Merge branch 'develop' into dist/ubuntu/bionic/develop

L'état de connexion est conservé dans le sessionStorage et réutilisé par
défaut lors du rafraichissement de la page.

Si une erreur 401 survient lors d'un appel à l'API alors l'utilisateur
est redirigé vers la page d'accueil.

client/package-lock.json

@@ -1,5 +1,5 @@
 {
-  "name": "dadd-",
+  "name": "daddy",
   "version": "0.0.0",
   "lockfileVersion": 1,
   "requires": true,
@@ -2839,6 +2839,14 @@
         }
       }
     },
+    "base-x": {
+      "version": "3.0.8",
+      "resolved": "https://registry.npmjs.org/base-x/-/base-x-3.0.8.tgz",
+      "integrity": "sha512-Rl/1AWP4J/zRrk54hhlxH4drNxPJXYUaKffODVI53/dAsV4t9fBxyxYKAVPU1XBHxYwOWP9h9H0hM2MVw4YfJA==",
+      "requires": {
+        "safe-buffer": "^5.0.1"
+      }
+    },
     "base64-js": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.3.1.tgz",
@@ -3127,6 +3135,14 @@
         "pkg-up": "^2.0.0"
       }
     },
+    "bs58": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/bs58/-/bs58-4.0.1.tgz",
+      "integrity": "sha1-vhYedsNU9veIrkBx9j806MTwpCo=",
+      "requires": {
+        "base-x": "^3.0.2"
+      }
+    },
     "btoa": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/btoa/-/btoa-1.2.1.tgz",
@@ -8631,8 +8647,7 @@
     "safe-buffer": {
       "version": "5.1.2",
       "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
+      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
     },
     "safe-regex": {
       "version": "1.1.0",

client/package.json

@@ -53,6 +53,7 @@
   "dependencies": {
     "@apollo/client": "^3.0.2",
     "@types/qs": "^6.9.3",
+    "bs58": "^4.0.1",
     "bulma": "^0.9.0",
     "graphql": "^15.3.0",
     "react": "^16.12.0",

client/src/components/App.tsx

@@ -1,20 +1,81 @@
-import React from 'react';
+import React, { FunctionComponent, useState, useEffect } from 'react';
 import { BrowserRouter, Route, Redirect, Switch } from "react-router-dom";
 import { HomePage } from './HomePage/HomePage';
 import { ProfilePage } from './ProfilePage/ProfilePage';
 import { WorkgroupPage } from './WorkgroupPage/WorkgroupPage';
+import { DecisionSupportFilePage } from './DecisionSupportFilePage/DecisionSupportFilePage';
+import { DashboardPage } from './DashboardPage/DashboardPage';
+import { useUserProfile } from '../gql/queries/profile';
+import { LoggedInContext, getSavedLoggedIn, saveLoggedIn } from '../hooks/useLoggedIn';
+import { PrivateRoute } from './PrivateRoute';
+import { useKonamiCode } from '../hooks/useKonamiCode';
+import { Modal } from './Modal';
+import { createClient } from '../util/apollo';
+import { ApolloProvider } from '@apollo/client';
+import { LogoutPage } from './LogoutPage';
 
-export class App extends React.Component {
-  render() {
-    return (
-      <BrowserRouter>
-        <Switch>
-          <Route path="/" exact component={HomePage} />
-          <Route path="/profile" exact component={ProfilePage} />
-          <Route path="/workgroups/:id" exact component={WorkgroupPage} />
-          <Route component={() => <Redirect to="/" />} />
-        </Switch>
-      </BrowserRouter>
-    );
-  }
-}
+export interface AppProps {
+
+}
+
+
+
+export const App: FunctionComponent<AppProps> = () => {
+  const [ loggedIn, setLoggedIn ] = useState(getSavedLoggedIn());
+
+  const client = createClient((loggedIn) => {
+    setLoggedIn(loggedIn);
+  });
+
+  useEffect(() => {
+    saveLoggedIn(loggedIn);
+  }, [loggedIn]);
+
+  const [ showBoneyM, setShowBoneyM ] = useState(false);
+  useKonamiCode(() => setShowBoneyM(true));
+
+  return (
+    <ApolloProvider client={client}>
+      <LoggedInContext.Provider value={loggedIn}>
+        <UserSessionCheck setLoggedIn={setLoggedIn} />
+        <BrowserRouter>
+          <Switch>
+            <Route path="/" exact component={HomePage} />
+            <PrivateRoute path="/profile" exact component={ProfilePage} />
+            <PrivateRoute path="/workgroups/:id" exact component={WorkgroupPage} />
+            <PrivateRoute path="/decisions/:id" exact component={DecisionSupportFilePage} />
+            <PrivateRoute path="/dashboard" exact component={DashboardPage} />
+            <PrivateRoute path="/logout" exact component={LogoutPage} />
+            <Route component={() => <Redirect to="/" />} />
+          </Switch>
+        </BrowserRouter>
+        {
+          showBoneyM ?
+          <Modal active={true} showCloseButton={true} onClose={() => setShowBoneyM(false)}>
+            <iframe width={560} height={315}
+              frameBorder={0}
+              allowFullScreen={true}
+              src="https://www.youtube.com/embed/uVzT5QEEQ2c?autoplay=1" allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture">
+            </iframe>
+          </Modal> :
+          null
+        }
+      </LoggedInContext.Provider>
+    </ApolloProvider>
+  );
+}
+
+interface UserSessionCheckProps {
+  setLoggedIn: (boolean) => void
+}
+
+const UserSessionCheck: FunctionComponent<UserSessionCheckProps> = ({ setLoggedIn }) => {
+  const { user, loading } = useUserProfile();
+
+  useEffect(() => {
+    if (loading) return;
+    setLoggedIn(user.id !== '');
+  }, [user]);
+
+  return null;
+};

client/src/components/DashboardPage/Dashboard.tsx

@@ -1,26 +1,17 @@
 import React from 'react';
 import { WorkgroupsPanel } from './WorkgroupsPanel';
+import { DecisionSupportFilePanel } from './DecisionSupportFilePanel';
 
 export function Dashboard() {
   return (
     <div className="columns">
-      <div className="column">
+      <div className="column is-6">
+        <DecisionSupportFilePanel />
+      </div>
+      <div className="column is-3">
         <WorkgroupsPanel />
       </div>
-      <div className="column">
-        <div className="box">
-          <div className="level">
-            <div className="level-left">
-              <h3 className="is-size-3 subtitle level-item">D.A.Ds</h3>
-            </div>
-            <div className="level-right">
-              <button disabled className="button is-primary level-item"><i className="fa fa-plus"></i></button>
-            </div>
-          </div>
-          <pre>TODO</pre>
-        </div>
-      </div>
-      <div className="column">
+      <div className="column is-3">
         <div className="box">
           <div className="level">
             <div className="level-left">

client/src/components/DashboardPage/DashboardPage.tsx

@@ -0,0 +1,15 @@
+import React from 'react';
+import { Page } from '../Page';
+import { Dashboard } from './Dashboard';
+
+export function DashboardPage() {
+  return (
+    <Page title={'Tableau de bord'}>
+      <div className="container is-fluid">
+        <section className="mt-5">
+          <Dashboard />
+        </section>
+      </div>
+    </Page>
+  );
+}

client/src/components/DashboardPage/DecisionSupportFilePanel.tsx

@@ -0,0 +1,43 @@
+import React from 'react';
+import { DecisionSupportFile, DecisionSupportFileStatus } from '../../types/decision';
+import { ItemPanel, TabDefinition, Item } from './ItemPanel';
+import { useUserProfile } from '../../gql/queries/profile';
+import { inWorkgroup } from '../../types/workgroup';
+import { useDecisionSupportFiles } from '../../gql/queries/dsf';
+
+export function DecisionSupportFilePanel() {
+  const { user } = useUserProfile();
+  const { decisionSupportFiles } = useDecisionSupportFiles();
+
+  const tabs: TabDefinition[] = [
+    {
+      label: 'Mes dossiers en cours',
+      itemFilter: (item: Item) => {
+        const dsf = item as DecisionSupportFile;
+        return (dsf.status === DecisionSupportFileStatus.Draft || dsf.status === DecisionSupportFileStatus.Ready) && inWorkgroup(user, dsf.workgroup);
+      }
+    },
+    {
+      label: 'Brouillons',
+      itemFilter: (item: Item) => (item as DecisionSupportFile).status === DecisionSupportFileStatus.Draft
+    },
+    {
+      label: 'Clos',
+      itemFilter: (item: Item) => (item as DecisionSupportFile).status === DecisionSupportFileStatus.Closed
+    },
+  ];
+  
+  return (
+    <ItemPanel
+      className='is-link'
+      title="Dossiers"
+      newItemUrl="/decisions/new"
+      items={decisionSupportFiles}
+      tabs={tabs}
+      itemIconClassName='fas fa-folder'
+      itemKey={item => item.id}
+      itemLabel={item => item.title}
+      itemUrl={item => `/decisions/${item.id}`}
+    />
+  );
+}

client/src/components/DashboardPage/ItemPanel.tsx

@@ -0,0 +1,119 @@
+import React, { FunctionComponent, useState, useEffect } from "react";
+import { Link } from "react-router-dom";
+import { WithLoader } from "../WithLoader";
+
+export interface Item {
+  id: string
+  [propName: string]: any;
+}
+
+export interface TabDefinition {
+  label: string
+  itemFilter?: (item: Item) => boolean
+}
+export interface ItemPanelProps {
+  className?: string
+  itemIconClassName?: string
+  title?: string
+  newItemUrl: string
+  isLoading?: boolean
+  items: Item[]
+  tabs?: TabDefinition[],
+  itemKey: (item: Item, index: number) => string
+  itemLabel: (item: Item, index: number) => string
+  itemUrl: (item: Item, index: number) => string
+}
+
+export const ItemPanel: FunctionComponent<ItemPanelProps> = (props) => {
+  const { 
+    title, className, newItemUrl, 
+    itemKey, itemLabel, 
+    itemIconClassName, itemUrl,
+  } = props;
+  
+  const items = props.items || [];
+  const tabs = props.tabs || [];
+
+  const [ state, setState ] = useState({ selectedTab: 0, filteredItems: [] });
+
+  const filterItemsForTab = (tab: TabDefinition, items: Item[]) => {
+    const itemFilter = tab && typeof tab.itemFilter === 'function' ? tab.itemFilter : () => true;
+    return items.filter(itemFilter);
+  };
+
+  const selectTab = (tabIndex: number) => {
+    setState(state => {
+      const newTab = Array.isArray(tabs) && tabs.length > 0 ? tabs[tabIndex] : null;
+      return { 
+        ...state, 
+        selectedTab: tabIndex,
+        filteredItems: filterItemsForTab(newTab, items)
+      };
+    });
+  };
+
+  useEffect(() => {
+    setState(state => {
+      const { tabs, items } = props;      
+      const newTab = Array.isArray(tabs) && tabs.length > 0 ? tabs[state.selectedTab] : null;
+      return {
+        ...state,
+        filteredItems: filterItemsForTab(newTab, items),
+      }
+    });
+  }, [items, tabs]);
+
+  const itemElements = state.filteredItems.map((item: Item, i: number) => {
+    return (
+      <Link to={itemUrl(item, i)} key={`item-${itemKey(item, i)}`} className="panel-block">
+        <span className="panel-icon">
+          <i className={itemIconClassName} aria-hidden="true"></i>
+        </span>
+        {itemLabel(item, i)}
+      </Link>
+    );
+  });
+
+  return (
+    <nav className={`panel ${className}`}>
+      <div className="level is-mobile panel-heading mb-0">
+        <div className="level-left">
+          <p className="level-item">{title}</p>
+        </div>
+        <div className="level-right">
+          <Link to={newItemUrl} className="button level-item is-outlined is-info is-inverted">
+            <i className="icon fa fa-plus"></i>
+          </Link>
+        </div>
+      </div>
+      <div className="panel-block">
+        <p className="control has-icons-left">
+          <input className="input" type="text" placeholder="Filtrer..." />
+          <span className="icon is-left">
+            <i className="fas fa-search" aria-hidden="true"></i>
+          </span>
+        </p>
+      </div>
+      <p className="panel-tabs">
+        {
+          tabs.map((tab, i) => {
+            return (
+              <a key={`workgroup-tab-${i}`}
+                onClick={selectTab.bind(null, i)}
+                className={i === state.selectedTab ? 'is-active' : ''}>
+                {tab.label}
+              </a>
+            )
+          })
+        }
+      </p>
+      {
+        itemElements.length > 0 ?
+        itemElements :
+        <a className="panel-block has-text-centered is-block">
+          <em>Aucun élément pour l'instant.</em>
+        </a>
+      }
+    </nav>
+  )
+};

client/src/components/DashboardPage/WorkgroupsPanel.tsx

@@ -0,0 +1,42 @@
+import React, {  } from 'react';
+import { Workgroup, inWorkgroup } from '../../types/workgroup';
+import { useWorkgroups } from '../../gql/queries/workgroups';
+import { useUserProfile } from '../../gql/queries/profile';
+import { ItemPanel, Item } from './ItemPanel';
+
+export function WorkgroupsPanel() {
+  const { workgroups } = useWorkgroups();
+  const  { user } = useUserProfile();
+
+  const tabs = [
+    {
+      label: "Mes groupes en cours",
+      itemFilter: (item: Item) => {
+        const wg = item as Workgroup;
+        return  wg.closedAt === null && inWorkgroup(user, wg);
+      }
+    },
+    {
+      label: "Ouverts",
+      itemFilter: (item: Item) => !(item as Workgroup).closedAt
+    },
+    {
+      label: "Clos",
+      itemFilter: (item: Item) => !!(item as Workgroup).closedAt
+    }
+  ];
+  
+  return (
+    <ItemPanel
+      className='is-info'
+      title="Groupes de travail"
+      newItemUrl="/workgroups/new"
+      items={workgroups}
+      tabs={tabs}
+      itemIconClassName='fas fa-users'
+      itemKey={item => item.id}
+      itemLabel={item => item.name}
+      itemUrl={item => `/workgroups/${item.id}`}
+    />
+  );
+}

client/src/components/DecisionSupportFilePage/AppendixPanel.tsx

@@ -0,0 +1,18 @@
+import React, { FunctionComponent, useState } from 'react';
+import { DecisionSupportFile } from '../../types/decision';
+
+export interface AppendixPanelProps {
+  dsf: DecisionSupportFile,
+};
+
+export const AppendixPanel: FunctionComponent<AppendixPanelProps> = ({ dsf }) => {
+  return (
+    <nav className="panel">
+      <p className="panel-heading">
+        Annexes
+      </p>
+      <div className="panel-block">
+      </div>
+    </nav>
+  );
+};

