@object-ui/core 16.0.0 → 17.1.0

package/dist/validation/validators/object-validation-engine.js

@@ -5,6 +5,50 @@
  * This source code is licensed under the MIT license found in the
  * LICENSE file in the root directory of this source tree.
  */
+/** The spec's `events` default, applied here because `/meta` ships it absent. */
+const DEFAULT_EVENTS = ['insert', 'update'];
+/** The spec's `priority` default (lower runs first). */
+const DEFAULT_PRIORITY = 100;
+/**
+ * Read a predicate out of an `ExpressionInput` — the spec's wire shape for every
+ * expression-valued key, which is `string | { dialect, source?, ast? }`.
+ *
+ * Returns `null` when there is nothing evaluable (an `ast`-only envelope, an
+ * empty source, a non-CEL dialect). `null` means BROKEN, and every caller
+ * fails open on it, mirroring the server.
+ */
+function expressionSource(input) {
+    if (typeof input === 'string')
+        return input.trim() === '' ? null : input;
+    if (input && typeof input === 'object') {
+        const { dialect, source } = input;
+        // `cron` / `template` are not predicates, and an absent dialect is not the
+        // spec's envelope at all. Either way there is nothing to evaluate here.
+        if (dialect !== undefined && dialect !== 'cel')
+            return null;
+        if (typeof source === 'string' && source.trim() !== '')
+            return source;
+    }
+    return null;
+}
+// The three readers below take `unknown` on purpose. They run against metadata
+// as it arrives over `/meta`, where any of these keys may be absent, and an
+// absent key must resolve to the SPEC's default rather than to JavaScript's
+// falsiness. Narrowing here keeps that decision in one place.
+/** `active` defaults to `true`; only an explicit `false` disables a rule. */
+function isActive(rule) {
+    return rule?.active !== false;
+}
+/** `events` defaults to `['insert','update']`. */
+function eventsOf(rule) {
+    const events = rule?.events;
+    return Array.isArray(events) && events.length > 0 ? events : DEFAULT_EVENTS;
+}
+/** `priority` defaults to 100 (lower runs first). */
+function priorityOf(rule) {
+    const priority = rule?.priority;
+    return typeof priority === 'number' ? priority : DEFAULT_PRIORITY;
+}
 /**
  * Simple expression evaluator using a simple parser (no dynamic code execution)
  *
@@ -20,9 +64,13 @@
  * - Simple escape sequence handling (doesn't handle escaped backslashes)
  * - Field names in bracket notation cannot contain escaped quotes
  *
- * For more complex expressions, integrate a dedicated library like:
- * - JSONLogic (jsonlogic.com)
- * - filtrex
+ * NOT CEL. The spec's `dialect: 'cel'` predicates are evaluated server-side by
+ * `@objectstack/formula`; this parser understands the common comparison shape
+ * and nothing more. Anything it cannot parse yields a falsy value, which under
+ * this engine's polarity (TRUE ⇒ violated) means the rule fails OPEN — the same
+ * outcome the server produces for an un-evaluable predicate. To make the
+ * pre-check agree with the server on richer predicates, pass a CEL-backed
+ * `ValidationExpressionEvaluator` to the constructor.
  *
  * @see https://github.com/objectstack-ai/objectui/blob/main/SECURITY_FIX_SUMMARY.md
  */
@@ -169,8 +217,15 @@ class SimpleExpressionEvaluator {
     }
 }
 /**
- * Object-Level Validation Engine
- * Implements ObjectStack Spec v2.0.1 validation framework
+ * Object-Level Validation Engine — the client pre-check described at the top of
+ * this module.
+ *
+ * @deprecated (#3110) Validation rules are enforcement, and enforcement is
+ * single-implementation on the server (`objectql`'s rule-validator). Render the
+ * server's rejection instead; for pre-submit feedback, use a validate-only
+ * (dry-run) write. Still functional and still correct as of #3103 — but it
+ * cannot stay in step with the server without a conformance-fixture mechanism
+ * that does not exist yet. See the module header.
