@antelopejs/dms 0.4.4 → 0.4.5

package/dist/test/unit/client-ip.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/client-ip.test.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const chai_1 = require("chai");
+const client_ip_1 = require("../../routes/auth/client-ip");
+const SOCKET_ADDRESS = "10.0.0.9";
+const CLIENT_ADDRESS = "109.132.199.8";
+const FRONTEND_EGRESS = "195.201.71.66";
+const CDN_EDGE = "104.23.166.64";
+const STAGING_CHAIN = `${CLIENT_ADDRESS},${FRONTEND_EGRESS},${CDN_EDGE}`;
+function authConfig(overrides) {
+    return {
+        jwtSecret: "",
+        emailValidationTokenLifetime: 0,
+        passwordRecoverTokenLifetime: 0,
+        accessTokenLifetime: 0,
+        refreshTokenLifetime: 0,
+        userSensitiveKeys: [],
+        mustValidateEmail: false,
+        ...overrides,
+    };
+}
+describe("[unit] resolveClientIp", () => {
+    it("records the socket peer and ignores the header without trusted proxies", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: SOCKET_ADDRESS, forwardedFor: STAGING_CHAIN }, 0)).to.equal(SOCKET_ADDRESS);
+    });
+    it("walks back one entry per trusted proxy from the right", () => {
+        const source = {
+            socketAddress: SOCKET_ADDRESS,
+            forwardedFor: STAGING_CHAIN,
+        };
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)(source, 1)).to.equal(CDN_EDGE);
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)(source, 2)).to.equal(FRONTEND_EGRESS);
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)(source, 3)).to.equal(CLIENT_ADDRESS);
+    });
+    it("never reaches the entries a client wrote ahead of the trusted ones", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({
+            socketAddress: SOCKET_ADDRESS,
+            forwardedFor: `6.6.6.6, 7.7.7.7, ${CLIENT_ADDRESS}`,
+        }, 1)).to.equal(CLIENT_ADDRESS);
+    });
+    it("yields the leftmost entry of a chain shorter than configured", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: SOCKET_ADDRESS, forwardedFor: CLIENT_ADDRESS }, 3)).to.equal(CLIENT_ADDRESS);
+    });
+    it("falls back to the socket peer without a header", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: SOCKET_ADDRESS, forwardedFor: undefined }, 2)).to.equal(SOCKET_ADDRESS);
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: SOCKET_ADDRESS, forwardedFor: " , " }, 2)).to.equal(SOCKET_ADDRESS);
+    });
+    it("returns an empty string when nothing is known", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: undefined, forwardedFor: undefined }, 1)).to.equal("");
+    });
+    it("keeps IPv6 addresses whole and trims the separators", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: "::1", forwardedFor: " 2001:db8::1 , fd00::2 " }, 2)).to.equal("2001:db8::1");
+    });
+    it("unmaps IPv4-mapped IPv6 addresses", () => {
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: "::ffff:127.0.0.1", forwardedFor: undefined }, 0)).to.equal("127.0.0.1");
+        (0, chai_1.expect)((0, client_ip_1.resolveClientIp)({ socketAddress: "::ffff:abcd", forwardedFor: "" }, 0)).to.equal("::ffff:abcd");
+    });
+});
+describe("[unit] trustedProxyCount", () => {
+    it("trusts no proxy by default", () => {
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({}))).to.equal(0);
+    });
+    it("reads trustedProxies", () => {
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({ trustedProxies: 3 }))).to.equal(3);
+    });
+    it("maps the deprecated oauth.trustProxy to one hop", () => {
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({ oauth: { trustProxy: true } }))).to.equal(1);
+    });
+    it("prefers trustedProxies over oauth.trustProxy", () => {
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({ trustedProxies: 0, oauth: { trustProxy: true } }))).to.equal(0);
+    });
+    it("ignores a value that is not a non-negative integer", () => {
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({ trustedProxies: -1 }))).to.equal(0);
+        (0, chai_1.expect)((0, client_ip_1.trustedProxyCount)(authConfig({ trustedProxies: 1.5 }))).to.equal(0);
+    });
+});
+//# sourceMappingURL=client-ip.test.js.map

