@appsemble/utils 0.23.4 → 0.23.6

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.23.4/config/assets/logo.svg) Appsemble Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.23.6/config/assets/logo.svg) Appsemble Utilities
 
 > Internal utility functions used across multiple Appsemble projects.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/utils)](https://www.npmjs.com/package/@appsemble/utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.23.4/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.23.4)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.23.6/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.23.6)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.23.4/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.23.6/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/api/components/schemas/ActionDefinition.js

@@ -26,6 +26,7 @@ export const ActionDefinition = {
         {
             anyOf: [
                 { $ref: '#/components/schemas/AnalyticsActionDefinition' },
+                { $ref: '#/components/schemas/ControllerActionDefinition' },
                 { $ref: '#/components/schemas/ConditionActionDefinition' },
                 { $ref: '#/components/schemas/DialogActionDefinition' },
                 { $ref: '#/components/schemas/DialogErrorActionDefinition' },

package/api/components/schemas/App.js

@@ -104,6 +104,14 @@ domain fall back to use the Appsemble server Sentry DSN.
 
   This is only applied when \`sentryDsn\` is specified.`,
         },
+        controllerCode: {
+            type: 'string',
+            description: 'Custom app logic as a JavaScript string',
+        },
+        controllerImplementations: {
+            type: 'string',
+            description: 'Appsemble SDK interfaces implementations',
+        },
     },
 };
 //# sourceMappingURL=App.js.map

package/api/components/schemas/AppDefinition.js

@@ -65,6 +65,9 @@ This **must** match the name of a page defined for the app.
             minLength: 2,
             description: 'The default language for the app.',
         },
+        controller: {
+            $ref: '#/components/schemas/ControllerDefinition',
+        },
         resources: {
             type: 'object',
             description: `Resources define how Appsemble can store data for an app.

package/api/components/schemas/ControllerActionDefinition.d.ts

@@ -0,0 +1 @@
+export declare const ControllerActionDefinition: import("openapi-types").OpenAPIV3.SchemaObject;

package/api/components/schemas/ControllerActionDefinition.js

@@ -0,0 +1,18 @@
+import { BaseActionDefinition } from './BaseActionDefinition.js';
+import { extendJSONSchema } from './utils.js';
+export const ControllerActionDefinition = extendJSONSchema(BaseActionDefinition, {
+    type: 'object',
+    additionalProperties: false,
+    required: ['type', 'handler'],
+    properties: {
+        type: {
+            enum: ['controller'],
+            description: 'Use the controller to handle the action.',
+        },
+        handler: {
+            type: 'string',
+            description: 'The name of the function in the controller that will handle the action',
+        },
+    },
+});
+//# sourceMappingURL=ControllerActionDefinition.js.map

package/api/components/schemas/ControllerDefinition.d.ts

@@ -0,0 +1,2 @@
+import { type OpenAPIV3 } from 'openapi-types';
+export declare const ControllerDefinition: OpenAPIV3.NonArraySchemaObject;

package/api/components/schemas/ControllerDefinition.js

@@ -0,0 +1,17 @@
+export const ControllerDefinition = {
+    type: 'object',
+    description: 'A controller for application logic.',
+    required: [],
+    additionalProperties: false,
+    properties: {
+        actions: {
+            type: 'object',
+            description: 'A mapping of actions that can be fired by the controller to action handlers.',
+            additionalProperties: {
+                $ref: '#/components/schemas/ActionDefinition',
+            },
+        },
+        events: { $ref: '#/components/schemas/EventsDefinition' },
+    },
+};
+//# sourceMappingURL=ControllerDefinition.js.map

package/api/components/schemas/index.d.ts

@@ -2,6 +2,8 @@ export * from './ActionDefinition.js';
 export * from './AnalyticsActionDefinition.js';
 export * from './App.js';
 export * from './AppCollection.js';
+export * from './ControllerDefinition.js';
+export * from './ControllerActionDefinition.js';
 export * from './AppCollectionDefinition.js';
 export * from './AppAccount.js';
 export * from './AppDefinition.js';

package/api/components/schemas/index.js

@@ -2,6 +2,8 @@ export * from './ActionDefinition.js';
 export * from './AnalyticsActionDefinition.js';
 export * from './App.js';
 export * from './AppCollection.js';
+export * from './ControllerDefinition.js';
+export * from './ControllerActionDefinition.js';
 export * from './AppCollectionDefinition.js';
 export * from './AppAccount.js';
 export * from './AppDefinition.js';

