@aotter/mantle-cloudflare 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/mount/mountServerEndpoints.js

@@ -1,11 +1,9 @@
-import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, meetsRole, redactForWire, runtimeDiagnostic, checkSchemaListFilter, schemaSortableFields, } from "@aotter/mantle-spec";
+import { DiagnosticError, HTTP_STATUS_BY_CODE, MANTLE_REF_KEYWORD, MCP_HINT_KEYWORD, VIEW_PARAMS_RESERVED, isMediaMcpHint, meetsRole, redactForWire, runtimeDiagnostic, checkSchemaAdminUi, checkViewAdminUi, schemaSortableFields, } from "@aotter/mantle-spec";
 import { ViewParamCoercionError, coerceViewParams, compilePathMatcher, evaluateAuthAll, } from "@aotter/mantle-runtime";
-import { indexHtml } from "@aotter/mantle-admin-ui";
 import { resolveCaller } from "./resolveCaller.js";
 import { runMantleUseCase } from "./runMantleUseCase.js";
 import { decodeMemberCursor, STAFF_ROLE_SET, } from "../auth/createAuth.js";
 import { rejectCrossOriginMutation } from "../auth/rejectCrossOriginMutation.js";
-import { AOTTER_FAVICON_SVG } from "../assets/aotterFavicon.js";
 const [PAGE_PARAM, SHOW_PARAM] = VIEW_PARAMS_RESERVED;
 /** Mount HTTP Triggers + Views + the Better Auth admin surface.
  *  HTTP Triggers resolve configured credentials and sessions through
@@ -35,7 +33,7 @@ export function mountServerEndpoints(app, ref) {
         // register under the guarded `/admin/api/views/<name>` route
         // inside `mountAdminBetterAuth` (which owns the staff gate).
         // Public (default) Views keep the public REST surface.
-        if (v.spec.surface === "staff")
+        if (v.spec.surface !== "public")
             continue;
         const viewName = v.metadata.name;
         app.get(`/api/views/${viewName}`, async (c) => {
@@ -48,15 +46,11 @@ export function mountServerEndpoints(app, ref) {
 }
 function mountAdminBetterAuth(app, ref, auth) {
     const authBasePath = auth.basePath;
-    const spa = () => new Response(indexHtml, {
-        headers: { "content-type": "text/html; charset=utf-8" },
-    });
-    app.get("/favicon.svg", () => new Response(AOTTER_FAVICON_SVG, {
-        headers: {
-            "content-type": "image/svg+xml; charset=utf-8",
-            "cache-control": "public, max-age=86400",
-        },
-    }));
+    const spa = async (c) => {
+        const runtime = await ref.get();
+        const asset = await runtime.assets.fetch(new Request(new URL("/_mantle/admin/index.html", c.req.url)));
+        return asset ?? new Response("Mantle Admin assets are missing; run `mantle generate` and configure the ASSETS binding.", { status: 503, headers: { "cache-control": "private, no-store" } });
+    };
     // Public read-only manifest of registered sign-in methods. The admin
     // SPA hits this on sign-in-page mount so it can render per-method
     // sections without baking the method list into its build. No secrets
@@ -103,6 +97,23 @@ function mountAdminBetterAuth(app, ref, auth) {
     // need to repeat per request.
     const schemas = ref.manifests.filter((m) => m.kind === "Schema");
     const schemasByName = new Map(schemas.map((s) => [s.metadata.name, s]));
+    const assertMutableSchema = (path, schema) => {
+        if (schema?.spec.schema.readOnly !== true)
+            return;
+        throw new DiagnosticError(runtimeDiagnostic({
+            code: "CONFLICT",
+            severity: "error",
+            path,
+            value: schema.metadata.name,
+            expected: "a Schema without root readOnly: true",
+            message: `Schema '${schema.metadata.name}' is read-only on generic authoring surfaces; use its declared Procedures.`,
+        }));
+    };
+    const readMutableEntry = async (runtime, id, path) => {
+        const entry = await runtime.getEntry.execute({ id });
+        assertMutableSchema(path, schemasByName.get(entry.collection));
+        return entry;
+    };
     const collections = schemas
         .filter((s) => !s.spec.translates)
         .map((s) => adminEditorCollection(s, schemas));
@@ -124,7 +135,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     // "precompute at mount from ref.manifests, list on GET") and needs
     // no changes to the `SiteInfo` type or its query key.
