@carthooks/arcubase-cli 0.1.20 → 0.1.21

package/bundle/arcubase-admin.mjs

@@ -605,6 +605,27 @@ var adminCommands = [
     "queryParams": [],
     "responseType": "AppIngressUpdateRespVO"
   },
+  {
+    "scope": "admin",
+    "module": "access-rule",
+    "functionName": "bulkApplyEntityIngress",
+    "commandPath": [
+      "access-rule",
+      "bulk-apply"
+    ],
+    "method": "POST",
+    "endpoint": "/api/apps/:app_id/access-rules/bulk-apply",
+    "pathParams": [
+      {
+        "param": "app_id",
+        "flag": "app-id"
+      }
+    ],
+    "controller": "App.IngressBulkApply",
+    "requestType": "AppIngressBulkApplyReqVO",
+    "queryParams": [],
+    "responseType": "AppIngressBulkApplyRespVO"
+  },
   {
     "scope": "admin",
     "module": "workflow",
@@ -16092,6 +16113,8 @@ var PermitFieldPermitSchema = external_exports.lazy(() => external_exports.objec
 var PermitPolicySchema = external_exports.lazy(() => external_exports.object({ "actions": external_exports.array(external_exports.string()).optional(), "all_fields_read": external_exports.boolean().optional(), "all_fields_write": external_exports.boolean().optional(), "condition": PermitConditionSetSchema.optional(), "description": external_exports.string().optional(), "fields": external_exports.array(PermitFieldPermitSchema).optional(), "id": external_exports.string().optional(), "key": external_exports.string().optional(), "name": external_exports.string().optional() }).strict());
 var PermitUserScopeSchema = external_exports.lazy(() => external_exports.object({ "data": external_exports.object({ "name": external_exports.string().optional() }).strict().optional(), "id": external_exports.number().optional(), "type": external_exports.string().optional() }).strict());
 var EntityIngressOptionsSchema = external_exports.lazy(() => external_exports.object({ "i18n_name": I18NTextSchema.optional(), "list_options": PermitEntityListOptionsSchema.optional(), "policy": PermitPolicySchema.optional(), "user_scope": external_exports.array(PermitUserScopeSchema).optional() }).strict());
+var AppIngressBulkApplyItemVOSchema = external_exports.lazy(() => external_exports.object({ "enabled": external_exports.boolean().optional(), "name": external_exports.string().optional(), "options": EntityIngressOptionsSchema.optional(), "rule_id": external_exports.number().optional(), "table_id": external_exports.number().optional(), "type": external_exports.string().optional() }).strict());
+var AppIngressBulkApplyReqVOSchema = external_exports.lazy(() => external_exports.object({ "dry_run": external_exports.boolean().optional(), "items": external_exports.array(AppIngressBulkApplyItemVOSchema).optional(), "mode": external_exports.string().optional() }).strict());
 var AppIngressCreateReqVOSchema = external_exports.lazy(() => external_exports.object({ "enabled": external_exports.boolean().optional(), "entity_id": external_exports.number().optional(), "icon_name": external_exports.string().optional(), "name": external_exports.string().optional(), "options": EntityIngressOptionsSchema.optional(), "type": external_exports.string().optional(), "url": external_exports.string().optional() }).strict());
 var AppIngressUpdateReqVOSchema = external_exports.lazy(() => external_exports.object({ "enabled": external_exports.boolean().optional(), "name": external_exports.string().optional(), "options": EntityIngressOptionsSchema.optional(), "update": external_exports.array(external_exports.string()).optional() }).strict());
 var GormDeletedAtSchema = external_exports.lazy(() => external_exports.object({ "Time": external_exports.string().optional(), "Valid": external_exports.boolean().optional() }).strict());
@@ -16159,6 +16182,7 @@ var UserProfileUpdateReqVOSchema = external_exports.lazy(() => external_exports.
