@object-ui/core 0.3.1 → 0.5.0

package/dist/validation/validators/object-validation-engine.js

@@ -0,0 +1,538 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Simple expression evaluator using a simple parser (no dynamic code execution)
+ *
+ * SECURITY: This implementation parses expressions into an AST and evaluates them
+ * without using eval() or new Function(). It supports:
+ * - Comparison operators: ==, !=, >, <, >=, <=
+ * - Logical operators: &&, ||, !
+ * - Property access: record.field, record['field']
+ * - Literals: true, false, null, numbers, strings
+ *
+ * LIMITATIONS:
+ * - Single comparison operator per expression (no chaining like a > b > c)
+ * - Simple escape sequence handling (doesn't handle escaped backslashes)
+ * - Field names in bracket notation cannot contain escaped quotes
+ *
+ * For more complex expressions, integrate a dedicated library like:
+ * - JSONLogic (jsonlogic.com)
+ * - filtrex
+ *
+ * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
+ */
+class SimpleExpressionEvaluator {
+    evaluate(expression, context) {
+        try {
+            return this.evaluateSafeExpression(expression.trim(), context);
+        }
+        catch (error) {
+            console.error('Expression evaluation error:', error);
+            return false;
+        }
+    }
+    /**
+     * Safely evaluate an expression without using dynamic code execution
+     */
+    evaluateSafeExpression(expr, context) {
+        // Handle boolean literals
+        if (expr === 'true')
+            return true;
+        if (expr === 'false')
+            return false;
+        if (expr === 'null')
+            return null;
+        // Handle string literals
+        if ((expr.startsWith('"') && expr.endsWith('"')) ||
+            (expr.startsWith("'") && expr.endsWith("'"))) {
+            return expr.slice(1, -1);
+        }
+        // Handle numeric literals
+        if (/^-?\d+(\.\d+)?$/.test(expr)) {
+            return parseFloat(expr);
+        }
+        // Handle logical NOT
+        if (expr.startsWith('!')) {
+            return !this.evaluateSafeExpression(expr.slice(1).trim(), context);
+        }
+        // Handle logical AND
+        if (expr.includes('&&')) {
+            const parts = this.splitOnOperator(expr, '&&');
+            return parts.every(part => this.evaluateSafeExpression(part, context));
+        }
+        // Handle logical OR
+        if (expr.includes('||')) {
+            const parts = this.splitOnOperator(expr, '||');
+            return parts.some(part => this.evaluateSafeExpression(part, context));
+        }
+        // Handle comparison operators
+        const comparisonMatch = expr.match(/^(.+?)\s*(===|!==|==|!=|>=|<=|>|<)\s*(.+)$/);
+        if (comparisonMatch) {
+            const [, left, op, right] = comparisonMatch;
+            const leftVal = this.evaluateSafeExpression(left.trim(), context);
+            const rightVal = this.evaluateSafeExpression(right.trim(), context);
+            switch (op) {
+                case '===':
+                    return leftVal === rightVal;
+                case '==':
+                    // Use loose equality for backward compatibility with existing expressions
+                    // eslint-disable-next-line eqeqeq
+                    return leftVal == rightVal;
+                case '!==':
+                    return leftVal !== rightVal;
+                case '!=':
+                    // Use loose inequality for backward compatibility with existing expressions
+                    // eslint-disable-next-line eqeqeq
+                    return leftVal != rightVal;
+                case '>': return leftVal > rightVal;
+                case '<': return leftVal < rightVal;
+                case '>=': return leftVal >= rightVal;
+                case '<=': return leftVal <= rightVal;
+                default: return false;
+            }
+        }
+        // Handle property access (e.g., record.field or context.field)
+        return this.getValueFromContext(expr, context);
+    }
+    /**
+     * Split expression on operator, respecting parentheses and quotes
+     */
+    splitOnOperator(expr, operator) {
+        const parts = [];
+        let current = '';
+        let depth = 0;
+        let inString = false;
+        let stringChar = '';
+        for (let i = 0; i < expr.length; i++) {
+            const char = expr[i];
+            const nextChar = expr[i + 1];
+            const prevChar = i > 0 ? expr[i - 1] : '';
+            // Handle string quotes, checking for escape sequences
+            if ((char === '"' || char === "'") && !inString) {
+                inString = true;
+                stringChar = char;
+            }