  */
 export class ObjectValidationEngine {
     constructor(expressionEvaluator, uniquenessChecker) {
@@ -190,20 +245,21 @@ export class ObjectValidationEngine {
         this.uniquenessChecker = uniquenessChecker;
     }
     /**
-     * Validate a record against a set of validation rules
+     * Validate a record against a set of validation rules.
+     *
+     * Rules run in `priority` order (lower first, stable within a priority), and
+     * only when `active` is not explicitly `false` and `events` covers this write
+     * context — reading the spec's defaults, not the falsiness of an absent key.
      */
     async validateRecord(rules, context, event = 'insert') {
         const results = [];
-        for (const rule of rules) {
-            // Check if rule is active
-            if (!rule.active) {
-                continue;
-            }
-            // Check if rule applies to this event
-            if (!rule.events.includes(event)) {
-                continue;
-            }
-            const result = await this.validateRule(rule, context);
+        const applicable = rules
+            .filter((rule) => isActive(rule) && eventsOf(rule).includes(event))
+            // `sort` is stable in every engine objectui targets (ES2019+), so equal
+            // priorities keep their authored order.
+            .sort((a, b) => priorityOf(a) - priorityOf(b));
+        for (const rule of applicable) {
+            const result = await this.validateRule(rule, context, event);
             if (!result.valid) {
                 results.push(result);
             }
@@ -211,40 +267,76 @@ export class ObjectValidationEngine {
         return results;
     }
     /**
-     * Validate a single rule
+     * Validate a single rule.
+     *
+     * `rule` is widened past `ObjectValidationRule` because a `conditional`'s
+     * `then` / `otherwise` branch may be any rule the SPEC's union admits —
+     * including `json_schema`, which this engine does not implement.
      */
-    async validateRule(rule, context) {
+    async validateRule(rule, context, event) {
         switch (rule.type) {
             case 'script':
-                return this.validateScript(rule, context);
-            case 'unique':
-                return this.validateUniqueness(rule, context);
-            case 'state_machine':
-                return this.validateStateMachine(rule, context);
+                return this.validatePredicate(rule, context, 'Script');
             case 'cross_field':
-                return this.validateCrossField(rule, context);
-            case 'async':
-                return this.validateAsync(rule, context);
+                return this.validatePredicate(rule, context, 'Cross-field');
+            case 'state_machine':
+                return this.validateStateMachine(rule, context, event);
             case 'conditional':
-                return this.validateConditional(rule, context);
+                return this.validateConditional(rule, context, event);
             case 'format':
                 return this.validateFormat(rule, context);
+            // Deprecated objectui-local variants — see @object-ui/types. The spec's
+            // union rejects these, so they cannot arrive from `/meta`.
+            case 'unique':
+                return this.validateUniqueness(rule, context);
+            case 'async':
+                return this.validateAsync(rule, context);
             case 'range':
                 return this.validateRange(rule, context);
             default:
-                return {
-                    valid: true,
-                    message: `Unknown validation type: ${rule.type}`,
-                };
+                // Loud, not silent. `json_schema` is a real spec variant this engine
+                // does not implement; reporting it as valid would let the pre-check
+                // green-light a record the server is about to reject, with nothing in
+                // the console to explain the disagreement.
+                console.warn(`[ObjectValidationEngine] rule '${rule.name ?? '(unnamed)'}' has ` +
+                    `type '${rule.type}', which this client engine does not evaluate — ` +
+                    `not checked here; the server remains the authority.`);
+                return { valid: true };
         }
     }
     /**
-     * Validate script-based rule
+     * The evaluation scope for a predicate.
+     *
+     * The server binds `{ record, previous }`, so a spec-authored predicate reads
+     * `record.amount`. objectui's own rules have always been written against the
+     * bare field name (`amount`). Both are bound — the roots last so a field
+     * literally called `record` cannot shadow them.
      */
-    validateScript(rule, context) {
+    scopeFor(context) {
+        return {
+            ...context.record,
+            record: context.record,
+            previous: context.oldRecord,
+            user: context.user,
+        };
+    }
+    /**
+     * Evaluate a `script` / `cross_field` predicate.
+     *
+     * Both variants share one path on the server, and so do they here. The
+     * predicate is the FAILURE condition: TRUE means the rule is violated. A
+     * predicate that cannot be evaluated is a BROKEN rule and fails open.