package/dist/test/unit/client-ip.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-ip.test.js","sourceRoot":"","sources":["../../../src/test/unit/client-ip.test.ts"],"names":[],"mappings":";;AAAA,+BAA8B;AAE9B,2DAGqC;AAErC,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,cAAc,GAAG,eAAe,CAAC;AACvC,MAAM,eAAe,GAAG,eAAe,CAAC;AACxC,MAAM,QAAQ,GAAG,eAAe,CAAC;AACjC,MAAM,aAAa,GAAG,GAAG,cAAc,IAAI,eAAe,IAAI,QAAQ,EAAE,CAAC;AAEzE,SAAS,UAAU,CAAC,SAA8B;IAChD,OAAO;QACL,SAAS,EAAE,EAAE;QACb,4BAA4B,EAAE,CAAC;QAC/B,4BAA4B,EAAE,CAAC;QAC/B,mBAAmB,EAAE,CAAC;QACtB,oBAAoB,EAAE,CAAC;QACvB,iBAAiB,EAAE,EAAE;QACrB,iBAAiB,EAAE,KAAK;QACxB,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,aAAa,EAAE,EAC9D,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG;YACb,aAAa,EAAE,cAAc;YAC7B,YAAY,EAAE,aAAa;SAC5B,CAAC;QACF,IAAA,aAAM,EAAC,IAAA,2BAAe,EAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtD,IAAA,aAAM,EAAC,IAAA,2BAAe,EAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAA,aAAM,EAAC,IAAA,2BAAe,EAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb;YACE,aAAa,EAAE,cAAc;YAC7B,YAAY,EAAE,qBAAqB,cAAc,EAAE;SACpD,EACD,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,EAC/D,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,EAAE,EAC1D,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC3B,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,EAAE,EACtD,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,IAAA,aAAM,EACJ,IAAA,2BAAe,EAAC,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAC1E,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,yBAAyB,EAAE,EACjE,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,IAAA,aAAM,EACJ,IAAA,2BAAe,EACb,EAAE,aAAa,EAAE,kBAAkB,EAAE,YAAY,EAAE,SAAS,EAAE,EAC9D,CAAC,CACF,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxB,IAAA,aAAM,EACJ,IAAA,2BAAe,EAAC,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CACvE,CAAC,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,IAAA,aAAM,EAAC,IAAA,6BAAiB,EAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,IAAA,aAAM,EAAC,IAAA,6BAAiB,EAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,IAAA,aAAM,EACJ,IAAA,6BAAiB,EAAC,UAAU,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAC/D,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,IAAA,aAAM,EACJ,IAAA,6BAAiB,EACf,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAC/D,CACF,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,IAAA,aAAM,EAAC,IAAA,6BAAiB,EAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAA,aAAM,EAAC,IAAA,6BAAiB,EAAC,UAAU,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/unit/interfaces/dms-base/table-view-tab-count-warning.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/test/unit/interfaces/dms-base/table-view-tab-count-warning.test.js

