chore: initial configuration

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+    # Adding new check for github-actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+        interval: "weekly"

.github/workflows/ci.yml

@@ -0,0 +1,55 @@
+name: Default CI
+on:
+  push:
+    branches:
+      - 'main'
+  pull_request:
+    branches:
+      - '**'
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0
+    - name: Setup Nodejs
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version-file: '.nvmrc'
+    - name: Install dependencies
+      run: npm ci
+    - name: Lint
+      run: npm run lint
+    - name: Type check
+      run: npm run types
+    - name: Test
+      run: npm run test
+    - name: Build
+      run: npm run build
+    - name: Coverage
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        fail_ci_if_error: true
+
+  # Packs the library and installs it into a frontend-platform/frontend-build MFE
+  # and a frontend-base site, then builds both. This is what keeps the package
+  # genuinely consumable by both architectures.
+  integration:
+    name: Integration
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Setup Nodejs
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version-file: '.nvmrc'
+    - name: Install dependencies
+      run: npm ci
+    - name: Build, pack and verify in both architectures
+      run: make test-apps

.github/workflows/lockfileversion-check.yml

@@ -0,0 +1,13 @@
+#check package-lock file version
+
+name: Lockfile Version check
+
+on:
+  push:
+    branches:
+    - main
+  pull_request:
+
+jobs:
+  version-check:
+    uses: openedx/.github/.github/workflows/lockfileversion-check-v3.yml@master

.github/workflows/release.yml

@@ -0,0 +1,43 @@
+name: Release CI
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  id-token: write  # Required for OIDC
+  contents: write  # For Semantic Release tagging
+
+jobs:
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        fetch-depth: 0
+    - name: Setup Node.js
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      with:
+        node-version-file: '.nvmrc'
+    - name: Install dependencies
+      run: npm ci
+    - name: Lint
+      run: npm run lint
+    - name: Type check
+      run: npm run types
+    - name: Test
+      run: npm run test
+    - name: Build
+      run: npm run build
+    - name: Coverage
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      with:
+        token: ${{ secrets.CODECOV_TOKEN }}
+        fail_ci_if_error: false
+    - name: Release
+      run: npx semantic-release@25
+      env:
+        GITHUB_TOKEN: ${{ secrets.OPENEDX_SEMANTIC_RELEASE_GITHUB_TOKEN }}

.gitignore

@@ -0,0 +1,25 @@
+.DS_Store
+.eslintcache
+.idea
+node_modules
+npm-debug.log
+coverage
+module.config.js
+
+dist/
+src/i18n/transifex_input.json
+temp/babel-plugin-react-intl
+
+### test-apps ###
+# The packed tarball is a build artifact, and the app lockfiles would churn on
+# every library change because they hash that tarball.
+test-apps/*.tgz
+test-apps/*/package-lock.json
+
+### pyenv ###
+.python-version
+
+### Emacs ###
+*~
+/temp
+/.vscode

.npmignore

@@ -0,0 +1 @@
+node_modules

.nvmrc

@@ -0,0 +1 @@
+24

.releaserc

@@ -0,0 +1,11 @@
+{
+  "branches": [
+    "main"
+  ],
+  "plugins": [
+    "@semantic-release/commit-analyzer",
+    "@semantic-release/release-notes-generator",
+    "@semantic-release/npm",
+    "@semantic-release/github"
+  ]
+}

Makefile

@@ -0,0 +1,36 @@
+.PHONY: build clean precommit requirements test-apps test-apps-clean types
+
+requirements:
+	npm ci
+
+clean:
+	rm -rf dist
+
+# Emit JS, type declarations and source maps from src/ with tsc.
+build: clean
+	./node_modules/.bin/tsc --project tsconfig.build.json
+
+# Type-check the whole project, including tests and config files, without emitting.
+types:
+	./node_modules/.bin/tsc --noEmit
+
+precommit:
+	npm run lint
+	npm audit
+
+# Verify the published artifact installs and builds in both architectures.
+#
+# The library is packed and installed as a tarball rather than linked, so that
+# packaging mistakes (exports map, files, types) surface here instead of in a
+# consuming MFE. The apps deliberately keep their own lockfiles, so that
+# frontend-platform/frontend-build and frontend-base never enter this library's
+# dependency tree.
+test-apps: build
+	npm pack --pack-destination test-apps
+	cd test-apps/platform && npm install && npm run types && npm run build
+	cd test-apps/base && npm install && npm run types && npm run lint && npm run build
+
+test-apps-clean:
+	rm -rf test-apps/*.tgz
+	rm -rf test-apps/platform/node_modules test-apps/platform/dist
+	rm -rf test-apps/base/node_modules test-apps/base/dist

