@byline/core 6.3.0 → 6.4.0

package/dist/services/document-lifecycle.test.node.js

@@ -337,6 +337,68 @@ describe('Document lifecycle service', () => {
     // createDocument
     // -----------------------------------------------------------------------
     describe('createDocument', () => {
+        it.each(['explicit', 'legacy'])('rejects a create-only published override (%s)', async (source) => {
+            const { db, createDocumentVersion } = createMockDb();
+            const ctx = buildCtx(db);
+            ctx.requestContext = createRequestContext({
+                actor: new AdminAuth({ id: 'editor', abilities: ['collections.articles.create'] }),
+            });
+            await expect(createDocument(ctx, {
+                data: { title: 'Hello', ...(source === 'legacy' ? { status: 'published' } : {}) },
+                ...(source === 'explicit' ? { status: 'published' } : {}),
+            })).rejects.toMatchObject({ code: AuthErrorCodes.FORBIDDEN });
+            expect(createDocumentVersion).not.toHaveBeenCalled();
+        });
+        it('rejects undeclared statuses and hook-produced publication', async () => {
+            const { db, createDocumentVersion } = createMockDb();
+            await expect(createDocument(buildCtx(db), { data: { title: 'Hello' }, status: 'bogus' })).rejects.toMatchObject({ code: ErrorCodes.VALIDATION });
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                hooks: {
+                    beforeCreate: ({ data }) => {
+                        data.status = 'published';
+                    },
+                },
+            });
+            ctx.requestContext = createRequestContext({
+                actor: new AdminAuth({ id: 'editor', abilities: ['collections.articles.create'] }),
+            });
+            await expect(createDocument(ctx, { data: { title: 'Hello' } })).rejects.toMatchObject({
+                code: AuthErrorCodes.FORBIDDEN,
+            });
+            expect(createDocumentVersion).not.toHaveBeenCalled();
+        });
+        it('preserves publication by configured default for create-only actors', async () => {
+            const { db, createDocumentVersion } = createMockDb();
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                workflow: { statuses: [{ name: 'published', label: 'Published' }] },
+            });
+            ctx.requestContext = createRequestContext({
+                actor: new AdminAuth({ id: 'editor', abilities: ['collections.articles.create'] }),
+            });
+            await createDocument(ctx, { data: { title: 'Hello' } });
+            expect(createDocumentVersion).toHaveBeenCalledWith(expect.objectContaining({ status: 'published' }));
+        });
+        it('rejects missing required data and values invalidated by hooks before persistence', async () => {
+            const { db, createDocumentVersion } = createMockDb();
+            await expect(createDocument(buildCtx(db), { data: {} })).rejects.toMatchObject({
+                code: ErrorCodes.VALIDATION,
+                details: { reason: 'invalid_document_fields' },
+            });
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                hooks: {
+                    beforeCreate: ({ data }) => {
+                        data.title = 42;
+                    },
+                },
+            });
+            await expect(createDocument(ctx, { data: { title: 'Hello' } })).rejects.toMatchObject({
+                code: ErrorCodes.VALIDATION,
+            });
+            expect(createDocumentVersion).not.toHaveBeenCalled();
+        });
         it('calls createDocumentVersion and returns IDs', async () => {
             const { db, createDocumentVersion } = createMockDb();
             const ctx = buildCtx(db);
@@ -2208,7 +2270,10 @@ describe('Document lifecycle service', () => {
         }
         it('reads the source with locale: "all" and re-emits via createDocumentVersion', async () => {
             const { db, createDocumentVersion, sourceVersionId, sourceFields, currentVersionId } = setupRestore();
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             const result = await restoreDocumentVersion(ctx, {
                 expectedRevision: 1,
                 documentId: 'doc-1',
@@ -2231,9 +2296,137 @@ describe('Document lifecycle service', () => {
                 sourceVersionId,
             });
         });
+        describe('exemption from field validation', () => {
+            // A historical version cannot be corrected through ordinary editing
+            // before it is restored, and both the schema and the validation rules
+            // may have moved since it was written. Enforcing today's rules would
+            // make that content permanently unrecoverable.
+            const tightened = {
+                ...minimalCollection,
+                fields: [
+                    { name: 'title', type: 'text', localized: true },
+                    { name: 'summary', type: 'text', label: 'Summary' },
+                ],
+            };
