@narrative.io/jsonforms-provider-protocols 3.0.0-beta.19 → 3.0.0-beta.20

package/src/no-eval-ajv.ts

@@ -0,0 +1,381 @@
+import {
+  Validator,
+  type OutputUnit,
+  type Schema,
+  type SchemaDraft,
+} from "@cfworker/json-schema";
+
+/**
+ * CSP-safe JSON Schema validation backed by `@cfworker/json-schema`.
+ *
+ * Cloudflare Pages and similar strict-CSP environments forbid `new Function`,
+ * which is how AJV compiles validators. This factory returns an
+ * AJV-shaped facade whose `compile()` produces a synchronous validator
+ * function `(data) => boolean` with a mutable `errors` property — enough
+ * for `<JsonForms :ajv="..." />` to drop in without any other changes.
+ *
+ * Only `compile()` is functional; the rest of the surface (`addSchema`,
+ * `getSchema`, `removeSchema`, `addFormat`, `addKeyword`, `opts`) exists
+ * as no-ops for forward compatibility with plugins that probe the AJV
+ * interface but never reach those methods at runtime.
+ */
+
+// AJV's ErrorObject shape. We don't import `ajv` here to keep the lib's
+// zero-runtime-deps philosophy intact; the consumer's transitive AJV types
+// are structurally compatible.
+export interface NoEvalErrorObject {
+  instancePath: string;
+  schemaPath: string;
+  keyword: string;
+  params: Record<string, unknown>;
+  message?: string;
+}
+
+export interface NoEvalValidateFunction {
+  (data: unknown): boolean;
+  errors: NoEvalErrorObject[] | null;
+}
+
+// Minimal subset of AJV's surface that JsonForms touches. The factory
+// returns this as `unknown as Ajv` at the call site; consumers cast on
+// import or pass directly to `<JsonForms :ajv="..." />`.
+export interface NoEvalAjv {
+  compile: (schema: unknown) => NoEvalValidateFunction;
+  addSchema: (schema: unknown, key?: string) => NoEvalAjv;
+  getSchema: (key: string) => NoEvalValidateFunction | undefined;
+  removeSchema: (schemaKeyRef?: unknown) => NoEvalAjv;
+  addFormat: (name: string, format: unknown) => NoEvalAjv;
+  addKeyword: (definition: unknown) => NoEvalAjv;
+  opts: Readonly<Record<string, unknown>>;
+}
+
+export interface CreateNoEvalAjvOptions {
+  /**
+   * JSON Schema draft to validate against. Defaults to `'2020-12'` to match
+   * the spec; schemas authored against draft-07 should pass `'7'`.
+   */
+  draft?: SchemaDraft;
+}
+
+const KEYWORD_WRAPPERS = new Set([
+  "properties",
+  "items",
+  "prefixItems",
+  "$ref",
+]);
+
+const QUOTED_RE = /(['"])((?:\\.|(?!\1).)*?)\1/g;
+
+function findQuoted(s: string): string[] {
+  const out: string[] = [];
+  let m: RegExpExecArray | null;
+  QUOTED_RE.lastIndex = 0;
+  while ((m = QUOTED_RE.exec(s)) !== null) {
+    out.push(m[2]!);
+  }
+  return out;
+}
+
+function firstQuoted(s: string): string | undefined {
+  const all = findQuoted(s);
+  return all[0];
+}
+
+function allQuoted(s: string): string[] {
+  return findQuoted(s);
+}
+
+const NUMBER_RE = /-?\d+(?:\.\d+)?/g;
+
+function extractNumbers(s: string): number[] {
+  const out: number[] = [];
+  let m: RegExpExecArray | null;
+  NUMBER_RE.lastIndex = 0;
+  while ((m = NUMBER_RE.exec(s)) !== null) {
+    out.push(Number(m[0]));
+  }
+  return out;
+}
+
+function firstNumber(s: string): number | undefined {
+  const nums = extractNumbers(s);
+  return nums[0];
+}
+
+function stripPointerPrefix(p: string): string {
+  return p.startsWith("#") ? p.slice(1) : p;
+}
+
+interface KeywordTransform {
+  params: Record<string, unknown>;
+  message: string | undefined;
+}
+
+function transformByKeyword(unit: OutputUnit): KeywordTransform {
+  const { keyword, error } = unit;
+
+  switch (keyword) {
+    case "required": {
+      const prop = firstQuoted(error);
+      return {
