@adminiumjs/manifest 0.3.7 → 0.3.9

package/dist/public-access.js

@@ -34,6 +34,31 @@ import { momentIssues, momentOffsetSchema, plainMomentSchema, wallTimeSchema } f
 import { conditionIssues, linkedConditionSchema, reachedOnlyByUndo, stateConditionSchema } from './states.js';
 /** The key every entry uses unless it names another. */
 export const CUSTOMER_KEY = 'customer';
+/** The longest a plain-text value may be unless its column says longer: a name. */
+export const PLAIN_TEXT_MAX = 80;
+/** The most digits a plain-text column may take in all: "table 12", "2 without onions", never a phone number. */
+export const PLAIN_TEXT_DIGITS_MOST = 4;
+/** The longest a plain-text column may say it runs: a note to the kitchen. */
+export const PLAIN_TEXT_LONGEST = 200;
+/**
+ * A column held to plain text: its ref (a name: no digits, 80 characters), or
+ * its ref with the digits it may hold in all and how long it may run (a note).
+ */
+const plainTextColumnSchema = z.union([
+    refSchema,
+    z
+        .object({
+        column: refSchema,
+        digits: z.number().int().min(1).max(PLAIN_TEXT_DIGITS_MOST).optional(),
+        max: z.number().int().min(1).max(PLAIN_TEXT_LONGEST).optional(),
+    })
+        .strict(),
+]);
+const plainTextSchema = z.array(plainTextColumnSchema).min(1).max(8);
+/** The column a plain-text entry names. */
+export const plainTextRef = (entry) => (typeof entry === 'string' ? entry : entry.column);
+/** The longest a plain-text entry takes. */
+export const plainTextMax = (entry) => (typeof entry === 'string' ? PLAIN_TEXT_MAX : (entry.max ?? PLAIN_TEXT_MAX));
 const keyNameSchema = z.string().regex(/^[a-z][a-z0-9-]{0,31}$/, 'a key name is kebab-case');
 const valueFilterSchema = z
     .object({
@@ -323,7 +348,7 @@ const childEntryShape = {
     agrees: z.array(agreeSchema).min(1).max(8).optional(),
     counts: z.array(countsSchema).min(1).max(2).optional(),
     /** Columns that hold plain text only (no links), as on a create nobody signed in for. */
-    plainText: z.array(refSchema).min(1).max(8).optional(),
+    plainText: plainTextSchema.optional(),
     /** The most a column may add up to across the rows of one write (a dozen items to an order). */
     sumMax: sumMaxSchema.optional(),
 };
@@ -499,7 +524,7 @@ export const publicAccessSchema = z
          * visitor is held to on any key, only fewer.
          */
         perIpHour: z.number().int().min(1).max(60).optional(),
-        plainText: z.array(refSchema).min(1).max(8).optional(),
+        plainText: plainTextSchema.optional(),
     })
         .strict()
         .optional(),
@@ -512,7 +537,7 @@ export const publicAccessSchema = z
     limits: z
         .object({
         perValue: z.object({ columns: z.array(refSchema).min(1).max(4), n: z.number().int().min(1).max(20) }).strict().optional(),
-        plainText: z.array(refSchema).min(1).max(8).optional(),
+        plainText: plainTextSchema.optional(),
     })
         .strict()
         .refine((l) => l.perValue !== undefined || l.plainText !== undefined, { message: 'limits name a per-value cap, plain-text columns, or both' })
@@ -590,11 +615,22 @@ export const publicKeySchema = z
      */
     requiresStaff: z.object({ role: z.string().regex(/^[a-z][a-z0-9-]*$/, 'a role key') }).strict().optional(),
     enabledBy: settingRefSchema.optional(),
+    /**
+     * The key's budget a minute when its app meets its peak (a show going on
+     * sale): from Adminium's own (3,000 reads, 300 writes) up to five times
+     * that. Each visitor still gets a twelfth of it. Read at install.
+     */
+    peak: z
+        .object({ reads: z.number().int().min(3000).max(15_000), writes: z.number().int().min(300).max(1500) })
+        .strict()
+        .optional(),
 })
     .strict();
 export const publicKeysSchema = z
     .record(keyNameSchema, publicKeySchema)
-    .refine((keys) => !(CUSTOMER_KEY in keys), { message: '"customer" is the app\'s own key and is not declared here' });
+    .refine((keys) => !(CUSTOMER_KEY in keys) || Object.keys(keys[CUSTOMER_KEY] ?? {}).every((field) => field === 'peak'), {
+    message: '"customer" is the app\'s own key: only its peak is said here',
+});
 /**
  * The own links of the rows a person of `identityTable` holds: each table a
  * token claims with `own: true`, by its code column, and the columns of it
@@ -667,6 +703,9 @@ export function publicAccessIssues(entries, ctx) {
     const has = index.has;
     for (const [name, key] of Object.entries(ctx.publicKeys ?? {})) {
         const at = ['publicKeys', name];
+        // The app's own key, named only for its peak: nothing more to check.
