@nocobase/app-template-default 1.0.0-beta.82 → 1.0.0-beta.84

package/tests/client/user-permissions.test.tsx

@@ -1,4 +1,5 @@
-import { answerApi, renderWithApp } from '@nocobase/app-testing/client';
+import { renderSettingsClient as renderWithApp } from '../helpers/settings-client.js';
+import { answerApi } from '@nocobase/app-testing/client';
 import { apiClientToken, type ClientApplication } from '@nocobase/app-client';
 import {
   AuthorizationClient,
@@ -9,7 +10,7 @@ import {
   defineAppRoutes,
   defineClientPlugin,
 } from '@nocobase/app-client/plugins';
-import { screen, waitFor } from '@testing-library/react';
+import { screen, waitFor, within } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { Routes, Route } from 'react-router';
 import { describe, expect, it, vi } from 'vitest';
@@ -138,12 +139,36 @@ describe('user permission configuration', () => {
       expect(
         screen.getByRole('heading', { name: words.roleAssignment }),
       ).toBeVisible();
-      expect(screen.getAllByRole('checkbox')).toHaveLength(8);
+      const permissionNames = [
+        words.readUsers,
+        words.createUsers,
+        words.updateUsers,
+        words.disable,
+        words.enable,
+        words.revokeSessions,
+        words.assignRole,
+      ];
+      const permissionCheckboxes = permissionNames.map((name) =>
+        screen.getByRole('checkbox', { name, exact: true }),
+      );
+      expect(screen.getAllByRole('checkbox')).toHaveLength(
+        permissionNames.length,
+      );
       expect(
         screen.queryByRole('checkbox', { name: words.inviteUsers }),
       ).not.toBeInTheDocument();
-      const rowIds = screen.getAllByRole('checkbox').map((node) => node.id);
-      expect(new Set(rowIds).size).toBe(8);
+      const rowIds = permissionCheckboxes.map((node) => node.id);
+      expect(rowIds).not.toContain('');
+      expect(new Set(rowIds).size).toBe(permissionNames.length);
+      const status = within(
+        screen.getByRole('tablist', { name: words.permissionStatus }),
+      );
+      expect(status.getAllByRole('tab')).toHaveLength(3);
+      expect(
+        status.getByRole('tab', { name: words.permissionAll, exact: true }),
+      ).toHaveAttribute('aria-selected', 'true');
+      for (const name of [words.permissionGranted, words.permissionUngranted])
+        expect(status.getByRole('tab', { name, exact: true })).toBeVisible();
       await user.click(
         screen.getByRole('button', { name: words.save, exact: true }),
       );

package/tests/database/mutation-receipts.test.ts

@@ -0,0 +1,45 @@
+import path from 'node:path';
+import { describeMigration } from '@nocobase/app-testing/server';
+import { expect } from 'vitest';
+
+describeMigration('202611020002_create_mutation_receipts', {
+  sources: [
+    {
+      packageName: 'operation-receipts-test',
+      directory: path.resolve(
+        import.meta.dirname,
+        '../../database/main/migrations',
+      ),
+    },
+  ],
+  up: async ({ connection, expectCollection }) => {
+    const receipts = await expectCollection('mutationReceipts').toExist();
+    expect(receipts.primaryKey).toEqual(['id']);
+    await expectCollection('mutationReceipts').toHaveField('expiresAt', {
+      nullable: false,
+    });
+    await connection.query
+      .insertInto('mutationReceipts')
+      .values({
+        id: 'sample',
+        digest: 'digest',
+        result: '{}',
+        expiresAt: new Date(),
+      })
+      .execute();
+    await expect(
+      connection.query
+        .insertInto('mutationReceipts')
+        .values({
+          id: 'sample',
+          digest: 'other',
+          result: '{}',
+          expiresAt: new Date(),
+        })
+        .execute(),
+    ).rejects.toThrow();
+  },
+  down: async ({ expectCollection }) => {
+    await expectCollection('mutationReceipts').not.toExist();
+  },
+});

