@carthooks/arcubase-cli 0.1.20 → 0.1.21

package/src/runtime/execute.ts

@@ -637,6 +637,10 @@ function isAssignUsersCommand(scope: CommandScope, command: NonNullable<ReturnTy
   return scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'assign-users'
 }
 
+function isAccessRuleBulkApplyCommand(scope: CommandScope, command: NonNullable<ReturnType<typeof findCommand>>): boolean {
+  return scope === 'admin' && command.commandPath[0] === 'access-rule' && command.commandPath[1] === 'bulk-apply'
+}
+
 function isTableCreateCommand(scope: CommandScope, command: NonNullable<ReturnType<typeof findCommand>>): boolean {
   return scope === 'admin' && command.commandPath[0] === 'table' && command.commandPath[1] === 'create'
 }
@@ -1085,33 +1089,124 @@ function normalizeNumericAccessRuleUserScopeIDs(
   command: NonNullable<ReturnType<typeof findCommand>>,
   body: unknown,
 ): unknown {
-  if (!isAccessRuleCommand(scope, command) || !isRecord(body) || !isRecord(body.options) || !Array.isArray(body.options.user_scope)) {
+  if (!isAccessRuleCommand(scope, command) || !isRecord(body)) {
     return body
   }
 
-  let changed = false
-  const userScope = body.options.user_scope.map((item) => {
-    if (!isRecord(item) || typeof item.id !== 'string' || !/^\d+$/.test(item.id)) {
-      return item
-    }
-    const id = Number(item.id)
-    if (!Number.isFinite(id) || !Number.isInteger(id)) {
-      return item
-    }
-    changed = true
-    return { ...item, id }
-  })
+  const normalizeUserScope = (userScope: unknown): { value: unknown; changed: boolean } => {
+    if (!Array.isArray(userScope)) return { value: userScope, changed: false }
+    let changed = false
+    const value = userScope.map((item) => {
+      if (!isRecord(item) || typeof item.id !== 'string' || !/^\d+$/.test(item.id)) {
+        return item
+      }
+      const id = Number(item.id)
+      if (!Number.isFinite(id) || !Number.isInteger(id)) {
+        return item
+      }
+      changed = true
+      return { ...item, id }
+    })
+    return { value, changed }
+  }
+
+  const normalizeNumericID = (value: unknown): { value: unknown; changed: boolean } => {
+    if (typeof value !== 'string' || !/^\d+$/.test(value)) return { value, changed: false }
+    const id = Number(value)
+    if (!Number.isFinite(id) || !Number.isInteger(id)) return { value, changed: false }
+    return { value: id, changed: true }
+  }
+
+  if (isAccessRuleBulkApplyCommand(scope, command) && Array.isArray(body.items)) {
+    let changed = false
+    const items = body.items.map((item) => {
+      if (!isRecord(item)) return item
+      let nextItem: Record<string, unknown> = item
+      for (const key of ['table_id', 'rule_id']) {
+        const normalized = normalizeNumericID(nextItem[key])
+        if (normalized.changed) {
+          nextItem = { ...nextItem, [key]: normalized.value }
+          changed = true
+        }
+      }
+      if (isRecord(nextItem.options)) {
+        const normalizedUserScope = normalizeUserScope(nextItem.options.user_scope)
+        if (normalizedUserScope.changed) {
+          nextItem = {
+            ...nextItem,
+            options: {
+              ...nextItem.options,
+              user_scope: normalizedUserScope.value,
+            },
+          }
+          changed = true
+        }
+      }
+      return nextItem
+    })
+    return changed ? { ...body, items } : body
+  }
 
-  if (!changed) return body
+  if (!isRecord(body.options)) {
+    return body
+  }
+  const normalizedUserScope = normalizeUserScope(body.options.user_scope)
+  if (!normalizedUserScope.changed) return body
   return {
     ...body,
     options: {
       ...body.options,
-      user_scope: userScope,
+      user_scope: normalizedUserScope.value,
     },
   }
 }
 
