@flaredev/cli 0.8.1 → 0.9.0

package/templates/next/app/dashboard/actions.ts

@@ -41,20 +41,58 @@ async function removeUploads(resource: Resource, record: Record<string, unknown>
   }
 }
 
-export async function deleteRecordAction(resourceName: string, id: string): Promise<ActionResult<{ id: string }>> {
+/**
+ * Delete a record, or empty it from the trash with `force`.
+ *
+ * Uploads are only cleaned up when the row really goes. A soft delete is meant to be
+ * reversible, and a restore that gave back a record with its files missing would be a
+ * worse outcome than keeping the bytes a little longer.
+ */
+export async function deleteRecordAction(
+  resourceName: string,
+  id: string,
+  options: { force?: boolean } = {},
+): Promise<ActionResult<{ id: string }>> {
   const denied = await allowed(resourceName, "delete");
   if (denied) return denied;
 
   const store = dashboardStore(resourceName);
-  const existing = await store.get(id);
-  const result = await store.delete(id);
+  const force = options.force === true;
+  const soft = store.resource.softDelete && !force;
+  // `deleted: "all"` so emptying the trash can read the row it is about to remove.
+  const existing = await store.get(id, { deleted: "all" });
+  const result = await store.delete(id, { force });
   if (result.ok) {
-    await removeUploads(store.resource, existing.ok ? existing.data : null);
+    if (!soft) await removeUploads(store.resource, existing.ok ? existing.data : null);
     await recordAudit({
       action: "delete",
       resource: resourceName,
       recordId: id,
       recordLabel: existing.ok ? recordTitle(store.resource, existing.data) : null,
+      // Which kind of delete this was, since on a softDelete resource they are different
+      // events with the same name.
+      changes: store.resource.softDelete ? { trash: soft ? "moved to" : "emptied from" } : null,
+    });
+    revalidatePath(resourcePath(store.resource));
+  }
+  return result;
+}
+
+/** Put a record back from the trash. Only a `softDelete` resource has anything to restore. */
+export async function restoreRecordAction(resourceName: string, id: string): Promise<ActionResult<Record<string, unknown>>> {
+  // Restoring is a change to the record, so it needs the permission that changes records.
+  const denied = await allowed(resourceName, "update");
+  if (denied) return denied;
+
+  const store = dashboardStore(resourceName);
+  const result = await store.restore(id);
+  if (result.ok) {
+    await recordAudit({
+      action: "update",
+      resource: resourceName,
+      recordId: id,
+      recordLabel: recordTitle(store.resource, result.data),
+      changes: { trash: "restored from" },
     });
     revalidatePath(resourcePath(store.resource));
   }

package/templates/next/lib/dashboard.ts

@@ -1,6 +1,6 @@
 import { headers } from "next/headers";
 import { notFound, redirect } from "next/navigation";
-import { allowedActions, can, columnName, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
+import { allowedActions, can, columnName, ownershipFilter, type Policy, type PolicyAction, type Resource } from "@flaredev/core";
 import { createResourceStore, prismaRows, type PrismaDelegate, type ResourceStore } from "@/lib/resource";
 import { prisma } from "@/lib/db";
 import { policies } from "@/policies";
@@ -59,6 +59,17 @@ export async function adminPermissions(resourceName: string) {
   return allowedActions(policyFor(resourceName), role);
 }
 
+/**
+ * The field the current user is confined by on this resource, or undefined.
+ *
+ * Forms leave it out: the store sets it from the session, so an input for it would throw
+ * away whatever was typed into it. Everyone exempt from `own` sees and edits it normally,
+ * because for them it really is just a field.
+ */
+export async function confinedField(resourceName: string): Promise<string | undefined> {
+  return ownershipFilter(policyFor(resourceName), await currentUser())?.field;
+}
+
 const stores = new Map<string, ResourceStore>();
 
 /** CRUD store for a resource by name (404 for unknown names). */
@@ -70,6 +81,10 @@ export function dashboardStore(name: string): ResourceStore {
     store = createResourceStore({
       resource: entry.resource,
       rows: prismaRows(entry.delegate, prisma),
+      // The admin is not exempt from ownership. A policy that confines staff to their own
+      // rows has to mean the same thing here as it does over the API, or the dashboard is
+      // a way around it.
+      policy: policyFor(name),
       onChange: revalidateResource,
       currentUser,
     });
@@ -98,9 +113,16 @@ export interface ResourceStats {
   values: Record<string, number>;
 }
 
-export function resourceStats(name: string, field?: string, days = 7): Promise<ResourceStats> {
+export async function resourceStats(name: string, field?: string, days = 7): Promise<ResourceStats> {
+  // Counted over the rows this user may see, not the table. A policy with `own` that the
+  // table below obeys and the cards above it don't would report 142 invoices to someone
+  // who owns three — wrong, and a leak besides. The owner is an argument rather than a
+  // closed-over value because unstable_cache keys on the arguments: without it one user's
+  // numbers would be served to the next.
+  const limit = ownershipFilter(policyFor(name), await currentUser());
+
   const read = cached(
-    async (resourceName: string, key: string | undefined, windowDays: number): Promise<ResourceStats> => {
+    async (resourceName: string, key: string | undefined, windowDays: number, owner?: { field: string; value: string }): Promise<ResourceStats> => {
       const entry = (resourceTables as unknown as Record<string, { resource: Resource } | undefined>)[resourceName];
       if (!entry) return { total: 0, current: 0, previous: 0, values: {} };
 