package/api/paths/apps.js

@@ -76,6 +76,14 @@ export const paths = {
                                         format: 'binary',
                                     },
                                 },
+                                controllerCode: {
+                                    type: 'string',
+                                    description: 'Custom app logic as a JavaScript string',
+                                },
+                                controllerImplementations: {
+                                    type: 'string',
+                                    description: 'Appsemble SDK interfaces implementations',
+                                },
                             },
                         },
                         encoding: {
@@ -217,6 +225,14 @@ export const paths = {
                                         format: 'binary',
                                     },
                                 },
+                                controllerCode: {
+                                    type: 'string',
+                                    description: 'Custom app logic as a JavaScript string',
+                                },
+                                controllerImplementations: {
+                                    type: 'string',
+                                    description: 'Appsemble SDK interfaces implementations',
+                                },
                                 showAppsembleLogin: {
                                     type: 'boolean',
                                     description: 'Whether the Appsemble login method should be shown.',

package/constants/patterns.d.ts

@@ -19,7 +19,7 @@ export declare const partialNormalized: RegExp;
  */
 export declare const normalized: RegExp;
 /**
- * A pattern for matching the block name pattern of @organization/block.
+ * A pattern for matching the block name pattern of @organization/project.
  */
 export declare const blockNamePattern: RegExp;
 export declare const domainPattern: RegExp;

package/constants/patterns.js

@@ -19,7 +19,7 @@ export const partialNormalized = /([\da-z](?:(?!.*--)[\da-z-]*[\da-z])?)/;
  */
 export const normalized = new RegExp(`^${partialNormalized.source}$`);
 /**
- * A pattern for matching the block name pattern of @organization/block.
+ * A pattern for matching the block name pattern of @organization/project.
  */
 export const blockNamePattern = new RegExp(`^@${partialNormalized.source}/${partialNormalized.source}$`);
 export const domainPattern = new RegExp(`^(${partialNormalized.source}+\\.)+[a-z]{2,}$`);

package/iterApp.d.ts

@@ -1,4 +1,4 @@
-import { type ActionDefinition, type AppDefinition, type BlockDefinition, type PageDefinition } from '@appsemble/types';
+import { type ActionDefinition, type AppDefinition, type BlockDefinition, type ControllerDefinition, type PageDefinition } from '@appsemble/types';
 export type Prefix = (number | string)[];
 type IterCallback<T> = (item: T, path: Prefix) => boolean | void;
 interface IterCallbacks {
@@ -6,6 +6,7 @@ interface IterCallbacks {
     onBlockList?: IterCallback<BlockDefinition[]>;
     onBlock?: IterCallback<BlockDefinition>;
     onAction?: IterCallback<ActionDefinition>;
+    onController?: IterCallback<ControllerDefinition>;
 }
 /**
  * Iterate over an action definition and call each callback if relevant.
@@ -18,6 +19,7 @@ interface IterCallbacks {
  * @returns True if any callback returns true, false otherwise.
  */
 export declare function iterAction(action: ActionDefinition, callbacks: IterCallbacks, prefix?: Prefix): boolean;
+export declare function iterController(controller: ControllerDefinition, callbacks: IterCallbacks, prefix?: Prefix): boolean;
 /**
  * Iterate over a block definition and call each callback if relevant.
  *

package/iterApp.js

@@ -32,6 +32,16 @@ export function iterAction(action, callbacks, prefix = []) {
     }
     return false;
 }
+export function iterController(controller, callbacks, prefix = []) {
+    var _a;
+    if ((_a = callbacks.onController) === null || _a === void 0 ? void 0 : _a.call(callbacks, controller, prefix)) {
+        return true;
+    }
+    if (controller.actions) {
+        return Object.entries(controller.actions).some(([key, action]) => iterAction(action, callbacks, [...prefix, 'actions', key]));
+    }
+    return false;
+}
 /**
  * Iterate over a block definition and call each callback if relevant.
  *
@@ -116,6 +126,9 @@ export function iterApp(app, callbacks) {
         app.pages.some((page, index) => iterPage(page, callbacks, ['pages', index]))) {
         return true;
     }
+    if (app.controller && iterController(app.controller, callbacks, ['controller'])) {
+        return true;
+    }
     if (app.cron) {
         for (const [name, job] of Object.entries(app.cron)) {
             if ((job === null || job === void 0 ? void 0 : job.action) && iterAction(job.action, callbacks, ['cron', name, 'action'])) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/utils",
-  "version": "0.23.4",
+  "version": "0.23.6",
   "description": "Utility functions used in Appsemble internally",
   "keywords": [
     "app",
@@ -37,7 +37,7 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/types": "0.23.4",
+    "@appsemble/types": "0.23.6",
     "axios": "^1.0.0",
     "cron-parser": "^4.0.0",
     "date-fns": "^2.0.0",