client/src/components/DecisionSupportFilePage/ClarificationSection.tsx

@@ -0,0 +1,134 @@
+import React, { FunctionComponent, useState, ChangeEvent, useEffect } from 'react';
+import { DecisionSupportFileUpdaterProps } from './DecisionSupportFileUpdaterProps';
+import { useDebounce } from '../../hooks/useDebounce';
+import { asDate } from '../../util/date';
+
+export interface ClarificationSectionProps extends DecisionSupportFileUpdaterProps {};
+
+const ClarificationSectionName = 'clarification';
+
+export const ClarificationSection: FunctionComponent<ClarificationSectionProps> = ({ dsf, updateDSF }) => {
+  const [ state, setState ] = useState({
+    changed: false,
+    section: {
+      objectives: '',
+      motivations: '',
+      scope: '',
+      nature: '',
+      deadline: undefined,
+      hasDeadline: false,
+    }
+  });
+
+  useEffect(() => {
+    if (!state.changed) return;
+    updateDSF({ ...dsf, sections: { ...dsf.sections, [ClarificationSectionName]: { ...state.section }} })
+    setState(state => ({ ...state, changed: false }));
+  }, [state.changed]);
+
+  useEffect(() => {
+    if (!dsf.sections[ClarificationSectionName]) return;
+    setState(state => ({ ...state, changed: false, section: {...state.section, ...dsf.sections[ClarificationSectionName] }}));
+  }, [dsf.sections[ClarificationSectionName]]);
+
+  const onTitleChange = (evt: ChangeEvent<HTMLInputElement>) => {
+    const title = (evt.currentTarget).value;
+    updateDSF({ ...dsf, title });
+  };
+
+  const onSectionAttrChange = (attrName: string, evt: ChangeEvent<HTMLInputElement>) => {
+    const target = evt.currentTarget;
+    const value = target.hasOwnProperty('checked') ? target.checked : target.value;
+    setState(state => ({ ...state, changed: true, section: {...state.section, [attrName]: value }}));
+  };
+
+  const onDeadlineChange = (evt: ChangeEvent<HTMLInputElement>) => {
+    const deadline = evt.currentTarget.valueAsDate;
+    setState(state => ({ ...state, changed: true, section: { ...state.section, deadline }}));
+  };
+
+  return (
+    <section>
+      <div className="box">
+        <div className="field">
+          <label className="label">Intitulé du dossier</label>
+          <div className="control">
+            <input className="input" type="text" value={dsf.title} onChange={onTitleChange} />
+          </div>
+        </div>
+        <div className="field">
+          <label className="label">Quelle décision devons nous prendre ?</label>
+          <div className="control">
+            <textarea className="textarea"
+              value={state.section.objectives}
+              onChange={onSectionAttrChange.bind(null, 'objectives')}
+              placeholder="Décrire globalement les tenants et aboutissants de la décision à prendre." 
+              rows={10}>
+            </textarea>
+          </div>
+          <p className="help is-info"><i className="fa fa-info-circle"></i> Ne pas essayer de rentrer trop dans les détails ici. Préférer l'utilisation des annexes et y faire référence.</p>
+        </div>
+        <div className="field">
+          <label className="label">Pourquoi devons nous prendre cette décision ?</label>
+          <div className="control">
+            <textarea className="textarea"
+              value={state.section.motivations}
+              onChange={onSectionAttrChange.bind(null, 'motivations')}
+              placeholder="Décrire pourquoi il est important de prendre cette décision." 
+              rows={10}>
+            </textarea>
+          </div>
+          <p className="help is-info"><i className="fa fa-info-circle"></i> Penser à indiquer si des obligations légales pèsent sur cette prise de décision.</p>
+        </div>
+        <div className="field">
+          <label className="label">Portée de la décision</label>
+          <div className="control">
+            <div className="select">
+              <select 
+                onChange={onSectionAttrChange.bind(null, 'scope')} 
+                value={state.section.scope}>
+                <option></option>
+                <option value="individual">Individuelle</option>
+                <option value="identified-group">Groupe identifié</option>
+                <option value="collective">Collective</option>
+              </select>
+            </div>
+          </div>
+        </div>
+        <div className="field">
+          <label className="label">Nature de la décision</label>
+          <div className="control">
+            <div className="select">
+              <select onChange={onSectionAttrChange.bind(null, 'nature')} 
+                value={state.section.nature}>
+                <option></option>
+                <option value="operational">Opérationnelle</option>
+                <option value="tactic">Tactique</option>
+                <option value="strategic">Stratégique</option>
+              </select>
+            </div>
+          </div>
+        </div>
+        
+        <div className="columns">
+          <div className="column">
+            <label className="checkbox">
+              <input type="checkbox"
+                onChange={onSectionAttrChange.bind(null, 'hasDeadline')}
+                checked={state.section.hasDeadline} />
+              <span className="ml-1">Existe t'il une échéance particulière pour cette décision ?</span>
+            </label>
+            <div className="field">
+              <div className="control">
+                <input disabled={!state.section.hasDeadline} 
+                  value={state.section.deadline ? asDate(state.section.deadline).toISOString().substr(0, 10) : ''}
+                  onChange={onDeadlineChange}
+                  type="date" className="input" />
+              </div>
+            </div>
+          </div>
+        </div>
+      </div>
+    </section>
+  );
+};

client/src/components/DecisionSupportFilePage/DecisionSupportFilePage.tsx

@@ -0,0 +1,161 @@
+import React, { FunctionComponent, useState, useEffect } from 'react';
+import { Page } from '../Page';
+import { ClarificationSection } from './ClarificationSection';
+import { MetadataPanel } from './MetadataPanel';
+import { AppendixPanel } from './AppendixPanel';
+import { DecisionSupportFile, newDecisionSupportFile, DecisionSupportFileStatus } from '../../types/decision';
+import { useParams, useHistory } from 'react-router';
+import { useDecisionSupportFiles } from '../../gql/queries/dsf';
+import { useCreateDecisionSupportFileMutation, useUpdateDecisionSupportFileMutation } from '../../gql/mutations/dsf';
+import { useDebounce } from '../../hooks/useDebounce';
+import { OptionsSection } from './OptionsSection';
+
+export interface DecisionSupportFilePageProps {
+
+};
+
+export const DecisionSupportFilePage: FunctionComponent<DecisionSupportFilePageProps> = () => {
+  const { id } = useParams();
+  const history = useHistory();
+  const { decisionSupportFiles } = useDecisionSupportFiles({
+    variables:{
+      filter: {
+        ids: id !== 'new' ? [id] : undefined,
+      }
+    }
+  });
+
+  const [ state, setState ] = useState({ 
+    dsf: newDecisionSupportFile(),
+    saved: true,
+    selectedTabIndex: 0,
+  });
+
+  useEffect(() => {
+    const dsf = decisionSupportFiles.length > 0 && decisionSupportFiles[0].id === id ? decisionSupportFiles[0] : {};
+    setState(state => ({ ...state, dsf: { ...state.dsf, ...dsf }}))
+  }, [ decisionSupportFiles ]);
+
+  const selectTab = (tabIndex: number) => {
+    setState(state => ({ ...state, selectedTabIndex: tabIndex }));
+  };
+
+  const updateDSF = (dsf: DecisionSupportFile) => {
+    setState(state => {
+      return { ...state, saved: false, dsf: { ...state.dsf, ...dsf } };
+    });
+  };
+
+  const [ createDecisionSupportFile ] = useCreateDecisionSupportFileMutation();
+  const [ updateDecisionSupportFile ] = useUpdateDecisionSupportFileMutation();
+
+  const saveDSF = () => {
+    const changes = {
+      title: state.dsf.title !== '' ? state.dsf.title : undefined,
+      status: state.dsf.status,
+      workgroupId: state.dsf.workgroup ? state.dsf.workgroup.id : undefined,
+      sections: state.dsf.sections,
+    };
+
+    if (!changes.workgroupId) return;
+
+    if (state.dsf.id === '') {
+      createDecisionSupportFile({
+        variables: { changes },
+      }).then(({ data }) => {
+        history.push(`/decisions/${data.createDecisionSupportFile.id}`);
+      });
+    } else {
+      updateDecisionSupportFile({
+        variables: { changes, id: state.dsf.id },
+      }).then(({ data }) => {
+        setState(state => {
+          return { ...state, saved: true, dsf: { ...state.dsf, ...data.updateDecisionSupportFile } };
+        });
+      });
+    }
+  };
+
+  const canSave = !!state.dsf.workgroup && !state.saved;
+  const isNew = state.dsf.id === '';
+  const isClosed = state.dsf.status === DecisionSupportFileStatus.Closed;
+
+  return (
+    <Page title="Dossier d'Aide à la Décision">
+      <div className="container is-fluid">
+        <section className="mt-5">
+          <div className="level">
+            <div className="level-left">
+              {
+                isNew ?
+                <div className="level-item">
+                  <div>
+                    <h2 className="is-size-3 title is-spaced">Nouveau</h2>
+                    <h3 className="is-size-5 subtitle">Dossier d'Aide à la Décision</h3>
+                  </div>
+                </div> :
+                <div className="level-item">
+                  <div>
+                    <h2 className="is-size-3 title is-spaced">{state.dsf.title}</h2>
+                    <h3 className="is-size-5 subtitle">Dossier d'Aide à la Décision <span className="is-italic">{ isClosed ? '(clos)' : null }</span></h3>
+                  </div>
+                </div>
+              }
+            </div>
+            <div className="level-right">
+              <div className="level-item buttons">
+                <button className="button is-medium is-success" disabled={!canSave} onClick={saveDSF}>
+                  <span className="icon"><i className="fa fa-save"></i></span>
+                  <span>Enregistrer</span>
+                </button>
+              </div>
+            </div>
+          </div>
+        </section>
+        <div className="columns mt-3">
+          <div className="column is-9">
+            <div className="tabs is-medium is-toggle">
+              <ul>
+                <li className={`has-background-white ${state.selectedTabIndex === 0 ? 'is-active': ''}`}
+                  onClick={selectTab.bind(null, 0)}>
+                  <a>
+                    <span className="icon is-small"><i className="fas fa-pen" aria-hidden="true"></i></span>
+                    <span>Clarifier la proposition</span>
+                  </a>
+                </li>
+                <li className={`has-background-white ${state.selectedTabIndex === 1 ? 'is-active': ''}`} 
+                    onClick={selectTab.bind(null, 1)}>
+                  <a>
+                    <span className="icon is-small"><i className="fas fa-search" aria-hidden="true"></i></span>
+                    <span>Explorer les options</span>
+                  </a>
+                </li>
+                <li className={`has-background-white ${state.selectedTabIndex === 2 ? 'is-active': ''}`} 
+                    onClick={selectTab.bind(null, 2)}>
+                  <a>
+                    <span className="icon is-small"><i className="fas fa-person-booth" aria-hidden="true"></i></span>
+                    <span>Prendre la décision</span>
+                  </a>
+                </li>
+              </ul>
+            </div>
+            {
+              state.selectedTabIndex === 0 ?
+              <ClarificationSection dsf={state.dsf} updateDSF={updateDSF} /> :
+              null
+            }
+            {
+              state.selectedTabIndex === 1 ?
+              <OptionsSection dsf={state.dsf} updateDSF={updateDSF} /> :
+              null
+            }
+          </div>
+          <div className="column is-3">
+            <MetadataPanel dsf={state.dsf} updateDSF={updateDSF} />
+            <AppendixPanel dsf={state.dsf} />
+          </div>
+        </div>
+      </div>
+    </Page>
+  );
+};

client/src/components/DecisionSupportFilePage/DecisionSupportFileUpdaterProps.tsx

@@ -0,0 +1,6 @@
+import { DecisionSupportFile } from "../../types/decision";
+
+export interface DecisionSupportFileUpdaterProps {
+  dsf: DecisionSupportFile
+  updateDSF: (dsf: DecisionSupportFile) => void
+}

client/src/components/DecisionSupportFilePage/MetadataPanel.tsx

@@ -0,0 +1,86 @@
+import React, { FunctionComponent, useState, useEffect, ChangeEvent } from 'react';
+import { DecisionSupportFile, DecisionSupportFileStatus } from '../../types/decision';
+import { useWorkgroups } from '../../gql/queries/workgroups';
+import { useUserProfile } from '../../gql/queries/profile';
+import { inWorkgroup } from '../../types/workgroup';
+import { DecisionSupportFileUpdaterProps } from './DecisionSupportFileUpdaterProps';
+import { asDate } from '../../util/date';
+
+export interface MetadataPanelProps extends DecisionSupportFileUpdaterProps {};
+
+export const MetadataPanel: FunctionComponent<MetadataPanelProps> = ({ dsf, updateDSF }) => {
+  const { user } = useUserProfile();
+  const { workgroups } = useWorkgroups();
+
+  const [ userOpenedWorkgroups, setUserOpenedWorkgroups ] = useState([]);
+
+  useEffect(() => {
+    const filtered = workgroups.filter(wg => !wg.closedAt && inWorkgroup(user, wg));
+    setUserOpenedWorkgroups(filtered);
+  }, [workgroups, user])
+
+  const onStatusChanged = (evt: ChangeEvent<HTMLSelectElement>) => {
+    const status = evt.currentTarget.value as DecisionSupportFileStatus;
+    updateDSF({ ...dsf, status });
+  };
+
+  const onWorkgroupChanged = (evt: ChangeEvent<HTMLSelectElement>) => {
+    const workgroupId = evt.currentTarget.value;
+    const workgroup = workgroups.find(wg => wg.id === workgroupId);
+    updateDSF({ ...dsf, workgroup });
+  };
+
+  return (
+    <nav className="panel">
+      <p className="panel-heading">
+        Métadonnées
+      </p>
+      <div className="panel-block">
+        <div style={{width:'100%'}}>
+          <div className="field">
+            <div className="label">Groupe de travail</div>
+            <div className="control is-expanded">
+              <div className="select is-fullwidth">
+                <select onChange={onWorkgroupChanged} value={dsf.workgroup ? dsf.workgroup.id : ''}>
+                  <option></option>
+                  {
+                    userOpenedWorkgroups.map(wg => {
+                      return (
+                        <option key={`wg-${wg.id}`} value={wg.id}>{wg.name}</option>
+                      );
+                    })
+                  }
+                </select>
+              </div>
+            </div>
+          </div>
+          <div className="field">
+            <div className="label">Statut</div>
+            <div className="control is-expanded">
+              <div className="select is-fullwidth">
+                <select onChange={onStatusChanged} value={dsf.status}>
+                  <option value="draft">Brouillon</option>
+                  <option value="ready">Prêt à voter</option>
+                  <option value="voted">Voté</option>
+                  <option value="closed">Clôs</option>
+                </select>
+              </div>
+            </div>
+          </div>
+          <div className="field">
+            <div className="label">Créé le</div>
+            <div className="control">
+              <p>{asDate(dsf.createdAt).toISOString()}</p>
+            </div>
+          </div>
+          <div className="field">
+            <div className="label">Voté le</div>
+            <div className="control">
+              <p>{dsf.votedAt ? dsf.votedAt : '--'}</p>
+            </div>
+          </div>
+        </div>
+      </div>
+    </nav>
+  );
+};