+            else if (char === stringChar && inString && prevChar !== '\\') {
+                // Only close string if quote is not escaped
+                inString = false;
+            }
+            if (!inString) {
+                if (char === '(')
+                    depth++;
+                if (char === ')')
+                    depth--;
+                if (depth === 0 && char === operator[0] && nextChar === operator[1]) {
+                    parts.push(current.trim());
+                    current = '';
+                    i++; // Skip next character
+                    continue;
+                }
+            }
+            current += char;
+        }
+        if (current) {
+            parts.push(current.trim());
+        }
+        return parts;
+    }
+    /**
+     * Get value from context by path (e.g., "record.age" or "age")
+     */
+    getValueFromContext(path, context) {
+        // Handle bracket notation: record['field']
+        const bracketMatch = path.match(/^(\w+)\['([^']+)'\]$/);
+        if (bracketMatch) {
+            const [, obj, field] = bracketMatch;
+            return context[obj]?.[field];
+        }
+        // Handle dot notation: record.field or just field
+        const parts = path.split('.');
+        let value = context;
+        for (const part of parts) {
+            if (value && typeof value === 'object' && part in value) {
+                value = value[part];
+            }
+            else {
+                // Try direct context access for simple identifiers
+                if (parts.length === 1 && part in context) {
+                    return context[part];
+                }
+                return undefined;
+            }
+        }
+        return value;
+    }
+}
+/**
+ * Object-Level Validation Engine
+ * Implements ObjectStack Spec v0.7.1 validation framework
+ */
+export class ObjectValidationEngine {
+    constructor(expressionEvaluator, uniquenessChecker) {
+        Object.defineProperty(this, "expressionEvaluator", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        Object.defineProperty(this, "uniquenessChecker", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.expressionEvaluator = expressionEvaluator || new SimpleExpressionEvaluator();
+        this.uniquenessChecker = uniquenessChecker;
+    }
+    /**
+     * Validate a record against a set of validation rules
+     */
+    async validateRecord(rules, context, event = 'insert') {
+        const results = [];
+        for (const rule of rules) {
+            // Check if rule is active
+            if (!rule.active) {
+                continue;
+            }
+            // Check if rule applies to this event
+            if (!rule.events.includes(event)) {
+                continue;
+            }
+            const result = await this.validateRule(rule, context);
+            if (!result.valid) {
+                results.push(result);
+            }
+        }
+        return results;
+    }
+    /**
+     * Validate a single rule
+     */
+    async validateRule(rule, context) {
+        switch (rule.type) {
+            case 'script':
+                return this.validateScript(rule, context);
+            case 'unique':
+                return this.validateUniqueness(rule, context);
+            case 'state_machine':
+                return this.validateStateMachine(rule, context);
+            case 'cross_field':
+                return this.validateCrossField(rule, context);
+            case 'async':
+                return this.validateAsync(rule, context);
+            case 'conditional':
+                return this.validateConditional(rule, context);
+            case 'format':
+                return this.validateFormat(rule, context);
+            case 'range':
+                return this.validateRange(rule, context);
+            default:
+                return {
+                    valid: true,
+                    message: `Unknown validation type: ${rule.type}`,
+                };
+        }
+    }
+    /**
+     * Validate script-based rule
+     */
+    validateScript(rule, context) {
+        try {
+            const result = this.expressionEvaluator.evaluate(rule.condition, context.record);
+            if (!result) {
+                return {
+                    valid: false,
+                    message: rule.message,
+                    rule: rule.name,
+                    severity: rule.severity,
+                };
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Script evaluation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Validate uniqueness constraint
+     */
+    async validateUniqueness(rule, context) {
+        if (!this.uniquenessChecker) {
+            console.warn('Uniqueness checker not configured');
