@nanobpm/urban 0.30.0 → 0.31.0

package/dist/runtime/core/modules/pages.js

@@ -580,12 +580,20 @@ function renderText(node) {
   return el(v === "heading" ? "h1" : "p", { class: cls }, node.props.text || "");
 }
 
-// A grid td cell. When the column declares linkField, the cell text (the
-// column's own value) becomes a link to the URL held in that other field,
-// opened in a new tab. Only http(s) hrefs are linked — anything else (e.g. a
-// javascript: URL smuggled through row data) falls back to plain text — and
-// external links get rel=noopener noreferrer so the opened page can't reach
-// window.opener. Shared by the top-level grid and child grids.
+// A grid td cell. Two column-declared linking modes, checked in order:
+//   1. linkField — the cell text becomes a link to the URL held in that other
+//      field. Only http(s) hrefs are linked (a javascript:/other-scheme URL
+//      smuggled through row data falls back to plain text).
+//   2. link: { kind: "processExplorer", keyField } — a structured, engine-aware
+//      link: the cell text links to the Nano console's explorer view for the
+//      process instance whose key is held in the row's keyField. The console
+//      path is constructed HERE (never taken from row data) and the key is
+//      URL-encoded, so row data can't smuggle a path or scheme; only a
+//      non-empty key (after trimming surrounding whitespace) produces a link.
+//      Unknown link kinds fall back to plain text so an unrecognised schema
+//      can't render a broken anchor.
+// Both open in a new tab with rel=noopener noreferrer so the opened page can't
+// reach window.opener. Shared by the top-level grid and child grids.
 function gridCell(col, row) {
   const text = row[col.field] == null ? "" : String(row[col.field]);
   if (col.linkField) {
@@ -598,6 +606,18 @@ function gridCell(col, row) {
       );
     }
   }
+  if (col.link && col.link.kind === "processExplorer" && col.link.keyField) {
+    const key = row[col.link.keyField];
+    const keyStr = key == null ? "" : String(key).trim();
+    if (text !== "" && keyStr !== "") {
+      const href = "/console/explorer?instance=" + encodeURIComponent(keyStr);
+      return el(
+        "td",
+        {},
+        el("a", { class: "pc-link", href, target: "_blank", rel: "noopener noreferrer" }, text),
+      );
+    }
+  }
   return el("td", {}, text);
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/urban",
-  "version": "0.30.0",
+  "version": "0.31.0",
   "description": "Urban: build and run code-first apps on Nano — runtime, derivation toolkit, and CLI in one. Author durable processes with @nanobpm/workflow (defineFlow), a typed datasource, forms, triggers and surfaces from a nano.app.json manifest, on Node or Deno.",
   "license": "Apache-2.0",
   "type": "module",

package/src/runtime/core/modules/pages.test.ts

@@ -189,6 +189,23 @@ test("renderer wires a column's linkField to a new-tab anchor", async () => {
   assert.match(js, /rel: "noopener noreferrer"/);
 });
 
+test("renderer wires a column's processExplorer link to the console explorer", async () => {
+  const res = await dispatch("GET", "/app/runtime.js");
+  const js = res.body ?? "";
+  // A column declaring `link: { kind: "processExplorer", keyField }` renders its
+  // text as a link to the Nano console's explorer for the process instance whose
+  // key is held in that field. Guard the whole shape so the primitive can't
+  // silently regress: the discriminant + keyField are read, the key is trimmed
+  // (whitespace-only keys don't produce a link), the console path is constructed
+  // here (not from row data), the trimmed key is URL-encoded, and the anchor
+  // opens in a new tab with a hardened rel.
+  assert.match(js, /col\.link && col\.link\.kind === "processExplorer" && col\.link\.keyField/);
+  assert.match(js, /String\(key\)\.trim\(\)/);
+  assert.match(js, /"\/console\/explorer\?instance="\s*\+\s*encodeURIComponent\(keyStr\)/);
+  assert.match(js, /target:\s*"_blank"/);
+  assert.match(js, /rel:\s*"noopener noreferrer"/);
+});
+
 test("the renderer honours numeric actionForm fields", async () => {
   const res = await dispatch("GET", "/app/runtime.js");
   const js = res.body ?? "";

package/src/runtime/core/modules/pages.ts

@@ -621,12 +621,20 @@ function renderText(node) {
   return el(v === "heading" ? "h1" : "p", { class: cls }, node.props.text || "");
 }
 
-// A grid td cell. When the column declares linkField, the cell text (the
-// column's own value) becomes a link to the URL held in that other field,
-// opened in a new tab. Only http(s) hrefs are linked — anything else (e.g. a
-// javascript: URL smuggled through row data) falls back to plain text — and
-// external links get rel=noopener noreferrer so the opened page can't reach
-// window.opener. Shared by the top-level grid and child grids.
+// A grid td cell. Two column-declared linking modes, checked in order:
+//   1. linkField — the cell text becomes a link to the URL held in that other
+//      field. Only http(s) hrefs are linked (a javascript:/other-scheme URL
+//      smuggled through row data falls back to plain text).
+//   2. link: { kind: "processExplorer", keyField } — a structured, engine-aware
+//      link: the cell text links to the Nano console's explorer view for the
+//      process instance whose key is held in the row's keyField. The console
+//      path is constructed HERE (never taken from row data) and the key is
+//      URL-encoded, so row data can't smuggle a path or scheme; only a
+//      non-empty key (after trimming surrounding whitespace) produces a link.
+//      Unknown link kinds fall back to plain text so an unrecognised schema
+//      can't render a broken anchor.
+// Both open in a new tab with rel=noopener noreferrer so the opened page can't
+// reach window.opener. Shared by the top-level grid and child grids.
 function gridCell(col, row) {
   const text = row[col.field] == null ? "" : String(row[col.field]);
   if (col.linkField) {
@@ -639,6 +647,18 @@ function gridCell(col, row) {
       );
     }
   }
+  if (col.link && col.link.kind === "processExplorer" && col.link.keyField) {
+    const key = row[col.link.keyField];
+    const keyStr = key == null ? "" : String(key).trim();
+    if (text !== "" && keyStr !== "") {
+      const href = "/console/explorer?instance=" + encodeURIComponent(keyStr);
+      return el(
+        "td",
+        {},
+        el("a", { class: "pc-link", href, target: "_blank", rel: "noopener noreferrer" }, text),
+      );
+    }
+  }
   return el("td", {}, text);
 }