feat(core): implement application capability model and store slice (#1672)

apps/geolibre-desktop/src/components/layout/toolbar/ProcessingMenu.tsx

@@ -1,4 +1,4 @@
-import { type NetworkToolKind, useAppStore } from "@geolibre/core";
+import { type NetworkToolKind, useAppCapability, useAppStore } from "@geolibre/core";
 import { isEarthEngineAvailable } from "@geolibre/plugins";
 import {
   Button,
@@ -73,6 +73,9 @@ export function ProcessingMenu({
   const setAssistantOpen = useAppStore((s) => s.setAssistantOpen);
   const setDashboardOpen = useAppStore((s) => s.setDashboardOpen);
   const setProcessingHistoryOpen = useAppStore((s) => s.setProcessingHistoryOpen);
+  const processingCap = useAppCapability("processing:run");
+  const sidecarCap = useAppCapability("processing:sidecar");
+  const assistantCap = useAppCapability("assistant:use");
 
   // Format Conversion, Raster tools, and AI Segmentation require the Python
   // sidecar, which cannot run on Android/iOS — hide them on mobile so they don't
@@ -143,7 +146,10 @@ export function ProcessingMenu({
         <DropdownMenuSeparator />
         {show("processing.assistant") && (
           <>
-            <DropdownMenuItem onSelect={() => setAssistantOpen(true)}>
+            <DropdownMenuItem
+              onSelect={() => setAssistantOpen(true)}
+              disabled={!assistantCap.granted}
+            >
               {t("toolbar.command.assistant")}
             </DropdownMenuItem>
             <DropdownMenuSeparator />
@@ -157,7 +163,10 @@ export function ProcessingMenu({
             does; pairs with the GeoLibre Toolbox trigger below. Reuses the
             dialog's own heading string, already translated in every locale. */}
         {showWhitebox && (
-          <DropdownMenuItem onSelect={() => setProcessingOpen(true)}>
+          <DropdownMenuItem
+            onSelect={() => setProcessingOpen(true)}
+            disabled={!processingCap.granted}
+          >
             {t("processing.whitebox.toolbox")}
           </DropdownMenuItem>
         )}

apps/geolibre-desktop/src/components/layout/toolbar/ProjectMenu.tsx

@@ -1,4 +1,4 @@
-import { projectPathLabel, useAppStore } from "@geolibre/core";
+import { projectPathLabel, useAppCapability, useAppStore } from "@geolibre/core";
 import {
   Button,
   DropdownMenu,
@@ -102,6 +102,8 @@ export function ProjectMenu({
   const clearRecentProjects = useAppStore((s) => s.clearRecentProjects);
   const setStorymapPanelOpen = useAppStore((s) => s.setStorymapPanelOpen);
   const uiProfile = useDesktopSettingsStore((s) => s.desktopSettings.uiProfile);
+  const saveCapability = useAppCapability("project:save");
+  const shareCapability = useAppCapability("project:share");
   const show = (id: string) => isMenuItemVisible(uiProfile, id);
   // A deployment that turned sharing off should not advertise it; one that named
   // a host we rejected should say so rather than leave the user wondering.
@@ -271,25 +273,25 @@ export function ProjectMenu({
         )}
         {showSaveGroup && <DropdownMenuSeparator />}
         {show("project.save") && (
-          <DropdownMenuItem onSelect={onSave}>
+          <DropdownMenuItem onSelect={onSave} disabled={!saveCapability.granted}>
             <Save className="me-2 h-3.5 w-3.5" />
             {t("common.save")}
           </DropdownMenuItem>
         )}
         {show("project.saveAs") && (
-          <DropdownMenuItem onSelect={onSaveAs}>
+          <DropdownMenuItem onSelect={onSaveAs} disabled={!saveCapability.granted}>
             <FilePen className="me-2 h-3.5 w-3.5" />
             {t("toolbar.item.saveAsEllipsis")}
           </DropdownMenuItem>
         )}
         {show("project.duplicate") && onDuplicate && (
-          <DropdownMenuItem onSelect={onDuplicate}>
+          <DropdownMenuItem onSelect={onDuplicate} disabled={!saveCapability.granted}>
             <Copy className="me-2 h-3.5 w-3.5" />
             {t("toolbar.item.duplicate")}
           </DropdownMenuItem>
         )}
         {show("project.saveAsTemplate") && onSaveAsTemplate && (
-          <DropdownMenuItem onSelect={onSaveAsTemplate}>
+          <DropdownMenuItem onSelect={onSaveAsTemplate} disabled={!saveCapability.granted}>
             <Bookmark className="me-2 h-3.5 w-3.5" />
             {t("toolbar.item.saveAsTemplateEllipsis")}
           </DropdownMenuItem>
@@ -298,7 +300,7 @@ export function ProjectMenu({
           <>
             <DropdownMenuItem
               onSelect={onShare}
-              disabled={shareBroken}
+              disabled={shareBroken || !shareCapability.granted}
               aria-describedby={shareBroken ? SHARE_UNAVAILABLE_ID : undefined}
             >
               <Share2 className="me-2 h-3.5 w-3.5" />

packages/core/src/capabilities.ts

@@ -1,4 +1,10 @@
-import type { GeoLibreLayer, LayerCapabilities } from "./types";
+import type {
+  AppCapabilities,
+  AppPrivilege,
+  AppRole,
+  GeoLibreLayer,
+  LayerCapabilities,
+} from "./types";
 
