@nest-my-admin/core 0.2.1 → 0.3.0

package/dist/inlines/inline-reader.d.ts

@@ -0,0 +1,38 @@
+import type { AdminRecord } from '../contract.js';
+import type { AdminPolicy } from '../policy/admin-policy.service.js';
+import type { RegisteredResource } from '../registry/resource-registry.js';
+import type { AdminContext } from '../resource/admin-context.js';
+export interface InlineReaderDeps {
+    policy: AdminPolicy;
+    /** Serializes the child's entities exactly as its own record endpoint does (fields cut, `_perm`, `_files`…). */
+    serialize: (entry: RegisteredResource, entities: object[], ctx: AdminContext) => Promise<AdminRecord[]>;
+}
+/**
+ * `_inlines` of a record: for each inline the user may see (`AdminPolicy.canSeeInline`: the child's `view` and its link
+ * field), the children of this record read through the CHILD resource's own `findMany` (so its `query()`, the user's
+ * scopes there and any host override apply, as on the child's list), filtered by the link and sorted by `order` then
+ * key, and serialized like the child's records.
+ */
+export declare class InlineReader {
+    private readonly deps;
+    constructor(deps: InlineReaderDeps);
+    /** Sets `record._inlines`, unless the parent has no inline this user may see (then the key stays absent). */
+    readInto(record: AdminRecord, parent: RegisteredResource, entity: object, ctx: AdminContext): Promise<void>;
+    /**
+     * The default `findMany` gets one page of `max` rows, uncounted (it reads `max + 1` rows to know whether more exist),
+     * so an inline costs one query for its rows plus the serializer's lookups (one per relation field and one for files,
+     * whatever the number of rows); a truncated inline adds one count query. A child that overrides `findMany` runs its
+     * own queries, and its rows are re-checked in one more query (see `overridden`).
+     */
+    private rows;
+    /**
+     * A `findMany` override may ignore the link filter and the scopes: its rows are kept only when they are children of
+     * THIS parent inside the user's view scopes and the child's `query()` (one query, `children()` with their keys), in
+     * the override's order. `truncated` and `total` come after that re-check: the override's own `hasMore`/`total` count
+     * rows it may not have filtered, so when it says there are more (or more than `max` remain), the children are
+     * counted with `children()` instead of trusting it.
+     */
+    private overridden;
+    /** This parent's children as the user may view them: the child's `query()`, the user's view scopes, the link. */
+    private children;
+}

package/dist/inlines/inline-reader.js

@@ -0,0 +1,84 @@
+import { recordIdOf } from '../crud/record-id.js';
+import { AdminResourceBase } from '../resource/admin-resource-base.js';
+/**
+ * `_inlines` of a record: for each inline the user may see (`AdminPolicy.canSeeInline`: the child's `view` and its link
+ * field), the children of this record read through the CHILD resource's own `findMany` (so its `query()`, the user's
+ * scopes there and any host override apply, as on the child's list), filtered by the link and sorted by `order` then
+ * key, and serialized like the child's records.
+ */
+export class InlineReader {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Sets `record._inlines`, unless the parent has no inline this user may see (then the key stays absent). */
+    async readInto(record, parent, entity, ctx) {
+        const out = {};
+        for (const inline of parent.inlines) {
+            if (this.deps.policy.canSeeInline(inline.child, inline.link, ctx))
+                out[inline.name] = await this.rows(inline, entity, ctx);
+        }
+        if (Object.keys(out).length > 0)
+            record._inlines = out;
+    }
+    /**
+     * The default `findMany` gets one page of `max` rows, uncounted (it reads `max + 1` rows to know whether more exist),
+     * so an inline costs one query for its rows plus the serializer's lookups (one per relation field and one for files,
+     * whatever the number of rows); a truncated inline adds one count query. A child that overrides `findMany` runs its
+     * own queries, and its rows are re-checked in one more query (see `overridden`).
+     */
+    async rows(inline, parent, ctx) {
+        const { child } = inline;
+        const { policy } = this.deps;
+        const value = parent[inline.referenced];
+        if (value === null || value === undefined)
+            return { rows: [], total: 0, truncated: false };
+        // Sorting by a field the user cannot see would reveal its values (the child's list refuses it too): by key then.
+        const order = inline.order !== undefined && (policy.levels(child, ctx).get(inline.order) ?? 'hidden') !== 'hidden' ? inline.order : undefined;
+        const params = {
+            page: 1,
+            pageSize: inline.max,
+            sort: { field: order ?? child.schema.primaryKeys[0], direction: 'asc' },
+            filters: [{ field: inline.link, operator: 'eq', value: value }],
+            count: 'none',
+            pagination: 'offset',
+        };
+        const found = await child.resource.findMany(params, ctx);
+        if (child.resource.findMany !== AdminResourceBase.prototype.findMany)
+            return this.overridden(inline, value, found, ctx);
+        const truncated = found.hasMore === true || found.items.length > inline.max;
+        const items = found.items.slice(0, inline.max);
+        const total = truncated ? await this.children(inline, value, ctx).getCount() : items.length;
+        return { rows: await this.deps.serialize(child, items, ctx), total, truncated };
+    }
+    /**
+     * A `findMany` override may ignore the link filter and the scopes: its rows are kept only when they are children of
+     * THIS parent inside the user's view scopes and the child's `query()` (one query, `children()` with their keys), in
+     * the override's order. `truncated` and `total` come after that re-check: the override's own `hasMore`/`total` count
+     * rows it may not have filtered, so when it says there are more (or more than `max` remain), the children are
+     * counted with `children()` instead of trusting it.
+     */
+    async overridden(inline, value, found, ctx) {
+        const { child } = inline;
+        const keys = child.schema.primaryKeys;
+        const idOf = (item) => (keys.length === 1 ? item[keys[0]] : Object.fromEntries(keys.map((key) => [key, item[key]])));
+        let items = found.items;
+        if (items.length > 0) {
+            const kept = await this.children(inline, value, ctx).andWhereInIds(items.map(idOf)).select(keys.map((key) => `nma_inline.${key}`)).getMany();
+            const allowed = new Set(kept.map((row) => recordIdOf(row, keys)));
+            items = items.filter((item) => allowed.has(recordIdOf(item, keys)));
+        }
+        const more = found.hasMore === true || (found.total ?? 0) > found.items.length;
+        const total = more || items.length > inline.max ? await this.children(inline, value, ctx).getCount() : items.length;
+        const rows = items.slice(0, inline.max);
+        return { rows: await this.deps.serialize(child, rows, ctx), total, truncated: total > rows.length };
+    }
+    /** This parent's children as the user may view them: the child's `query()`, the user's view scopes, the link. */
+    children(inline, value, ctx) {
+        const { child } = inline;
+        const manager = ctx.manager ?? child.dataSource.manager;
+        const qb = manager.getRepository(child.metadata.target).createQueryBuilder('nma_inline');
+        return this.deps.policy.applyScopes(child.resource.query(qb, ctx), child, 'view', ctx).andWhere(`nma_inline.${inline.link} = :nmaInlineParent`, { nmaInlineParent: value });
+    }
+}
+//# sourceMappingURL=inline-reader.js.map