client/src/components/DecisionSupportFilePage/OptionsSection.tsx

@@ -0,0 +1,153 @@
+import React, { FunctionComponent, useState, useEffect, ChangeEvent, MouseEvent } from 'react';
+import { DecisionSupportFileUpdaterProps } from './DecisionSupportFileUpdaterProps';
+import { base58UUID } from "../../util/uuid";
+
+export interface OptionsSectionProps extends DecisionSupportFileUpdaterProps {};
+
+const OptionsSectionName = 'options';
+
+export const OptionsSection: FunctionComponent<OptionsSectionProps> = ({ dsf, updateDSF }) => {
+  interface OptionsSectionState {
+    changed: boolean
+    section: OptionsSection
+  }
+  
+  interface OptionsSection {
+     options: Option[]
+  }
+  
+  interface Option {
+      id: string
+      label: string
+      pros: string
+      cons: string
+  }
+  
+  const [ state, setState ] = useState<OptionsSectionState>({
+     changed: false,
+     section: {
+       options: [],
+     }
+  });
+
+  useEffect(() => {
+    if (!state.changed) return;
+    updateDSF({ ...dsf, sections: { ...dsf.sections, [OptionsSectionName]: { ...state.section }} })
+    setState(state => ({ ...state, changed: false }));
+  }, [state.changed]);
+
+  useEffect(() => {
+    if (!dsf.sections[OptionsSectionName]) return;
+    setState(state => ({ ...state, changed: false, section: {...state.section, ...dsf.sections[OptionsSectionName] }}));
+  }, [dsf.sections[OptionsSectionName]]);
+
+  function newOption(label: string, pros: string, cons: string): Option {
+    return {
+      id: base58UUID(),
+      label,
+      pros,
+      cons
+    };
+  }
+
+  const onAddOptionClick = (evt: MouseEvent) => {
+    const options = JSON.parse(JSON.stringify(state.section.options))
+    const option = newOption("Décision", "", "");
+    options.push(option);
+    setState(state => ({ ...state, changed: true, section: { ...state.section, options }}));
+  };
+
+  const onOptionChange = (id: number, attrName: string, evt: ChangeEvent<HTMLInputElement>) => {
+    const target = evt.currentTarget;
+    const value = target.hasOwnProperty('checked') ? target.checked : target.value;
+    const options = JSON.parse(JSON.stringify(state.section.options))
+    options[id][attrName] = value;
+    setState(state => ({ ...state, changed: true, section: { ...state.section, options }}));
+  };
+
+  const onRemoveOptionClick = (id: number, evt: MouseEvent) => {
+    if(confirm('Voulez-vous supprimer cette option ?')){
+      const options = JSON.parse(JSON.stringify(state.section.options))
+      options.splice(id, 1);
+      setState(state => ({ ...state, changed: true, section: { ...state.section, options }}));
+    }
+  };
+
+  return (
+    <section>
+      <h4 id="options-section" className="is-size-4 title is-spaced"><a href="#options-section">Explorer les options</a></h4>
+      <div className="box">
+      <div className="table-container">
+            <table className={`table is-bordered is-striped is-hoverable is-fullwidth`}>
+                <thead>
+                    <tr>
+                        <th></th>
+                        <th>Décision</th>
+                        <th>Pours</th>
+                        <th>Contres</th>
+                    </tr>
+                </thead>
+                <tbody>
+                    {
+                        state.section.options.map((o, index) => {
+                            return (
+                                <tr key={`option-${o.id}`}>
+                                    <td>
+                                        <button
+                                            onClick={onRemoveOptionClick.bind(null, index)}
+                                            className="button is-danger is-small is-outlined">
+                                        🗑️
+                                        </button>
+                                    </td>
+                                    <td>
+                                      <textarea className="textarea"
+                                        value={o.label}
+                                        onChange={onOptionChange.bind(null, index, 'label')}
+                                        placeholder="Décrire cette décision." 
+                                        rows={10}>
+                                      </textarea>
+                                    </td>
+                                    <td>
+                                      <textarea className="textarea is-success"
+                                        value={o.pros}
+                                        onChange={onOptionChange.bind(null, index, 'pros')}
+                                        placeholder="Décrire les avantages de cette décision." 
+                                        rows={10}>
+                                      </textarea>
+                                    </td>
+                                    <td>
+                                      <textarea className="textarea is-danger"
+                                        value={o.cons}
+                                        onChange={onOptionChange.bind(null, index, 'cons')}
+                                        placeholder="Décrire les désavantages de cette décision." 
+                                        rows={10}>
+                                      </textarea>
+                                    </td>
+                                </tr>
+                            )
+                        })
+                    }
+                    {
+                        state.section.options.length === 0 ?
+                        <tr>
+                            <td></td>
+                            <td colSpan={4}>Aucune option pour l'instant.</td>
+                        </tr> :
+                        null
+                    }
+                </tbody>
+                <tfoot>
+                    <tr>
+                        <td colSpan={5}>
+                          <a className="button is-primary is-pulled-right" onClick={onAddOptionClick}>
+                          Ajouter
+                          </a>
+                        </td>
+                    </tr>
+                </tfoot>
+            </table>
+        </div>
+      </div>
+    </section>
+  );
+};

client/src/components/HomePage/HomePage.tsx

@@ -1,33 +1,21 @@
-import React from 'react';
+import React, { useEffect } from 'react';
 import { Page } from '../Page';
-import { Dashboard } from './Dashboard';
-import { useUserProfileQuery } from '../../gql/queries/profile';
-import { WithLoader } from '../WithLoader';
+import { WelcomeContent } from './WelcomeContent';
+import { useUserProfile } from '../../gql/queries/profile';
+import { useHistory } from 'react-router';
+import { useLoggedIn } from '../../hooks/useLoggedIn';
 
 export function HomePage() {
-  const { data, loading } = useUserProfileQuery();
+  const loggedIn = useLoggedIn();
+  const history = useHistory();
 
-  const { userProfile } = (data || {});
+  useEffect(() => {
+    if (loggedIn) history.push('/dashboard');
+  }, [loggedIn])
 
   return (
-    <Page title={userProfile ? 'Tableau de bord' : 'Accueil'}>
-      <div className="container is-fluid">
-        <section className="mt-5">
-          <WithLoader loading={loading}>
-          {
-            userProfile ?
-            <Dashboard /> :
-            <div className="columns">
-              <div className="column is-4 is-offset-4">
-                <div className="box">
-                  <p>Veuillez vous authentifier.</p>
-                </div>
-              </div>
-            </div> 
-          }
-          </WithLoader>
-        </section>
-      </div>
+    <Page title="Accueil">
+      <WelcomeContent />
     </Page>
   );
 }

client/src/components/HomePage/WelcomeContent.tsx

@@ -0,0 +1,75 @@
+import React, { FunctionComponent, Fragment } from "react";
+
+export interface WelcomeContentProps {
+
+}
+
+export const WelcomeContent: FunctionComponent<WelcomeContentProps> = () => {
+  return (
+    <Fragment>
+      <section className="hero is-normal is-light is-bold">
+        <div className="hero-body has-text-centered">
+          <div className="container">
+            <h1 className="title">
+              Bienvenue sur Daddy !
+            </h1>
+            <h2 className="subtitle">
+              L'outil de suivi de la vie d'entreprise démocratique.
+            </h2>
+          </div>
+        </div>
+      </section>
+      <div className="box cta">
+        <p className="has-text-centered">
+          <span className="tag is-info">Attention</span> Le service est actuellement en alpha. L'accès est restreint aux adresses autorisées.
+        </p>
+      </div>
+      <section className="container mt-5">
+        <div className="columns">
+          <div className="column is-4">
+            <div className="card is-shady">
+              <div className="card-image has-text-centered">
+                <i className="fa fa-at mt-5" style={{fontSize: '8rem'}}></i>
+              </div>
+              <div className="card-content">
+                <div className="content">
+                  <h4>Une adresse courriel et c'est parti !</h4>
+                  <p>Pas de création de compte, pas de mot de passe à retenir. Entrez votre adresse courriel et commencez directement à travailler !</p>
+                  {/* <p><a href="#">En savoir plus</a></p> */}
+                </div>
+              </div>
+            </div>
+          </div>
+          <div className="column is-4">
+            <div className="card is-shady">
+              <div className="card-image has-text-centered">
+                <i className="fa fa-edit mt-5" style={{fontSize: '8rem'}}></i>
+              </div>
+              <div className="card-content">
+                <div className="content">
+                  <h4>Préparer vos dossiers d'aide à la décision</h4>
+                  <p>Une décision à prendre ? Un nouveau projet à lancer ? Crééz votre groupe de travail et rédigez un dossier pour faciliter la prise de décision collective !</p>
+                  {/* <p><a href="#">En savoir plus</a></p> */}
+                </div>
+              </div>
+            </div>
+          </div>
+          <div className="column is-4">
+            <div className="card is-shady">
+              <div className="card-image has-text-centered">
+                <i className="fa fa-users mt-5" style={{fontSize: '8rem'}}></i>
+              </div>
+              <div className="card-content">
+                <div className="content">
+                  <h4>Travaillez collaborativement</h4>
+                  <p>Éditez à plusieurs vos dossiers d'aide à la décision, suivi l'avancée des débats et retrouvez simplement les décisions prises dans l'entreprise.</p>
+                  {/* <p><a href="#">En savoir plus</a></p> */}
+                </div>
+              </div>
+            </div>
+          </div>
+        </div>
+      </section>
+    </Fragment>
+  );
+};

client/src/components/HomePage/WorkgroupsPanel.tsx

@@ -1,98 +0,0 @@
-import React, { useEffect, useState } from 'react';
-import { Workgroup } from '../../types/workgroup';
-import { User } from '../../types/user';
-import { Link } from 'react-router-dom';
-import { useWorkgroupsQuery } from '../../gql/queries/workgroups';
-import { useUserProfileQuery } from '../../gql/queries/profile';
-import { WithLoader } from '../WithLoader';
-
-export function WorkgroupsPanel() {
-  const workgroupsQuery = useWorkgroupsQuery();
-  const userProfileQuery =  useUserProfileQuery();
-  const [ state, setState ] = useState({ selectedTab: 0 });
-
-  const isLoading = userProfileQuery.loading || workgroupsQuery.loading;
-  const { userProfile } = (userProfileQuery.data || {});
-  const { workgroups } = (workgroupsQuery.data || {});
-
-  const filterTabs = [
-    {
-      label: "Mes groupes en cours",
-      filter: workgroups => workgroups.filter((wg: Workgroup) => {
-        return  wg.closedAt === null && wg.members.some((u: User) => u.id === (userProfile ? userProfile.id : ''));
-      })
-    },
-    {
-      label: "Ouverts",
-      filter: workgroups => workgroups.filter((wg: Workgroup) => !wg.closedAt)
-    },
-    {
-      label: "Clos",
-      filter: workgroups => workgroups.filter((wg: Workgroup) => !!wg.closedAt)
-    }
-  ];
-
-  const selectTab = (tabIndex: number) => {
-    setState(state => ({ ...state, selectedTab: tabIndex }));
-  };
-  
-  let workgroupsItems = [];
-  
-  workgroupsItems = filterTabs[state.selectedTab].filter(workgroups || []).map((wg: Workgroup) => {
-    return (
-      <Link to={`/workgroups/${wg.id}`} key={`wg-${wg.id}`} className="panel-block">
-        <span className="panel-icon">
-          <i className="fas fa-users" aria-hidden="true"></i>
-        </span>
-        {wg.name}
-      </Link>
-    );
-  });
-
-  return (
-    <nav className="panel is-info">
-      <div className="level panel-heading mb-0">
-        <div className="level-left">
-          <p className="level-item">
-          Groupes de travail
-          </p>
-        </div>
-        <div className="level-right">
-          <Link to="/workgroups/new" className="button level-item is-outlined is-info is-inverted">
-            <i className="icon fa fa-plus"></i>
-          </Link>
-        </div>
-      </div>
-      {/* <div className="panel-block">
-        <p className="control has-icons-left">
-          <input className="input" type="text" placeholder="Filtrer..." />
-          <span className="icon is-left">
-            <i className="fas fa-search" aria-hidden="true"></i>
-          </span>
-        </p>
-      </div> */}
-      <WithLoader loading={isLoading}>
-        <p className="panel-tabs">
-          {
-            filterTabs.map((tab, i) => {
-              return (
-                <a key={`workgroup-tab-${i}`}
-                  onClick={selectTab.bind(null, i)}
-                  className={i === state.selectedTab ? 'is-active' : ''}>
-                  {tab.label}
-                </a>
-              )
-            })
-          }
-        </p>
-        {
-          workgroupsItems.length > 0 ?
-          workgroupsItems :
-          <a className="panel-block has-text-centered is-block">
-            <em>Aucun groupe dans cet catégorie pour l'instant.</em>
-          </a>
-        }
-      </WithLoader>
-    </nav>
-  )
-}

client/src/components/LogoutPage.tsx

@@ -0,0 +1,15 @@
+import React, { FunctionComponent, useEffect } from "react";
+import { saveLoggedIn } from "../hooks/useLoggedIn";
+import { Config } from "../config";
+
+export interface LogoutPageProps {
+  
+}
+
+export const LogoutPage: FunctionComponent<LogoutPageProps> = () => {
+  useEffect(() => {
+    saveLoggedIn(false);
+    window.location.replace(Config.logoutURL);
+  }, []);
+  return null;
+};

client/src/components/Navbar.tsx

@@ -3,11 +3,10 @@ import logo from '../resources/logo.svg';
 import { useSelector } from 'react-redux';
 import { Config } from '../config';
 import { Link } from 'react-router-dom';
-import { useUserProfileQuery } from '../gql/queries/profile';
-import { WithLoader } from './WithLoader';
+import { useLoggedIn } from '../hooks/useLoggedIn';
 
 export function Navbar() {
-  const userProfileQuery = useUserProfileQuery();
+  const loggedIn = useLoggedIn();
   const [ isActive, setActive ] = useState(false);
 
   const toggleMenu = () => {
@@ -15,7 +14,7 @@ export function Navbar() {
   };
   
   return (
-    <nav className="navbar" role="navigation" aria-label="main navigation">
+    <nav className="navbar is-fixed-top" role="navigation" aria-label="main navigation">
       <div className="container is-fluid">
         <div className="navbar-brand">
           <Link className="navbar-item" to="/">
@@ -35,30 +34,30 @@ export function Navbar() {
         <div className={`navbar-menu ${isActive ? 'is-active' : ''}`}>
           <div className="navbar-end">
             <div className="navbar-item">
-              <WithLoader loading={userProfileQuery.loading}>
-                <div className="buttons">
+              <div className="buttons">
                 {
-                  userProfileQuery.data && userProfileQuery.data.userProfile ?
+                  loggedIn ?
                   <Fragment>
                     <Link to="/profile" className="button">
                       <span className="icon">
                         <i className="fas fa-user"></i>
                       </span>
+                      <span>Mon profil</span>
                     </Link>
-                    <a className="button" href={Config.logoutURL}>
+                    <Link className="button is-warning" to="/logout">
                       <span className="icon">
                         <i className="fas fa-sign-out-alt"></i>
                       </span>
-                    </a>
+                    </Link>
                   </Fragment> :
-                  <a className="button" href={Config.loginURL}>
+                  <a className="button is-primary" href={Config.loginURL}>
                     <span className="icon">
                       <i className="fas fa-sign-in-alt"></i>
                     </span>
+                    <span>S'identifier</span>
                   </a>
                 }
-                </div>
-              </WithLoader>
+              </div>
             </div>
           </div>
         </div>

client/src/components/PrivateRoute.tsx

@@ -0,0 +1,18 @@
+import React, { FunctionComponent, Component, ReactType } from "react"
+import { Route, Redirect, RouteProps } from "react-router"
+import { useLoggedIn } from "../hooks/useLoggedIn";
+
+export interface PrivateRouteProps extends RouteProps {
+}
+
+export const PrivateRoute: FunctionComponent<PrivateRouteProps> = ({component: Component, ...rest}) => {  
+  const loggedIn = useLoggedIn();
+  return (
+    <Route
+      {...rest}
+      render={(props) => loggedIn === true
+        ? <Component {...props} />
+        : <Redirect to={{pathname: '/', state: {from: props.location}}} />}
+    />
+  )
+}

client/src/components/WorkgroupPage/InfoForm.tsx

@@ -1,12 +1,13 @@
 import React, { useState, ChangeEvent, useEffect } from 'react';
 import { Workgroup } from '../../types/workgroup';
+import { useIsAuthorized } from '../../gql/queries/authorization';
 
 export interface InfoFormProps {
   workgroup: Workgroup
   onChange?: (workgroup: Workgroup) => void
 }
 
-export function InfoForm({ workgroup, onChange }: InfoFormProps) {  
+export function InfoForm({ workgroup, onChange }: InfoFormProps) {
   const [ state, setState ] = useState({
     changed: false,
     workgroup: {
@@ -17,6 +18,15 @@ export function InfoForm({ workgroup, onChange }: InfoFormProps) {
     }
   });
 