@@ -0,0 +1,96 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const interface_api_1 = require("@antelopejs/interface-api");
+const interface_data_api_1 = require("@antelopejs/interface-data-api");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const chai_1 = require("chai");
+const constants_1 = require("@antelopejs/interface-dms/constants");
+const table_view_1 = require("@antelopejs/interface-dms/base/table-view");
+const logging_1 = require("../../../helpers/logging");
+const TABLE = "tab-count-warning-rows";
+const MISSING_ROUTE = "count/batch";
+const TABS = [
+    {
+        id: "open",
+        label: "Open",
+        filters: [{ accessorKey: "status", value: "open", mode: "is" }],
+    },
+];
+let Row = class Row extends interface_database_decorators_1.Table {
+};
+Row = __decorate([
+    (0, interface_database_decorators_1.RegisterTable)(TABLE, constants_1.CORE_SCHEMA_NAME)
+], Row);
+let CountOnlyAPI = class CountOnlyAPI extends (0, interface_data_api_1.DataController)(Row, { list: table_view_1.TableViewRoutes.List, count: table_view_1.TableViewRoutes.Count }, (0, interface_api_1.Controller)("/api/tab-count-warning/count-only")) {
+};
+CountOnlyAPI = __decorate([
+    (0, interface_data_api_1.RegisterDataController)()
+], CountOnlyAPI);
+let RepeatedAPI = class RepeatedAPI extends (0, interface_data_api_1.DataController)(Row, { list: table_view_1.TableViewRoutes.List }, (0, interface_api_1.Controller)("/api/tab-count-warning/repeated")) {
+};
+RepeatedAPI = __decorate([
+    (0, interface_data_api_1.RegisterDataController)()
+], RepeatedAPI);
+let BatchAPI = class BatchAPI extends (0, interface_data_api_1.DataController)(Row, { list: table_view_1.TableViewRoutes.List, countBatch: table_view_1.TableViewRoutes.CountBatch }, (0, interface_api_1.Controller)("/api/tab-count-warning/batch")) {
+};
+BatchAPI = __decorate([
+    (0, interface_data_api_1.RegisterDataController)()
+], BatchAPI);
+let RenamedBatchAPI = class RenamedBatchAPI extends (0, interface_data_api_1.DataController)(Row, { list: table_view_1.TableViewRoutes.List, tabCounters: table_view_1.TableViewRoutes.CountBatch }, (0, interface_api_1.Controller)("/api/tab-count-warning/renamed")) {
+};
+RenamedBatchAPI = __decorate([
+    (0, interface_data_api_1.RegisterDataController)()
+], RenamedBatchAPI);
+let NoTabsAPI = class NoTabsAPI extends (0, interface_data_api_1.DataController)(Row, { list: table_view_1.TableViewRoutes.List }, (0, interface_api_1.Controller)("/api/tab-count-warning/no-tabs")) {
+};
+NoTabsAPI = __decorate([
+    (0, interface_data_api_1.RegisterDataController)()
+], NoTabsAPI);
+function countBatchWarnings(register) {
+    const captured = (0, logging_1.captureWarnings)();
+    try {
+        register();
+    }
+    finally {
+        captured.restore();
+    }
+    return captured.messages.filter((message) => message.includes(MISSING_ROUTE));
+}
+describe("[unit] interfaces/dms-base/table-view — filter tabs require countBatch", () => {
+    it("warns when a table with tabs is mounted on a controller without countBatch", () => {
+        const warnings = countBatchWarnings(() => (0, table_view_1.TableView)(CountOnlyAPI, { tabs: TABS, realtime: false }));
+        (0, chai_1.expect)(warnings).to.have.length(1);
+        (0, chai_1.expect)(warnings[0]).to.include("CountOnlyAPI");
+        (0, chai_1.expect)(warnings[0]).to.include("/api/tab-count-warning/count-only");
+        (0, chai_1.expect)(warnings[0]).to.include("TableViewRoutes.CountBatch");
+    });
+    it("warns once per controller however many tables mount it", () => {
+        const warnings = countBatchWarnings(() => {
+            (0, table_view_1.TableView)(RepeatedAPI, { tabs: TABS, realtime: false });
+            (0, table_view_1.TableView)(RepeatedAPI, { tabs: TABS, realtime: false });
+        });
+        (0, chai_1.expect)(warnings).to.have.length(1);
+    });
+    it("stays silent when the controller mounts countBatch", () => {
+        const warnings = countBatchWarnings(() => (0, table_view_1.TableView)(BatchAPI, { tabs: TABS, realtime: false }));
+        (0, chai_1.expect)(warnings).to.be.empty;
+    });
+    it("stays silent when countBatch is mounted under another key", () => {
+        const warnings = countBatchWarnings(() => (0, table_view_1.TableView)(RenamedBatchAPI, { tabs: TABS, realtime: false }));
+        (0, chai_1.expect)(warnings).to.be.empty;
+    });
+    it("stays silent when the table declares no tabs", () => {
+        const warnings = countBatchWarnings(() => {
+            (0, table_view_1.TableView)(NoTabsAPI, { realtime: false });
+            (0, table_view_1.TableView)(NoTabsAPI, { tabs: [], realtime: false });
+        });
+        (0, chai_1.expect)(warnings).to.be.empty;
+    });
+});
+//# sourceMappingURL=table-view-tab-count-warning.test.js.map