+     */
+    validatePredicate(rule, context, label) {
+        const source = expressionSource(rule.condition);
+        if (source === null) {
+            console.warn(`[ObjectValidationEngine] ${label.toLowerCase()} rule '${rule.name}' has no evaluable ` +
+                `condition — skipped (the server remains the authority).`);
+            return { valid: true };
+        }
         try {
-            const result = this.expressionEvaluator.evaluate(rule.condition, context.record);
-            if (!result) {
+            const violated = this.expressionEvaluator.evaluate(source, this.scopeFor(context));
+            if (violated === true) {
                 return {
                     valid: false,
                     message: rule.message,
@@ -255,12 +347,10 @@ export class ObjectValidationEngine {
             return { valid: true };
         }
         catch (error) {
-            return {
-                valid: false,
-                message: `Script evaluation error: ${error}`,
-                rule: rule.name,
-                severity: 'error',
-            };
+            // Broken, not violated — mirror the server and fail open.
+            console.warn(`[ObjectValidationEngine] ${label.toLowerCase()} rule '${rule.name}' failed to ` +
+                `evaluate (${error}) — skipped.`);
+            return { valid: true };
         }
     }
     /**
@@ -287,31 +377,65 @@ export class ObjectValidationEngine {
         return { valid: true };
     }
     /**
-     * Validate state machine transitions
+     * Validate state machine transitions (ADR-0020).
+     *
+     * A flat `field` plus a `{ from: [allowedTo] }` map. Semantics mirror the
+     * server-side rule-validator:
+     *
+     *   INSERT
+     *   - no `initialStates` declared        → allow (legacy no-op)
+     *   - field absent from the write        → allow (requiredness is not our job)
+     *   - value empty                        → allow (ditto)
+     *   - value ∉ initialStates              → reject (the FSM entry point, #3165)
+     *
+     *   UPDATE
+     *   - field absent from the write        → allow (no transition to police)
+     *   - no prior record                    → allow (cannot reason)
+     *   - field unchanged, or cleared        → allow (no transition)
+     *   - `from` not declared in the map     → lenient allow (unconstrained)
+     *   - `to` ∉ transitions[from]           → reject
      */
-    validateStateMachine(rule, context) {
-        // ADR-0020 flat FSM: a `field` plus a `{ from: [allowedTo] }` map.
-        // Semantics mirror the server-side rule-validator:
-        //   - insert / no prior state           → allow (initial assignment)
-        //   - field unchanged (from === to)      → allow (no transition)
-        //   - `from` not declared in the map      → lenient allow (unconstrained)
-        //   - `to` ∉ transitions[from]           → reject
+    validateStateMachine(rule, context, event) {
+        const touched = rule.field in context.record;
+        if (event === 'insert') {
+            const initial = rule.initialStates;
+            // No entry-point contract — insert is unconstrained (legacy behavior).
+            if (!Array.isArray(initial) || initial.length === 0)
+                return { valid: true };
+            if (!touched)
+                return { valid: true };
+            const value = context.record[rule.field];
+            // Empty is requiredness's problem, not the FSM's.
+            if (value === undefined || value === null || value === '')
+                return { valid: true };
+            if (initial.includes(String(value)))
+                return { valid: true };
+            return {
+                valid: false,
+                message: rule.message || `'${String(value)}' is not a valid initial state for ${rule.field}`,
+                rule: rule.name,
+                severity: rule.severity,
+            };
+        }
+        // The state field wasn't part of this write — nothing to police.
+        if (!touched)
+            return { valid: true };
         const currentState = context.record[rule.field];
         const previousState = context.oldRecord?.[rule.field];
-        // No prior state (insert) — any initial value is allowed.
+        // No prior state — cannot reason about a transition.
         if (previousState === undefined || previousState === null) {
             return { valid: true };
         }
-        // The state field wasn't part of this change — nothing to police.
-        if (previousState === currentState) {
+        // Unchanged, or cleared — no transition to enforce.