+            it('restores a version that predates a required field and reports it', async () => {
+                const { db, createDocumentVersion, sourceVersionId } = setupRestore();
+                const result = await restoreDocumentVersion(buildCtx(db, tightened), {
+                    expectedRevision: 1,
+                    documentId: 'doc-1',
+                    sourceVersionId,
+                });
+                expect(createDocumentVersion).toHaveBeenCalledOnce();
+                expect(result.validationIssues).toEqual([
+                    { field: 'summary', message: 'Summary is required', kind: 'required' },
+                ]);
+            });
+            it('restores content that fails a rule the schema never changed', async () => {
+                // The corrected email rule is the concrete case: a version written
+                // when the rule was inert must stay restorable.
+                const emailCollection = {
+                    ...minimalCollection,
+                    fields: [
+                        { name: 'title', type: 'text', localized: true },
+                        {
+                            name: 'contact',
+                            type: 'text',
+                            validation: { rules: [{ type: 'email', value: true }] },
+                        },
+                    ],
+                };
+                const { db, createDocumentVersion, sourceVersionId } = setupRestore({
+                    sourceFields: { title: { en: 'Old EN' }, contact: 'not-an-email' },
+                });
+                const result = await restoreDocumentVersion(buildCtx(db, emailCollection), {
+                    expectedRevision: 1,
+                    documentId: 'doc-1',
+                    sourceVersionId,
+                });
+                expect(createDocumentVersion).toHaveBeenCalledOnce();
+                expect(result.validationIssues?.map((issue) => issue.field)).toEqual(['contact']);
+                expect(result.validationIssues?.[0]?.kind).toBe('invalid');
+            });
+            it('restores into a published default status, republishing invalid content', async () => {
+                // Accepted recovery semantics, not a guarantee about restored content.
+                const publishedOnly = {
+                    ...tightened,
+                    workflow: {
+                        statuses: [
+                            { name: 'draft', label: 'Draft' },
+                            { name: 'published', label: 'Published' },
+                            { name: 'archived', label: 'Archived' },
+                        ],
+                        defaultStatus: 'published',
+                    },
+                };
+                const { db, createDocumentVersion, sourceVersionId } = setupRestore();
+                const result = await restoreDocumentVersion(buildCtx(db, publishedOnly), {
+                    expectedRevision: 1,
+                    documentId: 'doc-1',
+                    sourceVersionId,
+                });
+                expect(createDocumentVersion.mock.calls[0]?.[0].status).toBe('published');
+                expect(result.validationIssues?.map((issue) => issue.field)).toEqual(['summary']);
+            });
+            it('omits validationIssues when the source satisfies the current rules', async () => {
+                const { db, sourceVersionId } = setupRestore({
+                    sourceFields: { title: { en: 'Old EN' }, summary: 'Present' },
+                });
+                const result = await restoreDocumentVersion(buildCtx(db, tightened), {
+                    expectedRevision: 1,
+                    documentId: 'doc-1',
+                    sourceVersionId,
+                });
+                expect(result.validationIssues).toBeUndefined();
+            });
+            it('is not blocked by a validator that throws on the historical shape', async () => {
+                // The diagnostic pass runs schema-author code against data it may not
+                // anticipate. An exception there must not abort recovery.
+                const throwing = {
+                    ...minimalCollection,
+                    fields: [
+                        { name: 'title', type: 'text', localized: true },
+                        {
+                            name: 'slug',
+                            type: 'text',
+                            optional: true,
+                            validate: (value) => (value.trim() === '' ? 'empty' : undefined),
+                        },
+                    ],
+                };
+                const { db, createDocumentVersion, sourceVersionId } = setupRestore();
+                const result = await restoreDocumentVersion(buildCtx(db, throwing), {
+                    expectedRevision: 1,
+                    documentId: 'doc-1',
+                    sourceVersionId,
+                });
+                expect(createDocumentVersion).toHaveBeenCalledOnce();
+                expect(result.validationIssues?.map((issue) => issue.field)).toEqual(['slug']);