+  const { isAuthorized } = useIsAuthorized({
+    variables: {
+      action: 'update',
+      object: {
+        workgroupId: state.workgroup.id,
+      }
+    }
+  }, state.workgroup.id === '' ? true : false);
+
   useEffect(() => {
     setState({
       changed: false,
@@ -60,7 +70,8 @@ export function InfoForm({ workgroup, onChange }: InfoFormProps) {
       <div className="field">
         <label className="label">Nom du groupe</label>
         <div className="control">
-          <input type="text" className="input" value={state.workgroup.name} 
+          <input type="text" className="input" value={state.workgroup.name}
+            disabled={!isAuthorized}
             onChange={onWorkgroupAttrChange.bind(null, "name")} />
         </div>
       </div>
@@ -85,7 +96,7 @@ export function InfoForm({ workgroup, onChange }: InfoFormProps) {
         null
       }
       <div className="buttons is-right">
-        <button disabled={!state.changed} 
+        <button disabled={!state.changed || !isAuthorized}
           className="button is-success" onClick={onSaveClick}>
           <span>Enregistrer</span>
           <span className="icon"><i className="fa fa-save"></i></span>

client/src/components/WorkgroupPage/WorkgroupPage.tsx

@@ -2,8 +2,8 @@ import React, { useEffect, useState, Fragment } from 'react';
 import { Page } from '../Page';
 import { WithLoader } from '../WithLoader';
 import { useParams } from 'react-router';
-import { useWorkgroupsQuery } from '../../gql/queries/workgroups';
-import { useUserProfileQuery } from '../../gql/queries/profile';
+import { useWorkgroupsQuery, useWorkgroups } from '../../gql/queries/workgroups';
+import { useUserProfileQuery, useUserProfile } from '../../gql/queries/profile';
 import { MembersPanel } from './MembersPanel';
 import { User } from '../../types/user';
 import { InfoPanel } from './InfoPanel';
@@ -12,17 +12,19 @@ import { useJoinWorkgroupMutation, useLeaveWorkgroupMutation, useCloseWorkgroupM
 
 export function WorkgroupPage() {
   const { id } = useParams();
-  const workgroupsQuery = useWorkgroupsQuery({
+  const { workgroups } = useWorkgroups({
     variables:{
       filter: { 
         ids: [id],
       }
     }
   });
-  const userProfileQuery = useUserProfileQuery();
-  const [ joinWorkgroup, joinWorkgroupMutation ] = useJoinWorkgroupMutation();
-  const [ leaveWorkgroup, leaveWorkgroupMutation ] = useLeaveWorkgroupMutation();
-  const [ closeWorkgroup, closeWorkgroupMutation ] = useCloseWorkgroupMutation();
+  const { user } = useUserProfile();
+  
+  const [ joinWorkgroup ] = useJoinWorkgroupMutation();
+  const [ leaveWorkgroup ] = useLeaveWorkgroupMutation();
+  const [ closeWorkgroup ] = useCloseWorkgroupMutation();
+
   const [ state, setState ] = useState({
     userProfileId: '',
     workgroup: {
@@ -35,14 +37,12 @@ export function WorkgroupPage() {
   });
 
   useEffect(() => {
-    if (!workgroupsQuery.data) return;
-    setState(state => ({...state, workgroup:{ ...state.workgroup, ...workgroupsQuery.data.workgroups[0]}}));
-  }, [workgroupsQuery.data]);
+    setState(state => ({...state, workgroup:{ ...state.workgroup, ...workgroups[0]}}));
+  }, [workgroups]);
 
   useEffect(() => {
-    if (!userProfileQuery.data) return;
-    setState(state => ({...state, userProfileId: userProfileQuery.data.userProfile.id }));
-  }, [userProfileQuery.data]);
+    setState(state => ({...state, userProfileId: user.id }));
+  }, [user]);
 
   const onJoinWorkgroupClick = () => {
     joinWorkgroup({
@@ -54,6 +54,18 @@ export function WorkgroupPage() {
 
   const onLeaveWorkgroupClick = () => {
     leaveWorkgroup({
+      update: (cache, result) => {
+        cache.modify({
+          id: cache.identify(result.data.leaveWorkgroup),
+          fields: {
+            members(existingMembers, { readField }) {
+              return existingMembers.filter(
+                user => state.userProfileId !== readField('id', user)
+              );
+            },
+          },
+        });
+      },
       variables: {
         workgroupId: state.workgroup.id,
       }
@@ -121,16 +133,14 @@ export function WorkgroupPage() {
               </div>
             </div>
           </div>
-          <WithLoader loading={[workgroupsQuery.loading, userProfileQuery.loading, joinWorkgroupMutation.loading, leaveWorkgroupMutation.loading]}>
-            <div className="columns">
-              <div className="column">
-                <InfoPanel workgroup={state.workgroup as Workgroup} />
-              </div>
-              <div className="column">
-                <MembersPanel users={state.workgroup.members as User[]} />
-              </div>
+          <div className="columns">
+            <div className="column">
+              <InfoPanel workgroup={state.workgroup as Workgroup} />
             </div>
-          </WithLoader>
+            <div className="column">
+              <MembersPanel users={state.workgroup.members as User[]} />
+            </div>
+          </div>
         </section>
       </div>
     </Page>

client/src/gql/client.tsx

@@ -1,20 +0,0 @@
-import { ApolloClient, InMemoryCache, HttpLink } from '@apollo/client';
-import { Config } from '../config';
-import { WebSocketLink } from "@apollo/client/link/ws";
-import { RetryLink } from "@apollo/client/link/retry";
-import { SubscriptionClient } from "subscriptions-transport-ws";
-
-const subscriptionClient = new SubscriptionClient(Config.subscriptionEndpoint, {
-  reconnect: true,
-});
-
-const link = new RetryLink({attempts: {max: 2}}).split(
-  (operation) => operation.operationName === 'subscription',
-  new WebSocketLink(subscriptionClient),
-  new HttpLink({ uri: Config.graphQLEndpoint, credentials: 'include' })
-);
-
-export const client = new ApolloClient<any>({
-  cache: new InMemoryCache(),
-  link: link,
-});

client/src/gql/mutations/dsf.tsx

@@ -0,0 +1,58 @@
+import { gql, useQuery, useMutation } from '@apollo/client';
+import { QUERY_DECISION_SUPPORT_FILES } from '../queries/dsf';
+
+export const MUTATION_CREATE_DECISION_SUPPORT_FILE = gql`
+mutation createDecisionSupportFile($changes: DecisionSupportFileChanges!) {
+  createDecisionSupportFile(changes: $changes) {
+    id,
+    title,
+    status,
+    sections,
+    createdAt,
+    updatedAt,
+    workgroup {
+      id,
+      name,
+      members {
+        id,
+        email,
+        name
+      }
+    },
+  }
+}`;
+
+export function useCreateDecisionSupportFileMutation() {
+  return useMutation(MUTATION_CREATE_DECISION_SUPPORT_FILE, {
+    refetchQueries: [{query: QUERY_DECISION_SUPPORT_FILES}],
+  });
+}
+
+export const MUTATION_UPDATE_DECISION_SUPPORT_FILE = gql`
+mutation updateDecisionSupportFile($id: ID!, $changes: DecisionSupportFileChanges!) {
+  updateDecisionSupportFile(id: $id, changes: $changes) {
+    id,
+    title,
+    status,
+    sections,
+    createdAt,
+    updatedAt,
+    workgroup {
+      id,
+      name,
+      members {
+        id,
+        email,
+        name
+      }
+    },
+  }
+}`;
+
+export function useUpdateDecisionSupportFileMutation() {
+  return useMutation(MUTATION_UPDATE_DECISION_SUPPORT_FILE, {
+    refetchQueries: [{
+      query: QUERY_DECISION_SUPPORT_FILES,
+    }],
+  });
+}

client/src/gql/mutations/profile.tsx

@@ -1,6 +1,6 @@
 import { gql, useQuery, useMutation } from '@apollo/client';
 
-const MUTATION_UPDATE_USER_PROFILE = gql`
+export const MUTATION_UPDATE_USER_PROFILE = gql`
 mutation updateUserProfile($changes: ProfileChanges!) {
   updateProfile(changes: $changes) {
     id,

client/src/gql/mutations/workgroups.tsx

@@ -1,6 +1,8 @@
-import { gql, useQuery, useMutation } from '@apollo/client';
+import { gql, useQuery, useMutation, FetchResult } from '@apollo/client';
+import { QUERY_WORKGROUP } from '../queries/workgroups';
+import { QUERY_IS_AUTHORIZED } from '../queries/authorization';
 
-const MUTATION_UPDATE_WORKGROUP = gql`
+export const MUTATION_UPDATE_WORKGROUP = gql`
 mutation updateWorkgroup($workgroupId: ID!, $changes: WorkgroupChanges!) {
   updateWorkgroup(workgroupId: $workgroupId, changes: $changes) {
     id,
@@ -19,7 +21,7 @@ export function useUpdateWorkgroupMutation() {
   return useMutation(MUTATION_UPDATE_WORKGROUP);
 }
 
-const MUTATION_CREATE_WORKGROUP = gql`
+export const MUTATION_CREATE_WORKGROUP = gql`
 mutation createWorkgroup($changes: WorkgroupChanges!) {
   createWorkgroup(changes: $changes) {
     id,
@@ -35,10 +37,12 @@ mutation createWorkgroup($changes: WorkgroupChanges!) {
 }`;
 
 export function useCreateWorkgroupMutation() {
-  return useMutation(MUTATION_CREATE_WORKGROUP);
+  return useMutation(MUTATION_CREATE_WORKGROUP, {
+    refetchQueries: [{query: QUERY_WORKGROUP}],
+  });
 }
 
-const MUTATION_JOIN_WORKGROUP = gql`
+export const MUTATION_JOIN_WORKGROUP = gql`
 mutation joinWorkgroup($workgroupId: ID!) {
   joinWorkgroup(workgroupId: $workgroupId) {
     id,
@@ -54,7 +58,19 @@ mutation joinWorkgroup($workgroupId: ID!) {
 }`;
 
 export function useJoinWorkgroupMutation() {
-  return useMutation(MUTATION_JOIN_WORKGROUP);
+  return useMutation(MUTATION_JOIN_WORKGROUP, {
+    refetchQueries: ({ data }: FetchResult) => {
+      return [{
+        query: QUERY_IS_AUTHORIZED,
+        variables: {
+          action: 'update',
+          object: {
+            workgroupId: data.joinWorkgroup.id,
+          }
+        }
+      }]
+    }
+  });
 }
 
 const MUTATION_LEAVE_WORKGROUP = gql`
@@ -73,7 +89,27 @@ mutation leaveWorkgroup($workgroupId: ID!) {
 }`;
 
 export function useLeaveWorkgroupMutation() {
-  return useMutation(MUTATION_LEAVE_WORKGROUP);
+  return useMutation(MUTATION_LEAVE_WORKGROUP, {
+    refetchQueries: ({ data }: FetchResult) => {
+      return [{
+        query: QUERY_WORKGROUP,
+        variables: {
+          filter: {
+            ids: [data.leaveWorkgroup.id],
+          }
+        }
+      },
+      {
+        query: QUERY_IS_AUTHORIZED,
+        variables: {
+          action: 'update',
+          object: {
+            workgroupId: data.leaveWorkgroup.id,
+          }
+        }
+      }]
+    }
+  });
 }
 
 const MUTATION_CLOSE_WORKGROUP = gql`

client/src/gql/queries/authorization.tsx

@@ -0,0 +1,19 @@
+import { gql, useQuery } from '@apollo/client';
+import { useGraphQLData } from './helper';
+
+export const QUERY_IS_AUTHORIZED = gql`
+  query isAuthorized($action: String!, $object: AuthorizationObject!) {
+    isAuthorized(action: $action, object: $object)
+  }
+`;
+
+export function useIsAuthorizedQuery(options = {}) {
+  return useQuery(QUERY_IS_AUTHORIZED, options);
+}
+
+export function useIsAuthorized(options = {}, defaultValue = false) {
+  const { data, loading, error } = useGraphQLData<boolean>(
+    QUERY_IS_AUTHORIZED, 'isAuthorized', defaultValue, options
+  );
+  return { isAuthorized: data, loading, error };
+}

client/src/gql/queries/dsf.tsx

@@ -0,0 +1,37 @@
+import { gql, useQuery } from '@apollo/client';
+import { DecisionSupportFile } from '../../types/decision';
+import { useGraphQLData } from './helper';
+
+export const QUERY_DECISION_SUPPORT_FILES = gql`
+  query decisionSupportFiles($filter: DecisionSupportFileFilter) {
+    decisionSupportFiles(filter: $filter) {
+      id,
+      title,
+      sections,
+      createdAt,
+      closedAt,
+      votedAt,
+      status,
+      workgroup {
+        id,
+        name,
+        members {
+          id,
+          email,
+          name
+        }
+      },
+    }
+  }
+`;
+
+export function useDecisionSupportFilesQuery(options = {}) {
+  return useQuery(QUERY_DECISION_SUPPORT_FILES, options);
+}
+
+export function useDecisionSupportFiles(options = {}) {
+  const { data, loading, error } = useGraphQLData<DecisionSupportFile[]>(
+    QUERY_DECISION_SUPPORT_FILES, 'decisionSupportFiles', [], options
+  );
+  return { decisionSupportFiles: data, loading, error };
+}

client/src/gql/queries/helper.ts

@@ -0,0 +1,11 @@
+import { useQuery, DocumentNode } from "@apollo/client";
+import { useState, useEffect } from "react";
+
+export function useGraphQLData<T>(q: DocumentNode, key: string, defaultValue: T, options = {}) {
+  const query = useQuery(q, options);
+  const [ data, setData ] = useState<T>(defaultValue);
+  useEffect(() => {
+    setData(query.data ? query.data[key] as T : defaultValue);
+  }, [query.loading, query.data]);
+  return { data, loading: query.loading, error: query.error };
+}

client/src/gql/queries/profile.tsx

@@ -1,6 +1,9 @@
 import { gql, useQuery } from '@apollo/client';
+import { User } from '../../types/user';
+import { useState, useEffect } from 'react';
+import { useGraphQLData } from './helper';
 
-const QUERY_USER_PROFILE = gql`
+export const QUERY_USER_PROFILE = gql`
 query userProfile {
   userProfile {
     id,
@@ -13,4 +16,11 @@ query userProfile {
 
 export function useUserProfileQuery() {
   return useQuery(QUERY_USER_PROFILE);
+}
+
+export function useUserProfile() {
+  const { data, loading, error } = useGraphQLData<User>(
+    QUERY_USER_PROFILE, 'userProfile', {id: '', email: ''}
+  );
+  return { user: data, loading, error };
 }

client/src/gql/queries/workgroups.tsx

@@ -1,6 +1,8 @@
 import { gql, useQuery } from '@apollo/client';
+import { Workgroup } from '../../types/workgroup';
+import { useGraphQLData } from './helper';
 
-const QUERY_WORKGROUP = gql`
+export const QUERY_WORKGROUP = gql`
   query workgroups($filter: WorkgroupsFilter) {
     workgroups(filter: $filter) {
       id,
@@ -18,4 +20,12 @@ const QUERY_WORKGROUP = gql`
 
 export function useWorkgroupsQuery(options = {}) {
   return useQuery(QUERY_WORKGROUP, options);
+}
+
+export function useWorkgroups(options = {}) {
+  const { data, loading, error } = useGraphQLData<Workgroup[]>(
+    QUERY_WORKGROUP, 'workgroups', [],
+    options
+  );
+  return { workgroups: data, loading, error };
 }

client/src/hooks/useDebounce.tsx

@@ -0,0 +1,19 @@
+import { useEffect, useState } from "react";
+
+export function useDebounce(value, delay) {
+  const [debouncedValue, setDebouncedValue] = useState(value);
+
+  useEffect(
+    () => {
+      const handler = setTimeout(() => {
+        setDebouncedValue(value);
+      }, delay);
+      return () => {
+        clearTimeout(handler);
+      };
+    },
+    [value, delay]
+  );
+
+  return debouncedValue;
+}

client/src/hooks/useKonamiCode.tsx

@@ -0,0 +1,20 @@
+import { useEffect } from "react";
+
+export function useKonamiCode(cb: Function) {
+  const KONAMI_CODE = [38, 38, 40, 40, 37, 39, 37, 39, 66, 65];
+  let cursor = 0;
+
+  useEffect(()=> {
+    const onKeyDown = (e) => {
+      cursor = (e.keyCode == KONAMI_CODE[cursor]) ? cursor + 1 : 0;
+      if (cursor == KONAMI_CODE.length) {
+        cb();
+        cursor = 0;
+      }
+    };
+
+    document.addEventListener('keydown', onKeyDown);
+  
+    return () => document.removeEventListener('keydown', onKeyDown);
+  }, []);
+}

client/src/hooks/useLoggedIn.tsx

@@ -0,0 +1,23 @@
+import React, { useContext, useEffect } from "react";
+
+const LOGGED_IN_KEY = 'loggedIn';
+
+export const LoggedInContext = React.createContext(getSavedLoggedIn());
+
+export const useLoggedIn = () => {
+  return useContext(LoggedInContext);
+};
+
+export function saveLoggedIn(loggedIn: boolean) {
+  console.log("saveLoggedIn", JSON.stringify(loggedIn))
+  window.sessionStorage.setItem(LOGGED_IN_KEY, JSON.stringify(loggedIn));
+}
+
+export function getSavedLoggedIn(): boolean {
+  try {
+    const loggedIn = JSON.parse(window.sessionStorage.getItem(LOGGED_IN_KEY));
+    return !!loggedIn;
+  } catch(err) {
+    return false;
+  }
+}

client/src/index.html

@@ -1,5 +1,5 @@
 <!DOCTYPE html>
-<html lang="en">
+<html lang="en" class="has-navbar-fixed-top">
   <head>
     <meta charset="utf-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

client/src/index.tsx

@@ -2,7 +2,6 @@ import './sass/_all.scss';
 import React from 'react';
 import ReactDOM from 'react-dom';
 import { App } from './components/App';
-import { client } from './gql/client';
 
 import '@fortawesome/fontawesome-free/js/fontawesome'
 import '@fortawesome/fontawesome-free/js/solid'
@@ -12,8 +11,6 @@ import './resources/favicon.png';
 import { ApolloProvider } from '@apollo/client';
 