     // Report-sidebar source (#433): ONLY `surface: staff` Views. Public
-    // storefront Views (default surface) auto-mount on the public REST
+    // storefront Views explicitly marked public auto-mount on the public REST
     // path and must not appear in the admin report sidebar — listing
     // them was noise + broke on param-driven storefront Views (see #433).
     const staffViews = ref.manifests
@@ -132,9 +143,10 @@ function mountAdminBetterAuth(app, ref, auth) {
     const viewsManifest = staffViews.map((v) => ({
         name: v.metadata.name,
         title: v.spec.title ?? null,
-        from: v.spec.from,
+        from: v.spec.from ?? null,
         params: v.spec.params ?? null,
         fields: v.spec.fields ?? null,
+        list: checkViewAdminUi(v).list,
     }));
     const guarded = (method, path, body) => {
         app.on(method.toUpperCase(), path, async (c) => {
@@ -296,6 +308,11 @@ function mountAdminBetterAuth(app, ref, auth) {
             const waitUntil = readWaitUntil(c);
             return handleViewRequest(c.req.raw, runtime, viewName, ref, c.env, waitUntil, "/admin/api/views");
         });
+        guarded("get", `/admin/api/views/${viewName}/export`, async (c) => {
+            const runtime = await ref.get();
+            const waitUntil = readWaitUntil(c);
+            return handleViewRequest(c.req.raw, runtime, viewName, ref, c.env, waitUntil, "/admin/api/views", true);
+        });
     }
     guarded("get", "/admin/api/operations", (c, gate) => Response.json({
         operations: operations.filter((op) => evaluateAuthAll(op.procedure.spec.requires, adminHandlerContext(c, gate), `GET /admin/api/operations/${op.name}`, "runtime") === null).map((op) => ({
@@ -303,6 +320,7 @@ function mountAdminBetterAuth(app, ref, auth) {
             title: op.title,
             description: op.description,
             input: op.input,
+            uiSchema: op.uiSchema,
             triggers: op.triggers,
             rowBindings: op.rowBindings,
         })),
@@ -480,25 +498,49 @@ function mountAdminBetterAuth(app, ref, auth) {
             }, { status: 404 });
         }
         const runtime = await ref.get();
+        const statusQuery = c.req.query("status");
+        const filterField = c.req.query("filter_field");
+        const filterValue = c.req.query("filter_value");
+        if (Boolean(filterField) !== Boolean(filterValue)) {
+            return Response.json({
+                ok: false,
+                diagnostic: runtimeDiagnostic({
+                    code: "INPUT_VALIDATION_FAILED",
+                    severity: "error",
+                    path: "GET /admin/api/entries/export",
+                    expected: "filter_field and filter_value together",
+                    message: "List filters require both `filter_field` and `filter_value`.",
+                }),
+            }, { status: 400 });
+        }
+        const listOptions = {
+            collection,
+            status: statusQuery && statusQuery !== "all" ? statusQuery : undefined,
+            search: c.req.query("search") || undefined,
+            filter: filterField && filterValue ? { field: filterField, value: filterValue } : undefined,
+            sort: {
+                field: c.req.query("sort") || "updatedAt",
+                direction: c.req.query("direction") === "asc" ? "asc" : "desc",
+            },
+        };
         const propertyNames = Object.keys(schema.spec.schema.properties ?? {});
         const columns = ["id", "status", "version", "updated_at", ...propertyNames];
-        const lines = [csvRow(columns)];
-        let cursor;
-        do {
-            const page = await runtime.listEntries.executePage({ collection, cursor });
-            for (const row of page.rows) {
-                lines.push(csvRow(columns.map((column) => csvValue(column, row, propertyNames))));
+        let page = await runtime.listEntries.executePage({ ...listOptions, limit: 100 });
+        async function* chunks() {
+            while (true) {
+                if (page.rows.length > 0) {
+                    yield page.rows.map((row) => csvRow(columns.map((column) => csvValue(column, row, propertyNames)))).join("\r\n") + "\r\n";
+                }
+                if (!page.nextCursor)
+                    return;
+                page = await runtime.listEntries.executePage({
+                    ...listOptions,
+                    limit: 100,
+                    cursor: page.nextCursor,
+                });
             }
-            cursor = page.nextCursor;
-        } while (cursor);
-        const csv = "" + lines.join("\r\n") + "\r\n";
-        return new Response(csv, {
-            status: 200,
-            headers: {
-                "content-type": "text/csv; charset=utf-8",
-                "content-disposition": `attachment; filename="${collection}.csv"`,
-            },
-        });
+        }
+        return csvDownloadResponse(collection, columns, chunks());
     });
     guarded("get", "/admin/api/entries/:id", async (c) => runMantleUseCase(`GET /admin/api/entries/${c.req.param("id")}`, async () => {
         const runtime = await ref.get();
@@ -518,6 +560,7 @@ function mountAdminBetterAuth(app, ref, auth) {
                 message: "A non-empty `collection` is required.",
             }));
         }