+        params: { missingProperty: prop ?? "" },
+        message: prop
+          ? `must have required property '${prop}'`
+          : "must have required property",
+      };
+    }
+
+    case "type": {
+      const quoted = allQuoted(error);
+      // cfworker emits `Instance type "X" is invalid. Expected "Y".` (single)
+      // or `... Expected "Y" or "Z".` (union). Per AJV: `params.type` is the
+      // expected type as a string; for unions it's comma-separated.
+      const expected = quoted.slice(1).join(",") || quoted[0];
+      const message = expected ? `must be ${expected}` : "must be of expected type";
+      return {
+        params: expected ? { type: expected } : {},
+        message,
+      };
+    }
+
+    case "enum": {
+      // cfworker error: `Instance does not match any of [...].`
+      const match = error.match(/\[.*\]/);
+      let allowedValues: unknown[] = [];
+      if (match) {
+        try {
+          allowedValues = JSON.parse(match[0]);
+        } catch {
+          allowedValues = [];
+        }
+      }
+      return {
+        params: { allowedValues },
+        message: "must be equal to one of the allowed values",
+      };
+    }
+
+    case "const":
+      return {
+        params: {},
+        message: "must be equal to constant",
+      };
+
+    case "minimum": {
+      const limit = extractNumbers(error)[1];
+      return {
+        params: { comparison: ">=", limit: limit ?? 0 },
+        message: `must be >= ${limit ?? 0}`,
+      };
+    }
+
+    case "exclusiveMinimum": {
+      const limit = extractNumbers(error)[1];
+      return {
+        params: { comparison: ">", limit: limit ?? 0 },
+        message: `must be > ${limit ?? 0}`,
+      };
+    }
+
+    case "maximum": {
+      const limit = extractNumbers(error)[1];
+      return {
+        params: { comparison: "<=", limit: limit ?? 0 },
+        message: `must be <= ${limit ?? 0}`,
+      };
+    }
+
+    case "exclusiveMaximum": {
+      const limit = extractNumbers(error)[1];
+      return {
+        params: { comparison: "<", limit: limit ?? 0 },
+        message: `must be < ${limit ?? 0}`,
+      };
+    }
+
+    case "minLength": {
+      const limit = firstNumber(error) ?? 0;
+      return {
+        params: { limit },
+        message: `must NOT have fewer than ${limit} characters`,
+      };
+    }
+
+    case "maxLength": {
+      const limit = firstNumber(error) ?? 0;
+      return {
+        params: { limit },
+        message: `must NOT have more than ${limit} characters`,
+      };
+    }
+
+    case "minItems": {
+      const limit = firstNumber(error) ?? 0;
+      return {
+        params: { limit },
+        message: `must NOT have fewer than ${limit} items`,
+      };
+    }
+
+    case "maxItems": {
+      const limit = firstNumber(error) ?? 0;
+      return {
+        params: { limit },
+        message: `must NOT have more than ${limit} items`,
+      };
+    }
+
+    case "pattern": {
+      const pattern = firstQuoted(error) ?? "";
+      return {
+        params: { pattern },
+        message: `must match pattern "${pattern}"`,
+      };
+    }
+
+    case "format": {
+      const format = firstQuoted(error) ?? "";
+      return {
+        params: { format },
+        message: `must match format "${format}"`,
+      };
+    }
+
+    case "multipleOf": {
+      // cfworker emits two numbers: the value and the divisor.
+      const nums = extractNumbers(error);
+      const multipleOf = nums[1] ?? nums[0] ?? 1;
+      return {
+        params: { multipleOf },
+        message: `must be multiple of ${multipleOf}`,
+      };
+    }
+
+    case "uniqueItems":
+      return {
+        params: {},