 ReactDOM.render(
-  <ApolloProvider client={client}>
-    <App />
-  </ApolloProvider>,
+  <App />,
   document.getElementById('app')
 );

client/src/sass/_base.scss

@@ -1,6 +1,8 @@
 html, body {
     height: 100%;
-    background-color: #f7f7f7;
+    background-color: #ffffff;
+    // Generated with https://www.svgbackgrounds.com/
+    background-image: url("data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='351' height='292.5' viewBox='0 0 1080 900'%3E%3Cg fill-opacity='0.04'%3E%3Cpolygon fill='%23444' points='90 150 0 300 180 300'/%3E%3Cpolygon points='90 150 180 0 0 0'/%3E%3Cpolygon fill='%23AAA' points='270 150 360 0 180 0'/%3E%3Cpolygon fill='%23DDD' points='450 150 360 300 540 300'/%3E%3Cpolygon fill='%23999' points='450 150 540 0 360 0'/%3E%3Cpolygon points='630 150 540 300 720 300'/%3E%3Cpolygon fill='%23DDD' points='630 150 720 0 540 0'/%3E%3Cpolygon fill='%23444' points='810 150 720 300 900 300'/%3E%3Cpolygon fill='%23FFF' points='810 150 900 0 720 0'/%3E%3Cpolygon fill='%23DDD' points='990 150 900 300 1080 300'/%3E%3Cpolygon fill='%23444' points='990 150 1080 0 900 0'/%3E%3Cpolygon fill='%23DDD' points='90 450 0 600 180 600'/%3E%3Cpolygon points='90 450 180 300 0 300'/%3E%3Cpolygon fill='%23666' points='270 450 180 600 360 600'/%3E%3Cpolygon fill='%23AAA' points='270 450 360 300 180 300'/%3E%3Cpolygon fill='%23DDD' points='450 450 360 600 540 600'/%3E%3Cpolygon fill='%23999' points='450 450 540 300 360 300'/%3E%3Cpolygon fill='%23999' points='630 450 540 600 720 600'/%3E%3Cpolygon fill='%23FFF' points='630 450 720 300 540 300'/%3E%3Cpolygon points='810 450 720 600 900 600'/%3E%3Cpolygon fill='%23DDD' points='810 450 900 300 720 300'/%3E%3Cpolygon fill='%23AAA' points='990 450 900 600 1080 600'/%3E%3Cpolygon fill='%23444' points='990 450 1080 300 900 300'/%3E%3Cpolygon fill='%23222' points='90 750 0 900 180 900'/%3E%3Cpolygon points='270 750 180 900 360 900'/%3E%3Cpolygon fill='%23DDD' points='270 750 360 600 180 600'/%3E%3Cpolygon points='450 750 540 600 360 600'/%3E%3Cpolygon points='630 750 540 900 720 900'/%3E%3Cpolygon fill='%23444' points='630 750 720 600 540 600'/%3E%3Cpolygon fill='%23AAA' points='810 750 720 900 900 900'/%3E%3Cpolygon fill='%23666' points='810 750 900 600 720 600'/%3E%3Cpolygon fill='%23999' points='990 750 900 900 1080 900'/%3E%3Cpolygon fill='%23999' points='180 0 90 150 270 150'/%3E%3Cpolygon fill='%23444' points='360 0 270 150 450 150'/%3E%3Cpolygon fill='%23FFF' points='540 0 450 150 630 150'/%3E%3Cpolygon points='900 0 810 150 990 150'/%3E%3Cpolygon fill='%23222' points='0 300 -90 450 90 450'/%3E%3Cpolygon fill='%23FFF' points='0 300 90 150 -90 150'/%3E%3Cpolygon fill='%23FFF' points='180 300 90 450 270 450'/%3E%3Cpolygon fill='%23666' points='180 300 270 150 90 150'/%3E%3Cpolygon fill='%23222' points='360 300 270 450 450 450'/%3E%3Cpolygon fill='%23FFF' points='360 300 450 150 270 150'/%3E%3Cpolygon fill='%23444' points='540 300 450 450 630 450'/%3E%3Cpolygon fill='%23222' points='540 300 630 150 450 150'/%3E%3Cpolygon fill='%23AAA' points='720 300 630 450 810 450'/%3E%3Cpolygon fill='%23666' points='720 300 810 150 630 150'/%3E%3Cpolygon fill='%23FFF' points='900 300 810 450 990 450'/%3E%3Cpolygon fill='%23999' points='900 300 990 150 810 150'/%3E%3Cpolygon points='0 600 -90 750 90 750'/%3E%3Cpolygon fill='%23666' points='0 600 90 450 -90 450'/%3E%3Cpolygon fill='%23AAA' points='180 600 90 750 270 750'/%3E%3Cpolygon fill='%23444' points='180 600 270 450 90 450'/%3E%3Cpolygon fill='%23444' points='360 600 270 750 450 750'/%3E%3Cpolygon fill='%23999' points='360 600 450 450 270 450'/%3E%3Cpolygon fill='%23666' points='540 600 630 450 450 450'/%3E%3Cpolygon fill='%23222' points='720 600 630 750 810 750'/%3E%3Cpolygon fill='%23FFF' points='900 600 810 750 990 750'/%3E%3Cpolygon fill='%23222' points='900 600 990 450 810 450'/%3E%3Cpolygon fill='%23DDD' points='0 900 90 750 -90 750'/%3E%3Cpolygon fill='%23444' points='180 900 270 750 90 750'/%3E%3Cpolygon fill='%23FFF' points='360 900 450 750 270 750'/%3E%3Cpolygon fill='%23AAA' points='540 900 630 750 450 750'/%3E%3Cpolygon fill='%23FFF' points='720 900 810 750 630 750'/%3E%3Cpolygon fill='%23222' points='900 900 990 750 810 750'/%3E%3Cpolygon fill='%23222' points='1080 300 990 450 1170 450'/%3E%3Cpolygon fill='%23FFF' points='1080 300 1170 150 990 150'/%3E%3Cpolygon points='1080 600 990 750 1170 750'/%3E%3Cpolygon fill='%23666' points='1080 600 1170 450 990 450'/%3E%3Cpolygon fill='%23DDD' points='1080 900 1170 750 990 750'/%3E%3C/g%3E%3C/svg%3E");
 }
 
 .is-fullheight {
@@ -18,4 +20,8 @@ html, body {
 #app {
     display: flex;
     flex-direction: column;
+}
+
+.panel {
+    background-color: #ffffff;
 }

client/src/types/decision.tsx

@@ -0,0 +1,35 @@
+import { Workgroup } from "./workgroup";
+
+export enum DecisionSupportFileStatus {
+  Draft = "draft",
+  Ready = "ready",
+  Voted = "voted",
+  Closed = "closed",
+}
+
+export interface DecisionSupportFileSection {
+  name: string
+}
+
+// aka Dossier d'aide à la décision
+export interface DecisionSupportFile {
+  id: string
+  title: string
+  sections: {[name: string]: any}
+  status: DecisionSupportFileStatus
+  workgroup?: Workgroup,
+  createdAt: Date
+  votedAt?: Date
+  closedAt?: Date
+}
+
+export function newDecisionSupportFile(): DecisionSupportFile {
+  return {
+    id: '',
+    title: '',
+    sections: {},
+    status: DecisionSupportFileStatus.Draft,
+    workgroup: null,
+    createdAt: new Date(),
+  };
+}

client/src/types/workgroup.ts

@@ -1,9 +1,18 @@
 import { User } from "./user";
-
 export interface Workgroup {
   id: string
   name: string
   createdAt: Date
   closedAt: Date
-  members: [User]
+  members: User[]
+}
+
+export function inWorkgroup(u: User, wg: Workgroup): boolean {
+  for (let m, i = 0; (m = wg.members[i]); i++) {
+    if(m.id === u.id) {
+      return true;
+    }
+  }
+
+  return false;
 }

client/src/util/apollo.ts

@@ -0,0 +1,74 @@
+
+import { ApolloClient, InMemoryCache, HttpLink, from } from '@apollo/client';
+import { Config } from '../config';
+import { WebSocketLink } from "@apollo/client/link/ws";
+import { RetryLink } from "@apollo/client/link/retry";
+import { onError } from "@apollo/client/link/error";
+import { SubscriptionClient } from "subscriptions-transport-ws";
+import { User } from '../types/user';
+
+export function createClient(setLoggedIn: (boolean) => void) {
+  const subscriptionClient = new SubscriptionClient(Config.subscriptionEndpoint, {
+    reconnect: true,
+  });
+  
+  const errorLink = onError(({ operation }) => {
+    const { response } = operation.getContext();
+    if (response.status === 401) setLoggedIn(false);
+  });
+  
+  const retryLink = new RetryLink({attempts: {max: 2}}).split(
+    (operation) => operation.operationName === 'subscription',
+    new WebSocketLink(subscriptionClient),
+    new HttpLink({ 
+      uri: Config.graphQLEndpoint, 
+      credentials: 'include',
+    })
+  );
+  
+  const cache = new InMemoryCache({
+    typePolicies: {
+      Workgroup: {
+        fields: {
+          members: {
+            merge: mergeArrayByField<User>("id"),
+          }
+        }
+      }
+    }
+  });
+  
+  return new ApolloClient<any>({
+    cache: cache,
+    link: from([
+      errorLink,
+      retryLink
+    ]),
+  });
+}
+
+export function mergeArrayByField<T>(fieldName: string) {
+  return (existing: T[] = [], incoming: T[], { readField, mergeObjects }) => {
+    const merged: any[] = existing ? existing.slice(0) : [];
+    
+    const objectFieldToIndex: Record<string, number> = Object.create(null);
+    if (existing) {
+      existing.forEach((obj, index) => {
+        objectFieldToIndex[readField(fieldName, obj)] = index;
+      });
+    }
+
+    incoming.forEach(obj => {
+      const field = readField(fieldName, obj);
+      const index = objectFieldToIndex[field];
+      if (typeof index === "number") {
+        merged[index] = mergeObjects(merged[index], obj);
+      } else {
+        objectFieldToIndex[name] = merged.length;
+        merged.push(obj);
+      }
+    });
+    
+    return merged;
+  }
+}

client/src/util/date.ts

@@ -0,0 +1,4 @@
+export function asDate(d: string|Date): Date {
+  if (typeof d === 'string') return new Date(d);
+  return d;
+}

client/src/util/uuid.ts

@@ -0,0 +1,53 @@
+import bs58 from 'bs58';
+
+const hex: string[] = [];
+
+for (var i = 0; i < 256; i++) {
+    hex[i] = (i < 16 ? '0' : '') + (i).toString(16);
+}
+
+export function uuidV4(): string {
+    const r = crypto.getRandomValues(new Uint8Array(16));
+
+    r[6] = r[6] & 0x0f | 0x40;
+    r[8] = r[8] & 0x3f | 0x80;
+
+    return (
+        hex[r[0]] +
+        hex[r[1]] +
+        hex[r[2]] +
+        hex[r[3]] +
+        "-" +
+        hex[r[4]] +
+        hex[r[5]] +
+        "-" +
+        hex[r[6]] +
+        hex[r[7]] +
+        "-" +
+        hex[r[8]] +
+        hex[r[9]] +
+        "-" +
+        hex[r[10]] +
+        hex[r[11]] +
+        hex[r[12]] +
+        hex[r[13]] +
+        hex[r[14]] +
+        hex[r[15]]
+    );
+}
+
+export function toUTF8Bytes(str: string): number[] {
+    var utf8 = unescape(encodeURIComponent(str));
+
+    var arr: number[] = [];
+    for (var i = 0; i < utf8.length; i++) {
+        arr.push(utf8.charCodeAt(i));
+    }
+
+    return arr
+}
+
+export function base58UUID(): string {
+    const uuid = uuidV4();
+    return bs58.encode(toUTF8Bytes(uuid));
+}

cmd/server/container.go

@@ -5,8 +5,12 @@ import (
 	"net/http"
 	"time"
 
+	"forge.cadoles.com/Cadoles/daddy/internal/model"
+	"forge.cadoles.com/Cadoles/daddy/internal/voter"
+
 	"github.com/wader/gormstore"
 
+	"forge.cadoles.com/Cadoles/daddy/internal/auth"
 	"forge.cadoles.com/Cadoles/daddy/internal/orm"
 
 	"gitlab.com/wpetit/goweb/logger"
@@ -96,5 +100,13 @@ func getServiceContainer(ctx context.Context, conf *config.Config) (*service.Con
 		oidc.WithScopes("email", "openid"),
 	))
 