 /**
  * Default inferred capabilities for a layer based on its type and metadata.
@@ -93,3 +99,119 @@ export function normalizeLayerCapabilities(raw: unknown): LayerCapabilities | un
 
   return hasAny ? caps : undefined;
 }
+
+/**
+ * All supported application privilege identifiers in GeoLibre.
+ */
+export const ALL_APP_PRIVILEGES: readonly AppPrivilege[] = [
+  "layers:edit",
+  "layers:add-remote",
+  "layers:add-local",
+  "processing:run",
+  "processing:sidecar",
+  "project:save",
+  "project:share",
+  "project:share-public",
+  "plugins:install",
+  "assistant:use",
+  "connections:manage",
+  "export:data",
+  "export:image",
+  "settings:manage",
+] as const;
+
+/**
+ * Standard privilege bundles for named application roles.
+ */
+export const ROLE_PRIVILEGES: Record<Exclude<AppRole, "custom">, readonly AppPrivilege[]> = {
+  viewer: ["export:image", "export:data"],
+  editor: [
+    "export:image",
+    "export:data",
+    "layers:edit",
+    "layers:add-local",
+    "layers:add-remote",
+    "processing:run",
+    "project:save",
+  ],
+  publisher: [
+    "export:image",
+    "export:data",
+    "layers:edit",
+    "layers:add-local",
+    "layers:add-remote",
+    "processing:run",
+    "project:save",
+    "project:share",
+    "project:share-public",
+    "processing:sidecar",
+    "assistant:use",
+  ],
+  administrator: ALL_APP_PRIVILEGES,
+};
+
+/**
+ * Resolves the effective privilege list for a given role, applying custom overrides if specified.
+ */
+export function resolveRolePrivileges(
+  role: AppRole,
+  customPrivileges?: readonly AppPrivilege[],
+): AppPrivilege[] {
+  if (role === "custom") {
+    if (!customPrivileges || customPrivileges.length === 0) return [];
+    const validSet = new Set<AppPrivilege>(ALL_APP_PRIVILEGES);
+    return [...new Set(customPrivileges.filter((p) => validSet.has(p)))];
+  }
+  return [...ROLE_PRIVILEGES[role]];
+}
+
+/**
+ * Intersects multiple sets of privileges to derive the effective permissions when multiple
+ * policies (e.g. deployment, organization, and share link) apply simultaneously.
+ */
+export function intersectPrivileges(...privilegeSets: (readonly AppPrivilege[])[]): AppPrivilege[] {
+  if (privilegeSets.length === 0) return [];
+  if (privilegeSets.length === 1) return [...new Set(privilegeSets[0])];
+  let current = new Set<AppPrivilege>(privilegeSets[0]);
+  for (let i = 1; i < privilegeSets.length; i++) {
+    const nextSet = new Set<AppPrivilege>(privilegeSets[i]);
+    current = new Set([...current].filter((p) => nextSet.has(p)));
+  }
+  return [...current];
+}
+
+/**
+ * Evaluates whether an application capability set grants a specific privilege.
+ */
+export function hasAppPrivilege(
+  capabilities: AppCapabilities | undefined,
+  privilege: AppPrivilege,
+): boolean {
+  if (!capabilities) return true;
+  return capabilities.privileges.includes(privilege);
+}
+
+/**
+ * Creates the default unconstrained application capabilities (Administrator role).
+ */
+export function createDefaultAppCapabilities(): AppCapabilities {
+  return {
+    role: "administrator",
+    privileges: [...ALL_APP_PRIVILEGES],
+  };
+}
+
+/**
+ * Normalizes an untrusted array of privilege strings.
+ */
+export function normalizeAppPrivileges(raw: unknown): AppPrivilege[] | undefined {
+  if (!Array.isArray(raw)) return undefined;
+  const validSet = new Set<string>(ALL_APP_PRIVILEGES);
+  const result: AppPrivilege[] = [];
+  for (const item of raw) {
+    if (typeof item === "string" && validSet.has(item)) {
+      result.push(item as AppPrivilege);
+    }
+  }
+  return result.length > 0 ? [...new Set(result)] : [];
+}

packages/core/src/index.ts

@@ -52,6 +52,7 @@ export {
   redo,
   undo,
   useAppStore,
+  useAppCapability,
   type AppState,
   type ConversionToolKind,
   type GpsStatusFix,