+        message: "must NOT have duplicate items",
+      };
+
+    case "additionalProperties": {
+      const additionalProperty = firstQuoted(error) ?? "";
+      return {
+        params: { additionalProperty },
+        message: `must NOT have additional property '${additionalProperty}'`,
+      };
+    }
+
+    case "anyOf":
+      return { params: {}, message: "must match a schema in anyOf" };
+
+    case "oneOf":
+      return {
+        params: { passingSchemas: null },
+        message: "must match exactly one schema in oneOf",
+      };
+
+    case "allOf":
+      return { params: {}, message: "must match all schemas in allOf" };
+
+    case "not":
+      return { params: {}, message: "must NOT be valid against schema" };
+
+    default:
+      return { params: {}, message: undefined };
+  }
+}
+
+/**
+ * Transform a single cfworker `OutputUnit` into an AJV-compatible
+ * `ErrorObject`, or `null` if the unit is a structural wrapper that should
+ * be filtered out (`properties` / `items` / `prefixItems` / `$ref`).
+ *
+ * Exported for unit testing.
+ */
+export function transformUnit(unit: OutputUnit): NoEvalErrorObject | null {
+  if (KEYWORD_WRAPPERS.has(unit.keyword)) return null;
+
+  const { params, message } = transformByKeyword(unit);
+
+  return {
+    instancePath: stripPointerPrefix(unit.instanceLocation),
+    schemaPath: unit.keywordLocation,
+    keyword: unit.keyword,
+    params,
+    message: message ?? unit.error,
+  };
+}
+
+/**
+ * Transform a cfworker `OutputUnit[]` into an AJV-compatible
+ * `ErrorObject[]`, with structural wrappers filtered out.
+ *
+ * Exported for unit testing.
+ */
+export function transformErrors(units: OutputUnit[]): NoEvalErrorObject[] {
+  const out: NoEvalErrorObject[] = [];
+  for (const unit of units) {
+    const transformed = transformUnit(unit);
+    if (transformed !== null) out.push(transformed);
+  }
+  return out;
+}
+
+const FROZEN_OPTS: Readonly<Record<string, unknown>> = Object.freeze({
+  allErrors: true,
+  verbose: true,
+  errorDataPath: "",
+  strict: false,
+});
+
+/**
+ * Build a CSP-safe AJV-shaped validator backed by `@cfworker/json-schema`.
+ *
+ * Each `compile(schema)` call constructs a `Validator` and returns a
+ * synchronous validator function. The validator function's `errors`
+ * property is reassigned on every call, matching AJV's contract.
+ *
+ * Validators are memoized per-schema via a `WeakMap`, so JsonForms's
+ * repeated `compile()` calls on prop changes don't re-parse the schema
+ * graph each time.
+ */
+export function createNoEvalAjv(
+  options: CreateNoEvalAjvOptions = {},
+): NoEvalAjv {
+  const draft: SchemaDraft = options.draft ?? "2020-12";
+  const cache = new WeakMap<object, NoEvalValidateFunction>();
+
+  const compile = (schema: unknown): NoEvalValidateFunction => {
+    if (schema && typeof schema === "object") {
+      const cached = cache.get(schema as object);
+      if (cached) return cached;
+    }
+
+    const validator = new Validator(schema as Schema | boolean, draft, false);
+
+    const fn: NoEvalValidateFunction = ((data: unknown) => {
+      const result = validator.validate(data);
+      fn.errors = result.valid ? null : transformErrors(result.errors);
+      return result.valid;
+    }) as NoEvalValidateFunction;
+
+    fn.errors = null;
+
+    if (schema && typeof schema === "object") {
+      cache.set(schema as object, fn);
+    }
+    return fn;
+  };
+
+  const facade: NoEvalAjv = {
+    compile,
+    addSchema: () => facade,
+    getSchema: () => undefined,
+    removeSchema: () => facade,
+    addFormat: () => facade,
+    addKeyword: () => facade,
+    opts: FROZEN_OPTS,
+  };
+
+  return facade;
+}