+        assertMutableSchema("POST /admin/api/entries", schemasByName.get(body.collection));
         if (gate.role === "contributor" &&
             (schemasByName.get(body.collection)?.spec.lifecycle ?? "publishing") === "operational") {
             throw new DiagnosticError(adminRoleDiagnostic("POST /admin/api/entries", "editor", "Contributors can create drafts, not operational records."));
@@ -534,8 +577,8 @@ function mountAdminBetterAuth(app, ref, auth) {
     guarded("patch", "/admin/api/entries/:id", async (c, gate) => runMantleUseCase(`PATCH /admin/api/entries/${c.req.param("id")}`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
+        const current = await readMutableEntry(runtime, id, `PATCH /admin/api/entries/${id}`);
         if (gate.role === "contributor") {
-            const current = await runtime.getEntry.execute({ id });
             const lifecycle = schemasByName.get(current.collection)?.spec.lifecycle ?? "publishing";
             if (lifecycle === "operational" || current.status !== "draft") {
                 throw new DiagnosticError(adminRoleDiagnostic(`PATCH /admin/api/entries/${id}`, "editor", "Contributors can edit drafts only."));
@@ -554,6 +597,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     roleGuarded("post", "/admin/api/entries/:id/publish", "editor", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/publish`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
+        await readMutableEntry(runtime, id, `POST /admin/api/entries/${id}/publish`);
         const body = await c.req.raw.json().catch(() => ({}));
         const row = await runtime.requestPublish.execute({
             id,
@@ -565,6 +609,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     roleGuarded("post", "/admin/api/entries/:id/unpublish", "editor", async (c, gate) => runMantleUseCase(`POST /admin/api/entries/${c.req.param("id")}/unpublish`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
+        await readMutableEntry(runtime, id, `POST /admin/api/entries/${id}/unpublish`);
         const body = await c.req.raw.json().catch(() => ({}));
         const row = await runtime.unpublish.execute({
             id,
@@ -576,6 +621,7 @@ function mountAdminBetterAuth(app, ref, auth) {
     roleGuarded("delete", "/admin/api/entries/:id", "editor", async (c, gate) => runMantleUseCase(`DELETE /admin/api/entries/${c.req.param("id")}`, async () => {
         const runtime = await ref.get();
         const id = c.req.param("id");
+        await readMutableEntry(runtime, id, `DELETE /admin/api/entries/${id}`);
         const body = await c.req.raw.json().catch(() => ({}));
         return runtime.deleteEntry.execute({
             id,
@@ -805,6 +851,7 @@ function discoverStaffOperations(manifests, schemasByName) {
             title: procedure.spec.title ?? null,
             description: procedure.spec.description ?? null,
             input: procedure.spec.input,
+            uiSchema: procedure.spec.uiSchema ?? null,
             triggers: [...kinds],
             rowBindings: discoverRowBindings(procedure, schemasByName),
             procedure,
@@ -895,9 +942,7 @@ function adminEntryTitle(data, schema) {
     const key = titleFieldKey(data, schema);
     return key ? data[key] : null;
 }
-/** Which data key `adminEntryTitle` would read, or `null` if none
- *  matched. Split out from `adminEntryTitle` so `adminDataPreview` can
- *  skip the same property instead of repeating it in a data column. */
+/** Which data key publishing-list `adminEntryTitle` reads. */
 function titleFieldKey(data, schema) {
     if (typeof data.title === "string" && data.title)
         return "title";
@@ -921,33 +966,13 @@ function titleFieldKey(data, schema) {
     }
     return null;
 }
-/** Schema property names that collide in MEANING with a system column
- *  the admin list already renders unconditionally (the "updated"
- *  column reads the reserved `updatedAt` storage column, formatted as
- *  `row.updated_at`). A schema-declared `required` property with one
- *  of these exact names would otherwise show up a SECOND time as a
- *  raw data-preview column — same value, no title-cased header — right
- *  next to the system column (#443). NAME-based only, on purpose: no
- *  fuzzy/semantic matching, just these two well-known reserved names. */
-const DATA_PREVIEW_SYSTEM_COLUMN_NAMES = new Set(["updatedAt", "createdAt"]);
-/** Operational collections have no title/status
- *  workflow worth a dedicated column — instead the admin list shows up
- *  to 3 raw data columns. Mirrors the client-side column-picking rule
- *  in `collection-view.tsx`: first 3 `required` properties, skipping
- *  the schema-stable title field and the system-column-name collisions
- *  above (#443). Kept small on the wire on purpose — this is a
- *  preview, not the full entry. */
+/** Operational previews contain exactly the manifest-declared list
+ *  fields. Undeclared lists stay metadata-only. */
 function adminDataPreview(data, manifest) {
     if (!manifest || manifest.spec.lifecycle !== "operational")
         return undefined;
-    const schema = manifest.spec.schema;
-    // Schema-stable skip (not per-row): rows with a blank title field
-    // must still produce the same columns as every other row, or the
-    // client's fixed headers drift out of sync with the values.
