@everystack/admin 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/admin",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Declarative admin dashboard framework for PostgREST APIs",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/rpc/resource-dashboard-rpc.ts

@@ -15,6 +15,7 @@
  */
 
 import { sql, type SQL } from 'drizzle-orm';
+import { toCamelCaseKeys } from '../utils/naming';
 import type { ResourceDashboardConfig, DimensionConfig, StatDialConfig } from '../types';
 
 interface DbExecutor {
@@ -413,6 +414,61 @@ function createEventListHandler(
   };
 }
 
+// ────────────────────────────────────────────────────────────
+// Event Detail RPC
+//
+// The show view's data source for detailVia: 'rpc' resources — one row
+// by primary key, the static where still applied (an STI discriminator
+// must gate detail exactly like it gates the list), keys camelCased to
+// match field definitions. Keeps telemetry off the REST surface entirely.
+// ────────────────────────────────────────────────────────────
+
+const MAX_ID_LENGTH = 256;
+
+function createEventDetailHandler(
+  tableName: string,
+  config: ResourceDashboardConfig,
+  db: DbExecutor,
+): (body: unknown) => Promise<unknown> {
+  const pkColumn = Array.isArray(config.primaryKey)
+    ? config.primaryKey[0]
+    : config.primaryKey ?? 'id';
+
+  return async (body: unknown) => {
+    const id = (body as { id?: unknown } | null)?.id;
+    if (
+      (typeof id !== 'string' && typeof id !== 'number') ||
+      String(id).length === 0 ||
+      String(id).length > MAX_ID_LENGTH
+    ) {
+      throw new Error('Invalid id');
+    }
+
+    const conditions: SQL[] = [sql`${sql.raw(pkColumn)} = ${String(id)}`];
+    for (const predicate of config.where ?? []) {
+      conditions.push(sql`${sql.raw(predicate.column)} = ${predicate.equals}`);
+    }
+    let where = conditions[0];
+    for (let i = 1; i < conditions.length; i++) {
+      where = sql`${where} AND ${conditions[i]}`;
+    }
+
+    const result = await db.execute(sql`
+      SELECT row_to_json(r) AS row
+      FROM (SELECT * FROM ${sql.raw(tableName)} WHERE ${where} LIMIT 1) r
+    `);
+
+    const rows = extractRows(result);
+    const first = rows[0] as { row: Record<string, unknown> | string } | undefined;
+    if (!first) {
+      throw new Error(`Record not found: ${id}`);
+    }
+
+    const raw = typeof first.row === 'string' ? JSON.parse(first.row) : first.row;
+    return toCamelCaseKeys(raw);
+  };
+}
+
 // ────────────────────────────────────────────────────────────
 // Public API
 // ────────────────────────────────────────────────────────────
@@ -420,6 +476,7 @@ function createEventListHandler(
 export interface ResourceDashboardRpcs {
   dashboardData: (body: unknown) => Promise<unknown>;
   eventList: (body: unknown) => Promise<unknown>;
+  eventDetail: (body: unknown) => Promise<unknown>;
 }
 
 /**
@@ -438,6 +495,7 @@ export function createResourceDashboardRpcs(
   return {
     dashboardData: createDashboardDataHandler(tableName, config, db),
     eventList: createEventListHandler(tableName, config, db),
+    eventDetail: createEventDetailHandler(tableName, config, db),
   };
 }
 
@@ -464,6 +522,7 @@ export function createAllDashboardRpcs(
     const prefix = resource.name.replace(/_([a-z])/g, (_, c) => c.toUpperCase());
     rpcs[`${prefix}DashboardData`] = handlers.dashboardData;
     rpcs[`${prefix}EventList`] = handlers.eventList;
+    rpcs[`${prefix}EventDetail`] = handlers.eventDetail;
   }
 
   return rpcs;

package/src/screens/ResourceShow.tsx

@@ -12,7 +12,8 @@ import { useDataAdapter } from '../hooks/useAdminData';
 import { LoadingState, ErrorState, Button, Card, Divider } from '@everystack/ui';
 import { ImageDisplay } from '../components/ImageDisplay';
 import { visibleRowActions } from '../utils/row-actions';
-import type { FieldDefinition, DataRecord, RowActionConfig } from '../types';
+import { toCamelCase } from '../utils/naming';
+import type { FieldDefinition, DataRecord, ResourceConfig, RowActionConfig } from '../types';
 import type { DataAdapter } from '../adapters/types';
 
 export interface ResourceShowProps {
@@ -47,14 +48,13 @@ export function ResourceShow({
     setLoading(true);
     setError(null);
     try {
-      const result = await adapter.fetchOne(resource, id);
-      setRecord(result);
+      setRecord(await fetchDetail(adapter, resource, id, resourceConfig));
     } catch (err) {
       setError(err instanceof Error ? err : new Error(String(err)));
     } finally {
       setLoading(false);
     }
-  }, [adapter, resource, id]);
+  }, [adapter, resource, id, resourceConfig]);
 
   useEffect(() => {
     fetchRecord();
@@ -132,6 +132,30 @@ export function ResourceShow({
   );
 }
 
+// =============================================================================
+// Detail fetching
+// =============================================================================
+
+/**
+ * detailVia: 'rpc' fetches through the role-gated {prefix}EventDetail RPC —
+ * the resource never enters the REST surface (telemetry tables stay out of
+ * exposedTables). Everything else uses adapter.fetchOne as before.
+ */
+async function fetchDetail(
+  adapter: DataAdapter,
+  resource: string,
+  id: string | number,
+  resourceConfig: ResourceConfig | undefined,
+): Promise<DataRecord> {
+  if (resourceConfig?.dashboard?.detailVia === 'rpc') {
+    if (!adapter.rpc) {
+      throw new Error(`Resource "${resource}" uses detailVia: 'rpc' but the adapter has no rpc()`);
+    }
+    return (await adapter.rpc(`${toCamelCase(resource)}EventDetail`, { id })) as DataRecord;
+  }
+  return adapter.fetchOne(resource, id);
+}
+
 // =============================================================================
 // RowActionButton
 // =============================================================================

package/src/types.ts

@@ -195,6 +195,12 @@ export interface ResourceDashboardConfig {
   searchColumns?: string[];
   /** Navigate to detail on row press (default: true) */
   linkToDetail?: boolean;
+  /**
+   * How the show view fetches the record. 'rpc' uses the role-gated
+   * {prefix}EventDetail RPC — the whole resource stays off the REST
+   * surface (telemetry tables never enter exposedTables). Default 'rest'.
+   */
+  detailVia?: 'rpc' | 'rest';
 }
 
 // =============================================================================