@appsemble/lang-sdk 0.36.10 → 0.37.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/lang-sdk",
-  "version": "0.36.10",
+  "version": "0.37.0",
   "description": "Language SDK for Appsemble",
   "keywords": [
     "app",
@@ -49,7 +49,7 @@
     "intl-messageformat": "^11.0.0",
     "jsonschema": "~1.4.1",
     "language-tags": "^1.0.0",
-    "lcm": "^0.0.3",
+    "lcm": "^0.0.4",
     "openapi-types": "^12.0.0",
     "parse-duration": "^1.0.0",
     "type-fest": "^4.0.0",

package/schemas/AppLayoutDefinition.js

@@ -94,6 +94,13 @@ If this is omitted, a collapsable side navigation menu will be rendered on the l
             type: 'boolean',
             default: false,
         },
+        hideGroupDropdown: {
+            description: `Whether to hide the group dropdown.
+
+Set to \`true\` to hide it for all users, or provide a list of role names to hide it only
+for members holding any of those roles.`,
+            oneOf: [{ type: 'boolean' }, { type: 'array', items: { type: 'string' } }],
+        },
     },
 };
 //# sourceMappingURL=AppLayoutDefinition.js.map

package/schemas/actions/ResourcePatchActionDefinition.js

@@ -17,6 +17,19 @@ export const ResourcePatchActionDefinition = extendJSONSchema(RequestActionDefin
             $ref: '#/components/schemas/RemapperDefinition',
             description: 'The ID of the group to scope the request to. Defaults to the currently selected group.',
         },
+        optimistic: {
+            type: 'object',
+            additionalProperties: false,
+            description: 'Fetch the latest resource before writing, merge its `$etag` into the request data so the implicit `If-Match` precondition holds, and retry on precondition conflicts. The fetched resource is also exposed to remappers as `{ context: resource }`.',
+            properties: {
+                retries: {
+                    type: 'integer',
+                    minimum: 0,
+                    default: 0,
+                    description: 'The number of precondition conflicts to retry after fetching the latest resource again.',
+                },
+            },
+        },
         id: {
             $ref: '#/components/schemas/RemapperDefinition',
         },

package/schemas/actions/ResourceUpdateActionDefinition.js

@@ -17,6 +17,19 @@ export const ResourceUpdateActionDefinition = extendJSONSchema(RequestActionDefi
             $ref: '#/components/schemas/RemapperDefinition',
             description: 'The ID of the group to scope the request to. Defaults to the currently selected group.',
         },
+        optimistic: {
+            type: 'object',
+            additionalProperties: false,
+            description: 'Fetch the latest resource before writing, merge its `$etag` into the request data so the implicit `If-Match` precondition holds, and retry on precondition conflicts. The fetched resource is also exposed to remappers as `{ context: resource }`.',
+            properties: {
+                retries: {
+                    type: 'integer',
+                    minimum: 0,
+                    default: 0,
+                    description: 'The number of precondition conflicts to retry after fetching the latest resource again.',
+                },
+            },
+        },
     },
 }, ['url', 'method']);
 //# sourceMappingURL=ResourceUpdateActionDefinition.js.map

package/types/actionDefinition.d.ts

@@ -564,6 +564,19 @@ interface ResourceOrderQueryDefinition {
      */
     order?: 'asc' | 'desc';
 }
+interface OptimisticResourceWriteActionDefinition {
+    /**
+     * Fetch the latest resource before writing, merge its `$etag` into the request data so the
+     * implicit `If-Match` precondition holds, and retry on precondition conflicts. The fetched
+     * resource is also exposed to remappers as `{ context: resource }`.
+     */
+    optimistic?: {
+        /**
+         * The number of precondition conflicts to retry after fetching the latest resource again.
+         */
+        retries?: number;
+    };
+}
 export interface ControllerActionDefinition extends BaseActionDefinition<'controller'> {
     handler: string;
 }
@@ -576,12 +589,12 @@ export type ResourceHistoryGetActionDefinition = ResourceActionDefinition<'resou
 export type ResourceGetActionDefinition = ResourceActionDefinition<'resource.get'> & ResourceActionWithIdDefinition & ViewResourceDefinition;
 export type ResourceQueryActionDefinition = OwnResourceDefinition & ResourceActionDefinition<'resource.query'> & ViewResourceDefinition;
 export type ResourceCountActionDefinition = OwnResourceDefinition & ResourceActionDefinition<'resource.count'>;
-export type ResourceUpdateActionDefinition = ResourceActionDefinition<'resource.update'>;
+export type ResourceUpdateActionDefinition = ResourceActionDefinition<'resource.update'> & OptimisticResourceWriteActionDefinition;
 export type ResourceUpdateGroupActionDefinition = ResourceActionDefinition<'resource.update.group'> & ResourceActionWithIdDefinition & {
     groupId?: Remapper;
 };
 export type ResourceUpdatePositionsActionDefinition = ResourceActionDefinition<'resource.update.positions'> & ResourceActionWithIdDefinition & ResourceOrderQueryDefinition;
-export type ResourcePatchActionDefinition = ResourceActionDefinition<'resource.patch'> & ResourceActionWithIdDefinition;
+export type ResourcePatchActionDefinition = ResourceActionDefinition<'resource.patch'> & ResourceActionWithIdDefinition & OptimisticResourceWriteActionDefinition;
 export type AppMemberLogoutAction = BaseActionDefinition<'app.member.logout'>;
 export interface BaseResourceSubscribeActionDefinition<T extends ActionName> extends BaseActionDefinition<T> {
     /**