+	ctn.Provide(auth.ServiceName, auth.ServiceProvider(conf.Auth.Rules))
+
+	ctn.Provide(voter.ServiceName, voter.ServiceProvider(
+		voter.StrategyUnanimous,
+		model.NewDecisionSupportFileVoter(),
+		model.NewWorkgroupVoter(),
+	))
+
 	return ctn, nil
 }

cmd/server/migration.go

@@ -80,6 +80,7 @@ func applyMigration(ctx context.Context, ctn *service.Container) error {
 var initialModels = []interface{}{
 	&model.User{},
 	&model.Workgroup{},
+	&model.DecisionSupportFile{},
 }
 
 func m000initialSchema() orm.Migration {
@@ -95,8 +96,8 @@ func m000initialSchema() orm.Migration {
 			return nil
 		},
 		func(ctx context.Context, tx *gorm.DB) error {
-			for _, m := range initialModels {
-				if err := tx.DropTableIfExists(m).Error; err != nil {
+			for i := len(initialModels) - 1; i >= 0; i-- {
+				if err := tx.DropTableIfExists(initialModels[i]).Error; err != nil {
 					return errors.WithStack(err)
 				}
 			}

docker-compose.yml

@@ -32,7 +32,7 @@ services:
     command: hydra serve all --dangerous-force-http
   
   hydra-passwordless:
-    image: bornholm/hydra-passwordless:latest
+    image: bornholm/hydra-passwordless:latest@sha256:e6b335e3677dc937c62978890b42312a7486e4fe10208aa2670b1917489ec492
     ports:
       - 3000:3000
     environment:
@@ -48,6 +48,7 @@ services:
       - SMTP_INSECURE_SKIP_VERIFY=true
       - HYDRA_BASE_URL=http://hydra:4445
       - HYDRA_FAKE_SSL_TERMINATION=false
+      - NO_PROXY=hydra
 
   smtp:
     image: bornholm/fake-smtp

go.mod

@@ -5,6 +5,7 @@ go 1.14
 require (
 	forge.cadoles.com/wpetit/goweb-oidc v0.0.0-20200619080035-4bbf7b016032
 	github.com/99designs/gqlgen v0.11.3
+	github.com/antonmedv/expr v1.8.8
 	github.com/caarlos0/env/v6 v6.2.2
 	github.com/cortesi/modd v0.0.0-20200630120222-8983974e5450 // indirect
 	github.com/davecgh/go-spew v1.1.1

go.sum

@@ -20,6 +20,7 @@ github.com/99designs/gqlgen v0.11.3 h1:oFSxl1DFS9X///uHV3y6CEfpcXWrDUxVblR4Xib2b
 github.com/99designs/gqlgen v0.11.3/go.mod h1:RgX5GRRdDWNkh4pBrdzNpNPFVsdoUFY2+adM6nb1N+4=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
+github.com/DATA-DOG/go-sqlmock v1.3.3/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
 github.com/GeertJohan/go.incremental v1.0.0/go.mod h1:6fAjUhbVuX1KcMD3c8TEgVUqmo4seqhv0i0kdATSkM0=
 github.com/GeertJohan/go.rice v1.0.0/go.mod h1:eH6gbSOAUv07dQuZVnBmoDP8mgsM1rtixis4Tib9if0=
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
@@ -44,6 +45,8 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d h1:UQZhZ2O0vMHr2c
 github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
 github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/cascadia v1.1.0/go.mod h1:GsXiBklL0woXo1j/WYWtSYYC4ouU9PqHO0sqidkEA4Y=
+github.com/antonmedv/expr v1.8.8 h1:uVwIkIBNO2yn4vY2u2DQUqXTmv9jEEMCEcHa19G5weY=
+github.com/antonmedv/expr v1.8.8/go.mod h1:5qsM3oLGDND7sDmQGDXHkYfkjYMUX14qsgqmHhwGEk8=
 github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/bmatcuk/doublestar v1.3.0/go.mod h1:wiQtGV+rzVYxB7WIlirSN++5HPtPlXEo9MEoZQC/PmE=
 github.com/bmatcuk/doublestar v1.3.1 h1:rT8rxDPsavp9G+4ZULzqhhUSaI/OPsTZNG88Z3i0xvY=
@@ -71,6 +74,7 @@ github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ3
 github.com/daaku/go.zipexe v1.0.0/go.mod h1:z8IiR6TsVLEYKwXAoE/I+8ys/sDkgTzSL0CLnGVd57E=
 github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 h1:y5HC9v93H5EPKqaS1UYVg1uYah5Xf51mBfIoWehClUQ=
 github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964/go.mod h1:Xd9hchkHSWYkEqJwUGisez3G1QY8Ryz0sdWrLPMGjLk=
+github.com/davecgh/go-spew v0.0.0-20161028175848-04cdfd42973b/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -90,6 +94,8 @@ github.com/fatih/color v1.7.0 h1:DkWD4oS2D8LGGgTQ6IvwJJXSL5Vp2ffcQg58nFV38Ys=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.9.0 h1:8xPHl4/q1VyqGIPif1F+1V3Y3lSmrq01EabUW3CoW5s=
 github.com/fatih/color v1.9.0/go.mod h1:eQcE1qtQxscV5RaZvpXrrb8Drkc3/DdQ+uUYCNjL+zU=
+github.com/gdamore/encoding v1.0.0/go.mod h1:alR0ol34c49FCSBLjhosxzcPHQbf2trDkoo5dl+VrEg=
+github.com/gdamore/tcell v1.3.0/go.mod h1:Hjvr+Ofd+gLglo7RYKxxnzCBmev3BzsS67MebKS4zMM=
 github.com/go-chi/chi v3.3.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
 github.com/go-chi/chi v4.0.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
 github.com/go-chi/chi v4.1.0+incompatible h1:ETj3cggsVIY2Xao5ExCu6YhEh5MD6JTfcBzS37R260w=
@@ -230,6 +236,8 @@ github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.3.0 h1:/qkRGz8zljWiDcFvgpwUpwIAPu3r07TDvs3Rws+o/pU=
 github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
+github.com/lucasb-eyer/go-colorful v1.0.2/go.mod h1:0MS4r+7BZKSJ5mw4/S5MPN+qHFF1fYclkSPilDOKW0s=
+github.com/lucasb-eyer/go-colorful v1.0.3/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/matryer/moq v0.0.0-20200106131100-75d0ddfc0007 h1:reVOUXwnhsYv/8UqjvhrMOu5CNT9UapHFLbQ2JcXsmg=
 github.com/matryer/moq v0.0.0-20200106131100-75d0ddfc0007/go.mod h1:9ELz6aaclSIGnZBoaSLZ3NAl1VTufbOrXBPvtcy6WiQ=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
@@ -250,6 +258,8 @@ github.com/mattn/go-isatty v0.0.11 h1:FxPOTFNqGkuDUGi3H/qkUbQO4ZiBa2brKq5r0l8TGe
 github.com/mattn/go-isatty v0.0.11/go.mod h1:PhnuNfih5lzO57/f3n+odYbM4JtupLOxQOAqxQCu2WE=
 github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-runewidth v0.0.4/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.8/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
 github.com/mattn/go-sqlite3 v1.14.0 h1:mLyGNKR8+Vv9CAU7PphKa2hkEqxxhn8i32J6FPj1/QA=
 github.com/mattn/go-sqlite3 v1.14.0/go.mod h1:JIl7NbARA7phWnGvh0LKTyg7S9BA+6gx71ShQilpsus=
 github.com/mattn/go-sqlite3 v2.0.1+incompatible/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
@@ -267,11 +277,14 @@ github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v0.0.0-20151028094244-d8ed2627bdf0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35 h1:J9b7z+QKAmPf4YLrFg6oQUotqHQeUNWwkvo7jZp1GLU=
 github.com/pquerna/cachecontrol v0.0.0-20180517163645-1555304b9b35/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/rivo/tview v0.0.0-20200219210816-cd38d7432498/go.mod h1:6lkG1x+13OShEf0EaOCaTQYyB7d5nSbb181KtjlS+84=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
 github.com/rjeczalik/notify v0.0.0-20181126183243-629144ba06a1 h1:FLWDC+iIP9BWgYKvWKKtOUZux35LIQNAuIzp/63RQJU=
 github.com/rjeczalik/notify v0.0.0-20181126183243-629144ba06a1/go.mod h1:aErll2f0sUX9PXZnVNyeiObbmTlk5jnMoCa4QEjJeqM=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@@ -283,6 +296,7 @@ github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OK
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
 github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/sanity-io/litter v1.2.0/go.mod h1:JF6pZUFgu2Q0sBZ+HSV35P8TVPI1TTzEwyu9FXAw2W4=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
 github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
 github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
@@ -299,6 +313,7 @@ github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6Mwd
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
+github.com/stretchr/testify v0.0.0-20161117074351-18a02ba4a312/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -410,6 +425,7 @@ golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190626150813-e07cf5db2756/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190804053845-51ab0e2deafa/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -418,6 +434,7 @@ golang.org/x/sys v0.0.0-20191210023423-ac6580df4449 h1:gSbV7h1NRL2G1xTg/owz62CST
 golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42 h1:vEOn+mP2zCOVzKckCZy6YsCtDblrpj/w7B9nxGNELpg=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae h1:/WDfKMnPU+m5M4xB+6x4kaepxRw6jWvR5iDRdvjHgy8=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=

internal/auth/auth.go

@@ -0,0 +1,71 @@
+package auth
+
+import (
+	"sync"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/model"
+	"github.com/antonmedv/expr"
+	"github.com/antonmedv/expr/vm"
+	"github.com/pkg/errors"
+)
+
+var (
+	ErrUnexpectedRuleResult = errors.New("unexpected rule result")
+)
+
+type Service struct {
+	rules []*vm.Program
+	mutex sync.RWMutex
+}
+
+func (s *Service) LoadRules(rawRules ...string) error {
+	rules := make([]*vm.Program, 0, len(rawRules))
+
+	for _, rr := range rawRules {
+		r, err := expr.Compile(rr)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+
+		rules = append(rules, r)
+	}
+
+	s.mutex.Lock()
+	s.rules = rules
+	s.mutex.Unlock()
+
+	return nil
+}
+
+func (s *Service) Authorize(user *model.User) (bool, error) {
+	s.mutex.RLock()
+	defer s.mutex.RUnlock()
+
+	env := map[string]interface{}{
+		"user": user,
+	}
+
+	for _, r := range s.rules {
+		result, err := expr.Run(r, env)
+		if err != nil {
+			return false, errors.WithStack(err)
+		}
+
+		authorized, ok := result.(bool)
+		if !ok {
+			return false, errors.WithStack(ErrUnexpectedRuleResult)
+		}
+
+		if !authorized {
+			return false, nil
+		}
+	}
+
+	return true, nil
+}
+
+func NewService() *Service {
+	return &Service{
+		rules: make([]*vm.Program, 0),
+	}
+}

internal/auth/provider.go

@@ -0,0 +1,20 @@
+package auth
+
+import (
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/service"
+)
+
+func ServiceProvider(rules []string) service.Provider {
+	srv := NewService()
+
+	err := srv.LoadRules(rules...)
+
+	return func(ctn *service.Container) (interface{}, error) {
+		if err != nil {
+			return nil, errors.WithStack(err)
+		}
+
+		return srv, nil
+	}
+}

internal/auth/service.go

@@ -0,0 +1,33 @@
+package auth
+
+import (
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/service"
+)
+
+const ServiceName service.Name = "auth"
+
+// From retrieves the auth service in the given container.
+func From(container *service.Container) (*Service, error) {
+	service, err := container.Service(ServiceName)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error while retrieving '%s' service", ServiceName)
+	}
+
+	srv, ok := service.(*Service)
+	if !ok {
+		return nil, errors.Errorf("retrieved service is not a valid '%s' service", ServiceName)
+	}
+
+	return srv, nil
+}
+
+// Must retrieves the auth service in the given container or panic otherwise.
+func Must(container *service.Container) *Service {
+	srv, err := From(container)
+	if err != nil {
+		panic(err)
+	}
+
+	return srv
+}

internal/config/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	HTTP     HTTPConfig     `yaml:"http"`
 	OIDC     OIDCConfig     `yaml:"oidc"`
 	Database DatabaseConfig `yaml:"database"`
+	Auth     AuthConfig     `yaml:"auth"`
 }
 
 // NewFromFile retrieves the configuration from the given file
@@ -69,6 +70,10 @@ type DatabaseConfig struct {
 	DSN string `yaml:"dsn" env:"DATABASE_DSN"`
 }
 
+type AuthConfig struct {
+	Rules []string `yaml:"rules" env:"AUTH_RULES"`
+}
+
 func NewDumpDefault() *Config {
 	config := NewDefault()
 	return config
@@ -85,7 +90,7 @@ func NewDefault() *Config {
 			Address:                 ":8081",
 			CookieAuthenticationKey: "",
 			CookieEncryptionKey:     "",
-			CookieMaxAge:            int((time.Hour * 1).Seconds()), // 1 hour
+			CookieMaxAge:            int((time.Hour * 24).Seconds()), // 24 hours
 			TemplateDir:             "template",
 			PublicDir:               "public",
 			FrontendURL:             "http://localhost:8080",
@@ -102,6 +107,11 @@ func NewDefault() *Config {
 		Database: DatabaseConfig{
 			DSN: "host=localhost database=daddy",
 		},
+		Auth: AuthConfig{
+			Rules: []string{
+				"user.Email endsWith 'cadoles.com'",
+			},
+		},
 	}
 }
 

internal/graph/authorization_handler.go

@@ -0,0 +1,59 @@
+package graph
+
+import (
+	"context"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/model"
+	errs "github.com/pkg/errors"
+)
+
+func handleIsAuthorized(ctx context.Context, action string, obj model.AuthorizationObject) (bool, error) {
+	db, err := getDB(ctx)
+	if err != nil {
+		return false, errs.WithStack(err)
+	}
+
+	var object interface{}
+
+	switch {
+	case obj.WorkgroupID != nil:
+		repo := model.NewWorkgroupRepository(db)
+
+		workgroup, err := repo.Find(ctx, *obj.WorkgroupID)
+		if err != nil {
+			return false, errs.WithStack(err)
+		}
+
+		object = workgroup
+
+	case obj.DecisionSupportFileID != nil:
+		repo := model.NewDSFRepository(db)
+
+		dsf, err := repo.Find(ctx, *obj.DecisionSupportFileID)
+		if err != nil {
+			return false, errs.WithStack(err)
+		}
+
+		object = dsf
+
+	case obj.UserID != nil:
+		repo := model.NewUserRepository(db)
+
+		user, err := repo.Find(ctx, *obj.UserID)
+		if err != nil {
+			return false, errs.WithStack(err)
+		}
+
+		object = user
+
+	default:
+		return false, errs.WithStack(ErrInvalidInput)
+	}
+
+	authorized, err := isAuthorized(ctx, object, model.Action(action))
+	if err != nil {
+		return false, errs.WithStack(err)
+	}
+
+	return authorized, nil
+}

internal/graph/dsf_handler.go

@@ -0,0 +1,100 @@
+package graph
+
+import (
+	"context"
+	"encoding/json"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/orm"
+	"gitlab.com/wpetit/goweb/middleware/container"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/model"
+	errs "github.com/pkg/errors"
+)
+
+func handleCreateDecisionSupportFile(ctx context.Context, changes *model.DecisionSupportFileChanges) (*model.DecisionSupportFile, error) {
+	authorized, err := isAuthorized(ctx, &model.DecisionSupportFile{}, model.ActionCreate)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	ctn := container.Must(ctx)
+	db := orm.Must(ctn).DB()
+
+	repo := model.NewDSFRepository(db)
+
+	dsf, err := repo.Create(ctx, changes)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsf, nil
+}
+
+func handleUpdateDecisionSupportFile(ctx context.Context, id string, changes *model.DecisionSupportFileChanges) (*model.DecisionSupportFile, error) {
+	ctn := container.Must(ctx)
+	db := orm.Must(ctn).DB()
+
+	repo := model.NewDSFRepository(db)
+
+	dsf, err := repo.Find(ctx, id)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	authorized, err := isAuthorized(ctx, dsf, model.ActionUpdate)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	dsf, err = repo.Update(ctx, id, changes)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsf, nil
+}
+
+func handleDecisionSupportFiles(ctx context.Context, filter *model.DecisionSupportFileFilter) ([]*model.DecisionSupportFile, error) {
+	ctn := container.Must(ctx)
+	db := orm.Must(ctn).DB()
+
+	repo := model.NewDSFRepository(db)
+
+	found, err := repo.Search(ctx, filter)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	dsfs := make([]*model.DecisionSupportFile, 0)
+
+	for _, d := range found {
+		authorized, err := isAuthorized(ctx, d, model.ActionRead)
+		if err != nil {
+			return nil, errs.WithStack(err)
+		}
+
+		if authorized {
+			dsfs = append(dsfs, d)
+		}
+	}
+
+	return dsfs, nil
+}
+
+func handleSections(ctx context.Context, dsf *model.DecisionSupportFile) (map[string]interface{}, error) {
+	sections := make(map[string]interface{})
+
+	if err := json.Unmarshal(dsf.Sections.RawMessage, &sections); err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return sections, nil
+}

internal/graph/error.go

@@ -0,0 +1,8 @@
+package graph
+
+import "errors"
+
+var (
+	ErrForbidden    = errors.New("forbidden")
+	ErrInvalidInput = errors.New("invalid input")
+)

internal/graph/helper.go

@@ -3,6 +3,8 @@ package graph
 import (
 	"context"
 