package/tests/fixtures/form-feedback/README.md

@@ -0,0 +1,33 @@
+# Isolated form feedback verification
+
+This test-only workload checks newly generated Default and Examples applications. It is not registered in either template runtime. Use independent databases and storage, native sign-in and the existing administrator action; never install it in a management or production application.
+
+## Prepare two new applications
+
+Create one application from each selected target template with `pnpm create @nocobase/app@beta <name> --template <package>@<exact-version> --no-install --json`. Use actual released packages or immutable, explicitly versioned candidates in an isolated registry. Read each generated application's instructions, install dependencies and record exact template/runtime versions, lockfiles, source commits and package integrity. Keep the target's feedback component and auth/settings sources unchanged.
+
+Copy `equipment-layout.tsx`, `equipment-detail.tsx`, `equipment.tsx` and `equipment-validation.tsx` into the application's `client/pages/`; copy `equipment-server.ts` as `server/routes/equipment-fixture.ts` and `equipment-migration.ts` as `database/main/migrations/209901010001_equipment_fixture.ts`. Keep an executed migration unchanged. Register `equipmentRoutes` in the server route contributions.
+
+Declare `/equipment` with required native authentication, `authz: { resource: { type: 'user', id: '*' }, action: 'create' }` and the equipment layout. Its `dialog` and `drawer` children load the equipment editor; its `:equipmentId` detail child has an `edit` child loading that editor. The layout renders the page editor at its own path and the outlet on child paths. Keep the actual RouteDialog, RouteDrawer and RouteChildPage. Declare `/equipment-validation` loading `equipment-validation.tsx` with the same authentication and administrator action. The server independently checks that native permission.
+
+Add the `equipment` application translation group: title, name, help, department, departmentError, attachment, retainedAttachment, longForm, response, save, saved, itemError, customCopy. English values are “Equipment borrowing”, “Equipment name”, “Keep this equipment identifier.”, “Department”, “Department must be Operations.”, “Attachment”, “Retained attachment”, “Additional equipment information.”, “Response”, “Save request”, “Saved; workflow submitted.”, “Check this borrowed item.” and “Customized equipment workflow and asset fields are preserved.” respectively. Add corresponding Chinese application overrides and preserve existing system groups.
+
+Initialize and check configuration through the native CLI, using a separate SQLite database and storage for each app. Start one fixture at a time with `NOCOBASE_STRICT_STARTUP=true APP_SERVER_PORT=<port> pnpm dev`, record its printed server Local URL, and verify the served `client/runtime.ts` identifies the intended application. Strict startup isolates the backend port while several development tasks share a host. Never copy configuration secrets or native sessions between applications or into evidence.
+
+Run `pnpm typecheck` after wiring the workload. Install the application's matching Playwright Chromium shell in a task-local directory and set `PLAYWRIGHT_BROWSERS_PATH`.
+
+## Inline feedback regression
+
+From each generated application run:
+
+```bash
+node tests/fixtures/form-feedback/verify-inline.mjs <printed-server-entry-url> <evidence-directory> <sample-name>
+```
+
+The verifier accepts only an explicitly supplied loopback `/main/` entry. It uses the isolated initializer's default native administrator or `TEST_ADMIN_USERNAME`/`TEST_ADMIN_PASSWORD` from the environment; it saves no session.
+
+Mapped field and array-level reasons appear only beside their controls, without a top summary or navigation list. Submission still opens required regions, scrolls and focuses the first editable error. Repeated submission does not accumulate errors; corrections and successful retry clear obsolete marks while preserving input, selected files, existing attachment references and help/error associations. Unknown paths, permission/network failures and unavailable editable focus targets retain a safe accessible form message. The script checks these cases in a real routed drawer and saves English screenshots and machine-readable results.
+
+The broader `verify.mjs` fixture remains available for layout order, row identities, long forms, dialog/drawer/detail routes, native permission checks and the fictional submitted/approved process. Its failure modes are explicit test inputs, not external providers. This fixture does not verify resumable uploads or a commercial approval provider.
+
+Existing source reconciliation support is documented in the installed upgrade Skill's `references/form-feedback-upgrade.md`. Preserve application-owned business code and executed migrations when using that support; creating old applications or replaying upgrades is not part of this inline regression.