+            return { valid: true };
+        }
+        const values = {};
+        for (const field of rule.fields) {
+            values[field] = context.record[field];
+        }
+        const isUnique = await this.uniquenessChecker(rule.fields, values, rule.scope, context);
+        if (!isUnique) {
+            return {
+                valid: false,
+                message: rule.message,
+                rule: rule.name,
+                severity: rule.severity,
+            };
+        }
+        return { valid: true };
+    }
+    /**
+     * Validate state machine transitions
+     */
+    validateStateMachine(rule, context) {
+        const currentState = context.record[rule.stateField];
+        const previousState = context.oldRecord?.[rule.stateField];
+        // If no previous state (insert), allow any state
+        if (!previousState) {
+            return { valid: true };
+        }
+        // Check if transition is allowed
+        for (const transition of rule.transitions) {
+            const fromStates = Array.isArray(transition.from) ? transition.from : [transition.from];
+            if (!fromStates.includes(previousState)) {
+                continue;
+            }
+            if (transition.to !== currentState) {
+                continue;
+            }
+            // Check condition if specified
+            if (transition.condition) {
+                const conditionMet = this.expressionEvaluator.evaluate(transition.condition, context.record);
+                if (!conditionMet) {
+                    continue;
+                }
+            }
+            // Valid transition found
+            return { valid: true };
+        }
+        return {
+            valid: false,
+            message: rule.message || `Invalid state transition from ${previousState} to ${currentState}`,
+            rule: rule.name,
+            severity: rule.severity,
+        };
+    }
+    /**
+     * Validate cross-field constraints
+     */
+    validateCrossField(rule, context) {
+        try {
+            const result = this.expressionEvaluator.evaluate(rule.condition, context.record);
+            if (!result) {
+                return {
+                    valid: false,
+                    message: rule.message,
+                    rule: rule.name,
+                    severity: rule.severity,
+                };
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Cross-field validation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Validate async/remote validation
+     */
+    async validateAsync(rule, context) {
+        try {
+            const method = rule.method || 'POST';
+            const response = await fetch(rule.endpoint, {
+                method,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: method !== 'GET' ? JSON.stringify(context.record) : undefined,
+            });
+            const data = await response.json();
+            if (!data.valid) {
+                return {
+                    valid: false,
+                    message: data.message || rule.message,
+                    rule: rule.name,
+                    severity: rule.severity,
+                };
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Async validation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Validate conditional rules
+     */
+    async validateConditional(rule, context) {
+        try {
+            const conditionMet = this.expressionEvaluator.evaluate(rule.condition, context.record);
+            if (!conditionMet) {
+                // Condition not met, validation passes
+                return { valid: true };
+            }
+            // Condition met, validate nested rules
+            for (const nestedRule of rule.rules) {
+                const result = await this.validateRule(nestedRule, context);
+                if (!result.valid) {
+                    return result;
+                }
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Conditional validation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Validate format/pattern
+     */
+    validateFormat(rule, context) {
+        const value = context.record[rule.field];
+        if (value === null || value === undefined || value === '') {
+            return { valid: true };
+        }
+        try {
+            let pattern;
+            if (rule.format) {
+                // Use predefined format
+                pattern = this.getPredefinedPattern(rule.format);
+            }
+            else if (typeof rule.pattern === 'string') {
+                pattern = new RegExp(rule.pattern, rule.flags);
+            }
+            else {
+                pattern = rule.pattern;
+            }
+            if (!pattern.test(String(value))) {