package/types/core.d.ts

@@ -6,7 +6,7 @@ import { type CompanionContainerDefinition } from './container.js';
 import { type LayoutPosition, type Navigation } from './layout.js';
 import { type Remapper } from './remapper.js';
 import { type ResourceDefinition } from './resource.js';
-import { type ViewRole } from './roles.js';
+import { type AppRole, type ViewRole } from './roles.js';
 import { type Security } from './security.js';
 import { type Theme } from './theme.js';
 import { type PageLayoutDefinition } from './gridLayout.js';
@@ -110,6 +110,13 @@ export interface AppDefinition {
          * Whether to hide the title bar from all pages in the app.
          */
         hideTitleBar?: boolean;
+        /**
+         * Whether to hide the group dropdown.
+         *
+         * Set to `true` to hide it for all users, or provide a list of role names to hide it
+         * only for members holding any of those roles.
+         */
+        hideGroupDropdown?: boolean | AppRole[];
     };
     /**
      * The strategy to use for apps to subscribe to push notifications.

package/validation.js

@@ -6,7 +6,7 @@ import { BlockParamInstanceValidator } from './BasicValidator.js';
 import { getAppBlocks, normalizeBlockName } from './blockUtils.js';
 import { partialNormalized } from './constants/index.js';
 import { findPageByName } from './findPageByName.js';
-import { iterApp } from './iterApp.js';
+import { iterAction, iterApp } from './iterApp.js';
 import { has } from './miscellaneous.js';
 import { normalize } from './normalize.js';
 import { serverActions } from './serverActions.js';
@@ -19,6 +19,29 @@ const allResourceViewPermissionPattern = /^\$resource:all:(get|query):[^:]+$/;
 const resourceViewPermissionPattern = /^\$resource:[^:]+:(get|query):[^:]+$/;
 const allWebhookPermissionPattern = /^\$webhook:all:invoke$/;
 const webhookPermissionPattern = /^\$webhook:[^:]+:invoke$/;
+function hasResourcePermission(permissions, resourceName, resourceAction, view) {
+    return permissions.some((permission) => {
+        if (resourcePermissionPattern.test(permission)) {
+            const [, permissionResourceName, permissionResourceAction] = permission.split(':');
+            return (['all', resourceName].includes(permissionResourceName) &&
+                (permissionResourceAction === resourceAction ||
+                    (resourceAction === 'count' && permissionResourceAction === 'query')));
+        }
+        if (ownResourcePermissionPattern.test(permission)) {
+            const [, permissionResourceName, , permissionResourceAction] = permission.split(':');
+            return (['all', resourceName].includes(permissionResourceName) &&
+                (permissionResourceAction === resourceAction ||
+                    (resourceAction === 'count' && permissionResourceAction === 'query')));
+        }
+        if (view && resourceViewPermissionPattern.test(permission)) {
+            const [, permissionResourceName, permissionResourceAction, permissionResourceView] = permission.split(':');
+            return (['all', resourceName].includes(permissionResourceName) &&
+                permissionResourceAction === resourceAction &&
+                (!permissionResourceView || permissionResourceView === view));
+        }
+        return false;
+    });
+}
 /**
  * Check whether or not the given link represents a link related to the Appsemble core.
  *
@@ -968,6 +991,12 @@ function validateSecurity(definition, report) {
         }
     }
     iterApp(definition, { onBlock: checkRoles, onPage: checkRoles });
+    const { hideGroupDropdown } = definition.layout ?? {};
+    if (Array.isArray(hideGroupDropdown)) {
+        for (const [index, role] of hideGroupDropdown.entries()) {
+            checkRoleExists(role, ['layout', 'hideGroupDropdown', index]);
+        }
+    }
 }
 /**
  * Validates the hooks in resource definition to ensure its properties are valid.
@@ -1068,6 +1097,18 @@ function validateCronJobs({ cron }, report) {
 // TODO: horrible nesting
 function validateActions(definition, report) {
     const urlRegex = new RegExp(`^${partialNormalized.source}:`);
+    const validateUnsupportedServerOptimisticResourceWrite = (action, path) => {
+        if ((path[0] === 'cron' || path[0] === 'webhooks') &&
+            (action.type === 'resource.update' || action.type === 'resource.patch') &&
+            'optimistic' in action) {
+            report(action.type, 'optimistic resource writes are not supported for server-side actions', [
+                ...path,
+                'optimistic',
+            ]);
+            return true;
+        }
+        return false;
+    };
     iterApp(definition, {
         onAction(action, path) {
             // XXX: could we validate server-side actions differently
@@ -1075,8 +1116,7 @@ function validateActions(definition, report) {
