@colixsystems/widget-sdk 0.123.0 → 0.124.0

package/README.md

@@ -70,7 +70,22 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.123.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.124.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.124.0 (contract 1.96.0)
+
+**A `filterList` condition can scope itself to the signed-in app-user (sc-6282).** `valueMode` used to be `literal` or `relativeDate`, so every filter value was a constant chosen at build time. "Show only my rows" was therefore not something a no-code author could express — it needed a custom widget reading `ctx.user` and filtering client-side, which put the scoping decision in code the server does not enforce.
+
+Two actor-scoped modes join the vocabulary:
+
+- **`currentUser`** on a `USER` column — the rows whose user column is the caller.
+- **`currentUserGroup`** on a `USER_GROUP` column — the rows assigned to any group the caller belongs to (live groups only; a tombstoned group surfaces nothing).
+
+Both **carry no value**. The condition sends the `me` sentinel and the backend resolves the identity from the request actor, so a tampered widget config cannot redirect the sentinel at another user, and a caller with no session matches **nothing** rather than every row. Valid with `eq` / `neq` only — any other operator is rejected as `INVALID_FILTER`, rather than quietly answering "mine".
+
+To be precise about what this is: it scopes what the widget **displays**. It is not an access-control boundary — a signed-in user can always ask for the unfiltered list, so row privacy has to come from the table's record ACL (a creator-only template). Use the two together. `eq` reads as "mine", `neq` as "not mine". In the Studio the author gets a signed-in-user checkbox on the row, offered only for the column type that can carry an identity.
+
+Additive — `literal` and `relativeDate` conditions are unchanged, and an author-supplied `value` is simply ignored by the new modes. `CONTRACT.version` → `1.96.0`.
 
 ### What's new in 0.123.0 (contract unchanged at 1.95.0)
 

package/dist/contract.cjs

@@ -3655,7 +3655,23 @@ const CONTRACT = deepFreeze({
   //    be opened rejects UNSUPPORTED rather than falling back to a file dialog:
   //    the gesture is already spent on the permission prompt, and a file input
   //    clicked outside it would never open.
-  version: "1.95.0",
+  // 1.96.0: additive (sc-6282) -- the `filterList` propertySchema type gains
+  //    two actor-scoped `valueMode`s beside `literal` / `relativeDate`:
+  //    `currentUser` (a USER column) and `currentUserGroup` (a USER_GROUP
+  //    column) scope a condition to the signed-in app-user, so an author can
+  //    build "only my rows" / "only my organization's rows" without a custom
+  //    widget reading `ctx.user`. Both DISCARD the condition's `value` and
+  //    send the `me` sentinel; the backend resolves the identity from the
+  //    request actor, so the sentinel cannot be redirected at another user, and
+  //    wherever it cannot be resolved -- no signed-in app-user, a renamed or
+  //    encrypted column -- it matches NOTHING rather than falling back to every
+  //    row. Valid with `eq` ("mine") and `neq` ("carries none of my
+  //    identities", which includes an unassigned row) only; any other operator
+  //    is rejected as INVALID_FILTER. It scopes what a widget DISPLAYS -- row
+  //    privacy remains the record ACL's job. Existing `literal` and
+  //    `relativeDate` conditions are untouched -- minor bump on the pre-1.0
+  //    channel.
+  version: "1.96.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/contract.js

@@ -3655,7 +3655,23 @@ const CONTRACT = deepFreeze({
   //    be opened rejects UNSUPPORTED rather than falling back to a file dialog:
   //    the gesture is already spent on the permission prompt, and a file input
   //    clicked outside it would never open.
-  version: "1.95.0",
+  // 1.96.0: additive (sc-6282) -- the `filterList` propertySchema type gains
+  //    two actor-scoped `valueMode`s beside `literal` / `relativeDate`:
+  //    `currentUser` (a USER column) and `currentUserGroup` (a USER_GROUP
+  //    column) scope a condition to the signed-in app-user, so an author can
+  //    build "only my rows" / "only my organization's rows" without a custom
+  //    widget reading `ctx.user`. Both DISCARD the condition's `value` and
+  //    send the `me` sentinel; the backend resolves the identity from the
+  //    request actor, so the sentinel cannot be redirected at another user, and
+  //    wherever it cannot be resolved -- no signed-in app-user, a renamed or
+  //    encrypted column -- it matches NOTHING rather than falling back to every
+  //    row. Valid with `eq` ("mine") and `neq` ("carries none of my
+  //    identities", which includes an unassigned row) only; any other operator
+  //    is rejected as INVALID_FILTER. It scopes what a widget DISPLAYS -- row
+  //    privacy remains the record ACL's job. Existing `literal` and
+  //    `relativeDate` conditions are untouched -- minor bump on the pre-1.0
+  //    channel.
+  version: "1.96.0",
   sharedTranslationKeys: SHARED_TRANSLATION_KEYS,
   hooks: HOOKS,
   primitives: PRIMITIVES,

package/dist/index.d.ts

@@ -65,7 +65,11 @@ export type WidgetPropertyType =
   // builder. Persisted value is `Array<{ column, operator, value, valueMode }>`
   // matching the ?filter[col]=op:value contract; columns resolve from a
   // sibling tableRef (defaults to the form-root `tableId`, override via
-  // `ui.tableProp`).
+  // `ui.tableProp`). `valueMode` is `literal` (the default), `relativeDate`
+  // (ordering operators on a DATE column — `value` is "N days ago"), or the
+  // sc-6282 actor-scoped pair `currentUser` (USER column) / `currentUserGroup`
+  // (USER_GROUP column), which drop `value` and let the SERVER scope the
+  // condition to the signed-in app-user.
   | "filterList";
 
 export interface WidgetPropertyDef {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.123.0",
+  "version": "0.124.0",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",