@colixsystems/widget-sdk 0.277.0 → 0.277.1

package/README.md

@@ -86,7 +86,11 @@ See the design reference for the full architecture: [`docs/architecture/widget-m
 
 ## Status
 
-`v0.277.0` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+`v0.277.1` — pre-publish. The package surface (types, function names, export paths) is the v1 contract; runtime behaviour for some hooks is stubbed (each hook documents what's wired and what isn't). It is **not yet published to npm**.
+
+### What's new in 0.277.1
+
+**`hand-rolled-write-gate` no longer fires on `theme.typography.roles`.** The rule looked for `.roles` / `.groupIds` anywhere in the file, so a writing widget that called `useUser()` and styled its text with `theme.typography.roles[name]` was flagged on the `useUser()` line and, through the publish gate, refused. It now reads only the value `useUser()` returns: the identifier it is assigned to (`user.roles`, `user?.groupIds`), a destructured `{ roles }` or `{ groupIds }`, or `useUser().roles` inline. Gating a write on `user.roles` without `useCanWrite` still warns.
 
 ### What's new in 0.277.0
 

package/dist/linter.cjs

@@ -1589,13 +1589,22 @@ function _rawUseMemoIntoDatastoreQueryRules(source) {
 // `.roles` re-implements the table ACL client-side and drifts from it the
 // moment the ACL changes; `useCanWrite(tableId)` reads the same rule the
 // write endpoint enforces. Flags only when the file has NOT already reached
-// for it.
+// for it, and only on useUser()'s own value: `theme.typography.roles` is a
+// style read (sc-15204).
+function _readsUserRoles(code) {
+  const named = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (named && new RegExp(`\\b${named[1].replace(/\$/g, "\\$")}\\??\\.(groupIds|roles)\\b`).test(code)) return true;
+  const destructured = /\b(?:const|let|var)\s*\{([^}]*)\}\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (destructured && /\b(groupIds|roles)\b/.test(destructured[1])) return true;
+  return /\buseUser\s*\(\s*\)\s*\??\.(groupIds|roles)\b/.test(code);
+}
+
 function _handRolledWriteGateRules(source) {
   const code = _stripNonCode(source);
   if (/\buseCanWrite\s*\(/.test(code)) return [];
   const userCall = /\buseUser\s*\(\s*\)/.exec(code);
   if (!userCall) return [];
-  if (!/\.(groupIds|roles)\b/.test(code)) return [];
+  if (!_readsUserRoles(code)) return [];
   const hasWrite =
     /\.(create|update)\s*\(/.test(code) ||
     /\buseDatastoreMutation\s*\(/.test(code);

package/dist/linter.js

@@ -1584,13 +1584,22 @@ function _rawUseMemoIntoDatastoreQueryRules(source) {
 // `.roles` re-implements the table ACL client-side and drifts from it the
 // moment the ACL changes; `useCanWrite(tableId)` reads the same rule the
 // write endpoint enforces. Flags only when the file has NOT already reached
-// for it.
+// for it, and only on useUser()'s own value: `theme.typography.roles` is a
+// style read (sc-15204).
+function _readsUserRoles(code) {
+  const named = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (named && new RegExp(`\\b${named[1].replace(/\$/g, "\\$")}\\??\\.(groupIds|roles)\\b`).test(code)) return true;
+  const destructured = /\b(?:const|let|var)\s*\{([^}]*)\}\s*=\s*useUser\s*\(\s*\)/.exec(code);
+  if (destructured && /\b(groupIds|roles)\b/.test(destructured[1])) return true;
+  return /\buseUser\s*\(\s*\)\s*\??\.(groupIds|roles)\b/.test(code);
+}
+
 function _handRolledWriteGateRules(source) {
   const code = _stripNonCode(source);
   if (/\buseCanWrite\s*\(/.test(code)) return [];
   const userCall = /\buseUser\s*\(\s*\)/.exec(code);
   if (!userCall) return [];
-  if (!/\.(groupIds|roles)\b/.test(code)) return [];
+  if (!_readsUserRoles(code)) return [];
   const hasWrite =
     /\.(create|update)\s*\(/.test(code) ||
     /\buseDatastoreMutation\s*\(/.test(code);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colixsystems/widget-sdk",
-  "version": "0.277.0",
+  "version": "0.277.1",
   "description": "Common widget interface for AppStudio. Implements WidgetManifest, WidgetContext, property schema, and helper hooks.",
   "homepage": "https://github.com/Colix-AB/AppStudio",
   "type": "module",