package/validation.d.ts

@@ -1,4 +1,4 @@
-import { type AppDefinition, type BlockManifest } from '@appsemble/types';
+import { type AppDefinition, type BlockManifest, type ProjectImplementations } from '@appsemble/types';
 import { type ValidatorResult } from 'jsonschema';
 import { type Promisable } from 'type-fest';
 import { type IdentifiableBlock } from './blockUtils.js';
@@ -17,8 +17,9 @@ export type BlockVersionsGetter = (blockMap: IdentifiableBlock[]) => Promisable<
  *
  * @param definition The app validation to check.
  * @param getBlockVersions A function for getting block manifests from block versions.
+ * @param controllerImplementations App controller implementations of interfaces.
  * @param validatorResult If specified, error messages will be applied to this existing validator
  *   result.
  * @returns A validator result which contains all app validation violations.
  */
-export declare function validateAppDefinition(definition: AppDefinition, getBlockVersions: BlockVersionsGetter, validatorResult?: ValidatorResult): Promise<ValidatorResult>;
+export declare function validateAppDefinition(definition: AppDefinition, getBlockVersions: BlockVersionsGetter, controllerImplementations?: ProjectImplementations, validatorResult?: ValidatorResult): Promise<ValidatorResult>;

package/validation.js

@@ -120,6 +120,72 @@ function validateResourceSchemas(definition, report) {
         }
     }
 }
+function validateController(definition, controllerImplementations, report) {
+    if (!definition.controller || !controllerImplementations) {
+        return;
+    }
+    iterApp(definition, {
+        onController(controller, path) {
+            var _a, _b, _c, _d, _e, _f;
+            const actionParameters = new Set();
+            if (controller.actions) {
+                if (controllerImplementations.actions) {
+                    for (const [key, action] of Object.entries(controller.actions)) {
+                        if (action.type in
+                            [
+                                'link',
+                                'link.back',
+                                'link.next',
+                                'dialog',
+                                'dialog.ok',
+                                'dialog.error',
+                                'flow.back',
+                                'flow.cancel',
+                                'flow.finish',
+                                'flow.next',
+                                'flow.to',
+                            ]) {
+                            report(action, 'cannot be used in controllers', [...path, 'actions', key]);
+                        }
+                        if (controllerImplementations.actions.$any) {
+                            if (actionParameters.has(key)) {
+                                continue;
+                            }
+                            if (!has(controllerImplementations.actions, key)) {
+                                report(action, 'is unused', [...path, 'actions', key]);
+                            }
+                        }
+                        else if (!has(controllerImplementations.actions, key)) {
+                            report(action, 'is an unknown action for this controller', [...path, 'actions', key]);
+                        }
+                    }
+                }
+                else {
+                    report(controller.actions, 'is not allowed on this controller', [...path, 'actions']);
+                }
+            }
+            if (!controller.events) {
+                return;
+            }
+            if (controller.events.emit) {
+                for (const [key, value] of Object.entries(controller.events.emit)) {
+                    if (!((_b = (_a = controllerImplementations.events) === null || _a === void 0 ? void 0 : _a.emit) === null || _b === void 0 ? void 0 : _b.$any) &&
+                        !has((_c = controllerImplementations.events) === null || _c === void 0 ? void 0 : _c.emit, key)) {
+                        report(value, 'is an unknown event emitter', [...path, 'events', 'emit', key]);
+                    }
+                }
+            }
+            if (controller.events.listen) {
+                for (const [key, value] of Object.entries(controller.events.listen)) {
+                    if (!((_e = (_d = controllerImplementations.events) === null || _d === void 0 ? void 0 : _d.listen) === null || _e === void 0 ? void 0 : _e.$any) &&
+                        !has((_f = controllerImplementations.events) === null || _f === void 0 ? void 0 : _f.listen, key)) {
+                        report(value, 'is an unknown event listener', [...path, 'events', 'listen', key]);
+                    }
+                }
+            }
+        },
+    });
+}
 function validateBlocks(definition, blockVersions, report) {
     iterApp(definition, {
         onBlock(block, path) {
@@ -506,17 +572,29 @@ function validateEvents(definition, blockVersions, report) {
     const indexMap = new Map();
     function collect(prefix, name, isEmitter) {
         const [firstKey, pageIndex] = prefix;
-        // Ignore anything not part of a page. For example cron actions never support events.
-        if (firstKey !== 'pages') {
-            return;
-        }
-        if (typeof pageIndex !== 'number') {
-            return;