+function validateAccessRulePolicyShape(
+  scope: CommandScope,
+  command: NonNullable<ReturnType<typeof findCommand>>,
+  requestType: string,
+  policy: Record<string, unknown> | undefined,
+  env: EnvInput,
+  pathPrefix: string,
+) {
+  const actions = policy && Array.isArray(policy.actions) ? policy.actions : []
+  if (actions.includes('read') || actions.includes('write')) {
+    throwBodyValidationFailure(
+      'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
+      requestType,
+      `${pathPrefix}.actions`,
+      scope,
+      command,
+      env,
+    )
+  }
+  const fields = policy && Array.isArray(policy.fields) ? policy.fields : []
+  const allowedSystemFieldKeys = new Set(['created', 'updated', 'creator'])
+  for (const [index, field] of fields.entries()) {
+    if (!isRecord(field)) continue
+    if (typeof field.key === 'number' || (typeof field.key === 'string' && /^\d+$/.test(field.key))) {
+      throwBodyValidationFailure(
+        'access-rule policy.fields[].key must be a string prefixed with colon, for example ":1002"; do not use raw numbers',
+        requestType,
+        `${pathPrefix}.fields.${index}.key`,
+        scope,
+        command,
+        env,
+      )
+    }
+    if (typeof field.key === 'string' && !field.key.startsWith(':') && !allowedSystemFieldKeys.has(field.key)) {
+      throwBodyValidationFailure(
+        'access-rule policy.fields[].key must use Arcubase permission keys such as ":1002"; do not use FieldVO.key values such as "vote_name"',
+        requestType,
+        `${pathPrefix}.fields.${index}.key`,
+        scope,
+        command,
+        env,
+      )
+    }
+  }
+}
+
 function requireUpdateContains(
   scope: CommandScope,
   command: NonNullable<ReturnType<typeof findCommand>>,
@@ -1172,6 +1267,54 @@ function validateActionSpecificRawBody(
   }
 