                 report(action.type, 'action type is not supported for cron jobs', [...path, 'type']);
                 return;
             }
-            if (path[0] === 'webhooks' && !serverActions.has(action.type)) {
-                report(action.type, 'action type is not supported for webhooks', [...path, 'type']);
+            if (validateUnsupportedServerOptimisticResourceWrite(action, path)) {
                 return;
             }
             if (action.type.startsWith('app.member.') && !definition.security) {
@@ -1100,6 +1140,13 @@ function validateActions(definition, report) {
                 const { resource: resourceName, view } = action;
                 const resource = definition.resources?.[resourceName];
                 const [, resourceAction] = action.type.split('.');
+                // Optimistic concurrency is implicit via `data.$etag`; the explicit
+                // `ifMatch` field used to live on the action schema and has been removed.
+                if (['update', 'patch', 'delete'].includes(resourceAction) &&
+                    'ifMatch' in action) {
+                    report(action.type, 'ifMatch is no longer accepted; resource writes use the implicit $etag carried in data', [...path, 'ifMatch']);
+                    return;
+                }
                 if (!resource) {
                     report(action.type, 'refers to a resource that doesn’t exist', [...path, 'resource']);
                     return;
@@ -1118,31 +1165,16 @@ function validateActions(definition, report) {
                         const allRolePermissions = getAppRolePermissions(definition.security, Object.keys(definition.security.roles));
                         allPermissions.push(...allRolePermissions);
                     }
-                    // TODO: repeats way too much, code not self-explanatory at all
-                    if (!allPermissions.some((permission) => {
-                        if (resourcePermissionPattern.test(permission)) {
-                            const [, permissionResourceName, permissionResourceAction] = permission.split(':');
-                            return (['all', resourceName].includes(permissionResourceName) &&
-                                (permissionResourceAction === resourceAction ||
-                                    (resourceAction === 'count' && permissionResourceAction === 'query')));
-                        }
-                        if (ownResourcePermissionPattern.test(permission)) {
-                            const [, permissionResourceName, , permissionResourceAction] = permission.split(':');
-                            return (['all', resourceName].includes(permissionResourceName) &&
-                                (permissionResourceAction === resourceAction ||
-                                    (resourceAction === 'count' && permissionResourceAction === 'query')));
-                        }
-                        if (view && resourceViewPermissionPattern.test(permission)) {
-                            const [, permissionResourceName, permissionResourceAction, permissionResourceView] = permission.split(':');
-                            return (['all', resourceName].includes(permissionResourceName) &&
-                                permissionResourceAction === resourceAction &&
-                                (!permissionResourceView || permissionResourceView === view));
-                        }
-                        return false;
-                    })) {
+                    if (!hasResourcePermission(allPermissions, resourceName, resourceAction, view)) {
                         report(action.type, 'there is no one in the app who has permissions to use this action', [...path, 'resource']);
                         return;
                     }
+                    if (['update', 'patch'].includes(resourceAction) &&
+                        'optimistic' in action &&
+                        !hasResourcePermission(allPermissions, resourceName, 'get', view)) {
+                        report(action.type, 'there is no one in the app who has permissions to fetch this resource for optimistic writes', [...path, 'optimistic']);
+                        return;
+                    }
                 }
             }
             if (action.type === 'webhook') {
@@ -1254,6 +1286,16 @@ function validateActions(definition, report) {
             }
         },
     });
+    for (const [name, webhook] of Object.entries(definition.webhooks ?? {})) {
+        if (webhook.action &&
+            iterAction(webhook.action, {
+                onAction(action, path) {
+                    return validateUnsupportedServerOptimisticResourceWrite(action, path);
+                },
+            }, ['webhooks', name, 'action'])) {
+            return;
+        }
+    }
 }
 function validateEvents(definition, blockVersions, report) {
     const indexMap = new Map();