCRIPT.contains("event.currentTarget.reset();"));
    }

    #[test]
    fn admin_policy_script_links_grants_to_local_folder_entry() {
        assert!(ADMIN_POLICY_SCRIPT.contains("function localFolderOpenHref(grant)"));
        assert!(ADMIN_POLICY_SCRIPT.contains("sourceKind', 'local_folder'"));
        assert!(ADMIN_POLICY_SCRIPT.contains("data-testid=\"mnote-admin-open-granted-root\""));
        assert!(ADMIN_POLICY_SCRIPT.contains("function isDefaultWorkspaceAutoGrant(grant)"));
        assert!(ADMIN_POLICY_SCRIPT.contains("var canRevoke = !systemOwned &&"));
    }
}