+        if (name === CUSTOMER_KEY)
+            continue;
         if (key.requiresStaff === undefined) {
             // No one signs this key in: it may only open one row by its token, and read.
             const identity = entries.find((entry) => (entry.key ?? CUSTOMER_KEY) === name && entry.claim !== undefined);
@@ -1161,7 +1200,7 @@ export function publicAccessIssues(entries, ctx) {
             const caps = entry.anonymous;
             if (!creates)
                 out.push({ path: at('anonymous'), message: 'anonymous limits a create' });
-            for (const [name, columns] of [['perValue', caps.perValue?.columns ?? []], ['plainText', caps.plainText ?? []]]) {
+            for (const [name, columns] of [['perValue', caps.perValue?.columns ?? []], ['plainText', (caps.plainText ?? []).map(plainTextRef)]]) {
                 for (const ref of columns) {
                     const found = column(ref);
                     if (found === undefined)
@@ -1175,7 +1214,7 @@ export function publicAccessIssues(entries, ctx) {
             const limits = entry.limits;
             if (!patches)
                 out.push({ path: at('limits'), message: 'limits apply to a change (PATCH); a create has anonymous' });
-            for (const [name, columns] of [['perValue', limits.perValue?.columns ?? []], ['plainText', limits.plainText ?? []]]) {
+            for (const [name, columns] of [['perValue', limits.perValue?.columns ?? []], ['plainText', (limits.plainText ?? []).map(plainTextRef)]]) {
                 for (const ref of columns) {
                     const found = column(ref);
                     if (found === undefined)
@@ -1709,7 +1748,7 @@ function treeIssues(entries, ctx, identities, shareCodes) {
                     ['writable', child.writable],
                     ['select', child.select ?? []],
                     ['requires', child.requires ?? []],
-                    ['plainText', child.plainText ?? []],
+                    ['plainText', (child.plainText ?? []).map(plainTextRef)],
                     ['defaults', Object.keys(child.defaults ?? {})],
                     ['writableValues', Object.keys(child.writableValues ?? {})],
                     ['position', child.position === undefined ? [] : [child.position]],
@@ -1745,7 +1784,7 @@ function treeIssues(entries, ctx, identities, shareCodes) {
                                 out.push({ path: here('writableValues', ref), message: `${JSON.stringify(value)} is not a value of "${name}.${ref}"` });
                         }
                 }
-                for (const ref of child.plainText ?? []) {
+                for (const ref of (child.plainText ?? []).map(plainTextRef)) {
                     const column = index.column(name, ref);
                     if (column !== undefined && column.type !== 'text')
                         out.push({ path: here('plainText'), message: `"${name}.${ref}" is not a text column` });
@@ -2309,4 +2348,40 @@ function ownAddressAndWithholdIssues(entries, ctx, identities) {
     });
     return out;
 }
+/**
+ * Advice about a plain-text column that holds more than its plain text takes:
+ * a guest who types to the column's `maxLength` is refused at the end of the
+ * form ("orders.note" holds 140, its plain text takes 80).
+ */
+export function plainTextLengthWarnings(publicAccess, tables) {
+    const out = [];
+    const check = (table, list, path) => {
+        (list ?? []).forEach((entry, k) => {
+            const ref = plainTextRef(entry);
+            const holds = tables.find((t) => t.ref === table)?.columns.find((c) => c.ref === ref)?.maxLength;
+            const takes = plainTextMax(entry);
+            if (holds === undefined || holds <= takes)
+                return;
+            out.push({
+                path: `${path}.${String(k)}`,
+                message: `"${table}.${ref}" holds ${String(holds)} characters but its plain text takes ${String(takes)}, so a guest who types more is refused: ` +
+                    `lower its maxLength to ${String(takes)}, or give it { "column": "${ref}", "max": ${String(Math.min(holds, PLAIN_TEXT_LONGEST))} }` +
+                    (holds > PLAIN_TEXT_LONGEST ? ` and a maxLength of ${String(PLAIN_TEXT_LONGEST)}` : ''),
+            });
+        });
+    };
+    const walk = (children, base) => {
+        for (const [name, child] of Object.entries(children ?? {})) {
+            check(name, child.plainText, `${base}.children.${name}.plainText`);
+            walk(child.children, `${base}.children.${name}`);
+        }
+    };
+    publicAccess.forEach((entry, e) => {
+        const base = `publicAccess.${String(e)}`;
+        check(entry.table, entry.anonymous?.plainText, `${base}.anonymous.plainText`);
+        check(entry.table, entry.limits?.plainText, `${base}.limits.plainText`);
+        walk(entry.children, base);
+    });
+    return out;
+}
 //# sourceMappingURL=public-access.js.map