   if (isAccessRuleCommand(scope, command)) {
+    if (isAccessRuleBulkApplyCommand(scope, command)) {
+      if (!Array.isArray(body.items) || body.items.length === 0) {
+        throwBodyValidationFailure(
+          'access-rule bulk-apply requires non-empty body.items; put every table/rule assignment in body.items',
+          command.requestType,
+          'body.items',
+          scope,
+          command,
+          env,
+        )
+      }
+      if (body.mode !== undefined && body.mode !== 'update_existing' && body.mode !== 'upsert_by_name') {
+        throwBodyValidationFailure(
+          'access-rule bulk-apply body.mode must be "update_existing" or "upsert_by_name"',
+          command.requestType,
+          'body.mode',
+          scope,
+          command,
+          env,
+        )
+      }
+      for (const [index, item] of body.items.entries()) {
+        if (!isRecord(item)) {
+          throwBodyValidationFailure(
+            'access-rule bulk-apply body.items[] must be an object',
+            command.requestType,
+            `body.items.${index}`,
+            scope,
+            command,
+            env,
+          )
+        }
+        const options = isRecord(item.options) ? item.options : undefined
+        if (!options) {
+          throwBodyValidationFailure(
+            'access-rule bulk-apply body.items[].options is required and must include the full canonical options object',
+            command.requestType,
+            `body.items.${index}.options`,
+            scope,
+            command,
+            env,
+          )
+        }
+        validateAccessRuleUserScope(scope, command, command.requestType, options.user_scope, env, `body.items.${index}.options.user_scope`)
+        validateAccessRulePolicyShape(scope, command, command.requestType, isRecord(options.policy) ? options.policy : undefined, env, `body.items.${index}.options.policy`)
+      }
+      return
+    }
     const update = stringArray(body.update)
     if (isAccessRuleUpdateCommand(scope, command) && update.some((item) => item.startsWith('options.'))) {
       throwBodyValidationFailure(
@@ -1216,42 +1359,7 @@ function validateActionSpecificRawBody(
       )
     }
     validateAccessRuleUserScope(scope, command, command.requestType, options?.user_scope, env)
-    const actions = policy && Array.isArray(policy.actions) ? policy.actions : []
-    if (actions.includes('read') || actions.includes('write')) {
-      throwBodyValidationFailure(
-        'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
-        command.requestType,
-        'body.options.policy.actions',
-        scope,
-        command,
-        env,
-      )
-    }
-    const fields = policy && Array.isArray(policy.fields) ? policy.fields : []
-    const allowedSystemFieldKeys = new Set(['created', 'updated', 'creator'])
-    for (const [index, field] of fields.entries()) {
-      if (!isRecord(field)) continue
-      if (typeof field.key === 'number' || (typeof field.key === 'string' && /^\d+$/.test(field.key))) {
-        throwBodyValidationFailure(
-          'access-rule policy.fields[].key must be a string prefixed with colon, for example ":1002"; do not use raw numbers',
-          command.requestType,
-          `body.options.policy.fields.${index}.key`,
-          scope,
-          command,
-          env,
-        )
-      }
-      if (typeof field.key === 'string' && !field.key.startsWith(':') && !allowedSystemFieldKeys.has(field.key)) {
-        throwBodyValidationFailure(
-          'access-rule policy.fields[].key must use Arcubase permission keys such as ":1002"; do not use FieldVO.key values such as "vote_name"',
-          command.requestType,
-          `body.options.policy.fields.${index}.key`,
-          scope,
-          command,
-          env,
-        )
-      }
-    }
+    validateAccessRulePolicyShape(scope, command, command.requestType, policy, env, 'body.options.policy')
   }
 }
 

package/src/runtime/zod_registry.ts

@@ -109,6 +109,10 @@ const docHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
     examplesIndexDocHint,
   ],
+  AppIngressBulkApplyReqVO: [
+    { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
+    examplesIndexDocHint,
+  ],
   EntitySaveReqVO: [
     { title: 'Table schema cheatsheet', file: 'docs/runtime-reference/entity-schema.md' },
     { title: 'Field type index', file: 'docs/runtime-reference/entity-schema/README.md' },
@@ -225,6 +229,10 @@ const commandDocHintIndex: Record<string, RuntimeDocHint[]> = {
     { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
     examplesIndexDocHint,
   ],
+  'admin.access-rule.bulkApplyEntityIngress': [
+    { title: 'Access rule', file: 'docs/runtime-reference/access-rule.md' },
+    examplesIndexDocHint,
+  ],
   'user.row.insertEntity': [
     { title: 'Row CRUD', file: 'docs/runtime-reference/row-crud.md' },
     { title: 'Uploads', file: 'docs/runtime-reference/uploads.md' },

package/src/tests/command_registry.test.ts

@@ -24,6 +24,7 @@ test('admin surface is restricted to reset white list', () => {
     'table rename',
     'table update-schema',
     'access-rule assign-users',
+    'access-rule bulk-apply',
     'access-rule create',
     'access-rule delete',
     'access-rule get',

package/src/tests/execute_validation.test.ts

@@ -1387,6 +1387,92 @@ test('access-rule assign-users accepts canonical mixed user_scope body', async (
   ])
 })
 