packages/core/src/store.ts

@@ -17,6 +17,12 @@ import {
   DEFAULT_PROJECT_NAME,
 } from "./project";
 import { initialLayerStyle } from "./layer-defaults";
+import {
+  createDefaultAppCapabilities,
+  hasAppPrivilege,
+  normalizeAppPrivileges,
+  resolveRolePrivileges,
+} from "./capabilities";
 import {
   createDefaultPrintLayout,
   printLayoutConfigsEqual,
@@ -41,6 +47,9 @@ import {
   MAX_PROCESSING_HISTORY,
   MIN_DASHBOARD_COLUMNS,
   type AddTileLayerOptions,
+  type AppCapabilities,
+  type AppPrivilege,
+  type AppRole,
   type CollabInvite,
   type CollaborationChatMessage,
   type CollaborationParticipant,
@@ -304,6 +313,12 @@ export interface AppState {
   // excluded from the project file (project.ts never reads it) and from undo
   // history (partialize never lists it).
   collaboration: CollaborationState;
+  /**
+   * Ephemeral application capability model (issue #1672). Gating role and
+   * privileges for the current session/deployment. Excluded from the project file
+   * and undo history.
+   */
+  capabilities: AppCapabilities;
   ui: {
     processingOpen: boolean;
     /**
@@ -577,6 +592,25 @@ export interface AppState {
   clearRecentProjects: () => void;
   markSaved: () => void;
 
+  /**
+   * Assign an application role (e.g. "viewer", "editor", "publisher", "administrator", "custom"),
+   * deriving the effective privileges and optional reason.
+   */
+  setAppRole: (
+    role: AppRole,
+    options?: { customPrivileges?: AppPrivilege[]; reason?: string },
+  ) => void;
+  /** Set explicit custom privileges and an optional reason. */
+  setAppPrivileges: (privileges: AppPrivilege[], reason?: string) => void;
+  /** Grant an individual application privilege. */
+  grantAppPrivilege: (privilege: AppPrivilege) => void;
+  /** Revoke an individual application privilege with an optional reason. */
+  revokeAppPrivilege: (privilege: AppPrivilege, reason?: string) => void;
+  /** Reset application capabilities back to the default unconstrained Administrator role. */
+  resetAppCapabilities: () => void;
+  /** Check if the current capabilities grant the requested privilege. */
+  hasAppPrivilege: (privilege: AppPrivilege) => boolean;
+
   addLayer: (layer: GeoLibreLayer, beforeLayerId?: string | null) => void;
   removeLayer: (id: string) => void;
   updateLayer: (id: string, patch: Partial<GeoLibreLayer>) => void;
@@ -1045,6 +1079,7 @@ export const useAppStore = create<AppState>()(
       recentProjects: [],
       attributeFilter: "",
       collaboration: DEFAULT_COLLABORATION_STATE,
+      capabilities: createDefaultAppCapabilities(),
       ui: {
         processingOpen: false,
         processingInitialTool: null,
@@ -2324,6 +2359,58 @@ export const useAppStore = create<AppState>()(
           });
         }
       },
+
+      setAppRole: (role, options) => {
+        const privileges = resolveRolePrivileges(role, options?.customPrivileges);
+        set({
+          capabilities: {
+            role,
+            privileges,
+            reason: options?.reason,
+          },
+        });
+      },
+
+      setAppPrivileges: (privileges, reason) => {
+        set({
+          capabilities: {
+            role: "custom",
+            privileges: normalizeAppPrivileges(privileges) ?? [],
+            reason,
+          },
+        });
+      },
+
+      grantAppPrivilege: (privilege) => {
+        const current = get().capabilities;
+        if (current.privileges.includes(privilege)) return;
+        set({
+          capabilities: {
+            ...current,
+            privileges: [...current.privileges, privilege],
+          },
+        });
+      },
+
+      revokeAppPrivilege: (privilege, reason) => {
+        const current = get().capabilities;
+        if (!current.privileges.includes(privilege)) return;
+        set({
+          capabilities: {
+            ...current,
+            privileges: current.privileges.filter((p) => p !== privilege),
+            reason: reason ?? current.reason,
+          },
+        });
+      },
+
+      resetAppCapabilities: () => {
+        set({ capabilities: createDefaultAppCapabilities() });
+      },
+
+      hasAppPrivilege: (privilege) => {
+        return hasAppPrivilege(get().capabilities, privilege);
+      },
     }),
     {
       // Only these fields participate in undo/redo; everything else (selection,
@@ -2514,3 +2601,17 @@ export function clearHistory(): void {
     notifyProjectRestoreHistory();
   }
 }
+
+/**
+ * React hook for consuming application capability state for a specific privilege.
+ *
+ * @param privilege - The privilege to check.
+ * @returns `{ granted: boolean, reason?: string }`
+ */
+export function useAppCapability(privilege: AppPrivilege): { granted: boolean; reason?: string } {
+  const capabilities = useAppStore((state) => state.capabilities);
+  return {
+    granted: capabilities.privileges.includes(privilege),
+    reason: capabilities.reason,
+  };
+}