@@ -116,9 +138,18 @@ export function resourceStats(name: string, field?: string, days = 7): Promise<R
         `count(*) filter (where "created_at" >= '${before}' and "created_at" < '${since}')::int as previous`,
         ...(grouped ? [`${grouped} as value`] : []),
       ].join(", ");
-      const query = `select ${select} from ${table}${grouped ? ` group by ${grouped}` : ""}`;
-
-      const rows = (await prisma.$queryRawUnsafe(query)) as { total: number; current: number; previous: number; value?: unknown }[];
+      // Parameterised, not interpolated. The id comes from a session rather than a URL,
+      // but raw SQL is the one place that distinction should never be relied on.
+      const ownerColumn = owner && entry.resource.fields[owner.field] ? `"${columnName(owner.field)}"` : undefined;
+      const where = ownerColumn ? ` where ${ownerColumn} = $1` : "";
+      const query = `select ${select} from ${table}${where}${grouped ? ` group by ${grouped}` : ""}`;
+
+      const rows = (await (ownerColumn ? prisma.$queryRawUnsafe(query, owner!.value) : prisma.$queryRawUnsafe(query))) as {
+        total: number;
+        current: number;
+        previous: number;
+        value?: unknown;
+      }[];
       const stats: ResourceStats = { total: 0, current: 0, previous: 0, values: {} };
       for (const row of rows) {
         stats.total += Number(row.total ?? 0);
@@ -131,7 +162,7 @@ export function resourceStats(name: string, field?: string, days = 7): Promise<R
     ["flare", "resource-stats"],
     { tags: [resourceTag(name)], revalidate: TTL.medium },
   );
-  return read(name, field, days);
+  return read(name, field, days, limit ?? undefined);
 }
 
 /** How many records a resource has. One field of {@link resourceStats}. */

package/templates/next/lib/realtime.ts

@@ -3,8 +3,8 @@
  *
  * The Cloudflare stack gives every channel a Durable Object: one address, one thread,
  * its own storage, and websockets that stay open. Vercel has no equivalent — functions
- * don't hold connections — so rather than pretend, this says so, and publishing is a
- * no-op that never breaks a write.
+ * don't hold connections — so rather than pretend, publishing warns once per channel
+ * and drops the event, which never breaks the write that triggered it.
  *
  * If you need it here, the shape to reach for is a hosted pub/sub (Ably, Pusher,
  * Upstash) behind these same two functions.
@@ -17,7 +17,30 @@ export interface RealtimeChannel {
   publish(event: string, data: unknown): Promise<void>;
 }
 
-/** A channel that accepts publishes and drops them, so callers need no special case. */
-export function realtimeChannel(_name: string): RealtimeChannel {
-  return { publish: async () => undefined };
+/**
+ * Channels this process has already warned about, so a publish in a hot path logs once
+ * rather than on every write.
+ */
+const warned = new Set<string>();
+
+/**
+ * A channel that accepts publishes and drops them, so callers need no special case.
+ *
+ * It says so the first time, once per channel. A silent no-op is the worst version of
+ * this: the code reads as though it works, nothing arrives, and there is nothing to
+ * search for.
+ */
+export function realtimeChannel(name: string): RealtimeChannel {
+  return {
+    publish: async (event) => {
+      if (warned.has(name)) return;
+      warned.add(name);
+      console.warn(
+        `[flare] realtimeChannel("${name}").publish("${event}") did nothing: this app is on the Next.js stack, ` +
+          "where there is nowhere to hold a websocket open. The write itself succeeded. " +
+          "To deliver events, put a hosted pub/sub (Ably, Pusher, Upstash) behind lib/realtime.ts — " +
+          "both functions in that file are yours to change.",
+      );
+    },
+  };
 }

package/templates/next/lib/resource/prisma-rows.ts

@@ -81,8 +81,12 @@ function fromIndexName(name: string): string {
 
 export function prismaRows(delegate: PrismaDelegate, client: unknown): ResourceRows {
   /** The search and filter half of a where clause — everything but the cursor. */
-  function matching(query: Pick<RowsQuery, "search" | "filters">): Record<string, unknown> {
+  function matching(query: Pick<RowsQuery, "search" | "filters" | "deleted">): Record<string, unknown> {
     const where: Record<string, unknown> = { ...query.filters };
+    // A soft-deleting resource hides its deleted rows. Set on the query rather than in
+    // `filters` because "only" is `not: null`, which the filter shape cannot say.
+    if (query.deleted === "exclude") where.deletedAt = null;
+    else if (query.deleted === "only") where.deletedAt = { not: null };
     if (query.search && query.search.fields.length > 0) {
       // Insensitive on purpose: SQLite's LIKE is case-insensitive for ASCII, so this is
       // what keeps search behaving the same on both stacks.