package/tests/fixtures/form-feedback/equipment-detail.tsx

@@ -0,0 +1,11 @@
+import { Outlet } from 'react-router';
+import type { ReactElement } from 'react';
+
+export default function EquipmentDetail(): ReactElement {
+  return (
+    <section aria-label='Equipment record detail'>
+      <h2>Equipment record detail</h2>
+      <Outlet />
+    </section>
+  );
+}

package/tests/fixtures/form-feedback/equipment-layout.tsx

@@ -0,0 +1,15 @@
+import { Outlet, useLocation } from 'react-router';
+import type { ReactElement } from 'react';
+import EquipmentFixture from './equipment.js';
+
+export default function EquipmentLayout(): ReactElement {
+  const { pathname } = useLocation();
+  return (
+    <div className='relative h-full'>
+      <section aria-label='Equipment requests'>
+        Equipment borrowing requests
+      </section>
+      {pathname === '/equipment' ? <EquipmentFixture /> : <Outlet />}
+    </div>
+  );
+}

package/tests/fixtures/form-feedback/equipment-migration.ts

@@ -0,0 +1,27 @@
+// Test-only schema, installed before the customized application's source upgrade.
+import { defineMigration } from '@nocobase/db';
+export default defineMigration({
+  name: '209901010001_equipment_fixture',
+  async up({ builder }) {
+    await builder.createCollection('equipmentFixture', (collection) => {
+      collection.string('id').primary().notNull();
+      for (const key of [
+        'name',
+        'department',
+        'attachment',
+        'workflow',
+        'customField',
+      ])
+        collection.string(key, { nullable: false });
+    });
+    await builder.createCollection('equipmentFixtureHistory', (collection) => {
+      collection.string('id').primary().notNull();
+      for (const key of ['recordId', 'event', 'actor'])
+        collection.string(key, { nullable: false });
+    });
+  },
+  async down({ builder }) {
+    await builder.dropCollection('equipmentFixtureHistory');
+    await builder.dropCollection('equipmentFixture');
+  },
+});

