Replaces the binary acl.allow/deny model with five permission verbs
(r/w/c/d/a) and first-class roles, and adds an authenticated file API
(PUT/DELETE/POST move/mkdir) so the HTML tools can edit-in-place over
HTTP. Closes the AC-3(7) and AC-6 federal-readiness gaps.
File API (zddc/internal/handler/fileapi.go)
- PUT <new> → action c
- PUT <existing> → action w
- PUT <.zddc> → action a (CanEditZddc strict-ancestor rule)
- DELETE → action d
- POST mkdir → action c (auto-writes creator-owned .zddc when the
parent is Incoming/Working/Staging)
- POST move → action w on src + c on dst, atomic via os.Rename
- Optional If-Match for optimistic concurrency, --max-write-bytes cap,
audit log emits a structured file_write event per operation.
Permission model (zddc/internal/zddc/{acl,file,roles,cascade_mode}.go)
- acl.permissions: { principal → verb-set } map; principals are email
patterns or role names. Empty verb set is an explicit deny.
- roles: { name → members } definitions, available at the level they
declare and all descendants. Closer-to-leaf shadows ancestor.
- Legacy acl.allow/deny still work; they fold into permissions at
parse time (allow → "rwcd", deny → "").
- Cascade walks leaf→root; first level with any matching entry wins;
the union of matching verb sets at that level decides.
- --cascade-mode=strict adds a root→leaf ancestor-deny pre-pass so an
ancestor explicit-deny is absolute (NIST AC-6). Default delegated
preserves the existing commercial behavior.
Special folders (zddc/internal/zddc/special.go)
- Incoming / Working / Staging: mkdir auto-writes a .zddc into the new
subdir granting created_by + that email rwcda directly. Same form
operators write by hand; creator can edit it later to add others.
- Issued / Received: server-enforced WORM split. Cascade grants
inherited from above the WORM folder are masked to r only; grants
placed at-or-below the WORM folder retain r,c. Operators grant
write-once (cr) to the doc controller via an explicit .zddc at the
Issued/Received folder. Admins exempt — only escape hatch.
Browser polyfill (shared/zddc-source.js)
- HttpDirectoryHandle + HttpFileHandle implement the FS Access API
surface (values, getFileHandle, createWritable, removeEntry,
queryPermission/requestPermission) over zddc-server's listing JSON
and file API. Existing tools written against showDirectoryPicker
work unchanged.
- detectServerRoot() returns { handle, status }: tools auto-load on
HTTP, surface a clear "no permission to list" message on 403, and
fall back to the welcome screen on 0.
- classifier renames take the atomic POST move path on HTTP-backed
handles; mdedit and transmittal route reads/writes through the
polyfill so prior FS-API code paths cover both modes.
Tests
- zddc/internal/zddc/{cascade_mode,roles,special,acl}_test.go cover
delegated vs strict, role membership / shadowing / legacy fallback,
WORM split semantics, verb-set parser round-trip.
- zddc/internal/handler/fileapi_test.go now also covers role-based
vendor scenarios, WORM blocking vendor & doc controller writes,
explicit Issued .zddc unlocking the cr drop-box, admin bypass,
auto-ownership on mkdir, and strict-mode lockouts.
Docs
- ARCHITECTURE.md + zddc/README.md document the verb model, role
syntax, special-folder behaviors, cascade-mode flag, and full file
API surface. Federal-readiness gap analysis strikes AC-3(7) and
AC-6.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
135 lines
3.8 KiB
Bash
135 lines
3.8 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
root_dir=$(cd "$(dirname "$0")" && pwd)
|
|
. "$root_dir/../shared/build-lib.sh"
|
|
|
|
src_html="$root_dir/template.html"
|
|
output_dir="$root_dir/dist"
|
|
output_html="$output_dir/mdedit.html"