+                return {
+                    valid: false,
+                    message: rule.message || `Invalid format for ${rule.field}`,
+                    rule: rule.name,
+                    severity: rule.severity,
+                };
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Format validation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Validate range constraints
+     */
+    validateRange(rule, context) {
+        const value = context.record[rule.field];
+        if (value === null || value === undefined) {
+            return { valid: true };
+        }
+        try {
+            // Convert to comparable values
+            let compareValue;
+            let minValue;
+            let maxValue;
+            if (value instanceof Date || typeof value === 'string') {
+                compareValue = value instanceof Date ? value : new Date(value);
+                minValue = rule.min ? (rule.min instanceof Date ? rule.min : new Date(rule.min)) : undefined;
+                maxValue = rule.max ? (rule.max instanceof Date ? rule.max : new Date(rule.max)) : undefined;
+            }
+            else {
+                compareValue = Number(value);
+                minValue = rule.min !== undefined ? Number(rule.min) : undefined;
+                maxValue = rule.max !== undefined ? Number(rule.max) : undefined;
+            }
+            // Check minimum
+            if (minValue !== undefined) {
+                const fails = rule.minExclusive
+                    ? compareValue <= minValue
+                    : compareValue < minValue;
+                if (fails) {
+                    return {
+                        valid: false,
+                        message: rule.message || `Value must be ${rule.minExclusive ? 'greater than' : 'at least'} ${rule.min}`,
+                        rule: rule.name,
+                        severity: rule.severity,
+                    };
+                }
+            }
+            // Check maximum
+            if (maxValue !== undefined) {
+                const fails = rule.maxExclusive
+                    ? compareValue >= maxValue
+                    : compareValue > maxValue;
+                if (fails) {
+                    return {
+                        valid: false,
+                        message: rule.message || `Value must be ${rule.maxExclusive ? 'less than' : 'at most'} ${rule.max}`,
+                        rule: rule.name,
+                        severity: rule.severity,
+                    };
+                }
+            }
+            return { valid: true };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                message: `Range validation error: ${error}`,
+                rule: rule.name,
+                severity: 'error',
+            };
+        }
+    }
+    /**
+     * Get predefined regex pattern
+     */
+    getPredefinedPattern(format) {
+        const patterns = {
+            email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
+            url: /^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&/=]*)$/,
+            phone: /^[\d\s\-+()]+$/,
+            ipv4: /^(\d{1,3}\.){3}\d{1,3}$/,
+            ipv6: /^([\da-f]{1,4}:){7}[\da-f]{1,4}$/i,
+            uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
+            iso_date: /^\d{4}-\d{2}-\d{2}$/,
+            credit_card: /^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$/,
+        };
+        return patterns[format] || /.*/;
+    }
+}
+/**
+ * Default instance
+ */
+export const defaultObjectValidationEngine = new ObjectValidationEngine();
+/**
+ * Convenience function to validate a record
+ */
+export async function validateRecord(rules, context, event = 'insert') {
+    return defaultObjectValidationEngine.validateRecord(rules, context, event);
+}

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@object-ui/core",
-  "version": "0.3.1",
+  "version": "0.5.0",
+  "type": "module",
   "license": "MIT",
   "description": "Core logic, types, and validation for Object UI. Zero React dependencies.",
   "homepage": "https://www.objectui.org",
@@ -12,13 +13,20 @@
   "bugs": {
     "url": "https://github.com/objectstack-ai/objectui/issues"
   },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
   "dependencies": {
-    "@objectstack/spec": "^0.3.3",
+    "@objectstack/spec": "^0.9.1",
     "lodash": "^4.17.23",
     "zod": "^4.3.6",
-    "@object-ui/types": "0.3.1"
+    "@object-ui/types": "0.5.0"
   },
   "devDependencies": {
     "typescript": "^5.9.3",

package/src/actions/index.ts

@@ -6,4 +6,4 @@
  * LICENSE file in the root directory of this source tree.
  */
 
-export * from './ActionRunner';
+export * from './ActionRunner.js';