+        if (previousState === currentState || currentState === undefined || currentState === null) {
             return { valid: true };
         }
-        const allowed = rule.transitions[previousState];
+        const allowed = rule.transitions[String(previousState)];
         // `from` state not declared — leave it unconstrained (lenient).
-        if (allowed === undefined) {
+        if (!Array.isArray(allowed)) {
             return { valid: true };
         }
-        if (allowed.includes(currentState)) {
+        if (allowed.includes(String(currentState))) {
             return { valid: true };
         }
         return {
@@ -321,31 +445,6 @@ export class ObjectValidationEngine {
             severity: rule.severity,
         };
     }
-    /**
-     * Validate cross-field constraints
-     */
-    validateCrossField(rule, context) {
-        try {
-            const result = this.expressionEvaluator.evaluate(rule.condition, context.record);
-            if (!result) {
-                return {
-                    valid: false,
-                    message: rule.message,
-                    rule: rule.name,
-                    severity: rule.severity,
-                };
-            }
-            return { valid: true };
-        }
-        catch (error) {
-            return {
-                valid: false,
-                message: `Cross-field validation error: ${error}`,
-                rule: rule.name,
-                severity: 'error',
-            };
-        }
-    }
     /**
      * Validate async/remote validation
      */
@@ -380,71 +479,75 @@ export class ObjectValidationEngine {
         }
     }
     /**
-     * Validate conditional rules
+     * Validate a conditional rule.
+     *
+     * Evaluates `when`, then recurses into `then` (TRUE) or `otherwise` (FALSE).
+     * The nested rule supplies the violation; an un-evaluable `when` is a broken
+     * rule and fails open. A branch whose own `active` is explicitly `false` is
+     * skipped, matching the server.
      */
-    async validateConditional(rule, context) {
-        try {
-            const conditionMet = this.expressionEvaluator.evaluate(rule.condition, context.record);
-            if (!conditionMet) {
-                // Condition not met, validation passes
-                return { valid: true };
-            }
-            // Condition met, validate nested rules
-            for (const nestedRule of rule.rules) {
-                const result = await this.validateRule(nestedRule, context);
-                if (!result.valid) {
-                    return result;
-                }
-            }
+    async validateConditional(rule, context, event) {
+        const source = expressionSource(rule.when);
+        if (source === null) {
+            console.warn(`[ObjectValidationEngine] conditional rule '${rule.name}' has no evaluable ` +
+                `\`when\` predicate — skipped (the server remains the authority).`);
             return { valid: true };
         }
+        let conditionMet;
+        try {
+            conditionMet = this.expressionEvaluator.evaluate(source, this.scopeFor(context));
+        }
         catch (error) {
-            return {
-                valid: false,
-                message: `Conditional validation error: ${error}`,
-                rule: rule.name,
-                severity: 'error',
-            };
+            console.warn(`[ObjectValidationEngine] conditional rule '${rule.name}' \`when\` predicate failed ` +
+                `to evaluate (${error}) — skipped.`);
+            return { valid: true };
+        }
+        const branch = conditionMet === true ? rule.then : rule.otherwise;
+        if (!branch || !isActive(branch)) {
+            return { valid: true };
         }
+        return this.validateRule(branch, context, event);
     }
     /**
-     * Validate format/pattern
+     * Validate a field's format against `regex` and/or a named `format`.
+     *
+     * Mirrors the server: the rule only fires when the write TOUCHES the field and
+     * the value is non-empty (requiredness and type-shape belong to the
+     * field-level validator, so an absent or blank value is not a format
+     * violation). Both checks apply when both are declared. A `regex` that will
+     * not compile is a BROKEN rule — logged and skipped, never a violation.