-    const titleKey = schemaTitleKey(schema);
-    const fields = (schema.required ?? [])
-        .filter((key) => key !== titleKey && !DATA_PREVIEW_SYSTEM_COLUMN_NAMES.has(key))
-        .slice(0, 3);
+    const list = checkSchemaAdminUi(manifest).list;
+    const fields = [...(list.primaryField ? [list.primaryField] : []), ...list.columns];
     if (fields.length === 0)
         return undefined;
     const preview = {};
@@ -955,23 +980,6 @@ function adminDataPreview(data, manifest) {
         preview[key] = data[key];
     return preview;
 }
-/** The property a row's title comes from, derived from the SCHEMA
- *  alone (no row data): literal `title`/`name`/`slug` when declared,
- *  else the first required string-typed property. Stable across all
- *  rows of a collection, so preview columns never vary per row. */
-function schemaTitleKey(schema) {
-    const properties = schema.properties ?? {};
-    for (const key of ["title", "name", "slug"]) {
-        if (key in properties)
-            return key;
-    }
-    for (const key of schema.required ?? []) {
-        const fieldSchema = properties[key];
-        if (fieldSchema && isStringTypedSchema(fieldSchema))
-            return key;
-    }
-    return null;
-}
 function isStringTypedSchema(schema) {
     const rawType = schema.type;
     const types = Array.isArray(rawType) ? rawType : rawType ? [rawType] : [];
@@ -985,7 +993,9 @@ function adminListItem(row, schemasByName, translationLocales = []) {
         locale: row.locale ?? null,
         status: row.status,
         version: row.version,
-        title: adminEntryTitle(row.data, manifest?.spec.schema),
+        title: manifest?.spec.lifecycle === "operational"
+            ? null
+            : adminEntryTitle(row.data, manifest?.spec.schema),
         updated_at: row.updatedAt,
         translation_locales: translationLocales,
         data_preview: adminDataPreview(row.data, manifest),
@@ -1001,6 +1011,41 @@ function csvField(value) {
 function csvRow(fields) {
     return fields.map(csvField).join(",");
 }
+function csvDownloadResponse(filename, columns, chunks) {
+    const encoder = new TextEncoder();
+    const iterator = chunks[Symbol.asyncIterator]();
+    const body = new ReadableStream({
+        start(controller) {
+            controller.enqueue(encoder.encode(`${csvRow(columns)}\r\n`));
+        },
+        async pull(controller) {
+            const next = await iterator.next();
+            if (next.done)
+                controller.close();
+            else
+                controller.enqueue(encoder.encode(next.value));
+        },
+        async cancel() {
+            await iterator.return?.();
+        },
+    });
+    return new Response(body, {
+        status: 200,
+        headers: {
+            "content-type": "text/csv; charset=utf-8",
+            "content-disposition": `attachment; filename="${filename}.csv"`,
+        },
+    });
+}
+function viewCsvValue(value) {
+    if (value === undefined || value === null)
+        return "";
+    if (typeof value === "string")
+        return value;
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    return JSON.stringify(value);
+}
 /** Reads one CSV column's value off an entry row. The four leading
  *  columns are row metadata; everything else is a Schema property
  *  read from `data`. Non-scalar values (objects, arrays) are
@@ -1046,6 +1091,7 @@ async function entryEditorPayload(runtime, row, schemas) {
     };
 }
 function adminEditorCollection(schema, schemas) {
+    const adminUi = checkSchemaAdminUi(schema);
     return {
         name: schema.metadata.name,
         title: schema.spec.title,
@@ -1059,7 +1105,8 @@ function adminEditorCollection(schema, schemas) {
         uiSchema: schema.spec.uiSchema ?? null,
         mediaFields: mediaFieldsForCollection(schema, schemas),
         sortableFields: schemaSortableFields(schema),
-        filter: checkSchemaListFilter(schema).filter,
+        filter: adminUi.filter,
+        list: adminUi.list,
     };
 }
 function adminEditorEntry(row) {
@@ -1320,7 +1367,7 @@ async function handleViewRequest(req, runtime, viewName, ref, env, waitUntil,
 // the same handler serves BOTH the public mount (`/api/views`) and
 // the staff mount (`/admin/api/views`); hardcoding the public prefix
 // here mislabels staff-View diagnostics + pathPrefix (#F7).
