viewer.ts

apps/dashboard/src/viewer.ts

1. /**
2. * Who is looking at the board, and what they are allowed to read.
3. * Runtime-neutral: no `node:fs`, so the Worker can import it.
4. *
5. * Cloudflare Access is not enough on its own. Access authenticates a person
6. * against Google Workspace and decides whether they may load a URL. It has no
7. * view inside the response, so it cannot show one person their briefing and
8. * hide another's. A page carrying every briefing with the others `hidden` is
9. * styling, not privacy: anyone through the Access door could read them all
10. * from view-source.
11. *
12. * So Access supplies the identity and this file decides the content. The board is
13. * rendered once per viewer and each variant contains only what that viewer may
14. * read; nothing is filtered in the browser, because anything sent to a browser
15. * has been disclosed.
16. */
18. import { personFromEmail, type Person } from '../../../config/meridian-people.js'
20. export interface Viewer {
21. /** The address Access asserted, lowercased. Null when unidentified. */
22. email: string | null
23. /** Roster match, or null for an authenticated address nobody has claimed. */
24. person: Person | null
25. /**
26. * Which rendered variant this viewer gets. A roster name, or 'company'.
27. * Also the KV key suffix, so it must stay stable and URL-safe.
28. */
29. key: string
30. /** May read the executive briefing. Exactly one person on the roster. */
31. seesExec: boolean
32. /** May read Leadership Team to-dos, and the company brief that names them. */
33. seesLeadership: boolean
34. /** Whose personal briefing to include. Null means none. */
35. ownBriefing: string | null
36. }
38. /**
39. * The fallback view: company numbers, queues, data health. No personal briefing,
40. * no Leadership detail, no exec.
41. *
42. * This is what an authenticated @meridiandisplay.example address that is not on the
43. * roster receives: a new hire, or a mailbox nobody has added yet. It fails closed
44. * on the private parts while staying useful, because the point of the board is
45. * that everybody has an idea of where the company is at.
46. */
47. export const COMPANY_VIEWER: Viewer = {
48. email: null,
49. person: null,
50. key: 'company',
51. seesExec: false,
52. seesLeadership: false,
53. ownBriefing: null,
54. }
56. /**
57. * Resolve an authenticated address to a viewer.
58. *
59. * Every permission defaults to false (rule 13). An unknown address, an absent
60. * one, and a malformed one all land on the company view. There is no branch
61. * here that grants anything without an exact roster match, which is what makes
62. * the exec brief's single reader enforceable rather than aspirational.
63. *
64. * An off-roster address keeps its email. It still gets the company view and
65. * every permission still false, but the address Access asserted is carried
66. * rather than thrown away, because the inbox grant lists key on it: shared
67. * desks such as `help@` are granted by address, and a viewer with
68. * `email: null` would make those lines present, reviewed, intended and inert.
69. *
70. * This does not widen anything. An off-roster address gains access only where a
71. * human has written its line in a list that ships closed.
72. */
73. export function viewerFor(email: string | null | undefined): Viewer {
74. const normalized = (email ?? '').trim().toLowerCase()
75. const person = personFromEmail(email)
76. // No address at all is a different thing from an address nobody claimed: the
77. // first can hold no grant, the second can be granted one by name.
78. if (!person) return normalized ? { ...COMPANY_VIEWER, email: normalized } : COMPANY_VIEWER
79. return {
80. email: (email ?? '').trim().toLowerCase(),
81. person,
82. key: person.name,
83. seesExec: person.seesExec === true,
84. seesLeadership: person.seesLeadership === true,
85. ownBriefing: person.name,
86. }
87. }
89. /**
90. * Which briefing key holds the company brief this viewer may read.
91. *
92. * Two exist because prose cannot be redacted after a model writes it. `company`
93. * names Leadership to-dos by title; `company-allhands` is generated from a
94. * payload with them removed. Serving the wrong one is the whole leak, so the
95. * choice lives here rather than at the call site.
96. */
97. export function companyBriefingKey(viewer: Viewer): 'company' | 'company-allhands' {
98. return viewer.seesLeadership ? 'company' : 'company-allhands'
99. }
101. /**
102. * Every variant that has to be rendered for a sync.
103. *
104. * Includes 'company' so an unrecognised address always has something to be
105. * served. Order is stable so the output is diffable.
106. */
107. export function allViewers(people: Person[]): Viewer[] {
108. return [
109. COMPANY_VIEWER,
110. ...people.map((p) => viewerFor(p.email)).filter((v) => v.person !== null),
111. ]
112. }