package/dist/test/unit/interfaces/dms-base/table-view-tab-count-warning.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"table-view-tab-count-warning.test.js","sourceRoot":"","sources":["../../../../../src/test/unit/interfaces/dms-base/table-view-tab-count-warning.test.ts"],"names":[],"mappings":";;;;;;;;AAAA,6DAAuD;AACvD,uEAGwC;AACxC,6FAGmD;AACnD,+BAA8B;AAC9B,mEAAuE;AACvE,0EAImD;AACnD,sDAA2D;AAE3D,MAAM,KAAK,GAAG,wBAAwB,CAAC;AACvC,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC,MAAM,IAAI,GAAmB;IAC3B;QACE,EAAE,EAAE,MAAM;QACV,KAAK,EAAE,MAAM;QACb,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;KAChE;CACF,CAAC;AAGF,IAAM,GAAG,GAAT,MAAM,GAAI,SAAQ,qCAAK;CAAG,CAAA;AAApB,GAAG;IADR,IAAA,6CAAa,EAAC,KAAK,EAAE,4BAAgB,CAAC;GACjC,GAAG,CAAiB;AAG1B,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,IAAA,mCAAc,EACvC,GAAG,EACH,EAAE,IAAI,EAAE,4BAAe,CAAC,IAAI,EAAE,KAAK,EAAE,4BAAe,CAAC,KAAK,EAAE,EAC5D,IAAA,0BAAU,EAAC,mCAAmC,CAAC,CAChD;CAAG,CAAA;AAJE,YAAY;IADjB,IAAA,2CAAsB,GAAE;GACnB,YAAY,CAId;AAGJ,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,IAAA,mCAAc,EACtC,GAAG,EACH,EAAE,IAAI,EAAE,4BAAe,CAAC,IAAI,EAAE,EAC9B,IAAA,0BAAU,EAAC,iCAAiC,CAAC,CAC9C;CAAG,CAAA;AAJE,WAAW;IADhB,IAAA,2CAAsB,GAAE;GACnB,WAAW,CAIb;AAGJ,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,IAAA,mCAAc,EACnC,GAAG,EACH,EAAE,IAAI,EAAE,4BAAe,CAAC,IAAI,EAAE,UAAU,EAAE,4BAAe,CAAC,UAAU,EAAE,EACtE,IAAA,0BAAU,EAAC,8BAA8B,CAAC,CAC3C;CAAG,CAAA;AAJE,QAAQ;IADb,IAAA,2CAAsB,GAAE;GACnB,QAAQ,CAIV;AAIJ,IAAM,eAAe,GAArB,MAAM,eAAgB,SAAQ,IAAA,mCAAc,EAC1C,GAAG,EACH,EAAE,IAAI,EAAE,4BAAe,CAAC,IAAI,EAAE,WAAW,EAAE,4BAAe,CAAC,UAAU,EAAE,EACvE,IAAA,0BAAU,EAAC,gCAAgC,CAAC,CAC7C;CAAG,CAAA;AAJE,eAAe;IADpB,IAAA,2CAAsB,GAAE;GACnB,eAAe,CAIjB;AAGJ,IAAM,SAAS,GAAf,MAAM,SAAU,SAAQ,IAAA,mCAAc,EACpC,GAAG,EACH,EAAE,IAAI,EAAE,4BAAe,CAAC,IAAI,EAAE,EAC9B,IAAA,0BAAU,EAAC,gCAAgC,CAAC,CAC7C;CAAG,CAAA;AAJE,SAAS;IADd,IAAA,2CAAsB,GAAE;GACnB,SAAS,CAIX;AAEJ,SAAS,kBAAkB,CAAC,QAAoB;IAC9C,MAAM,QAAQ,GAAG,IAAA,yBAAe,GAAE,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,EAAE,CAAC;IACb,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,OAAO,EAAE,CAAC;IACrB,CAAC;IACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,CACvC,IAAA,sBAAS,EAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACzD,CAAC;QACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnC,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC/C,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC;QACpE,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE;YACvC,IAAA,sBAAS,EAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxD,IAAA,sBAAS,EAAC,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,CACvC,IAAA,sBAAS,EAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CACrD,CAAC;QACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE,CACvC,IAAA,sBAAS,EAAC,eAAe,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAC5D,CAAC;QACF,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,EAAE;YACvC,IAAA,sBAAS,EAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,IAAA,sBAAS,EAAC,SAAS,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,IAAA,aAAM,EAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/frontend-vue/layers/dms-auth/app/middleware/auth.ts

@@ -72,8 +72,11 @@ async function isPublicAccessRoute(to: ReturnType<typeof useDmsRoute>) {
 export default defineDmsMiddleware(async (to) => {
   if (to.matched.length === 0) return;
 