+                expect(result.validationIssues?.[0]?.message).toBe('slug: could not be validated');
+            });
+            it('does not extend the exemption to duplication', async () => {
+                // Duplicate reads the current version, which the editor can open and
+                // correct, so it keeps the gate.
+                const { db } = setupRestore();
+                vi.mocked(db.queries.documents.getDocumentById).mockResolvedValue({
+                    document_version_id: 'ver-current',
+                    document_id: 'doc-1',
+                    path: 'sticky-path',
+                    status: 'published',
+                    fields: { title: { en: 'Current' } },
+                });
+                await expect(duplicateDocument(buildCtx(db, tightened), {
+                    expectedRevision: 1,
+                    sourceDocumentId: 'doc-1',
+                })).rejects.toThrow('Some document fields are invalid');
+            });
+        });
         it('hard-defaults the new version status to the workflow default (never inherits source status)', async () => {
             const { db, createDocumentVersion, sourceVersionId } = setupRestore();
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             await restoreDocumentVersion(ctx, {
                 expectedRevision: 1,
                 documentId: 'doc-1',
@@ -2246,7 +2439,10 @@ describe('Document lifecycle service', () => {
             const { db, createDocumentVersion, sourceVersionId } = setupRestore({
                 currentPath: 'sticky-path',
             });
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             await restoreDocumentVersion(ctx, {
                 expectedRevision: 1,
                 documentId: 'doc-1',
@@ -2261,7 +2457,10 @@ describe('Document lifecycle service', () => {
             const { db, sourceVersionId, createDocumentVersion } = setupRestore({
                 sourceDocumentId: 'doc-OTHER',
             });
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             try {
                 await restoreDocumentVersion(ctx, {
                     expectedRevision: 1,
@@ -2296,7 +2495,10 @@ describe('Document lifecycle service', () => {
                 created_at: new Date(),
                 updated_at: new Date(),
             });
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             try {
                 await restoreDocumentVersion(ctx, {
                     expectedRevision: 1,
@@ -2314,7 +2516,11 @@ describe('Document lifecycle service', () => {
             const beforeUpdate = vi.fn();
             const afterUpdate = vi.fn();
             const { db, sourceVersionId } = setupRestore();
-            const definition = { ...minimalCollection, hooks: { beforeUpdate, afterUpdate } };
+            const definition = {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+                hooks: { beforeUpdate, afterUpdate },
+            };
             const ctx = buildCtx(db, definition);
             await restoreDocumentVersion(ctx, {
                 expectedRevision: 1,
@@ -2340,6 +2546,7 @@ describe('Document lifecycle service', () => {
             const { db, sourceVersionId, createDocumentVersion } = setupRestore();
             const definition = {
                 ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
                 hooks: { afterUpdate: vi.fn().mockRejectedValue(new Error('search unavailable')) },
             };
             await expect(restoreDocumentVersion(buildCtx(db, definition), {
@@ -2359,7 +2566,10 @@ describe('Document lifecycle service', () => {
         });
         it('throws ERR_FORBIDDEN when actor lacks collections.<path>.update', async () => {
             const { db, sourceVersionId } = setupRestore();
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             const actor = new AdminAuth({
                 id: 'editor',
                 abilities: ['collections.articles.read'],
@@ -2380,7 +2590,10 @@ describe('Document lifecycle service', () => {
         });
         it('permits restore when actor holds only collections.<path>.update (no separate restore verb needed)', async () => {
             const { db, createDocumentVersion, sourceVersionId } = setupRestore();
-            const ctx = buildCtx(db);
+            const ctx = buildCtx(db, {
+                ...minimalCollection,
+                fields: [{ name: 'title', type: 'text', localized: true }],
+            });
             const actor = new AdminAuth({
                 id: 'editor',
                 abilities: ['collections.articles.update', 'collections.articles.read'],
@@ -2738,7 +2951,7 @@ describe('Document lifecycle service', () => {
             useAsTitle: 'title',
             fields: [
                 { name: 'title', type: 'text', localized: true },
-                { name: 'tagline', type: 'text', localized: true },
+                { name: 'tagline', type: 'text', optional: true, localized: true },
                 { name: 'sku', type: 'text' /* non-localized */ },
                 {
                     name: 'sections',