package/src/vue/composables/useProjection.ts

@@ -5,6 +5,7 @@ import {
   getProjectedSchema,
   parseProjectionPath,
 } from "../../core/projection";
+import { deref } from "../../core/refs";
 
 interface ProjectionControl {
   data: unknown;
@@ -48,27 +49,34 @@ function resolveLabel(
  * Determine whether the leaf of a projection path is listed in its parent
  * schema's `required` array. Numeric leaf segments (array indices) are not
  * considered "required properties".
+ *
+ * Dereferences `$ref` at every step against `root` (defaulting to `schema`)
+ * so that schemas like `items: { $ref: '#/$defs/Foo' }` resolve correctly.
  */
 function isProjectedFieldRequired(
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   schema: Record<string, any>,
   path: string,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  root?: Record<string, any>,
 ): boolean {
   const segments = parseProjectionPath(path);
   if (segments.length === 0) return false;
+  const rootSchema = root ?? schema;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  let current: Record<string, any> = schema;
+  let current: Record<string, any> | undefined = deref(schema, rootSchema);
   for (let i = 0; i < segments.length - 1; i++) {
     const seg = segments[i]!;
     if (typeof seg === "number") {
-      current = current?.items;
+      current = deref(current?.items, rootSchema);
     } else {
-      current = current?.properties?.[seg];
+      current = deref(current?.properties?.[seg], rootSchema);
     }
     if (!current) return false;
   }
   const last = segments[segments.length - 1];
   if (typeof last !== "string") return false;
+  current = deref(current, rootSchema);
   return Array.isArray(current?.required) && current.required.includes(last);
 }
 
@@ -162,13 +170,16 @@ export function useProjection(
     };
   }
 
-  // Inject JSONForms state to access raw AJV errors for projected sub-paths.
-  // control.errors only contains errors at the exact control path (e.g. "data_rates"),
-  // but projected fields need errors at the full path (e.g. "data_rates.0.video_rate_usd").
-  const jsonforms = inject<{ core?: { errors?: ErrorLike[] } } | null>(
-    "jsonforms",
-    null,
-  );
+  // Inject JSONForms state to access raw AJV errors for projected sub-paths,
+  // and the root schema so that `$ref` resolution inside the projected slice
+  // can find `$defs` (which live at the root, not on the control's schema).
+  const jsonforms = inject<{
+    core?: {
+      errors?: ErrorLike[];
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      schema?: Record<string, any>;
+    };
+  } | null>("jsonforms", null);
 
   const fullProjectedPath = control.value.path + "." + projection;
 
@@ -181,7 +192,11 @@ export function useProjection(
   );
 
   const projectedRequired = computed(() =>
-    isProjectedFieldRequired(control.value.schema, projection),
+    isProjectedFieldRequired(
+      control.value.schema,
+      projection,
+      jsonforms?.core?.schema ?? control.value.schema,
+    ),
   );
 
   const label = computed(() =>
@@ -195,7 +210,7 @@ export function useProjection(
   const projectedErrors = computed(() => {
     const baseErrors = normalizeErrors(control.value.errors || "");
 
-    const rawErrors = jsonforms?.core?.errors ?? [];
+    const rawErrors = jsonforms?.core?.errors ?? ([] as ErrorLike[]);
     const matching = rawErrors.filter(
       (err) => getErrorPath(err) === fullProjectedPath,
     );

package/dist/debug/overlay.d.ts

@@ -1,18 +0,0 @@
-/**
- * In-DOM debug overlay for `@narrative.io/jsonforms-provider-protocols`.
- *
- * Renders a fixed-position panel with a scrollable list of structured log
- * entries. Used in place of `console.*` because some host apps strip console
- * output in production. No-op unless explicitly enabled at runtime via
- * either `window.__PP_DEBUG__ = true` or `localStorage.PP_DEBUG = "1"`.
- *
- * Internal API. Not part of the package's public surface.
- */
-/**
- * Append a structured debug entry to the in-DOM overlay. No-op unless the
- * runtime gate is on (`window.__PP_DEBUG__ === true` or
- * `localStorage.PP_DEBUG === "1"`). Stringification is lazy: the payload is
- * not serialized when the gate is off, so this is safe to leave in hot paths.
- */
-export declare function debugLog(label: string, payload: unknown): void;
-//# sourceMappingURL=overlay.d.ts.map

package/dist/debug/overlay.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"overlay.d.ts","sourceRoot":"","sources":["../../src/debug/overlay.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA0TH;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CA4B9D"}