-  const error = useError();
-  if (error.value) throw showError(error.value);
+  // An error the page already raised (a failed `validation`, a missing page)
+  // is committed and rendered with its own status. Re-throwing it here would
+  // reject the pending navigation the SSR render awaits, turning that 404 into
+  // a 500 fallback render.
+  if (useError().value) return abortNavigation();
 
   const options = to.meta.auth as MiddlewareMeta | undefined;
   if (!options) return;

package/frontend-vue/layers/dms-core/app/composables/useApiError.ts

@@ -6,12 +6,16 @@ interface Options {
 
 interface ApiError {
   statusCode?: number;
+  status?: number;
   message?: string;
   data?: unknown;
 }
 
-const DEFAULT_TITLE_KEY = "error.500.title";
+const SERVER_ERROR_TITLE_KEY = "error.500.title";
+const CLIENT_ERROR_TITLE_KEY = "error.request_refused.title";
 const FALLBACK_ERROR_KEY = "error.500.description";
+const CLIENT_ERROR_STATUS_MIN = 400;
+const CLIENT_ERROR_STATUS_MAX = 499;
 
 function isApiError(error: unknown): error is ApiError {
   return typeof error === "object" && error !== null;
@@ -32,6 +36,27 @@ function resolveDescription(error: ApiError): string {
   return FALLBACK_ERROR_KEY;
 }
 
+function isClientErrorStatus(status: number | undefined): boolean {
+  return (
+    status !== undefined &&
+    status >= CLIENT_ERROR_STATUS_MIN &&
+    status <= CLIENT_ERROR_STATUS_MAX
+  );
+}
+
+/**
+ * The i18n title key matching a fetch error's HTTP status: a 4xx is a request
+ * the backend refused, anything else (5xx, network failure) a server error.
+ */
+export function resolveApiErrorTitle(error: unknown): string {
+  const status = isApiError(error)
+    ? (error.statusCode ?? error.status)
+    : undefined;
+  return isClientErrorStatus(status)
+    ? CLIENT_ERROR_TITLE_KEY
+    : SERVER_ERROR_TITLE_KEY;
+}
+
 /**
  * Extract the backend's error body from a fetch error — an i18n message key
  * per the API error contract — falling back to the generic 500 key.
@@ -46,7 +71,7 @@ export function useApiError(error: unknown, options?: Options) {
   const { t } = dmsApp.$i18n;
   const translate = (message: string) => resolveApiMessage(t, message);
 
-  const title = options?.title || DEFAULT_TITLE_KEY;
+  const title = options?.title || resolveApiErrorTitle(error);
   const description = options?.description || resolveApiErrorMessage(error);
 
   toast.add({

package/frontend-vue/layers/dms-core/app/utils/menu.ts

@@ -1,4 +1,5 @@
 import type { NavigationMenuItem } from "@nuxt/ui";
+import { parseLinkQuery, stripQueryAndHash } from "./routePath";
 
 // Menu items carry the registered page/category's dot-separated `fullId`
 // (e.g. `pages.erp.orders`) plus the DMS semantic fields; Nuxt UI's
@@ -88,7 +89,9 @@ const matchesRoutePrefix = (currentPath: string, to: string): boolean => {
 const resolveItemTarget = (
   to: NavigationMenuItem["to"],
 ): MenuItemTarget | null => {
-  if (typeof to === "string") return { path: to };
+  if (typeof to === "string") {
+    return { path: stripQueryAndHash(to), query: parseLinkQuery(to) };
+  }
   const target = to as MenuItemTarget | undefined;
   if (target && typeof target.path === "string") {
     return { path: target.path, query: target.query };
@@ -96,9 +99,11 @@ const resolveItemTarget = (
   return null;
 };
 
-// Subset match, mirroring the `exactQuery: "partial"` the entries are built
-// with: the entry's own parameters must be the current ones, while unrelated
-// parameters the page adds (tabs, filters) are ignored.
+const hasQuery = (target: MenuItemTarget | null): boolean =>
+  Object.keys(target?.query ?? {}).length > 0;
+
+// Subset match: the entry's own parameters must be the current ones, while
+// unrelated parameters the page adds (tabs, filters) are ignored.
 const queryMatches = (
   declared: MenuItemTarget["query"],
   currentQuery: Record<string, unknown>,
@@ -133,18 +138,29 @@ export const isMenuItemActive = (
   return matchedFullId !== null && fullId === matchedFullId;
 };
 