      */
     validateFormat(rule, context) {
+        if (!(rule.field in context.record)) {
+            return { valid: true };
+        }
         const value = context.record[rule.field];
         if (value === null || value === undefined || value === '') {
             return { valid: true };
         }
-        try {
+        const str = String(value);
+        const violation = {
+            valid: false,
+            message: rule.message || `Invalid format for ${rule.field}`,
+            rule: rule.name,
+            severity: rule.severity,
+        };
+        if (rule.regex) {
             let pattern;
-            if (rule.format) {
-                // Use predefined format
-                pattern = this.getPredefinedPattern(rule.format);
-            }
-            else if (typeof rule.pattern === 'string') {
-                pattern = new RegExp(rule.pattern, rule.flags);
+            try {
+                pattern = new RegExp(rule.regex);
             }
-            else {
-                pattern = rule.pattern;
-            }
-            if (!pattern.test(String(value))) {
-                return {
-                    valid: false,
-                    message: rule.message || `Invalid format for ${rule.field}`,
-                    rule: rule.name,
-                    severity: rule.severity,
-                };
+            catch {
+                console.warn(`[ObjectValidationEngine] format rule '${rule.name}' has an invalid regex — skipped.`);
+                return { valid: true };
             }
-            return { valid: true };
+            if (!pattern.test(str))
+                return violation;
         }
-        catch (error) {
-            return {
-                valid: false,
-                message: `Format validation error: ${error}`,
-                rule: rule.name,
-                severity: 'error',
-            };
+        if (rule.format && !matchesNamedFormat(rule.format, str)) {
+            return violation;
         }
+        return { valid: true };
     }
     /**
      * Validate range constraints
@@ -508,29 +611,59 @@ export class ObjectValidationEngine {
             };
         }
     }
-    /**
-     * Get predefined regex pattern
-     */
-    getPredefinedPattern(format) {
-        const patterns = {
-            email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
-            url: /^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&/=]*)$/,
-            phone: /^[\d\s\-+()]+$/,
-            ipv4: /^(\d{1,3}\.){3}\d{1,3}$/,
-            ipv6: /^([\da-f]{1,4}:){7}[\da-f]{1,4}$/i,
-            uuid: /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,
-            iso_date: /^\d{4}-\d{2}-\d{2}$/,
-            credit_card: /^\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}$/,
-        };
-        return patterns[format] || /.*/;
+}
+// Linear-time email check, copied from the server's rule-validator: domain
+// labels exclude '.', so the quantifiers either side of each '.' cannot overlap
+// — avoiding the polynomial backtracking (ReDoS) of the naive
+// `[^\s@]+\.[^\s@]+` shape while still requiring a local part, an '@' and a
+// dotted domain.
+const EMAIL_RE = /^[^\s@]+@[^\s@.]+(?:\.[^\s@.]+)+$/;
+// Lenient phone matcher: optional leading +, then 7–20 digits with spaces,
+// dashes, dots and parens allowed as separators. Intentionally permissive —
+// strict national formats belong in a `regex`.
+const PHONE_RE = /^\+?[\d\s().-]{7,20}$/;
+/**
+ * The spec's four named formats, matched the way the server matches them.
+ *
+ * An unrecognised name returns `true` (no violation): the client must not reject
+ * a value over a format only the server knows how to check.
+ */
+function matchesNamedFormat(format, str) {
+    switch (format) {
+        case 'email':
+            return EMAIL_RE.test(str);
+        case 'phone':
+            return PHONE_RE.test(str);
+        case 'url':
+            try {
+                new URL(str);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        case 'json':
+            try {
+                JSON.parse(str);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        default:
+            return true;
     }
 }
 /**
  * Default instance
+ *
+ * @deprecated (#3110) See `ObjectValidationEngine`.
  */
 export const defaultObjectValidationEngine = new ObjectValidationEngine();
 /**
  * Convenience function to validate a record
+ *
+ * @deprecated (#3110) See `ObjectValidationEngine`.
  */
 export async function validateRecord(rules, context, event = 'insert') {
     return defaultObjectValidationEngine.validateRecord(rules, context, event);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "16.0.0",
+  "version": "17.1.0",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -25,11 +25,11 @@
     }
   },
   "dependencies": {
-    "@objectstack/formula": "^14.6.0",
-    "@objectstack/spec": "^15.1.1",
+    "@objectstack/formula": "^17.0.0-rc.0",
+    "@objectstack/spec": "^17.0.0-rc.0",
     "lodash": "^4.18.1",
     "zod": "^4.4.3",
-    "@object-ui/types": "16.0.0"
+    "@object-ui/types": "17.1.0"
   },
   "devDependencies": {
     "typescript": "^6.0.3",