1import type { EnvironmentId, ManagedPolicySummary, ProviderDriverKind } from "@t3tools/contracts";
2
3import { useServerConfigs } from "./entities";
4import { usePrimaryEnvironmentId } from "./environments";
5
6/** The policy an environment's administrator applies, or undefined when it is unmanaged. */
7export function useManagedPolicy(
8 environmentId: EnvironmentId | null | undefined,
9): ManagedPolicySummary | undefined {
10 const serverConfigs = useServerConfigs();
11 return environmentId == null ? undefined : serverConfigs.get(environmentId)?.managedPolicy;
12}
13
14export function usePrimaryManagedPolicy(): ManagedPolicySummary | undefined {
15 return useManagedPolicy(usePrimaryEnvironmentId());
16}
17
18/**
19 * Why a control acting on several environments is unavailable: the first denial any target's
20 * policy gives, since one refusing target refuses the whole action.
21 */
22export function firstManagedDenial(
23 policies: Iterable<ManagedPolicySummary | undefined>,
24 deny: (policy: ManagedPolicySummary | undefined) => string | undefined,
25): string | undefined {
26 for (const policy of policies) {
27 const denial = deny(policy);
28 if (denial !== undefined) return denial;
29 }
30 return undefined;
31}
32
33/** What usage-data notices say when the policy turns product analytics off. */
34export function managedTelemetryOffMessage(
35 policy: ManagedPolicySummary | undefined,
36): string | undefined {
37 return policy?.limits?.telemetry === false
38 ? `${policy.organization} turned off anonymous usage data.`
39 : undefined;
40}
41
42export interface ManagedInstanceLocks {
43 /** Keys inside the instance's `config` users cannot change. */
44 readonly configKeys: ReadonlySet<string>;
45 /** Environment variables users cannot edit, rename, or remove. */
46 readonly environmentNames: ReadonlySet<string>;
47 /** Under a runtime-mode ceiling every variable is the administrator's, not only named ones. */
48 readonly wholeEnvironment: boolean;
49 readonly reason: string;
50}
51
52/** What the policy pins on instances of `driver`, or undefined when nothing is. */
53export function managedInstanceLocks(
54 policy: ManagedPolicySummary | undefined,
55 driver: ProviderDriverKind,
56): ManagedInstanceLocks | undefined {
57 const paths = policy?.limits?.providers?.lockedInstanceFields?.[driver];
58 if (policy === undefined || paths === undefined || paths.length === 0) return undefined;
59 const fieldsUnder = (prefix: string) =>
60 new Set(paths.flatMap((path) => (path.startsWith(prefix) ? [path.slice(prefix.length)] : [])));
61 return {
62 configKeys: fieldsUnder("config."),
63 environmentNames: fieldsUnder("environment."),
64 wholeEnvironment: paths.includes("environment"),
65 reason: `Managed by ${policy.organization}.`,
66 };
67}