|
|
|
|
# Vendor files (bundled dependencies — no CDN required at runtime)
|
|
# Note: Tailwind is NOT a vendor file — it's replaced by css/tailwind-utils.css,
|
|
# a hand-written subset of only the utility classes used in template.html.
|
|
toastui_js="$root_dir/vendor/toastui-editor-all.min.js"
|
|
toastui_css="$root_dir/vendor/toastui-editor.min.css"
|
|
|
|
mkdir -p "$output_dir"
|
|
ensure_exists "$src_html"
|
|
ensure_exists "$toastui_js"
|
|
ensure_exists "$toastui_css"
|
|
|
|
css_temp=$(mktemp)
|
|
js_raw=$(mktemp)
|
|
js_temp=$(mktemp)
|
|
toastui_js_safe=$(mktemp)
|
|
cleanup() { rm -f "$css_temp" "$js_raw" "$js_temp" "$toastui_js_safe"; }
|
|
trap cleanup EXIT
|
|
|
|
# CSS files to concatenate in order
|
|
concat_files \
|
|
"css/tailwind-utils.css" \
|
|
"../shared/base.css" \
|
|
"css/base.css" \
|
|
"css/editor.css" \
|
|
"css/toc.css" \
|
|
"css/markdown.css" \
|
|
> "$css_temp"
|
|
|
|
# JavaScript files to concatenate in order
|
|
concat_files \
|
|
"../shared/zddc.js" \
|
|
"../shared/zddc-source.js" \
|
|
"../shared/theme.js" \
|
|
"../shared/preview-lib.js" \
|
|
"js/app.js" \
|
|
"js/utils.js" \
|
|
"js/front-matter.js" \
|
|
"js/file-ops.js" \
|
|
"js/file-system.js" \
|
|
"js/file-tree.js" \
|
|
"js/editor.js" \
|
|
"js/toc.js" \
|
|
"js/resizer.js" \
|
|
"js/events.js" \
|
|
"js/main.js" \
|
|
"../shared/help.js" \
|
|
> "$js_raw"
|
|
|
|
# Escape '</' in app JS and the Toast UI vendor JS so neither can prematurely
|
|
# close the inline <script> blocks they get embedded in.
|
|
escape_js_close_tags "$js_raw" "$js_temp"
|
|
escape_js_close_tags "$toastui_js" "$toastui_js_safe"
|
|
|
|
compute_build_label "mdedit" "${1:-}" "${2:-}"
|
|
|
|
# Process template:
|
|
# - Strip the Tailwind CDN <script> tag (css/tailwind-utils.css replaces it)
|
|
# - Replace CDN <link> for Toast UI CSS with inline bundled CSS
|
|
# - Replace CDN <script src="...toastui..."> with inline bundled Toast UI JS
|
|
# - Inject custom CSS/JS at {{CSS_PLACEHOLDER}} and {{JS_PLACEHOLDER}}
|
|
# - Substitute {{BUILD_LABEL}}
|
|
awk \
|
|
-v css_file="$css_temp" \
|
|
-v js_file="$js_temp" \
|
|
-v toastui_js="$toastui_js_safe" \
|
|
-v toastui_css="$toastui_css" \
|
|
-v build_label="$build_label" \
|
|
-v is_red="$is_red" \
|
|
-v favicon_uri="$favicon_data_uri" \
|
|
'
|
|
/\{\{CSS_PLACEHOLDER\}\}/ {
|
|
while ((getline line < css_file) > 0) print line
|
|
close(css_file)
|
|
next
|
|
}
|
|
/\{\{JS_PLACEHOLDER\}\}/ {
|
|
while ((getline line < js_file) > 0) print line
|
|
close(js_file)
|
|
next
|
|
}
|
|
/\{\{BUILD_LABEL\}\}/ {
|
|
if (is_red == "1") {
|
|
gsub(/\{\{BUILD_LABEL\}\}/, "<span style=\"color:red;font-weight:bold\">" build_label "</span>")
|
|
} else {
|
|
gsub(/\{\{BUILD_LABEL\}\}/, build_label)
|
|
}
|
|
print
|
|
next
|
|
}
|
|
/\{\{FAVICON\}\}/ {
|
|
gsub(/\{\{FAVICON\}\}/, favicon_uri)
|
|
print
|
|
next
|
|
}
|
|
/<script src="https:\/\/cdn\.tailwindcss\.com"/ {
|
|
# Stripped: Tailwind utility classes are in css/tailwind-utils.css instead
|
|
next
|
|
}
|
|
/<link rel="stylesheet" href="https:\/\/uicdn\.toast\.com\/editor\/[^"]*\/toastui-editor\.min\.css"/ {
|
|
# Inline the bundled Toast UI CSS
|
|
print "<style>"
|
|
while ((getline line < toastui_css) > 0) print line
|
|
close(toastui_css)
|
|
print "</style>"
|
|
next
|
|
}
|
|
/<script src="https:\/\/uicdn\.toast\.com\/editor\/[^"]*\/toastui-editor/ {
|
|
# Inline the bundled Toast UI JS (already passed through escape_js_close_tags
|
|
# so its content cannot contain a literal </script> sequence). We close with
|
|
# the real </script> because only that exact string terminates a script
|
|
# block per the HTML5 spec.
|
|
print "<script>"
|
|
while ((getline line < toastui_js) > 0) print line
|
|
close(toastui_js)
|
|
print "</script>"
|
|
next
|
|
}
|
|
{ print }
|
|
' "$src_html" > "$output_html"
|
|
|
|
echo "Wrote $output_html ($(wc -c < "$output_html") bytes)"
|
|
|
|
if [ "$is_release" = "1" ]; then
|
|
promote_release "mdedit"
|
|
fi
|