package/tests/fixtures/form-feedback/equipment-server.ts

@@ -0,0 +1,197 @@
+import { randomUUID } from 'node:crypto';
+import type { Application } from '@nocobase/app-server/application';
+// Test-only routes for an isolated application; authentication and authorization remain native.
+import { authenticationToken } from '@nocobase/app-plugin-authentication';
+import { databaseManagerToken } from '@nocobase/db';
+import {
+  ApiError,
+  apiErrorHandler,
+  apiValidator,
+  apiErrorResponse,
+  dataResponse,
+  describeRoute,
+  defineApiRoutes,
+} from '@nocobase/app-server/router';
+import {
+  authorizationToken,
+  type AuthorizationEnv,
+} from '@nocobase/app-plugin-authorization';
+import { Hono } from 'hono';
+import { z } from 'zod';
+
+export const equipmentRoutes = defineApiRoutes<Application>((app) => {
+  const routes = new Hono<AuthorizationEnv>();
+  const auth = app.container.resolve(authenticationToken);
+  const db = app.container.resolve(databaseManagerToken);
+  routes.use(
+    '/equipmentFixture',
+    auth.required(),
+    app.container.resolve(authorizationToken).middleware(),
+  );
+  routes.onError(apiErrorHandler);
+  const schema = z.object({
+    mode: z.string(),
+    name: z.string(),
+    department: z.string(),
+    items: z.array(z.object({ key: z.string(), name: z.string() })),
+    attachment: z.string(),
+    recordId: z.string().optional(),
+  });
+  const description = {
+    tags: ['Equipment fixture'],
+    summary: 'Equipment verification fixture',
+    responses: {
+      200: dataResponse(z.unknown()),
+      400: apiErrorResponse(400),
+      401: apiErrorResponse(401),
+      403: apiErrorResponse(403),
+    },
+  };
+  routes.get(
+    '/equipmentFixture',
+    describeRoute({ ...description, operationId: 'equipmentFixtureGet' }),
+    async (c) => {
+      await c.get('authz').require({
+        resource: { type: 'user', id: '*' },
+        action: 'create',
+      });
+      const repository = db.repository('equipmentFixture');
+      if (!(await repository.findOne({ filter: { id: 'retained' } })))
+        await repository.createOne({
+          values: {
+            id: 'retained',
+            name: 'Legacy camera',
+            department: 'Operations',
+            attachment: 'safety-check.pdf',
+            workflow: 'approved',
+            customField: 'asset-714',
+          },
+        });
+      return c.json({
+        data: await repository.findOne({ filter: { id: 'retained' } }),
+        requests: await repository.findMany({}),
+        history: await db.repository('equipmentFixtureHistory').findMany({}),
+      });
+    },
+  );
+  routes.post(
+    '/equipmentFixture',
+    describeRoute({ ...description, operationId: 'equipmentFixtureSave' }),
+    apiValidator('json', schema),
+    async (c) => {
+      await c.get('authz').require({
+        resource: { type: 'user', id: '*' },
+        action: 'create',
+      });
+      const input = c.req.valid('json');
+      if (input.mode === 'denied')
+        throw new ApiError({
+          status: 'PERMISSION_DENIED',
+          reason: 'RESTRICTED',
+          domain: 'equipment-fixture',
+          message: 'Private equipment details',
+        });
+      if (input.mode !== 'success' && input.mode !== 'approve')
+        throw new ApiError({
+          status: 'INVALID_ARGUMENT',
+          reason: 'EQUIPMENT_INVALID',
+          domain: 'equipment-fixture',
+          message: 'Private developer stack',
+          fieldViolations:
+            input.mode === 'structured'
+              ? [
+                  {
+                    field: 'items[1].name',
+                    description: 'Private item value',
+                    reason: 'ITEM',
+                  },
+                  {
+                    field: 'items.0.name',
+                    description: 'Private item value',
+                    reason: 'ITEM',
+                  },
+                ]
+              : input.mode === 'business'
+                ? [
+                    {
+                      field: 'department',
+                      reason: 'DEPARTMENT',
+                      description: 'Private business detail',
+                    },
+                  ]
+                : [
+                    {
+                      field: 'privateSalary',
+                      description: 'Secret salary 123',
+                    },
+                  ],
+        });
+      return db.transaction(async (connection) => {
+        const repository = connection.repository('equipmentFixture');
+        const history = connection.repository('equipmentFixtureHistory');
+        if (input.mode === 'approve') {
+          const request = await repository.findOne({
+            filter: { id: input.recordId, workflow: 'submitted' },
+          });
+          if (!request)
+            throw new ApiError({
+              status: 'INVALID_ARGUMENT',
+              reason: 'NOT_SUBMITTED',
+              domain: 'equipment-fixture',
+              message: 'Only submitted requests can be approved.',
+            });
+          await repository.updateMany({
+            filter: { id: input.recordId, workflow: 'submitted' },
+            values: { workflow: 'approved' },
+          });
+          await history.createOne({
+            values: {
+              id: randomUUID(),
+              recordId: input.recordId,
+              event: 'approved',
+              actor: 'native-administrator',
+            },
+          });
+          return c.json({
+            data: await repository.findOne({ filter: { id: input.recordId } }),
+          });
+        }
+        if (input.department !== 'Operations')
+          throw new ApiError({
+            status: 'INVALID_ARGUMENT',
+            reason: 'DEPARTMENT',
+            domain: 'equipment-fixture',
+            message: 'Private business detail',
+            fieldViolations: [
+              {
+                field: 'department',
+                reason: 'DEPARTMENT',
+                description: 'Private business detail',
+              },
+            ],
+          });
+        const id = randomUUID();
+        await repository.createOne({
+          values: {
+            id,
+            name: input.name,
+            department: input.department,
+            attachment: input.attachment,
+            workflow: 'submitted',
+            customField: 'asset-714',
+          },
+        });
+        await history.createOne({
+          values: {
+            id: randomUUID(),
+            recordId: id,
+            event: 'submitted',
+            actor: 'native-administrator',
+          },
+        });
+        return c.json({ data: await repository.findOne({ filter: { id } }) });
+      });
+    },
+  );
+  return new Hono().route('/', routes);
+});