-// Only the boolean `true` is set: Nuxt UI forwards an explicit `active` to the
-// underlying link, and a `false` there would suppress the built-in route match.
-// Leaving it undefined preserves that native highlighting for every other item.
+// Only the boolean `true` is set on plain entries: Nuxt UI forwards an explicit
+// `active` to the underlying link, and a `false` there would suppress the
+// built-in route match. Entries carrying a query always get an explicit value,
+// because that built-in match is a URL prefix test that would light up
+// `?project=a` on `?project=ab`.
+const resolveActiveState = (
+  item: NavigationMenuItem,
+  matchedFullId: string | null,
+  currentRoute: MenuRouteState,
+): Partial<Pick<NavigationMenuItem, "active">> => {
+  if (isMenuItemActive(item, matchedFullId, currentRoute)) {
+    return { active: true };
+  }
+  return hasQuery(resolveItemTarget(item.to)) ? { active: false } : {};
+};
+
 export const addActiveStateToMenuItem = (
   item: NavigationMenuItem,
   matchedFullId: string | null,
   currentRoute: MenuRouteState,
 ): NavigationMenuItem => ({
   ...item,
-  ...(isMenuItemActive(item, matchedFullId, currentRoute)
-    ? { active: true }
-    : {}),
+  ...resolveActiveState(item, matchedFullId, currentRoute),
   children: item.children?.map((child) =>
     addActiveStateToMenuItem(child, matchedFullId, currentRoute),
   ),

package/frontend-vue/layers/dms-core/app/utils/routePath.ts

@@ -9,3 +9,26 @@ export function stripQueryAndHash(link: string): string {
   const [path] = link.split(QUERY_OR_HASH);
   return path ?? link;
 }
+
+/**
+ * A link to `path` narrowed by `query`, as the single string every link
+ * renderer accepts: the Inertia-backed `ULink` only takes a string `to`, and
+ * stringifies an object into `[object Object]`.
+ */
+export function buildLinkWithQuery(
+  path: string,
+  query: Record<string, string> | undefined,
+): string {
+  const search = new URLSearchParams(query ?? {}).toString();
+  return search === "" ? path : `${path}?${search}`;
+}
+
+/** The query parameters a link carries, the inverse of `buildLinkWithQuery`. */
+export function parseLinkQuery(link: string): Record<string, string> {
+  const [withoutHash = ""] = link.split("#");
+  const queryStart = withoutHash.indexOf("?");
+  if (queryStart === -1) return {};
+  return Object.fromEntries(
+    new URLSearchParams(withoutHash.slice(queryStart + 1)),
+  );
+}

package/frontend-vue/layers/dms-core/i18n/locales/core-en-GB.json

@@ -37,6 +37,9 @@
       "title": "Server error",
       "description": "An unexpected error occurred. Please try again later."
     },
+    "request_refused": {
+      "title": "Request refused"
+    },
     "recovering": {
       "title": "Restoring your session...",
       "description": "Your session has expired. Refreshing your access and reloading the page."

package/frontend-vue/layers/dms-core/i18n/locales/core-fr-FR.json

@@ -37,6 +37,9 @@
       "title": "Erreur serveur",
       "description": "Une erreur inattendue s'est produite. Veuillez réessayer plus tard."
     },
+    "request_refused": {
+      "title": "Requête refusée"
+    },
     "recovering": {
       "title": "Restauration de votre session...",
       "description": "Votre session a expiré. Renouvellement de l'accès et rechargement de la page."

package/frontend-vue/layers/dms-core/shared/types/runtime-config.d.ts

@@ -43,7 +43,10 @@ interface DmsPrivateConfig {
     relaySecret: string;
     /**
      * Whether a trusted reverse proxy sits immediately in front and appends
-     * to `x-forwarded-for`; drives the OAuth rate-limit client key.
+     * to `x-forwarded-for`.
+     *
+     * @deprecated Mirrors the deprecated `auth.oauth.trustProxy`. The frontend
+     * server keys its OAuth rate limit on its own `DMS_TRUSTED_PROXY_HOPS`.
      */
     trustProxy?: boolean;
   };

package/frontend-vue/layers/dms-layout/app/app.config.ts

@@ -134,7 +134,15 @@ export default {
     button: {
       slots: {
         // Tactile press + full transition (design .btn active:scale(.97)).
-        base: "transition active:scale-[0.98]",
+        // Nuxt UI only fades a disabled button to 75%, which still reads as
+        // enabled on a filled primary: fade it further and drop the press and
+        // the inset highlight so every variant looks inert.
+        base: [
+          "transition active:scale-[0.98]",
+          "disabled:opacity-50 aria-disabled:opacity-50",
+          "disabled:active:scale-100 aria-disabled:active:scale-100",
+          "disabled:shadow-none aria-disabled:shadow-none",
+        ].join(" "),
       },
       compoundVariants: [
         // Inset top highlight on the solid primary fill (design .btn-primary).