+test('access-rule bulk-apply normalizes numeric string ids before validation and request', async () => {
+  const body = JSON.stringify({
+    mode: 'update_existing',
+    items: [
+      {
+        table_id: '2188893443',
+        rule_id: '2188893557',
+        enabled: true,
+        options: {
+          user_scope: [{ type: 'department', id: '2188881201' }],
+          policy: { key: 'custom', actions: ['view'], all_fields_read: true, all_fields_write: false },
+          list_options: {},
+        },
+      },
+    ],
+  })
+  let requestedURL = ''
+  const out = await executeCLI(
+    'admin',
+    ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', body],
+    env as any,
+    async (url, init) => {
+      requestedURL = String(url)
+      return new Response(String(init?.body ?? '{}'), { status: 200 })
+    },
+  )
+  assert.equal(out.kind, 'result')
+  assert.match(requestedURL, /\/api\/apps\/app_1\/access-rules\/bulk-apply$/)
+  assert.equal(out.data.items[0].table_id, 2188893443)
+  assert.equal(out.data.items[0].rule_id, 2188893557)
+  assert.deepEqual(out.data.items[0].options.user_scope, [{ type: 'department', id: 2188881201 }])
+})
+
+test('access-rule bulk-apply rejects empty items before request', async () => {
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', '{"mode":"upsert_by_name","items":[]}'],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppIngressBulkApplyReqVO')
+    assert.match(error.message, /non-empty body.items/)
+    return true
+  })
+})
+
+test('access-rule bulk-apply rejects non-canonical policy actions before request', async () => {
+  const body = JSON.stringify({
+    mode: 'upsert_by_name',
+    items: [
+      {
+        table_id: 2188893443,
+        name: 'Bad read alias',
+        enabled: true,
+        options: {
+          user_scope: [{ type: 'user', id: 2188889901 }],
+          policy: { key: 'custom', actions: ['read'], all_fields_read: true, all_fields_write: false },
+          list_options: {},
+        },
+      },
+    ],
+  })
+  await assert.rejects(async () => {
+    await executeCLI(
+      'admin',
+      ['access-rule', 'bulk-apply', '--app-id', 'app_1', '--body-json', body],
+      env as any,
+      async () => new Response('{}', { status: 200 }),
+    )
+  }, (error: unknown) => {
+    assert.ok(error instanceof CLIError)
+    assert.equal(error.code, 'BODY_VALIDATION_FAILED')
+    assert.equal(error.details?.requestType, 'AppIngressBulkApplyReqVO')
+    assert.match(error.message, /actions must use Arcubase action codes/)
+    assert.deepEqual(error.details?.issues?.[0], {
+      path: 'body.items.0.options.policy.actions',
+      message: 'access-rule policy.actions must use Arcubase action codes: use "view" for read and "add","edit" for write; do not use "read", "write", or "insert"',
+    })
+    return true
+  })
+})
+
 test('access-rule create accepts nested custom policy condition with field columns', async () => {
   const body = JSON.stringify({
     name: 'Sales own or west region',

package/src/tests/help.test.ts

@@ -153,6 +153,19 @@ test('admin access-rule create help-examples show canonical ingress scopes and c
   assert.doesNotMatch(out.text, /"type":"member"/)
 })
 
+test('admin access-rule bulk-apply help-examples show transactional matrix body', async () => {
+  const out = await executeCLI('admin', ['access-rule', 'bulk-apply', '--help-examples'], env as any, async () => new Response('{}'))
+  assert.equal(out.kind, 'help')
+  assert.match(out.text, /arcubase-admin access-rule bulk-apply --help-examples/)
+  assert.match(out.text, /"mode":"upsert_by_name"/)
+  assert.match(out.text, /"table_id":2188893443/)
+  assert.match(out.text, /"type":"department"/)
+  assert.match(out.text, /"type":"actor"/)
+  assert.match(out.text, /"value":"\[\[current_user\]\]"/)
+  assert.doesNotMatch(out.text, forbiddenArcubaseUserTerms())
+  assert.doesNotMatch(out.text, /"type":"member"/)
+})
+
 test('user row bulk-update help-examples show ids and condition selection bodies', async () => {
   const out = await executeCLI('user', ['row', 'bulk-update', '--help-examples'], env as any, async () => new Response('{}'))
   assert.equal(out.kind, 'help')