 var bodySchemas = {
   "AppCreateByTenantsReqVO": AppCreateByTenantsReqVOSchema,
   "AppCreateEntityReqVO": AppCreateEntityReqVOSchema,
+  "AppIngressBulkApplyReqVO": AppIngressBulkApplyReqVOSchema,
   "AppIngressCreateReqVO": AppIngressCreateReqVOSchema,
   "AppIngressUpdateReqVO": AppIngressUpdateReqVOSchema,
   "AppUpdateAppReqVO": AppUpdateAppReqVOSchema,
@@ -16193,6 +16217,10 @@ var typeIndex = {
     "file": "types/app.ts",
     "dependencies": []
   },
+  "AppIngressBulkApplyReqVO": {
+    "file": "types/ingress.ts",
+    "dependencies": []
+  },
   "AppIngressCreateReqVO": {
     "file": "types/ingress.ts",
     "dependencies": []
@@ -17053,6 +17081,10 @@ var docHintIndex = {
     { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
     examplesIndexDocHint
   ],
+  AppIngressBulkApplyReqVO: [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
+    examplesIndexDocHint
+  ],
   EntitySaveReqVO: [
     { title: "Table schema cheatsheet", file: "docs/runtime-reference/entity-schema.md" },
     { title: "Field type index", file: "docs/runtime-reference/entity-schema/README.md" },
@@ -17166,6 +17198,10 @@ var commandDocHintIndex = {
     { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
     examplesIndexDocHint
   ],
+  "admin.access-rule.bulkApplyEntityIngress": [
+    { title: "Access rule", file: "docs/runtime-reference/access-rule.md" },
+    examplesIndexDocHint
+  ],
   "user.row.insertEntity": [
     { title: "Row CRUD", file: "docs/runtime-reference/row-crud.md" },
     { title: "Uploads", file: "docs/runtime-reference/uploads.md" },
@@ -17454,6 +17490,161 @@ var helpExamplesIndex = {
       }
     ]
   },
+  "admin.access-rule.bulk-apply": {
+    "command": [
+      "access-rule",
+      "bulk-apply"
+    ],
+    "examples": [
+      {
+        "title": "upsert permission matrix by rule name in one transaction",
+        "body": {
+          "mode": "upsert_by_name",
+          "items": [
+            {
+              "table_id": 2188893443,
+              "name": "Customer archive - sales owns rows",
+              "enabled": true,
+              "type": "form",
+              "options": {
+                "user_scope": [
+                  {
+                    "type": "department",
+                    "id": 2188881201
+                  }
+                ],
+                "policy": {
+                  "key": "custom",
+                  "actions": [
+                    "view",
+                    "add",
+                    "edit"
+                  ],
+                  "all_fields_read": true,
+                  "all_fields_write": true,
+                  "condition": {
+                    "mode": "and",
+                    "conditions": [
+                      {
+                        "column": "creator",
+                        "operator": "$eq",
+                        "value": "[[current_user]]",
+                        "value_from": 0,
+                        "value_relation": ""
+                      }
+                    ]
+                  }
+                },
+                "list_options": {}
+              }
+            },
+            {
+              "table_id": 2188893444,
+              "name": "Lead review - manager queue",
+              "enabled": true,
+              "type": "form",
+              "options": {
+                "user_scope": [
+                  {
+                    "type": "actor",
+                    "id": 2188883301
+                  }
+                ],
+                "policy": {
+                  "key": "custom",
+                  "actions": [
+                    "view",
+                    "edit"
+                  ],
+                  "all_fields_read": true,
+                  "all_fields_write": true,
+                  "condition": {
+                    "mode": "and",
+                    "conditions": [
+                      {
+                        "column": ":1004",
+                        "operator": "$eq",
+                        "value": "pending",
+                        "value_from": 0,
+                        "value_relation": ""
+                      },
+                      {
+                        "column": "",
+                        "operator": "",
+                        "value": null,
+                        "value_from": 0,
+                        "value_relation": "",
+                        "subset": {
+                          "mode": "or",
+                          "conditions": [
+                            {
+                              "column": "creator",
+                              "operator": "$eq",
+                              "value": "[[current_user]]",
+                              "value_from": 0,
+                              "value_relation": ""
+                            },
+                            {
+                              "column": ":1005",
+                              "operator": "$eq",
+                              "value": "high",
+                              "value_from": 0,
+                              "value_relation": ""
+                            }
+                          ]
+                        }
+                      }
+                    ]
+                  }
+                },
+                "list_options": {}
+              }
+            }
+          ]
+        },
+        "notes": [