package/frontend-vue/layers/dms-layout/app/components/navigation/CollapsedMenuItem.vue

@@ -82,11 +82,6 @@ function onLinkHover(): void {
   const { to } = props.item;
   if (typeof to === "string") {
     prefetchPageLayout(stripQueryAndHash(to));
-    return;
-  }
-  const path = (to as MenuItemTarget | undefined)?.path;
-  if (path) {
-    prefetchPageLayout(path);
   }
 }
 </script>

package/frontend-vue/layers/dms-layout/app/components/profile/ProfileLanguage.vue

@@ -1,8 +1,7 @@
 <script setup lang="ts">
-const { locale, setLocale } = useI18n();
+const { locale } = useI18n();
 const { uniqueLocales } = useUniqueLocales();
-const { $authFetch } = useAuthFetch();
-const { user, fetch: refreshUser } = useUserSession();
+const { changeLanguage } = useUserLanguage();
 
 const languageOptions = computed(() =>
   uniqueLocales.value.map((lang) => ({
@@ -10,25 +9,6 @@ const languageOptions = computed(() =>
     value: lang.code,
   })),
 );
-
-const handleLanguageChange = async (newLanguage: "en" | "fr") => {
-  setLocale(newLanguage);
-
-  try {
-    await $authFetch("/settings/user/profile", {
-      method: "POST",
-      body: {
-        name: user.value?.name,
-        email: user.value?.email,
-        language: newLanguage,
-      },
-    });
-
-    await refreshUser();
-  } catch {
-    /* ignore — silently skip the update on network / backend errors */
-  }
-};
 </script>
 
 <template>
@@ -62,7 +42,7 @@ const handleLanguageChange = async (newLanguage: "en" | "fr") => {
             class="w-full"
             :items="languageOptions"
             :model-value="locale"
-            @update:model-value="handleLanguageChange"
+            @update:model-value="changeLanguage"
           />
         </div>
       </section>

package/frontend-vue/layers/dms-layout/app/composables/profile/useUserLanguage.ts

@@ -0,0 +1,33 @@
+const PROFILE_ENDPOINT = "/settings/user/profile";
+
+/**
+ * Switches the interface language and stores it on the user's profile, so the
+ * `language-sync` plugin re-applies it on the next load instead of reverting
+ * to the previously stored language. Every language switcher goes through it.
+ */
+export function useUserLanguage() {
+  const dmsApp = useDmsApp();
+  const { $authFetch } = useAuthFetch();
+  const { user, fetch: refreshUser } = useUserSession();
+
+  async function changeLanguage(language: string): Promise<void> {
+    await dmsApp.$i18n.setLocale(language);
+
+    try {
+      await $authFetch(PROFILE_ENDPOINT, {
+        method: "POST",
+        body: {
+          name: user.value?.name,
+          email: user.value?.email,
+          language,
+        },
+      });
+
+      await refreshUser();
+    } catch {
+      /* ignore — silently skip the update on network / backend errors */
+    }
+  }
+
+  return { changeLanguage };
+}

package/frontend-vue/layers/dms-layout/app/plugins/command-palette-session.client.ts

@@ -34,6 +34,7 @@ export default defineDmsPlugin(() => {
   const { i18n, translate } = getPluginI18n();
   const toast = useToast();
   const { logout } = useLogout();
+  const { changeLanguage } = useUserLanguage();
   const { copy } = useClipboard({ legacy: true });
 
   const localeItems = (): CommandPaletteItem[] =>
@@ -41,7 +42,7 @@ export default defineDmsPlugin(() => {
       label: locale.name ?? locale.code,
       active: i18n.locale.value === locale.code,
       onSelect: () => {
-        void i18n.setLocale(locale.code);
+        void changeLanguage(locale.code);
       },
     }));
 

package/frontend-vue/layers/dms-ui/app/build/composables/data-types/registerDefaults.ts

