feat(tracker): issue access management — grants panel, access groups, level-aware enforcement (stacked on #10895)

dev/tool/package.json

@@ -114,6 +114,8 @@
     "@hcengineering/server-card-resources": "workspace:^0.7.0",
     "@hcengineering/server-chunter": "workspace:^0.7.0",
     "@hcengineering/server-chunter-resources": "workspace:^0.7.0",
+    "@hcengineering/server-access-group": "workspace:^0.7.0",
+    "@hcengineering/server-access-group-resources": "workspace:^0.7.0",
     "@hcengineering/server-contact": "workspace:^0.7.0",
     "@hcengineering/server-contact-resources": "workspace:^0.7.0",
     "@hcengineering/server-core": "workspace:^0.7.19",

dev/tool/src/__start.ts

@@ -25,6 +25,7 @@ import { serverActivityId } from '@hcengineering/server-activity'
 import { serverAiBotId } from '@hcengineering/server-ai-bot'
 import { serverAttachmentId } from '@hcengineering/server-attachment'
 import { serverCalendarId } from '@hcengineering/server-calendar'
+import { serverAccessGroupId } from '@hcengineering/server-access-group'
 import { serverCardId } from '@hcengineering/server-card'
 import { serverChunterId } from '@hcengineering/server-chunter'
 import { serverCollaborationId } from '@hcengineering/server-collaboration'
@@ -53,6 +54,7 @@ addLocation(serverCollaborationId, () => import('@hcengineering/server-collabora
 addLocation(serverContactId, () => import('@hcengineering/server-contact-resources'))
 addLocation(serverNotificationId, () => import('@hcengineering/server-notification-resources'))
 addLocation(serverChunterId, () => import('@hcengineering/server-chunter-resources'))
+addLocation(serverAccessGroupId, () => import('@hcengineering/server-access-group-resources'))
 addLocation(serverInventoryId, () => import('@hcengineering/server-inventory-resources'))
 addLocation(serverLeadId, () => import('@hcengineering/server-lead-resources'))
 addLocation(serverRecruitId, () => import('@hcengineering/server-recruit-resources'))

foundations/core/packages/core/src/__tests__/accessLevel.test.ts

@@ -0,0 +1,60 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import { accessLevelRank, hasAtLeast } from '../accessLevel'
+
+describe('accessLevel helper', () => {
+  describe('accessLevelRank', () => {
+    it('ranks read < write < admin', () => {
+      expect(accessLevelRank('read')).toBe(1)
+      expect(accessLevelRank('write')).toBe(2)
+      expect(accessLevelRank('admin')).toBe(3)
+    })
+
+    it('treats undefined as read (rank 1)', () => {
+      expect(accessLevelRank(undefined)).toBe(1)
+    })
+  })
+
+  describe('hasAtLeast', () => {
+    it('read does not satisfy write', () => {
+      expect(hasAtLeast('read', 'write')).toBe(false)
+    })
+
+    it('write satisfies write', () => {
+      expect(hasAtLeast('write', 'write')).toBe(true)
+    })
+
+    it('admin satisfies write', () => {
+      expect(hasAtLeast('admin', 'write')).toBe(true)
+    })
+
+    it('undefined satisfies read (minimal)', () => {
+      expect(hasAtLeast(undefined, 'read')).toBe(true)
+    })
+
+    it('undefined does not satisfy write', () => {
+      expect(hasAtLeast(undefined, 'write')).toBe(false)
+    })
+
+    it('admin satisfies admin', () => {
+      expect(hasAtLeast('admin', 'admin')).toBe(true)
+    })
+
+    it('write does not satisfy admin', () => {
+      expect(hasAtLeast('write', 'admin')).toBe(false)
+    })
+  })
+})

foundations/core/packages/core/src/accessLevel.ts

@@ -0,0 +1,50 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+import type { AccessLevel } from './classes'
+
+/**
+ * Ordinal rank of an access level: read < write < admin.
+ *
+ * `undefined` (missing level at a grant record) is treated as `read` — the
+ * fail-safe minimal grant. This is the single place that maps the string-enum
+ * to a comparable number, which is the evolution seam described in the design:
+ * when `level` later becomes a `Ref<Role>`, only this helper (and hasAtLeast)
+ * changes — every enforcement call-site keeps comparing via these helpers, not
+ * via string equality.
+ *
+ * @public
+ */
+export function accessLevelRank (level?: AccessLevel): number {
+  switch (level) {
+    case 'admin':
+      return 3
+    case 'write':
+      return 2
+    default:
+      // 'read' | undefined | any unexpected value → minimal
+      return 1
+  }
+}
+
+/**
+ * True iff `level` grants at least the authority of `min` (ordinal compare).
+ * Higher levels include lower ones (admin ⊇ write ⊇ read).
+ *
+ * @public
+ */
+export function hasAtLeast (level: AccessLevel | undefined, min: AccessLevel): boolean {
+  return accessLevelRank(level) >= accessLevelRank(min)
+}