package/dist/services/normalize-numeric-fields.d.ts

@@ -14,7 +14,7 @@ export declare function isCanonicalNumericValue(fieldType: CanonicalNumericField
  * Convert a tolerant numeric write value to its canonical representation.
  * `undefined` means the value was empty and should be removed.
  */
-export declare function normalizeNumericValue(fieldType: CanonicalNumericFieldType, value: unknown, path: string): CanonicalNumericValue | undefined;
+export declare function normalizeNumericValue(fieldType: CanonicalNumericFieldType, value: unknown, path: string, issuePath?: string): CanonicalNumericValue | undefined;
 /**
  * Normalize every user-writable numeric leaf in a schema-shaped data tree.
  * Mutates `data` in place. Counter fields are deliberately excluded because

package/dist/services/normalize-numeric-fields.js

@@ -21,32 +21,32 @@ export function isCanonicalNumericValue(fieldType, value) {
  * Convert a tolerant numeric write value to its canonical representation.
  * `undefined` means the value was empty and should be removed.
  */
-export function normalizeNumericValue(fieldType, value, path) {
+export function normalizeNumericValue(fieldType, value, path, issuePath = path) {
     if (typeof value === 'string') {
         const trimmed = value.trim();
         if (trimmed === '')
             return undefined;
         if (!NUMERIC_LITERAL_RE.test(trimmed))
-            throwNumericValidation(fieldType, value, path);
+            throwNumericValidation(fieldType, value, path, issuePath);
         if (fieldType === 'decimal')
             return trimmed;
         const numberValue = Number(trimmed);
         if (!Number.isFinite(numberValue))
-            throwNumericValidation(fieldType, value, path);
+            throwNumericValidation(fieldType, value, path, issuePath);
         if (fieldType === 'integer' && !Number.isInteger(numberValue)) {
-            throwNumericValidation(fieldType, value, path);
+            throwNumericValidation(fieldType, value, path, issuePath);
         }
         return numberValue;
     }
     if (typeof value === 'number') {
         if (!Number.isFinite(value))
-            throwNumericValidation(fieldType, value, path);
+            throwNumericValidation(fieldType, value, path, issuePath);
         if (fieldType === 'integer' && !Number.isInteger(value)) {
-            throwNumericValidation(fieldType, value, path);
+            throwNumericValidation(fieldType, value, path, issuePath);
         }
         return fieldType === 'decimal' ? String(value) : value;
     }
-    throwNumericValidation(fieldType, value, path);
+    throwNumericValidation(fieldType, value, path, issuePath);
 }
 /**
  * Normalize every user-writable numeric leaf in a schema-shaped data tree.
@@ -59,15 +59,15 @@ export function normalizeNumericFields(fields, data) {
             continue;
         if (leaf.field.localized === true && isLocaleMap(leaf.value)) {
             for (const [locale, localeValue] of Object.entries(leaf.value)) {
-                normalizeLeafValue(leaf.field.type, leaf.value, locale, localeValue, `${leaf.fieldPath}.${locale}`);
+                normalizeLeafValue(leaf.field.type, leaf.value, locale, localeValue, `${leaf.fieldPath}.${locale}`, toInstancePath(data, `${leaf.fieldPath}.${locale}`));
             }
             continue;
         }
-        normalizeLeafValue(leaf.field.type, leaf.parent, leaf.key, leaf.value, leaf.fieldPath);
+        normalizeLeafValue(leaf.field.type, leaf.parent, leaf.key, leaf.value, leaf.fieldPath, toInstancePath(data, leaf.fieldPath));
     }
 }
-function normalizeLeafValue(fieldType, parent, key, value, path) {
-    const normalized = normalizeNumericValue(fieldType, value, path);
+function normalizeLeafValue(fieldType, parent, key, value, path, issuePath) {
+    const normalized = normalizeNumericValue(fieldType, value, path, issuePath);
     if (normalized === undefined) {
         delete parent[key];
     }
@@ -81,9 +81,34 @@ function isWritableNumericType(type) {
 function isLocaleMap(value) {
     return value != null && typeof value === 'object' && !Array.isArray(value);
 }
-function throwNumericValidation(fieldType, value, path) {
+function throwNumericValidation(fieldType, value, path, issuePath) {
     throw ERR_VALIDATION({
         message: `invalid ${fieldType} value at '${path}'`,
-        details: { path, fieldType, value },
+        details: {
+            reason: 'invalid_document_fields',
+            issues: [{ field: issuePath, message: `Invalid ${fieldType} value` }],
+            path,
+            fieldType,
+            value,
+        },
     });
 }
+/** Map walker diagnostic indices to the editor's stable instance paths. */
+function toInstancePath(data, path) {
+    let current = data;
+    let result = '';
+    for (const part of path.split('.')) {
+        if (Array.isArray(current) && /^\d+$/.test(part)) {
+            current = current[Number(part)];
+            result +=
+                typeof current?._id === 'string' && /^[\w-]+$/.test(current._id)
+                    ? `[id=${current._id}]`
+                    : `[${part}]`;
+        }
+        else {
+            result += `${result ? '.' : ''}${part}`;
+            current = current?.[part];
+        }
+    }
+    return result;
+}

package/dist/services/normalize-numeric-fields.test.node.js

@@ -86,6 +86,14 @@ describe('normalizeNumericFields', () => {
             details: expect.objectContaining({ path: 'nested.2.value' }),
         }));
     });
+    it('preserves diagnostic paths and maps field errors to stable item identities', () => {
+        expect(() => normalizeNumericFields(fields, { rows: [{ _id: 'row-1', quantity: 'bad' }] })).toThrowError(expect.objectContaining({
+            details: expect.objectContaining({
+                path: 'rows.0.quantity',
+                issues: [{ field: 'rows[id=row-1].quantity', message: 'Invalid integer value' }],
+            }),
+        }));
+    });
     it('throws a BylineError with ERR_VALIDATION', () => {
         try {
             normalizeNumericValue('integer', {}, 'count');

package/dist/services/restore-review-probe.test.node.d.ts

@@ -0,0 +1,8 @@
+/**
+ * This Source Code is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * Copyright (c) Infonomic Company Limited
+ */
+export {};