-        }
-        if (!indexMap.has(pageIndex)) {
-            indexMap.set(pageIndex, { emitters: new Map(), listeners: new Map() });
+        let mapAtKey;
+        // Ignore anything not part of controller or a page.
+        // For example cron actions never support events.
+        switch (firstKey) {
+            case 'controller':
+                if (!indexMap.has('controller')) {
+                    indexMap.set('controller', { emitters: new Map(), listeners: new Map() });
+                }
+                mapAtKey = indexMap.get('controller');
+                break;
+            case 'pages':
+                if (typeof pageIndex !== 'number') {
+                    return;
+                }
+                if (!indexMap.has(pageIndex)) {
+                    indexMap.set(pageIndex, { emitters: new Map(), listeners: new Map() });
+                }
+                mapAtKey = indexMap.get(pageIndex);
+                break;
+            default:
+                return;
         }
-        const { emitters, listeners } = indexMap.get(pageIndex);
+        const { emitters, listeners } = mapAtKey;
         const context = isEmitter ? emitters : listeners;
         if (!context.has(name)) {
             context.set(name, []);
@@ -525,6 +603,21 @@ function validateEvents(definition, blockVersions, report) {
         prefixes.push(prefix);
     }
     iterApp(definition, {
+        onController(controller, path) {
+            if (!controller.events) {
+                return;
+            }
+            if (controller.events.emit) {
+                for (const [prefix, name] of Object.entries(controller.events.emit)) {
+                    collect([...path, 'events', 'emit', prefix], name, true);
+                }
+            }
+            if (controller.events.listen) {
+                for (const [prefix, name] of Object.entries(controller.events.listen)) {
+                    collect([...path, 'events', 'listen', prefix], name, false);
+                }
+            }
+        },
         onAction(action, path) {
             if (action.type === 'dialog') {
                 for (const block of action.blocks) {
@@ -567,16 +660,50 @@ function validateEvents(definition, blockVersions, report) {
             }
         },
     });
+    let controllerEvents = {
+        emitters: new Map(),
+        listeners: new Map(),
+    };
+    if (indexMap.has('controller')) {
+        controllerEvents = { ...indexMap.get('controller') };
+    }
+    indexMap.delete('controller');
+    for (const [name, prefixes] of controllerEvents.emitters.entries()) {
+        let found = false;
+        for (const { listeners } of indexMap.values()) {
+            if (listeners.has(name)) {
+                found = true;
+            }
+        }
+        if (!found) {
+            for (const prefix of prefixes) {
+                report(name, 'does not match any listeners', prefix);
+            }
+        }
+    }
+    for (const [name, prefixes] of controllerEvents.listeners.entries()) {
+        let found = false;
+        for (const { emitters } of indexMap.values()) {
+            if (emitters.has(name)) {
+                found = true;
+            }
+        }
+        if (!found) {
+            for (const prefix of prefixes) {
+                report(name, 'does not match any emitters', prefix);
+            }
+        }
+    }
     for (const { emitters, listeners } of indexMap.values()) {
         for (const [name, prefixes] of listeners.entries()) {
-            if (!emitters.has(name)) {
+            if (!emitters.has(name) && !controllerEvents.emitters.has(name)) {
                 for (const prefix of prefixes) {
                     report(name, 'does not match any event emitters', prefix);
                 }
             }
         }
         for (const [name, prefixes] of emitters.entries()) {
-            if (!listeners.has(name)) {
+            if (!listeners.has(name) && !controllerEvents.listeners.has(name)) {
                 for (const prefix of prefixes) {
                     report(name, 'does not match any event listeners', prefix);
                 }
@@ -591,11 +718,12 @@ function validateEvents(definition, blockVersions, report) {
  *
  * @param definition The app validation to check.
  * @param getBlockVersions A function for getting block manifests from block versions.
+ * @param controllerImplementations App controller implementations of interfaces.
  * @param validatorResult If specified, error messages will be applied to this existing validator
  *   result.
  * @returns A validator result which contains all app validation violations.
  */
-export async function validateAppDefinition(definition, getBlockVersions, validatorResult) {
+export async function validateAppDefinition(definition, getBlockVersions, controllerImplementations, validatorResult) {
     let result = validatorResult;
     if (!result) {
         const validator = new Validator();
@@ -617,6 +745,7 @@ export async function validateAppDefinition(definition, getBlockVersions, valida
         result.errors.push(new ValidationError(message, instance, undefined, path));
     };
     try {
+        validateController(definition, controllerImplementations, report);
         validateCronJobs(definition, report);
         validateDefaultPage(definition, report);
         validateHooks(definition, report);