+	"forge.cadoles.com/Cadoles/daddy/internal/voter"
+
 	"forge.cadoles.com/Cadoles/daddy/internal/model"
 	"forge.cadoles.com/Cadoles/daddy/internal/orm"
 	"forge.cadoles.com/Cadoles/daddy/internal/session"
@@ -46,3 +48,31 @@ func getSessionUser(ctx context.Context) (*model.User, *gorm.DB, error) {
 
 	return user, db, nil
 }
+
+func isAuthorized(ctx context.Context, obj interface{}, action interface{}) (bool, error) {
+	user, _, err := getSessionUser(ctx)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	ctn, err := container.From(ctx)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	voterSrv, err := voter.From(ctn)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	decision, err := voterSrv.Authorized(ctx, user, obj, action)
+	if err != nil {
+		return false, errors.WithStack(err)
+	}
+
+	if decision == voter.Allow {
+		return true, nil
+	}
+
+	return false, nil
+}

internal/graph/mutation.graphql

@@ -6,8 +6,21 @@ input WorkgroupChanges {
   name: String
 }
 
+input DecisionSupportFileChanges {
+  title: String
+	sections: Map
+	status: String
+	workgroupId: ID
+	votedAt: Time
+	closedAt: Time
+}
+
 type Mutation {
+  createDecisionSupportFile(changes: DecisionSupportFileChanges): DecisionSupportFile!
+  updateDecisionSupportFile(id: ID!, changes: DecisionSupportFileChanges): DecisionSupportFile!
+
   updateProfile(changes: ProfileChanges!): User!
+  
   joinWorkgroup(workgroupId: ID!): Workgroup!
   leaveWorkgroup(workgroupId: ID!): Workgroup!
   createWorkgroup(changes: WorkgroupChanges!): Workgroup!

internal/graph/mutation.resolvers.go

@@ -10,6 +10,14 @@ import (
 	"forge.cadoles.com/Cadoles/daddy/internal/model"
 )
 
+func (r *mutationResolver) CreateDecisionSupportFile(ctx context.Context, changes *model.DecisionSupportFileChanges) (*model.DecisionSupportFile, error) {
+	return handleCreateDecisionSupportFile(ctx, changes)
+}
+
+func (r *mutationResolver) UpdateDecisionSupportFile(ctx context.Context, id string, changes *model.DecisionSupportFileChanges) (*model.DecisionSupportFile, error) {
+	return handleUpdateDecisionSupportFile(ctx, id, changes)
+}
+
 func (r *mutationResolver) UpdateProfile(ctx context.Context, changes model.ProfileChanges) (*model.User, error) {
 	return handleUpdateUserProfile(ctx, changes)
 }

internal/graph/query.graphql

@@ -1,4 +1,5 @@
 scalar Time
+scalar Map
 
 type User {
   id: ID!
@@ -21,7 +22,31 @@ input WorkgroupsFilter {
   ids: [ID]
 }
 
+type DecisionSupportFile {
+  id: ID!
+  title: String
+	sections: Map
+	status: String
+	workgroup: Workgroup
+  createdAt: Time
+  updatedAt: Time
+	votedAt: Time
+	closedAt: Time
+}
+
+input DecisionSupportFileFilter {
+  ids: [ID]
+}
+
+input AuthorizationObject {
+  workgroupId: ID
+  userId: ID
+  decisionSupportFileId: ID
+}
+
 type Query {
   userProfile: User
   workgroups(filter: WorkgroupsFilter): [Workgroup]!
+  decisionSupportFiles(filter: DecisionSupportFileFilter): [DecisionSupportFile]!
+  isAuthorized(action: String!, object: AuthorizationObject!): Boolean!
 }

internal/graph/query.resolvers.go

@@ -11,6 +11,14 @@ import (
 	model1 "forge.cadoles.com/Cadoles/daddy/internal/model"
 )
 
+func (r *decisionSupportFileResolver) ID(ctx context.Context, obj *model1.DecisionSupportFile) (string, error) {
+	return strconv.FormatUint(uint64(obj.ID), 10), nil
+}
+
+func (r *decisionSupportFileResolver) Sections(ctx context.Context, obj *model1.DecisionSupportFile) (map[string]interface{}, error) {
+	return handleSections(ctx, obj)
+}
+
 func (r *queryResolver) UserProfile(ctx context.Context) (*model1.User, error) {
 	return handleUserProfile(ctx)
 }
@@ -19,6 +27,14 @@ func (r *queryResolver) Workgroups(ctx context.Context, filter *model1.Workgroup
 	return handleWorkgroups(ctx, filter)
 }
 
+func (r *queryResolver) DecisionSupportFiles(ctx context.Context, filter *model1.DecisionSupportFileFilter) ([]*model1.DecisionSupportFile, error) {
+	return handleDecisionSupportFiles(ctx, filter)
+}
+
+func (r *queryResolver) IsAuthorized(ctx context.Context, action string, object model1.AuthorizationObject) (bool, error) {
+	return handleIsAuthorized(ctx, action, object)
+}
+
 func (r *userResolver) ID(ctx context.Context, obj *model1.User) (string, error) {
 	return strconv.FormatUint(uint64(obj.ID), 10), nil
 }
@@ -27,6 +43,11 @@ func (r *workgroupResolver) ID(ctx context.Context, obj *model1.Workgroup) (stri
 	return strconv.FormatUint(uint64(obj.ID), 10), nil
 }
 
+// DecisionSupportFile returns generated.DecisionSupportFileResolver implementation.
+func (r *Resolver) DecisionSupportFile() generated.DecisionSupportFileResolver {
+	return &decisionSupportFileResolver{r}
+}
+
 // Query returns generated.QueryResolver implementation.
 func (r *Resolver) Query() generated.QueryResolver { return &queryResolver{r} }
 
@@ -36,6 +57,7 @@ func (r *Resolver) User() generated.UserResolver { return &userResolver{r} }
 // Workgroup returns generated.WorkgroupResolver implementation.
 func (r *Resolver) Workgroup() generated.WorkgroupResolver { return &workgroupResolver{r} }
 
+type decisionSupportFileResolver struct{ *Resolver }
 type queryResolver struct{ *Resolver }
 type userResolver struct{ *Resolver }
 type workgroupResolver struct{ *Resolver }

internal/graph/workgroup_handler.go

@@ -2,10 +2,10 @@ package graph
 
 import (
 	"context"
-	"strconv"
 
 	"forge.cadoles.com/Cadoles/daddy/internal/model"
 	"github.com/pkg/errors"
+	errs "github.com/pkg/errors"
 )
 
 func handleWorkgroups(ctx context.Context, filter *model.WorkgroupsFilter) ([]*model.Workgroup, error) {
@@ -24,20 +24,28 @@ func handleWorkgroups(ctx context.Context, filter *model.WorkgroupsFilter) ([]*m
 		}
 	}
 
-	workgroups, err := repo.FindWorkgroups(ctx, criteria...)
+	found, err := repo.FindWorkgroups(ctx, criteria...)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
 
+	workgroups := make([]*model.Workgroup, 0)
+
+	for _, wg := range found {
+		authorized, err := isAuthorized(ctx, wg, model.ActionRead)
+		if err != nil {
+			return nil, errs.WithStack(err)
+		}
+
+		if authorized {
+			workgroups = append(workgroups, wg)
+		}
+	}
+
 	return workgroups, nil
 }
 
 func handleJoinWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Workgroup, error) {
-	workgroupID, err := parseWorkgroupID(rawWorkgroupID)
-	if err != nil {
-		return nil, errors.WithStack(err)
-	}
-
 	user, db, err := getSessionUser(ctx)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -45,7 +53,21 @@ func handleJoinWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wor
 
 	repo := model.NewWorkgroupRepository(db)
 
-	workgroup, err := repo.AddUserToWorkgroup(ctx, user.ID, workgroupID)
+	workgroup, err := repo.Find(ctx, rawWorkgroupID)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	authorized, err := isAuthorized(ctx, workgroup, model.ActionJoin)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	workgroup, err = repo.AddUserToWorkgroup(ctx, user.ID, workgroup.ID)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
@@ -53,12 +75,7 @@ func handleJoinWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wor
 	return workgroup, nil
 }
 
-func handleLeaveWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Workgroup, error) {
-	workgroupID, err := parseWorkgroupID(rawWorkgroupID)
-	if err != nil {
-		return nil, errors.WithStack(err)
-	}
-
+func handleLeaveWorkgroup(ctx context.Context, workgroupID string) (*model.Workgroup, error) {
 	user, db, err := getSessionUser(ctx)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -66,7 +83,21 @@ func handleLeaveWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wo
 
 	repo := model.NewWorkgroupRepository(db)
 
-	workgroup, err := repo.RemoveUserFromWorkgroup(ctx, user.ID, workgroupID)
+	workgroup, err := repo.Find(ctx, workgroupID)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	authorized, err := isAuthorized(ctx, workgroup, model.ActionLeave)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	workgroup, err = repo.RemoveUserFromWorkgroup(ctx, user.ID, workgroup.ID)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
@@ -75,6 +106,15 @@ func handleLeaveWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wo
 }
 
 func handleCreateWorkgroup(ctx context.Context, changes model.WorkgroupChanges) (*model.Workgroup, error) {
+	authorized, err := isAuthorized(ctx, &model.Workgroup{}, model.ActionCreate)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
 	db, err := getDB(ctx)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -90,12 +130,7 @@ func handleCreateWorkgroup(ctx context.Context, changes model.WorkgroupChanges)
 	return workgroup, nil
 }
 
-func handleCloseWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Workgroup, error) {
-	workgroupID, err := parseWorkgroupID(rawWorkgroupID)
-	if err != nil {
-		return nil, errors.WithStack(err)
-	}
-
+func handleCloseWorkgroup(ctx context.Context, workgroupID string) (*model.Workgroup, error) {
 	db, err := getDB(ctx)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -103,7 +138,21 @@ func handleCloseWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wo
 
 	repo := model.NewWorkgroupRepository(db)
 
-	workgroup, err := repo.CloseWorkgroup(ctx, workgroupID)
+	workgroup, err := repo.Find(ctx, workgroupID)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	authorized, err := isAuthorized(ctx, workgroup, model.ActionClose)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	workgroup, err = repo.CloseWorkgroup(ctx, workgroup.ID)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
@@ -111,12 +160,7 @@ func handleCloseWorkgroup(ctx context.Context, rawWorkgroupID string) (*model.Wo
 	return workgroup, nil
 }
 
-func handleUpdateWorkgroup(ctx context.Context, rawWorkgroupID string, changes model.WorkgroupChanges) (*model.Workgroup, error) {
-	workgroupID, err := parseWorkgroupID(rawWorkgroupID)
-	if err != nil {
-		return nil, errors.WithStack(err)
-	}
-
+func handleUpdateWorkgroup(ctx context.Context, workgroupID string, changes model.WorkgroupChanges) (*model.Workgroup, error) {
 	db, err := getDB(ctx)
 	if err != nil {
 		return nil, errors.WithStack(err)
@@ -124,19 +168,24 @@ func handleUpdateWorkgroup(ctx context.Context, rawWorkgroupID string, changes m
 
 	repo := model.NewWorkgroupRepository(db)
 
-	workgroup, err := repo.UpdateWorkgroup(ctx, workgroupID, changes)
+	workgroup, err := repo.Find(ctx, workgroupID)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	authorized, err := isAuthorized(ctx, workgroup, model.ActionUpdate)
+	if err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if !authorized {
+		return nil, errs.WithStack(ErrForbidden)
+	}
+
+	workgroup, err = repo.UpdateWorkgroup(ctx, workgroup.ID, changes)
 	if err != nil {
 		return nil, errors.WithStack(err)
 	}
 
 	return workgroup, nil
 }
-
-func parseWorkgroupID(workgroupID string) (uint, error) {
-	workgroupID64, err := strconv.ParseUint(workgroupID, 10, 32)
-	if err != nil {
-		return 0, errors.WithStack(err)
-	}
-
-	return uint(workgroupID64), nil
-}

internal/model/action.go

@@ -0,0 +1,13 @@
+package model
+
+type Action string
+
+const (
+	ActionCreate Action = "create"
+	ActionRead   Action = "read"
+	ActionUpdate Action = "update"
+	ActionDelete Action = "delete"
+	ActionJoin   Action = "join"
+	ActionLeave  Action = "leave"
+	ActionClose  Action = "close"
+)

internal/model/dsf.go

@@ -0,0 +1,19 @@
+package model
+
+import (
+	"time"
+
+	"github.com/jinzhu/gorm"
+	"github.com/jinzhu/gorm/dialects/postgres"
+)
+
+type DecisionSupportFile struct {
+	gorm.Model
+	Title       string         `json:"title"`
+	Sections    postgres.Jsonb `json:"sections"`
+	Status      string         `json:"status"`
+	WorkgroupID uint           `json:"-"`
+	Workgroup   *Workgroup     `json:"workgroup"`
+	VotedAt     time.Time      `json:"votedAt"`
+	ClosedAt    time.Time      `json:"closedAt"`
+}

internal/model/dsf_repository.go

@@ -0,0 +1,122 @@
+package model
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+
+	"github.com/jinzhu/gorm"
+	"github.com/jinzhu/gorm/dialects/postgres"
+	errs "github.com/pkg/errors"
+)
+
+var (
+	ErrMissingWorkgroup                = errs.New("missing workgroup")
+	ErrInvalidWorkgroup                = errs.New("invalid workgroup")
+	ErrDecisionSupportFileDoesNotExist = errs.New("decision support file does not exist")
+)
+
+type DSFRepository struct {
+	db *gorm.DB
+}
+
+func (r *DSFRepository) Create(ctx context.Context, changes *DecisionSupportFileChanges) (*DecisionSupportFile, error) {
+	dsf := &DecisionSupportFile{}
+
+	if err := r.updateFromChanges(dsf, changes); err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if err := r.db.Save(&dsf).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsf, nil
+}
+
+func (r *DSFRepository) Update(ctx context.Context, id string, changes *DecisionSupportFileChanges) (*DecisionSupportFile, error) {
+	dsf := &DecisionSupportFile{}
+
+	if err := r.db.Find(dsf, "id = ?", id).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if err := r.updateFromChanges(dsf, changes); err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	if err := r.db.Save(dsf).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsf, nil
+}
+
+func (r *DSFRepository) updateFromChanges(dsf *DecisionSupportFile, changes *DecisionSupportFileChanges) error {
+	if changes.WorkgroupID == nil {
+		return errs.WithStack(ErrMissingWorkgroup)
+	}
+
+	wg := &Workgroup{}
+	if err := r.db.Model(wg).First(wg, "id = ?", changes.WorkgroupID).Error; err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return errs.WithStack(ErrInvalidWorkgroup)
+		}
+
+		return errs.WithStack(err)
+	}
+
+	dsf.Workgroup = wg
+
+	if changes.Sections != nil {
+		rawSections, err := json.Marshal(changes.Sections)
+		if err != nil {
+			return errs.WithStack(err)
+		}
+
+		dsf.Sections = postgres.Jsonb{RawMessage: rawSections}
+	}
+
+	if changes.Title != nil {
+		dsf.Title = *changes.Title
+	}
+
+	if changes.Status != nil {
+		dsf.Status = *changes.Status
+	}
+
+	return nil
+}
+
+func (r *DSFRepository) Find(ctx context.Context, id string) (*DecisionSupportFile, error) {
+	dsf := &DecisionSupportFile{}
+	query := r.db.Model(dsf).Preload("Workgroup").Where("id = ?", id)
+
+	if err := query.First(&dsf).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsf, nil
+}
+
+func (r *DSFRepository) Search(ctx context.Context, filter *DecisionSupportFileFilter) ([]*DecisionSupportFile, error) {
+	query := r.db.Model(&DecisionSupportFile{}).Preload("Workgroup")
+
+	if filter != nil {
+		if filter.Ids != nil {
+			query = query.Where("id in (?)", filter.Ids)
+		}
+	}
+
+	dsfs := make([]*DecisionSupportFile, 0)
+
+	if err := query.Find(&dsfs).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return dsfs, nil
+}
+
+func NewDSFRepository(db *gorm.DB) *DSFRepository {
+	return &DSFRepository{db}
+}

internal/model/dsf_voter.go

@@ -0,0 +1,48 @@
+package model
+
+import (
+	"context"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/voter"
+)
+
+type DecisionSupportFileVoter struct {
+}
+
+func (v *DecisionSupportFileVoter) Vote(ctx context.Context, subject interface{}, obj interface{}, act interface{}) (voter.Decision, error) {
+	user, ok := subject.(*User)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	dsf, ok := obj.(*DecisionSupportFile)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	action, ok := act.(Action)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	switch action {
+	case ActionCreate:
+		return voter.Allow, nil
+	case ActionRead:
+		return voter.Allow, nil
+	case ActionUpdate:
+		if inWorkgroup(user, dsf.Workgroup) {
+			return voter.Allow, nil
+		}
+
+		return voter.Deny, nil
+	case ActionDelete:
+		return voter.Deny, nil
+	}
+
+	return voter.Abstain, nil
+}
+
+func NewDecisionSupportFileVoter() *DecisionSupportFileVoter {
+	return &DecisionSupportFileVoter{}
+}

internal/model/helper.go

@@ -0,0 +1,15 @@
+package model
+
+func inWorkgroup(user *User, workgroup *Workgroup) bool {
+	if workgroup == nil {
+		return false
+	}
+
+	for _, w := range user.Workgroups {
+		if w.ID == workgroup.ID {
+			return true
+		}
+	}
+
+	return false
+}

internal/model/user_repository.go

@@ -7,6 +7,7 @@ import (
 	"forge.cadoles.com/Cadoles/daddy/internal/orm"
 	"github.com/jinzhu/gorm"
 	"github.com/pkg/errors"
+	errs "github.com/pkg/errors"
 )
 
 type UserRepository struct {
@@ -68,6 +69,17 @@ func (r *UserRepository) UpdateUserByEmail(ctx context.Context, email string, ch
 	return user, nil
 }
 