package/dist/inlines/inline-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-reader.js","sourceRoot":"","sources":["../../src/inlines/inline-reader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAoD,MAAM,oCAAoC,CAAC;AASzH;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACM,IAAI;IAAjC,YAA6B,IAAsB;oBAAtB,IAAI;IAAqB,CAAC;IAEvD,6GAA6G;IAC7G,KAAK,CAAC,QAAQ,CAAC,MAAmB,EAAE,MAA0B,EAAE,MAAc,EAAE,GAAiB;QAC/F,MAAM,GAAG,GAA+B,EAAE,CAAC;QAC3C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;IACzD,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,IAAI,CAAC,MAAwB,EAAE,MAAc,EAAE,GAAiB;QAC5E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAC7B,MAAM,KAAK,GAAI,MAAkC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;QAC3F,iHAAiH;QACjH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9I,MAAM,MAAM,GAAe;YACzB,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,MAAM,CAAC,GAAG;YACpB,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YACxE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,KAAoB,EAAE,CAAC;YAC9E,KAAK,EAAE,MAAM;YACb,UAAU,EAAE,QAAQ;SACrB,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACzD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,CAAC,SAAS,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QACxH,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QAC5F,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAClF,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,UAAU,CAAC,MAAwB,EAAE,KAAc,EAAE,KAAmE,EAAE,GAAiB;QACvJ,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;QACtC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAG,IAAgC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAa,CAAC;QACpM,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;QACxB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YAC7I,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAClE,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAC/E,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;QACpH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IACtG,CAAC;IAED,iHAAiH;IACzG,QAAQ,CAAC,MAAwB,EAAE,KAAc,EAAE,GAAiB;QAC1E,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC;QACxD,MAAM,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QACzF,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,cAAc,MAAM,CAAC,IAAI,qBAAqB,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;IAC9K,CAAC;CACF"}