package/validation.test.js

@@ -332,6 +332,28 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
+    it('should validate controller actions', async () => {
+        const app = createTestApp();
+        app.controller = {
+            actions: {
+                onClick: { type: 'noop' },
+                onSubmit: { type: 'noop' },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [], {
+            actions: {
+                onClick: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('is an unknown action for this controller', { type: 'noop' }, undefined, [
+                'controller',
+                'actions',
+                'onSubmit',
+            ]),
+        ]);
+    });
     it('should report if a block doesn’t support actions', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
@@ -358,6 +380,20 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
+    it('should report if a controller doesn’t support actions', async () => {
+        const app = createTestApp();
+        app.controller = {
+            actions: {},
+        };
+        const result = await validateAppDefinition(app, () => [], {});
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('is not allowed on this controller', {}, undefined, [
+                'controller',
+                'actions',
+            ]),
+        ]);
+    });
     it('should report unused block actions based on parameters', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
@@ -439,7 +475,7 @@ describe('validateAppDefinition', () => {
         ]);
         expect(result.valid).toBe(true);
     });
-    it('should report unknown event emitters', async () => {
+    it('should report unknown event emitters on blocks', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -479,7 +515,51 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
-    it('should allow $any matching unknown event emitters', async () => {
+    it('should report unknown event emitters on controller', async () => {
+        const app = createTestApp();
+        app.pages[0].blocks.push({
+            type: 'test',
+            version: '1.2.3',
+            events: {
+                listen: {
+                    foo: 'bar',
+                },
+            },
+        });
+        app.controller = {
+            events: {
+                emit: {
+                    foo: 'bar',
+                },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [
+            {
+                name: '@appsemble/test',
+                version: '1.2.3',
+                files: [],
+                languages: [],
+                wildcardActions: true,
+                events: {
+                    listen: { foo: {} },
+                },
+            },
+        ], {
+            events: {
+                emit: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('is an unknown event emitter', 'bar', undefined, [
+                'controller',
+                'events',
+                'emit',
+                'foo',
+            ]),
+        ]);
+    });
+    it('should allow $any matching unknown event emitters on blocks', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -508,7 +588,7 @@ describe('validateAppDefinition', () => {
         ]);
         expect(result.valid).toBe(true);
     });
-    it('should report unknown event listeners', async () => {
+    it('should report unknown event listeners on blocks', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -548,6 +628,50 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
+    it('should report unknown event listeners on controller', async () => {
+        const app = createTestApp();
+        app.pages[0].blocks.push({
+            type: 'test',
+            version: '1.2.3',
+            events: {
+                emit: {
+                    foo: 'bar',
+                },
+            },
+        });
+        app.controller = {
+            events: {
+                listen: {
+                    foo: 'bar',
+                },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [
+            {
+                name: '@appsemble/test',
+                version: '1.2.3',
+                files: [],
+                languages: [],
+                wildcardActions: true,
+                events: {
+                    emit: { foo: {} },
+                },
+            },
+        ], {
+            events: {
+                listen: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('is an unknown event listener', 'bar', undefined, [
+                'controller',
+                'events',
+                'listen',
+                'foo',
+            ]),
+        ]);
+    });
     it('should allow $any matching unknown event listener', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
@@ -577,7 +701,7 @@ describe('validateAppDefinition', () => {
         ]);
         expect(result.valid).toBe(true);
     });
-    it('should report unmatched event listeners', async () => {
+    it('should report unmatched event listeners when there is no controller present', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -613,7 +737,7 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
-    it('should report unmatched event emitters', async () => {
+    it('should report unmatched event emitters when there is no controller present', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -649,7 +773,7 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
