feat(desktop): principals in the app — create one, see its scope, mint keys as it

apps/desktop/__tests__/principal.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it } from 'vitest';
+
+import type { PrincipalRecord } from '../src/shared/api';
+import { principalReach } from '../src/shared/principal';
+
+const principal = (overrides: Partial<PrincipalRecord> = {}): PrincipalRecord => ({
+  principalId: 'principal-1',
+  name: 'ci-deploy',
+  ownerId: 'user-1',
+  isReadOnly: false,
+  bypassStepUp: false,
+  useAdminOwner: true,
+  entityIds: ['org-1'],
+  scopes: [],
+  ...overrides,
+});
+
+describe('principalReach', () => {
+  it('says it inherits, rather than showing nothing, when no scope is overridden', () => {
+    expect(principalReach(principal())).toBe('inherits you everywhere it is scoped');
+  });
+
+  it('names the restrictions it does carry', () => {
+    const text = principalReach(principal({ isReadOnly: true, bypassStepUp: true }));
+    expect(text).toContain('read-only');
+    expect(text).toContain('skips step-up');
+  });
+
+  it('shows a scope mask, and says when the scope is switched off', () => {
+    const text = principalReach(
+      principal({
+        scopes: [
+          {
+            membershipType: 2,
+            allowedMask: '0011',
+            isActive: false,
+            isReadOnly: true,
+            useAdminOwner: false,
+          },
+        ],
+      })
+    );
+    expect(text).toContain('scope 2');
+    expect(text).toContain('disabled');
+    expect(text).toContain('mask 0011');
+  });
+
+  it('calls an absent mask inherited, because it is not an empty one', () => {
+    const text = principalReach(
+      principal({
+        scopes: [
+          {
+            membershipType: 1,
+            allowedMask: null,
+            isActive: true,
+            isReadOnly: false,
+            useAdminOwner: true,
+          },
+        ],
+      })
+    );
+    expect(text).toContain('mask inherited');
+  });
+});

apps/desktop/src/main/ipc.ts

@@ -10,6 +10,7 @@ import * as path from 'path';
 import {
   CHANNELS,
   CreateKeyRequest,
+  CreatePrincipalRequest,
   FieldPurpose,
   ItemKind,
   SignInRequest,
@@ -242,6 +243,11 @@ export const registerIpc = (service: VaultService): void => {
           expiresIn: days === undefined ? undefined : { days: assertInt(days, 1, 3650) },
           accessLevel:
             request?.accessLevel === undefined ? undefined : assertString(request.accessLevel),
+          principalId:
+            request?.principalId === undefined ? undefined : assertString(request.principalId),
+          orgId: request?.orgId === undefined ? undefined : assertString(request.orgId),
+          databaseId:
+            request?.databaseId === undefined ? undefined : assertString(request.databaseId),
         },
         proof(stepUp)
       );
@@ -256,6 +262,40 @@ export const registerIpc = (service: VaultService): void => {
     await accounts().revokeApiKey(assertString(itemId), proof(stepUp));
     service.scheduleSave();
   });
+  handle(
+    CHANNELS.accountsAssignKeyDatabase,
+    async (itemId: string, databaseId: string) => {
+      await accounts().assignKeyToDatabase(assertString(itemId), assertString(databaseId));
+      service.scheduleSave();
+    }
+  );
+  handle(CHANNELS.accountsPrincipals, (accountItemId: string) =>
+    accounts().listPrincipals(assertString(accountItemId))
+  );
+  handle(
+    CHANNELS.accountsCreatePrincipal,
+    (accountItemId: string, request: CreatePrincipalRequest, stepUp?: StepUpProof) =>
+      accounts().createPrincipal(
+        assertString(accountItemId),
+        {
+          name: assertString(request?.name),
+          orgId: assertString(request?.orgId),
+          isReadOnly: Boolean(request?.isReadOnly),
+          bypassStepUp: Boolean(request?.bypassStepUp),
+        },
+        proof(stepUp)
+      )
+  );
+  handle(
+    CHANNELS.accountsDeletePrincipal,
+    async (accountItemId: string, principalId: string, stepUp?: StepUpProof) => {
+      await accounts().deletePrincipal(
+        assertString(accountItemId),
+        assertString(principalId),
+        proof(stepUp)
+      );
+    }
+  );
   handle(CHANNELS.accountsLinkTotp, async (accountItemId: string, totpItemId: string) => {
     await accounts().linkTotp(assertString(accountItemId), assertString(totpItemId));
     service.scheduleSave();

apps/desktop/src/preload/index.ts

@@ -63,6 +63,13 @@ const api: DcryptApi & {
       invoke(CHANNELS.accountsCreateKey, accountItemId, request, stepUp),
     revealKey: (itemId) => invoke(CHANNELS.accountsRevealKey, itemId),
     revokeKey: (itemId, stepUp) => invoke(CHANNELS.accountsRevokeKey, itemId, stepUp),
+    assignKeyToDatabase: (itemId, databaseId) =>
+      invoke(CHANNELS.accountsAssignKeyDatabase, itemId, databaseId),
+    principals: (accountItemId) => invoke(CHANNELS.accountsPrincipals, accountItemId),
+    createPrincipal: (accountItemId, request, stepUp) =>
+      invoke(CHANNELS.accountsCreatePrincipal, accountItemId, request, stepUp),
+    deletePrincipal: (accountItemId, principalId, stepUp) =>
+      invoke(CHANNELS.accountsDeletePrincipal, accountItemId, principalId, stepUp),
     linkTotp: (accountItemId, totpItemId) =>
       invoke(CHANNELS.accountsLinkTotp, accountItemId, totpItemId),
     unlinkTotp: (accountItemId) => invoke(CHANNELS.accountsUnlinkTotp, accountItemId),