+func (r *UserRepository) Find(ctx context.Context, id string) (*User, error) {
+	user := &User{}
+	query := r.db.Model(user).Where("id = ?", id)
+
+	if err := query.First(&user).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return user, nil
+}
+
 func NewUserRepository(db *gorm.DB) *UserRepository {
 	return &UserRepository{db}
 }

internal/model/workgroup_repository.go

@@ -6,6 +6,7 @@ import (
 
 	"github.com/jinzhu/gorm"
 	"github.com/pkg/errors"
+	errs "github.com/pkg/errors"
 )
 
 type WorkgroupRepository struct {
@@ -47,7 +48,7 @@ func (r *WorkgroupRepository) CreateWorkgroup(ctx context.Context, changes Workg
 		Name: changes.Name,
 	}
 
-	if err := r.db.Model(&Workgroup{}).Create(workgroup).Error; err != nil {
+	if err := r.db.Model(&Workgroup{}).Preload("Members").Create(workgroup).Error; err != nil {
 		return nil, errors.WithStack(err)
 	}
 
@@ -135,6 +136,17 @@ func (r *WorkgroupRepository) RemoveUserFromWorkgroup(ctx context.Context, userI
 	return workgroup, nil
 }
 
+func (r *WorkgroupRepository) Find(ctx context.Context, id string) (*Workgroup, error) {
+	wg := &Workgroup{}
+	query := r.db.Model(wg).Preload("Members").Where("id = ?", id)
+
+	if err := query.First(&wg).Error; err != nil {
+		return nil, errs.WithStack(err)
+	}
+
+	return wg, nil
+}
+
 func NewWorkgroupRepository(db *gorm.DB) *WorkgroupRepository {
 	return &WorkgroupRepository{db}
 }

internal/model/workgroup_voter.go

@@ -0,0 +1,54 @@
+package model
+
+import (
+	"context"
+
+	"forge.cadoles.com/Cadoles/daddy/internal/voter"
+)
+
+type WorkgroupVoter struct {
+}
+
+func (v *WorkgroupVoter) Vote(ctx context.Context, subject interface{}, obj interface{}, act interface{}) (voter.Decision, error) {
+	user, ok := subject.(*User)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	workgroup, ok := obj.(*Workgroup)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	action, ok := act.(Action)
+	if !ok {
+		return voter.Abstain, nil
+	}
+
+	switch action {
+	case ActionCreate:
+		return voter.Allow, nil
+	case ActionRead:
+		return voter.Allow, nil
+	case ActionJoin:
+		return voter.Allow, nil
+	case ActionLeave:
+		fallthrough
+	case ActionUpdate:
+		fallthrough
+	case ActionClose:
+		if inWorkgroup(user, workgroup) {
+			return voter.Allow, nil
+		} else {
+			return voter.Deny, nil
+		}
+	case ActionDelete:
+		return voter.Deny, nil
+	}
+
+	return voter.Abstain, nil
+}
+
+func NewWorkgroupVoter() *WorkgroupVoter {
+	return &WorkgroupVoter{}
+}

internal/route/login.go

@@ -1,8 +1,11 @@
 package route
 
 import (
+	"fmt"
 	"net/http"
 
+	"forge.cadoles.com/Cadoles/daddy/internal/auth"
+
 	"forge.cadoles.com/Cadoles/daddy/internal/model"
 	"forge.cadoles.com/Cadoles/daddy/internal/orm"
 
@@ -31,6 +34,7 @@ func handleLoginCallback(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	ctn := container.Must(ctx)
 	conf := config.Must(ctn)
+	auth := auth.Must(ctn)
 
 	idToken, err := oidc.IDToken(w, r)
 	if err != nil {
@@ -65,10 +69,26 @@ func handleLoginCallback(w http.ResponseWriter, r *http.Request) {
 	db := orm.Must(ctn).DB()
 	repo := model.NewUserRepository(db)
 
-	if _, err := repo.CreateOrConnectUser(ctx, claims.Email); err != nil {
+	user, err := repo.CreateOrConnectUser(ctx, claims.Email)
+	if err != nil {
 		panic(errors.Wrap(err, "could not upsert user"))
 	}
 
+	authorized, err := auth.Authorize(user)
+	if err != nil {
+		panic(errors.WithStack(err))
+	}
+
+	if !authorized {
+		message := fmt.Sprintf(
+			"You are not authorized to access this application. Disconnect by navigating to %s.",
+			"http://"+r.Host+"/logout",
+		)
+		http.Error(w, message, http.StatusForbidden)
+
+		return
+	}
+
 	if err := session.SaveUserEmail(w, r, claims.Email); err != nil {
 		panic(errors.WithStack(err))
 	}

internal/route/mount.go

@@ -2,6 +2,7 @@ package route
 
 import (
 	"net/http"
+	"path"
 	"time"
 
 	"forge.cadoles.com/Cadoles/daddy/internal/config"
@@ -35,10 +36,12 @@ func Mount(r *chi.Mux, config *config.Config) error {
 		}).Handler)
 		r.Use(session.UserEmailMiddleware)
 
+		gqlConfig := generated.Config{
+			Resolvers: &graph.Resolver{},
+		}
+
 		gql := handler.New(
-			generated.NewExecutableSchema(generated.Config{
-				Resolvers: &graph.Resolver{},
-			}),
+			generated.NewExecutableSchema(gqlConfig),
 		)
 
 		gql.AddTransport(transport.POST{})
@@ -62,6 +65,19 @@ func Mount(r *chi.Mux, config *config.Config) error {
 		r.Handle("/v1/graphql", gql)
 	})
 
+	clientIndex := path.Join(config.HTTP.PublicDir, "index.html")
+
+	serveClientIndex := func(w http.ResponseWriter, r *http.Request) {
+		http.ServeFile(w, r, clientIndex)
+	}
+
+	// List of paths handled directly by the client
+	r.Get("/workgroups/*", serveClientIndex)
+	r.Get("/profile", serveClientIndex)
+	r.Get("/dashboard", serveClientIndex)
+	r.Get("/decisions/*", serveClientIndex)
+
+	// Serve static files
 	notFoundHandler := r.NotFoundHandler()
 	r.Get("/*", static.Dir(config.HTTP.PublicDir, "", notFoundHandler))
 

internal/voter/decision.go

@@ -0,0 +1,22 @@
+package voter
+
+type Decision int
+
+const (
+	Allow Decision = iota
+	Deny
+	Abstain
+)
+
+func AsString(d Decision) string {
+	switch d {
+	case Allow:
+		return "allow"
+	case Deny:
+		return "deny"
+	case Abstain:
+		return "abstain"
+	default:
+		return "unknown"
+	}
+}

internal/voter/manager.go

@@ -0,0 +1,60 @@
+package voter
+
+import (
+	"context"
+
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/logger"
+)
+
+type Voter interface {
+	Vote(ctx context.Context, subject interface{}, obj interface{}, action interface{}) (Decision, error)
+}
+
+type Strategy func(ctx context.Context, decisions []Decision) (Decision, error)
+
+type Manager struct {
+	strategy Strategy
+	voters   []Voter
+}
+
+func (m *Manager) Authorized(ctx context.Context, subject interface{}, obj interface{}, action interface{}) (Decision, error) {
+	decisions := make([]Decision, 0, len(m.voters))
+
+	logger.Debug(
+		ctx,
+		"checking authorization",
+		logger.F("subject", subject),
+		logger.F("object", obj),
+		logger.F("action", action),
+	)
+
+	for _, v := range m.voters {
+		dec, err := v.Vote(ctx, subject, obj, action)
+		if err != nil {
+			return Deny, errors.WithStack(err)
+		}
+
+		decisions = append(decisions, dec)
+	}
+
+	result, err := m.strategy(ctx, decisions)
+	if err != nil {
+		return Deny, errors.WithStack(err)
+	}
+
+	logger.Debug(
+		ctx,
+		"authorization checked",
+		logger.F("subject", subject),
+		logger.F("object", obj),
+		logger.F("action", action),
+		logger.F("result", AsString(result)),
+	)
+
+	return result, nil
+}
+
+func NewManager(strategy Strategy, voters ...Voter) *Manager {
+	return &Manager{strategy, voters}
+}

internal/voter/provider.go

@@ -0,0 +1,13 @@
+package voter
+
+import (
+	"gitlab.com/wpetit/goweb/service"
+)
+
+func ServiceProvider(strategy Strategy, voters ...Voter) service.Provider {
+	manager := NewManager(strategy, voters...)
+
+	return func(ctn *service.Container) (interface{}, error) {
+		return manager, nil
+	}
+}

internal/voter/service.go

@@ -0,0 +1,33 @@
+package voter
+
+import (
+	"github.com/pkg/errors"
+	"gitlab.com/wpetit/goweb/service"
+)
+
+const ServiceName service.Name = "voter"
+
+// From retrieves the voter service in the given container.
+func From(container *service.Container) (*Manager, error) {
+	service, err := container.Service(ServiceName)
+	if err != nil {
+		return nil, errors.Wrapf(err, "error while retrieving '%s' service", ServiceName)
+	}
+
+	srv, ok := service.(*Manager)
+	if !ok {
+		return nil, errors.Errorf("retrieved service is not a valid '%s' service", ServiceName)
+	}
+
+	return srv, nil
+}
+
+// Must retrieves the voter service in the given container or panic otherwise.
+func Must(container *service.Container) *Manager {
+	srv, err := From(container)
+	if err != nil {
+		panic(err)
+	}
+
+	return srv
+}

internal/voter/strategy.go

@@ -0,0 +1,77 @@
+package voter
+
+import "context"
+
+// StrategyUnanimous returns Allow if all voters allow the operations.
+func StrategyUnanimous(ctx context.Context, decisions []Decision) (Decision, error) {
+	allAbstains := true
+
+	for _, d := range decisions {
+		if d == Deny {
+			return Deny, nil
+		}
+
+		if d != Abstain {
+			allAbstains = false
+		}
+	}
+
+	if allAbstains {
+		return Abstain, nil
+	}
+
+	return Allow, nil
+}
+
+// StrategyAffirmative returns Allow if at least one voter allow the operation.
+func StrategyAffirmative(ctx context.Context, decisions []Decision) (Decision, error) {
+	allAbstains := true
+
+	for _, d := range decisions {
+		if d == Allow {
+			return Allow, nil
+		}
+
+		if allAbstains && d != Abstain {
+			allAbstains = false
+		}
+	}
+
+	if allAbstains {
+		return Abstain, nil
+	}
+
+	return Deny, nil
+}
+
+// StrategyConsensus returns Allow if the majority of voters allow the operation.
+func StrategyConsensus(ctx context.Context, decisions []Decision) (Decision, error) {
+	deny := 0
+	allow := 0
+	abstain := 0
+
+	for _, d := range decisions {
+		switch {
+		case d == Allow:
+			allow++
+		case d == Deny:
+			deny++
+		case d == Abstain:
+			abstain++
+		}
+	}
+
+	if abstain > allow && abstain > deny {
+		return Abstain, nil
+	}
+
+	if allow > abstain && allow > deny {
+		return Allow, nil
+	}
+
+	if deny > allow && deny > abstain {
+		return Deny, nil
+	}
+
+	return Abstain, nil
+}

internal/voter/strategy_test.go

@@ -0,0 +1,125 @@
+package voter
+
+import (
+	"context"
+	"testing"
+)
+
+func TestStrategyUnanimous(t *testing.T) {
+	testCases := []struct {
+		Decisions []Decision
+		Expect    Decision
+	}{
+		{
+			Decisions: []Decision{Allow, Allow, Allow},
+			Expect:    Allow,
+		},
+		{
+			Decisions: []Decision{Abstain, Abstain, Abstain},
+			Expect:    Abstain,
+		},
+		{
+			Decisions: []Decision{Deny, Abstain, Abstain},
+			Expect:    Deny,
+		},
+		{
+			Decisions: []Decision{Deny, Allow, Abstain},
+			Expect:    Deny,
+		},
+	}
+
+	for _, tc := range testCases {
+		ctx := context.Background()
+
+		result, err := StrategyUnanimous(ctx, tc.Decisions)
+		if err != nil {
+			t.Error(err)
+		}
+
+		if e, g := tc.Expect, result; e != g {
+			t.Errorf("result: expected '%v', got '%v'", AsString(e), AsString(g))
+		}
+	}
+}
+
+func TestStrategyAffirmative(t *testing.T) {
+	testCases := []struct {
+		Decisions []Decision
+		Expect    Decision
+	}{
+		{
+			Decisions: []Decision{Allow, Allow, Allow},
+			Expect:    Allow,
+		},
+		{
+			Decisions: []Decision{Abstain, Abstain, Abstain},
+			Expect:    Abstain,
+		},
+		{
+			Decisions: []Decision{Deny, Abstain, Abstain},
+			Expect:    Deny,
+		},
+		{
+			Decisions: []Decision{Deny, Allow, Abstain},
+			Expect:    Allow,
+		},
+	}
+
+	for _, tc := range testCases {
+		ctx := context.Background()
+
+		result, err := StrategyAffirmative(ctx, tc.Decisions)
+		if err != nil {
+			t.Error(err)
+		}
+
+		if e, g := tc.Expect, result; e != g {
+			t.Errorf("result: expected '%v', got '%v'", AsString(e), AsString(g))
+		}
+	}
+}
+
+func TestStrategyConsensus(t *testing.T) {
+	testCases := []struct {
+		Decisions []Decision
+		Expect    Decision
+	}{
+		{
+			Decisions: []Decision{Allow, Allow, Allow},
+			Expect:    Allow,
+		},
+		{
+			Decisions: []Decision{Abstain, Abstain, Abstain},
+			Expect:    Abstain,
+		},
+		{
+			Decisions: []Decision{Deny, Allow, Abstain},
+			Expect:    Abstain,
+		},
+		{
+			Decisions: []Decision{Deny, Deny, Allow},
+			Expect:    Deny,
+		},
+		{
+			Decisions: []Decision{Deny, Deny, Allow, Allow},
+			Expect:    Abstain,
+		},
+		{
+			Decisions: []Decision{Deny, Deny, Allow, Allow, Allow},
+			Expect:    Allow,
+		},
+	}
+
+	for _, tc := range testCases {
+		ctx := context.Background()
+
+		result, err := StrategyConsensus(ctx, tc.Decisions)
+		if err != nil {
+			t.Error(err)
+		}
+
+		if e, g := tc.Expect, result; e != g {
+			t.Errorf("result: expected '%v', got '%v'", AsString(e), AsString(g))
+		}
+	}
+}