+          "mode upsert_by_name is for idempotent setup; rule names must be unique within each table",
+          "department, actor, and specific user scopes all use options.user_scope",
+          "row-owner isolation uses [[current_user]] in policy.condition"
+        ]
+      },
+      {
+        "title": "preview updates for existing rule ids",
+        "body": {
+          "mode": "update_existing",
+          "dry_run": true,
+          "items": [
+            {
+              "table_id": 2188893443,
+              "rule_id": 2188893557,
+              "enabled": true,
+              "options": {
+                "user_scope": [
+                  {
+                    "type": "user",
+                    "id": 2188889901
+                  }
+                ],
+                "policy": {
+                  "key": "custom",
+                  "actions": [
+                    "view"
+                  ],
+                  "all_fields_read": true,
+                  "all_fields_write": false
+                },
+                "list_options": {}
+              }
+            }
+          ]
+        },
+        "notes": [
+          "dry_run true returns the planned operations without writing",
+          "update_existing requires rule_id on every item"
+        ]
+      }
+    ]
+  },
   "admin.access-rule.create": {
     "command": [
       "access-rule",
@@ -18269,6 +18460,9 @@ function buildTableCreateExampleBody() {
 function isAssignUsersCommand(scope, command) {
   return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "assign-users";
 }
+function isAccessRuleBulkApplyCommand(scope, command) {
+  return scope === "admin" && command.commandPath[0] === "access-rule" && command.commandPath[1] === "bulk-apply";
+}
 function isTableCreateCommand(scope, command) {
   return scope === "admin" && command.commandPath[0] === "table" && command.commandPath[1] === "create";
 }
@@ -18677,30 +18871,111 @@ function validateAccessRuleUserScope(scope, command, requestType, userScope, env
   }
 }
 function normalizeNumericAccessRuleUserScopeIDs(scope, command, body) {
-  if (!isAccessRuleCommand(scope, command) || !isRecord3(body) || !isRecord3(body.options) || !Array.isArray(body.options.user_scope)) {
+  if (!isAccessRuleCommand(scope, command) || !isRecord3(body)) {
     return body;
   }
-  let changed = false;
-  const userScope = body.options.user_scope.map((item) => {
-    if (!isRecord3(item) || typeof item.id !== "string" || !/^\d+$/.test(item.id)) {
-      return item;
-    }
-    const id = Number(item.id);
-    if (!Number.isFinite(id) || !Number.isInteger(id)) {
-      return item;
-    }
-    changed = true;
-    return { ...item, id };
-  });
-  if (!changed) return body;
+  const normalizeUserScope = (userScope) => {
+    if (!Array.isArray(userScope)) return { value: userScope, changed: false };
+    let changed = false;
+    const value = userScope.map((item) => {
+      if (!isRecord3(item) || typeof item.id !== "string" || !/^\d+$/.test(item.id)) {
+        return item;
+      }
+      const id = Number(item.id);
+      if (!Number.isFinite(id) || !Number.isInteger(id)) {
+        return item;
+      }
+      changed = true;
+      return { ...item, id };
+    });
+    return { value, changed };
+  };
+  const normalizeNumericID = (value) => {
+    if (typeof value !== "string" || !/^\d+$/.test(value)) return { value, changed: false };
+    const id = Number(value);
+    if (!Number.isFinite(id) || !Number.isInteger(id)) return { value, changed: false };
+    return { value: id, changed: true };
+  };
+  if (isAccessRuleBulkApplyCommand(scope, command) && Array.isArray(body.items)) {
+    let changed = false;
+    const items = body.items.map((item) => {
+      if (!isRecord3(item)) return item;
+      let nextItem = item;
+      for (const key of ["table_id", "rule_id"]) {
+        const normalized = normalizeNumericID(nextItem[key]);
+        if (normalized.changed) {
+          nextItem = { ...nextItem, [key]: normalized.value };
+          changed = true;
+        }
+      }
+      if (isRecord3(nextItem.options)) {
+        const normalizedUserScope2 = normalizeUserScope(nextItem.options.user_scope);
+        if (normalizedUserScope2.changed) {
+          nextItem = {
+            ...nextItem,
+            options: {
+              ...nextItem.options,
+              user_scope: normalizedUserScope2.value
+            }
+          };
+          changed = true;
+        }
+      }
+      return nextItem;
+    });
+    return changed ? { ...body, items } : body;
+  }
+  if (!isRecord3(body.options)) {
+    return body;
+  }
+  const normalizedUserScope = normalizeUserScope(body.options.user_scope);
+  if (!normalizedUserScope.changed) return body;
   return {
     ...body,
     options: {
       ...body.options,
-      user_scope: userScope
+      user_scope: normalizedUserScope.value
     }
   };
 }
+function validateAccessRulePolicyShape(scope, command, requestType, policy, env, pathPrefix) {
+  const actions = policy && Array.isArray(policy.actions) ? policy.actions : [];
+  if (actions.includes("read") || actions.includes("write")) {
+    throwBodyValidationFailure(
+      'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
+      requestType,
+      `${pathPrefix}.actions`,
+      scope,
+      command,
+      env
+    );
+  }