package/tests/fixtures/form-feedback/equipment-validation.tsx

@@ -0,0 +1,94 @@
+import { useState, type ReactElement } from 'react';
+import { useForm, useFieldArray } from 'react-hook-form';
+import { FeedbackForm } from '#components/feedback-form';
+import { PageContainer } from '#components/page-container';
+import { Button } from '#components/ui/button';
+import { Input } from '#components/ui/input';
+
+// Isolated browser regression workload; all feedback behavior comes from the selected template component.
+export default function EquipmentRegressions(): ReactElement {
+  const form = useForm<{ items: { name: string }[] }>({
+    defaultValues: { items: [{ name: 'Camera' }] },
+    shouldFocusError: false,
+  });
+  const rows = useFieldArray({
+    control: form.control,
+    name: 'items',
+    rules: {
+      minLength: { value: 2, message: 'Add at least two equipment items.' },
+    },
+  });
+  const [saved, setSaved] = useState(false);
+  const [invalid, setInvalid] = useState(false);
+  const [corrected, setCorrected] = useState(false);
+  return (
+    <PageContainer>
+      <h1 className='text-xl font-semibold'>Equipment validation</h1>
+      <div className='grid gap-8 max-w-2xl'>
+        <FeedbackForm
+          aria-label='Equipment group'
+          className='space-y-4'
+          noValidate
+          validationErrors={form.formState.errors}
+          submitting={form.formState.isSubmitting}
+          onSubmit={form.handleSubmit(() => setSaved(true))}
+        >
+          <h2 id='equipment-group-label' className='text-lg font-semibold'>
+            Equipment group
+          </h2>
+          <div>
+            <Button
+              type='button'
+              data-field-path='items'
+              aria-labelledby='equipment-group-label'
+              onClick={() => rows.append({ name: 'Projector' })}
+            >
+              Add equipment
+            </Button>
+          </div>
+          {rows.fields.map((row, i) => (
+            <div key={row.id}>
+              <label htmlFor={'group-' + row.id}>Equipment item {i + 1}</label>
+              <Input
+                id={'group-' + row.id}
+                {...form.register(`items.${i}.name`)}
+              />
+            </div>
+          ))}
+          <Button type='submit'>Save equipment group</Button>
+          {saved && <p role='status'>Equipment group saved.</p>}
+        </FeedbackForm>
+        <FeedbackForm
+          aria-label='Unique equipment'
+          className='space-y-4'
+          noValidate
+          onSubmit={() => setInvalid(true)}
+        >
+          <h2 className='text-lg'>Unique equipment name</h2>
+          <div data-slot='field'>
+            <label htmlFor='unique-equipment'>Unique name</label>
+            <Input
+              id='unique-equipment'
+              name='uniqueName'
+              defaultValue='Existing camera'
+              aria-invalid={invalid}
+              aria-describedby={corrected ? 'updated-help' : 'original-help'}
+              onChange={() => {
+                setInvalid(false);
+                setCorrected(true);
+              }}
+            />
+            <p id='original-help'>Use a unique inventory name.</p>
+            <p id='updated-help'>Corrected input is retained.</p>
+            {invalid && (
+              <p data-slot='field-error' className='text-destructive'>
+                Choose a unique equipment name.
+              </p>
+            )}
+          </div>
+          <Button type='submit'>Save unique name</Button>
+        </FeedbackForm>
+      </div>
+    </PageContainer>
+  );
+}