README.rst

@@ -0,0 +1,121 @@
+frontend-authz
+##############
+
+|license-badge| |status-badge| |ci-badge| |codecov-badge|
+
+.. |license-badge| image:: https://img.shields.io/github/license/openedx/frontend-authz.svg
+    :target: https://github.com/openedx/frontend-authz/blob/main/LICENSE
+    :alt: License
+
+.. |status-badge| image:: https://img.shields.io/badge/Status-Experimental-yellow
+
+.. |ci-badge| image:: https://github.com/openedx/frontend-authz/actions/workflows/ci.yml/badge.svg
+    :target: https://github.com/openedx/frontend-authz/actions/workflows/ci.yml
+    :alt: Continuous Integration
+
+.. |codecov-badge| image:: https://codecov.io/github/openedx/frontend-authz/coverage.svg?branch=main
+    :target: https://codecov.io/github/openedx/frontend-authz?branch=main
+    :alt: Codecov
+
+Purpose
+=======
+
+``frontend-authz`` provides reusable permission-validation hooks
+for integrating the `openedx-authz <https://github.com/openedx/openedx-authz>`_ backend service into Open edX MFEs.
+
+It is designed to be consumed by both MFEs on ``frontend-platform``/``frontend-build``
+and those migrated to ``frontend-base``.
+
+To make that possible, this library does not import either base library.
+
+Getting Started
+===============
+
+Installation
+------------
+
+.. code-block:: bash
+
+    npm install @openedx/frontend-authz
+
+Usage
+-----
+
+Documentation and usage examples will be added as the implementation is completed.
+See ``docs/how_tos/`` for how-to guides as they become available.
+
+Development
+-----------
+
+.. code-block:: bash
+
+    npm install
+    npm test
+    npm run lint
+    npm run types
+    npm run build
+
+The package is written in TypeScript and built with ``tsc``. ``npm run build``
+compiles ``src/`` to ``dist/``, emitting JavaScript, type declarations and source
+maps. 
+
+``npm run types`` type-checks the whole project, including tests and config files.
+
+Getting Help
+============
+
+If you're having trouble, we have discussion forums at
+https://discuss.openedx.org where you can connect with others in the community.
+
+Our real-time conversations are on Slack. You can request a `Slack
+invitation`_, then join our `community Slack workspace`_. Because this is a
+frontend repository, the best place to discuss it would be in the `#wg-frontend
+channel`_.
+
+For anything non-trivial, the best path is to open an issue in this repository
+with as many details about the issue you are facing as you can provide.
+
+https://github.com/openedx/frontend-authz/issues
+
+For more information about these options, see the `Getting Help`_ page.
+
+.. _Slack invitation: https://openedx.org/slack
+.. _community Slack workspace: https://openedx.slack.com/
+.. _#wg-frontend channel: https://openedx.slack.com/archives/C04BM6YC7A6
+.. _Getting Help: https://openedx.org/getting-help
+
+License
+=======
+
+The code in this repository is licensed under the AGPLv3 unless otherwise
+noted.
+
+Please see `LICENSE <LICENSE>`_ for details.
+
+Contributing
+============
+
+Contributions are very welcome. Please read `How To Contribute`_ for details.
+
+.. _How To Contribute: https://openedx.org/r/how-to-contribute
+
+The Open edX Code of Conduct
+============================
+
+All community members are expected to follow the `Open edX Code of Conduct`_.
+
+.. _Open edX Code of Conduct: https://openedx.org/code-of-conduct/
+
+People
+======
+
+The assigned maintainers for this component and other project details may be
+found in `Backstage`_. Backstage pulls this data from the ``catalog-info.yaml``
+file in this repo.
+
+.. _Backstage: https://open-edx-backstage.herokuapp.com/catalog/default/component/frontend-authz
+
+Reporting Security Issues
+=========================
+
+Please do not report security issues in public. Email security@openedx.org instead.

babel.config.js

@@ -0,0 +1,3 @@
+const { createConfig } = require('@openedx/frontend-base/tools');
+
+module.exports = createConfig('babel');

catalog-info.yaml

@@ -0,0 +1,19 @@
+# This file records information about this repo. Its use is described in OEP-55:
+# https://open-edx-proposals.readthedocs.io/en/latest/processes/oep-0055-proc-project-maintainers.html
+
+apiVersion: backstage.io/v1alpha1
+kind: Component
+metadata:
+  name: "frontend-authz"
+  description: "Permission-validation hooks and API client for integrating openedx-authz into Open edX MFEs"
+  links:
+    - url: "https://github.com/openedx/frontend-authz/blob/main/README.rst"
+      title: "README"
+      icon: "Article"
+  annotations:
+    openedx.org/arch-interest-groups: ""
+    openedx.org/release: "main"
+spec:
+  owner: group:committers-frontend
+  type: "library"
+  lifecycle: "experimental"

codecov.yml

@@ -0,0 +1,10 @@
+coverage:
+  status:
+    project:
+      default:
+        target: auto
+        threshold: 0%
+    patch:
+      default:
+        target: auto
+        threshold: 0%