package/dist/inlines/inline-writer.d.ts

@@ -0,0 +1,102 @@
+import { type RelationId } from '../crud/relation-writes.js';
+import type { ErrorMapper } from '../options.js';
+import type { AdminPolicy, ResourceView } from '../policy/admin-policy.service.js';
+import type { RegisteredResource } from '../registry/resource-registry.js';
+import type { AdminContext } from '../resource/admin-context.js';
+import type { RecordId } from '../resource/admin-resource-base.js';
+import type { WriteChange } from '../api/write-participant.js';
+import type { RegisteredInline } from './inline-config.js';
+/** What the writer needs of `AdminApiService` (its write participants, checks and serializer). */
+export interface InlineWriterDeps {
+    policy: AdminPolicy;
+    view: (entry: RegisteredResource, ctx: AdminContext) => ResourceView;
+    sanitizeHtml: (html: string) => string;
+    /** One change inside the parent's write, with every participant (files, audit) around the method. */
+    change: <T>(change: WriteChange, tx: AdminContext, method: () => Promise<T>) => Promise<T>;
+    checkRelationsExist: (entry: RegisteredResource, ids: Map<string, RelationId[]>, ctx: AdminContext, values: Record<string, unknown>) => Promise<void>;
+    checkVersion: (entry: RegisteredResource, id: RecordId, expected: number | undefined, ctx: AdminContext) => Promise<void>;
+    lockedFields: (entry: RegisteredResource, entity: object) => string[];
+    /** A record's values as `relationOptions()` sees them (as the user sees the record, relations as ids). */
+    values: (entry: RegisteredResource, entity: object, ctx: AdminContext) => Promise<Record<string, unknown>>;
+    reloadIfEmpty: (entry: RegisteredResource, result: unknown, id: RecordId, ctx: AdminContext) => Promise<object>;
+    errorMapper?: ErrorMapper;
+}
+interface PlannedCreate {
+    key: string;
+    index: number;
+    dto: Record<string, unknown>;
+    relationIds: Map<string, RelationId[]>;
+}
+interface PlannedUpdate {
+    /** The `_id` as sent (error paths) and as the canonical encoding (matching). */
+    raw: string;
+    canonical: string;
+    id: RecordId;
+    version?: number;
+    dto: Record<string, unknown>;
+    relationIds: Map<string, RelationId[]>;
+}
+interface PlannedDelete {
+    raw: string;
+    canonical: string;
+    id: RecordId;
+}
+/** One inline's changes, parsed, permission-checked and validated: nothing in it has touched the database. */
+interface PlannedInline {
+    inline: RegisteredInline;
+    creates: PlannedCreate[];
+    updates: PlannedUpdate[];
+    deletes: PlannedDelete[];
+    order?: string[];
+}
+/** The inline changes of one save (`prepare`), checked against the database (`check`) before anything is written. */
+export interface InlinePlan {
+    parent: RegisteredResource;
+    creating: boolean;
+    inlines: PlannedInline[];
+}
+/** What `check` read: the rows the save touches, and the order values it writes. */
+interface CheckedInline {
+    planned: PlannedInline;
+    /** Canonical `_id` → the stored child (updates, deletes and rows only moved). */
+    rows: Map<string, object>;
+    /** Canonical `_id` → new position, for existing rows whose position changes. */
+    moves: Map<string, number>;
+    /** `_key` → position. */
+    positions: Map<string, number>;
+}
+export type CheckedPlan = CheckedInline[];
+/**
+ * Saves the `_inlines` of a parent's POST or PATCH inside the parent's write (spec §5.2 inlines), in three steps:
+ *
+ * 1. `prepare` (before the transaction): the shape, the child's permissions (403), its field rules (403
+ *    FORBIDDEN_FIELDS) and each entry's validation by the child's DTO, as its own endpoints would (422);
+ * 2. `check` (in the transaction, before the parent is written): every `_id` is a child of THIS parent inside the
+ *    user's view scope and the operation's scope (else 404), `_version`s (409), `@AdminCan` rules (403), `readonlyIf`
+ *    (422), the order list and the resulting count (`min`/`max`, 422). A refused save has written nothing;
+ * 3. `apply` (after the parent): deletes, updates, then creates, each through the CHILD resource's own method inside
+ *    `change()`, so host overrides, hooks, files and the audit log (with `meta.parent`) apply as on its endpoints. A
+ *    failure there rolls back the transaction, parent included (inlines need `transactions`, checked at boot).
+ */
+export declare class InlineWriter {
+    private readonly deps;
+    constructor(deps: InlineWriterDeps);
+    /** Step 1, before the transaction. `raw` is the body's `_inlines` (undefined when it has none). */
+    prepare(parent: RegisteredResource, raw: unknown, ctx: AdminContext, creating: boolean): Promise<InlinePlan>;
+    /**
+     * Inside the transaction, before the parent is written: reads what the save touches and decides every 404, 409,
+     * 403 and 422 left, so that a refused save writes nothing. `parentEntity` is the stored parent (undefined when it
+     * is being created: it has no children yet, so any `_id` is not one of them).
+     */
+    check(plan: InlinePlan, parentEntity: object | undefined, tx: AdminContext): Promise<CheckedPlan>;
+    private checkInline;
+    /** `order` lists every row left (`remaining` ids, then the new rows' keys) exactly once; positions by index. */
+    private checkOrder;
+    private checkCount;
+    /**
+     * After the parent: every change through the child resource's own method, inside the parent's write. Deletes, then
+     * updates (with their new positions), rows that only move, then creates (link and position set by the server).
+     */
+    apply(plan: InlinePlan, checked: CheckedPlan, parentEntity: object, tx: AdminContext): Promise<void>;
+}
+export {};