+  const fields = policy && Array.isArray(policy.fields) ? policy.fields : [];
+  const allowedSystemFieldKeys = /* @__PURE__ */ new Set(["created", "updated", "creator"]);
+  for (const [index, field] of fields.entries()) {
+    if (!isRecord3(field)) continue;
+    if (typeof field.key === "number" || typeof field.key === "string" && /^\d+$/.test(field.key)) {
+      throwBodyValidationFailure(
+        'access-rule policy.fields[].key must be a string prefixed with colon, for example ":1002"; do not use raw numbers',
+        requestType,
+        `${pathPrefix}.fields.${index}.key`,
+        scope,
+        command,
+        env
+      );
+    }
+    if (typeof field.key === "string" && !field.key.startsWith(":") && !allowedSystemFieldKeys.has(field.key)) {
+      throwBodyValidationFailure(
+        'access-rule policy.fields[].key must use Arcubase permission keys such as ":1002"; do not use FieldVO.key values such as "vote_name"',
+        requestType,
+        `${pathPrefix}.fields.${index}.key`,
+        scope,
+        command,
+        env
+      );
+    }
+  }
+}
 function requireUpdateContains(scope, command, body, field, env) {
   if (!(field in body)) return;
   const update = stringArray(body.update);
@@ -18746,6 +19021,54 @@ function validateActionSpecificRawBody(scope, command, body, env) {
     }
   }
   if (isAccessRuleCommand(scope, command)) {
+    if (isAccessRuleBulkApplyCommand(scope, command)) {
+      if (!Array.isArray(body.items) || body.items.length === 0) {
+        throwBodyValidationFailure(
+          "access-rule bulk-apply requires non-empty body.items; put every table/rule assignment in body.items",
+          command.requestType,
+          "body.items",
+          scope,
+          command,
+          env
+        );
+      }
+      if (body.mode !== void 0 && body.mode !== "update_existing" && body.mode !== "upsert_by_name") {
+        throwBodyValidationFailure(
+          'access-rule bulk-apply body.mode must be "update_existing" or "upsert_by_name"',
+          command.requestType,
+          "body.mode",
+          scope,
+          command,
+          env
+        );
+      }
+      for (const [index, item] of body.items.entries()) {
+        if (!isRecord3(item)) {
+          throwBodyValidationFailure(
+            "access-rule bulk-apply body.items[] must be an object",
+            command.requestType,
+            `body.items.${index}`,
+            scope,
+            command,
+            env
+          );
+        }
+        const options2 = isRecord3(item.options) ? item.options : void 0;
+        if (!options2) {
+          throwBodyValidationFailure(
+            "access-rule bulk-apply body.items[].options is required and must include the full canonical options object",
+            command.requestType,
+            `body.items.${index}.options`,
+            scope,
+            command,
+            env
+          );
+        }
+        validateAccessRuleUserScope(scope, command, command.requestType, options2.user_scope, env, `body.items.${index}.options.user_scope`);
+        validateAccessRulePolicyShape(scope, command, command.requestType, isRecord3(options2.policy) ? options2.policy : void 0, env, `body.items.${index}.options.policy`);
+      }
+      return;
+    }
     const update = stringArray(body.update);
     if (isAccessRuleUpdateCommand(scope, command) && update.some((item) => item.startsWith("options."))) {
       throwBodyValidationFailure(
@@ -18790,42 +19113,7 @@ function validateActionSpecificRawBody(scope, command, body, env) {
       );
     }
     validateAccessRuleUserScope(scope, command, command.requestType, options?.user_scope, env);
-    const actions = policy && Array.isArray(policy.actions) ? policy.actions : [];
-    if (actions.includes("read") || actions.includes("write")) {
-      throwBodyValidationFailure(
-        'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
-        command.requestType,
-        "body.options.policy.actions",
-        scope,
-        command,
-        env
-      );
-    }
-    const fields = policy && Array.isArray(policy.fields) ? policy.fields : [];
-    const allowedSystemFieldKeys = /* @__PURE__ */ new Set(["created", "updated", "creator"]);
-    for (const [index, field] of fields.entries()) {
-      if (!isRecord3(field)) continue;
-      if (typeof field.key === "number" || typeof field.key === "string" && /^\d+$/.test(field.key)) {
-        throwBodyValidationFailure(
-          'access-rule policy.fields[].key must be a string prefixed with colon, for example ":1002"; do not use raw numbers',
-          command.requestType,
-          `body.options.policy.fields.${index}.key`,
-          scope,
-          command,
-          env
-        );
-      }
-      if (typeof field.key === "string" && !field.key.startsWith(":") && !allowedSystemFieldKeys.has(field.key)) {
-        throwBodyValidationFailure(
-          'access-rule policy.fields[].key must use Arcubase permission keys such as ":1002"; do not use FieldVO.key values such as "vote_name"',
-          command.requestType,
-          `body.options.policy.fields.${index}.key`,
-          scope,
-          command,
-          env
-        );
-      }
-    }
+    validateAccessRulePolicyShape(scope, command, command.requestType, policy, env, "body.options.policy");
   }
 }
 function validateActionSpecificBody(scope, command, flags, body, env) {