-mountPath) {
+mountPath, exportCsv = false) {
     const view = runtime.viewsByName.get(viewName);
     if (!view) {
         return jsonError({ status: 500, code: "INTERNAL_ERROR", message: `View '${viewName}' missing post-boot.` });
@@ -1344,8 +1391,12 @@ mountPath) {
     const page = parsePositiveInt(url.searchParams.get(PAGE_PARAM));
     const show = parsePositiveInt(url.searchParams.get(SHOW_PARAM));
     let params;
+    let listQuery;
     try {
         params = coerceViewParams(view, url.searchParams);
+        listQuery = mountPath === "/admin/api/views"
+            ? readViewListQuery(view, url.searchParams)
+            : { filters: [] };
     }
     catch (err) {
         if (err instanceof ViewParamCoercionError) {
@@ -1368,12 +1419,48 @@ mountPath) {
         }
         throw err;
     }
-    const result = await runtime.executeView.execute({
+    const execute = (requestedPage) => runtime.executeView.execute({
         view,
         pathPrefix: viewPath,
-        options: { params, page, show },
+        options: {
+            params,
+            page: requestedPage,
+            show: exportCsv ? view.spec.limit : show,
+            search: listQuery.search,
+            filters: listQuery.filters,
+        },
         ctx,
     });
+    if (exportCsv) {
+        const result = await execute(1);
+        if (!result.ok) {
+            const status = HTTP_STATUS_BY_CODE[result.diagnostic.code] ?? 500;
+            return Response.json({ ok: false, diagnostic: redactForWire(result.diagnostic) }, { status });
+        }
+        const declaredColumns = checkViewAdminUi(view).list.columns;
+        const columns = declaredColumns.length > 0
+            ? [...declaredColumns]
+            : view.spec.fields?.length
+                ? [...view.spec.fields]
+                : [...new Set(result.result.rows.flatMap((row) => Object.keys(row)))];
+        let current = result.result;
+        let exportPage = 1;
+        async function* chunks() {
+            while (true) {
+                if (current.rows.length > 0) {
+                    yield current.rows.map((row) => csvRow(columns.map((column) => viewCsvValue(row[column])))).join("\r\n") + "\r\n";
+                }
+                if (current.rows.length < current.show)
+                    return;
+                const next = await execute(++exportPage);
+                if (!next.ok)
+                    throw new DiagnosticError(next.diagnostic);
+                current = next.result;
+            }
+        }
+        return csvDownloadResponse(viewName, columns, chunks());
+    }
+    const result = await execute(page);
     if (result.ok) {
         return Response.json({ ok: true, data: result.result });
     }
@@ -1381,6 +1468,35 @@ mountPath) {
     // Same wire-redaction contract as the HTTP Trigger egress above (#396).
     return Response.json({ ok: false, diagnostic: redactForWire(result.diagnostic) }, { status });
 }
+function readViewListQuery(view, query) {
+    const list = checkViewAdminUi(view).list;
+    const rawSearch = query.get("search")?.trim() ?? "";
+    if (rawSearch && list.searchFields.length === 0) {
+        throw new ViewParamCoercionError(`View '${view.metadata.name}' does not declare Admin search fields.`);
+    }
+    if (rawSearch.length > 200) {
+        throw new ViewParamCoercionError("View Admin search must be at most 200 characters.");
+    }
+    const allowedFilters = new Set(list.filterFields);
+    for (const key of query.keys()) {
+        if (key.startsWith("filter.") && !allowedFilters.has(key.slice("filter.".length))) {
+            throw new ViewParamCoercionError(`View '${view.metadata.name}' does not declare Admin filter field '${key.slice("filter.".length)}'.`);
+        }
+    }
+    const filters = list.filterFields.flatMap((field) => {
+        const value = query.get(`filter.${field}`)?.trim() ?? "";
+        if (!value)
+            return [];
+        if (value.length > 200) {
+            throw new ViewParamCoercionError(`View Admin filter '${field}' must be at most 200 characters.`);
+        }
+        return [{ field, value }];
+    });
+    return {
+        search: rawSearch ? { term: rawSearch, fields: list.searchFields } : undefined,
+        filters,
+    };
+}
 function parsePositiveInt(raw) {
     if (raw == null || raw === "")
         return undefined;