@@ -1,8 +1,10 @@
 import { defineAsyncComponent, type VNode } from "vue";
 import type { DataType } from "#dms-core/app/composables/data-types/useDataType";
 import UAvatar from "@nuxt/ui/components/Avatar.vue";
+import UBadge from "@nuxt/ui/components/Badge.vue";
 import UIcon from "@nuxt/ui/runtime/vue/components/Icon.vue";
 import ULink from "@nuxt/ui/components/Link.vue";
+import { buildRelationBadges } from "./relationBadges";
 
 const FilePreview = defineAsyncComponent(
   () => import("../../../components/table-view/FilePreview.vue"),
@@ -37,6 +39,9 @@ const LINK_CLASS =
 const LINK_ICON_CLASS = "size-3 text-primary/70 flex-shrink-0";
 const LINK_ICON_NAME = "i-ph-arrow-up-right-light";
 const DEFAULT_RELATION_VALUE_KEY = "_id";
+const DEFAULT_RELATION_LABEL_KEY = "name";
+const RELATION_BADGES_CLASS = "inline-flex flex-wrap items-center gap-1";
+const RELATION_BADGE_CLASS = "max-w-40";
 const PERMISSION_SEPARATOR = ".";
 
 interface LinkRendererOptions {
@@ -263,18 +268,41 @@ function countLeafPermissions(value: string[]): number {
   return value.filter((id) => !parentIds.has(id)).length;
 }
 
+function renderRelationBadge(label: string, title?: string) {
+  return h(UBadge, {
+    label,
+    title: title ?? label,
+    color: "neutral",
+    variant: "subtle",
+    size: Size.small,
+    class: RELATION_BADGE_CLASS,
+  });
+}
+
+function renderRelationBadges(values: unknown[], labelKey: string) {
+  const { processI18n } = useTranslation();
+  const { visible, hidden } = buildRelationBadges(values, labelKey);
+  const badges = visible.map((label) =>
+    renderRelationBadge(processI18n(label)),
+  );
+  if (hidden.length > 0) {
+    const hiddenLabels = hidden.map((label) => processI18n(label)).join(", ");
+    badges.push(renderRelationBadge(`+${hidden.length}`, hiddenLabels));
+  }
+  return h("span", { class: RELATION_BADGES_CLASS }, badges);
+}
+
 function renderRelation(value: unknown, options: unknown) {
-  const { t } = useI18n();
   const opts = options as RelationOptions | undefined;
+  const labelKey = opts?.keyMapping?.label || DEFAULT_RELATION_LABEL_KEY;
 
   if (opts?.multiple && Array.isArray(value)) {
-    return t("dms.form.relation.selected_count", { count: value.length });
+    return renderRelationBadges(value, labelKey);
   }
 
   if (!value || !isObject(value)) return value;
 
   const valueObject = value as Record<string, string>;
-  const labelKey = opts?.keyMapping?.label || "name";
   const avatarKey = opts?.keyMapping?.avatar;
   const label = valueObject[labelKey] || String(value);
 

package/frontend-vue/layers/dms-ui/app/build/composables/data-types/relationBadges.ts

@@ -0,0 +1,36 @@
+/** How many labels a multi-value relation cell shows before collapsing. */
+export const MAX_RELATION_BADGES = 3;
+
+/** The labels a multi-value cell shows, and how many it folds into `+N`. */
+export interface RelationBadges {
+  visible: string[];
+  hidden: string[];
+}
+
+function readRelationLabel(item: unknown, labelKey: string): string {
+  if (typeof item === "object" && item !== null) {
+    const label = (item as Record<string, unknown>)[labelKey];
+    return label === undefined || label === null ? "" : String(label);
+  }
+  return item === undefined || item === null ? "" : String(item);
+}
+
+/**
+ * Split a multi-value relation into the labels rendered as badges and the ones
+ * folded into a trailing `+N`. List rows carry the related rows resolved by the
+ * relation join, so each item is read through the `label` key mapping; a raw id
+ * (join skipped) is shown as is rather than dropped.
+ */
+export function buildRelationBadges(
+  values: unknown[],
+  labelKey: string,
+  maxVisible = MAX_RELATION_BADGES,
+): RelationBadges {
+  const labels = values
+    .map((item) => readRelationLabel(item, labelKey))
+    .filter((label) => label !== "");
+  return {
+    visible: labels.slice(0, maxVisible),
+    hidden: labels.slice(maxVisible),
+  };
+}