-    it('should report unmatched event from event actions', async () => {
+    it('should report unmatched event from event actions when there is no controller present', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -702,6 +826,12 @@ describe('validateAppDefinition', () => {
         const result = await validateAppDefinition(app, () => []);
         expect(result.valid).toBe(true);
     });
+    it('should not crash if controller is undefined', async () => {
+        const app = createTestApp();
+        app.controller = undefined;
+        const result = await validateAppDefinition(app, () => [], {});
+        expect(result.valid).toBe(true);
+    });
     it('should report if notifications is "login" without a security definition', async () => {
         const app = createTestApp();
         delete app.security;
@@ -1559,7 +1689,7 @@ describe('validateAppDefinition', () => {
             new ValidationError('was defined but ‘onFlowCancel’ page action wasn’t defined', 'flow.cancel', undefined, ['pages', 3, 'steps', 1, 'blocks', 0, 'actions', 'onWhatever', 'type']),
         ]);
     });
-    it('should report an error if a resource action refers to a non-existent resource', async () => {
+    it('should report an error if a resource action on a block refers to a non-existent resource', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -1595,7 +1725,32 @@ describe('validateAppDefinition', () => {
             ]),
         ]);
     });
-    it('should report an error if a resource action refers to a private resource action', async () => {
+    it('should report an error if a resource action on the controller refers to a non-existent resource', async () => {
+        const app = createTestApp();
+        app.controller = {
+            actions: {
+                onWhatever: {
+                    type: 'resource.get',
+                    resource: 'Nonexistent',
+                },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [], {
+            actions: {
+                onWhatever: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('refers to a resource that doesn’t exist', 'resource.get', undefined, [
+                'controller',
+                'actions',
+                'onWhatever',
+                'resource',
+            ]),
+        ]);
+    });
+    it('should report an error if a resource action on a block refers to a private resource action', async () => {
         const app = createTestApp();
         app.pages[0].blocks.push({
             type: 'test',
@@ -1623,7 +1778,27 @@ describe('validateAppDefinition', () => {
             new ValidationError('refers to a resource action that is currently set to private', 'resource.get', undefined, ['pages', 0, 'blocks', 0, 'actions', 'onWhatever', 'resource']),
         ]);
     });
-    it('should report an error if a resource action refers is private action without a security definition', async () => {
+    it('should report an error if a resource action on the controller refers to a private resource action', async () => {
+        const app = createTestApp();
+        app.controller = {
+            actions: {
+                onWhatever: {
+                    type: 'resource.get',
+                    resource: 'person',
+                },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [], {
+            actions: {
+                onWhatever: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('refers to a resource action that is currently set to private', 'resource.get', undefined, ['controller', 'actions', 'onWhatever', 'resource']),
+        ]);
+    });
+    it('should report an error if a resource action on a block refers is private action without a security definition', async () => {
         const { security, ...app } = createTestApp();
         app.resources.person.roles = [];
         app.pages[0].blocks.push({
@@ -1652,6 +1827,27 @@ describe('validateAppDefinition', () => {
             new ValidationError('refers to a resource action that is accessible when logged in, but the app has no security definitions', 'resource.get', undefined, ['pages', 0, 'blocks', 0, 'actions', 'onWhatever', 'resource']),
         ]);
     });
+    it('should report an error if a resource action on the controller refers is private action without a security definition', async () => {
+        const { security, ...app } = createTestApp();
+        app.resources.person.roles = [];
+        app.controller = {
+            actions: {
+                onWhatever: {
+                    type: 'resource.get',
+                    resource: 'person',
+                },
+            },
+        };
+        const result = await validateAppDefinition(app, () => [], {
+            actions: {
+                onWhatever: {},
+            },
+        });
+        expect(result.valid).toBe(false);
+        expect(result.errors).toStrictEqual([
+            new ValidationError('refers to a resource action that is accessible when logged in, but the app has no security definitions', 'resource.get', undefined, ['controller', 'actions', 'onWhatever', 'resource']),
+        ]);
+    });
     it('should ignore if an app is null', async () => {
         const result = await validateAppDefinition(null, () => []);
         expect(result.valid).toBe(true);