@object-ui/core 5.0.2 → 5.2.1

package/CHANGELOG.md

@@ -1,5 +1,91 @@
 # @object-ui/core
 
+## 5.2.1
+
+### Patch Changes
+
+- @object-ui/types@5.2.1
+
+## 5.2.0
+
+### Minor Changes
+
+- de0c5e6: Add `DataSource.bulkDelete(resource, ids)` as the symmetric counterpart
+  to `bulkUpdate`. Implemented in `data-objectstack` via the client's
+  `deleteMany` primitive with a per-id fallback that emulates
+  `continueOnError` semantics for older clients.
+
+  Extract the bulk-vs-per-row decision into a reusable
+  `executeBulkBatch(input, ops)` helper in `@object-ui/core`:
+  - Single decision tree shared by both update and delete fast paths.
+  - Bulk success → no per-row pass.
+  - Bulk partial-count → aggregate batch error.
+  - Bulk throw → per-row fallback so users still get id-level error detail.
+
+  `useBulkExecutor` in plugin-grid now uses the helper for both `update`
+  and `delete` batches, cutting "delete 500 selected rows" from 500 HTTP
+  requests down to ~3.
+
+### Patch Changes
+
+- d1442e3: test(core): comprehensive security + correctness tests for SafeExpressionParser
+
+  Add a ~50-case suite covering literals, operators, ternary, property
+  access, calls/arrows, and a full security section (blocks
+  `constructor` / `__proto__` / `prototype` / `__defineGetter__` /
+  `__defineSetter__`, denies `eval` / `Function` / `window` / `process`,
+  rejects assignment syntax). No production code changes.
+
+- Updated dependencies [de0c5e6]
+- Updated dependencies [9997cae]
+- Updated dependencies [70b5570]
+  - @object-ui/types@5.2.0
+
+## 5.1.1
+
+### Patch Changes
+
+- @object-ui/types@5.1.1
+
+## 5.1.0
+
+### Minor Changes
+
+- 5b80cfd: feat: Optimistic Concurrency Control (OCC) on DataSource writes
+
+  `DataSource.update()` and `DataSource.delete()` now accept an optional fourth /
+  third argument `opts?: { ifMatch?: string }`. When supplied, adapters forward
+  the token to the backend; servers that implement OCC (e.g. ObjectStack
+  `>=4.2.0`) compare it against the record's current `updated_at` and reject
+  with `409 CONCURRENT_UPDATE` on mismatch, preventing silent overwrites in
+  multi-user editing scenarios.
+
+  **`@object-ui/data-objectstack`**
+  - Exports `ConcurrentUpdateError` (carries `currentVersion` and
+    `currentRecord`) and `isConcurrentUpdateError()` type guard.
+  - `update()` / `delete()` accept `opts.ifMatch` and forward it via the
+    `@objectstack/client` data API (header: `If-Match`). Requires
+    `@objectstack/client@>=4.1.2` for the header to reach the server;
+    older clients silently drop the option and fall back to today's
+    "last writer wins" behaviour.
+  - Adapter-level error handling maps a 409 with `code === 'CONCURRENT_UPDATE'`
+    into a typed `ConcurrentUpdateError` so callers can detect and recover
+    from conflicts without parsing the wire format.
+
+  **`@object-ui/core`**
+  - `ApiDataSource.update()` and `.delete()` accept `opts.ifMatch` and emit
+    the `If-Match` HTTP header.
+
+  UI consumers (Detail view, inline cell-edit) will be wired in a follow-up
+  patch to capture `updated_at` at load time, pass it as `ifMatch` on save,
+  and present a Reload / Overwrite / Cancel dialog on conflict.
+
+### Patch Changes
+
+- Updated dependencies [cf30cc2]
+- Updated dependencies [5b80cfd]
+  - @object-ui/types@5.1.0
+
 ## 5.0.2
 
 ### Patch Changes

package/dist/actions/bulkFastPath.d.ts

@@ -0,0 +1,85 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Outcome of a single batch execution. Mirrors the fields callers care
+ * about so they can fold these into their own aggregate result.
+ */
+export interface BulkBatchOutcome {
+    succeeded: number;
+    failed: number;
+    errors: Array<{
+        id: string;
+        error: string;
+    }>;
+}
+/**
+ * Pluggable callbacks for the executor. Either of these is wired by the
+ * caller — typically `bulkCall` issues 1 HTTP request and `perRow` is
+ * the per-id fallback used when the bulk endpoint is unavailable or
+ * throws. We never call both for the same batch in the same pass.
+ */
+export interface BulkBatchOps {
+    /**
+     * One server call that mutates every id in the batch with the same
+     * shape. Returns the count of rows the server reports as succeeded.
+     * Throws when the entire request fails (network, 500, auth) — that
+     * signals "fall back to per-row" upstream.
+     */
+    bulkCall?: (ids: string[]) => Promise<number>;
+    /**
+     * Per-row mutation. Called once per id in the batch when bulk is
+     * unavailable, when bulk throws, or when the batch is too small for
+     * bulk to be worth it. Resolve = success; reject = failure with the
+     * reason captured into `errors`.
+     */
+    perRow: (id: string) => Promise<unknown>;
+}
+export interface BulkBatchInput {
+    /**
+     * Stable ids for this batch. Empty strings and nulls must already be
+     * filtered out by the caller — this helper trusts the contract.
+     */
+    ids: string[];
+    /**
+     * Original batch size before id-stripping. Used to attribute "missing
+     * id" failures in the caller's error report.
+     */
+    originalSize: number;
+    /**
+     * Index of the first row of this batch within the run. Used to build
+     * stable aggregate-error ids like `batch_0`, `batch_200` etc.
+     */
+    offset: number;
+    /**
+     * When true, the helper is allowed to issue `bulkCall`. When false
+     * (e.g. single-row batches where bulk is no win) it goes straight to
+     * the per-row path.
+     */
+    allowBulk: boolean;
+    /**
+     * Human-readable operation label folded into aggregate error
+     * messages ("bulk update", "bulk delete"). Defaults to "bulk".
+     */
+    label?: string;
+}
+/**
+ * Execute one batch with bulk-first / per-row-fallback semantics.
+ *
+ * Decision tree:
+ * 1. `allowBulk` AND `ops.bulkCall` provided → call it.
+ *    - returned `n === ids.length` → all good, no per-row pass.
+ *    - returned `n < ids.length`   → aggregate error for the shortfall,
+ *      no per-row pass (the server already accepted the request; calling
+ *      per-row would re-mutate the rows that already succeeded).
+ *    - threw                       → fall through to per-row to recover
+ *      actionable per-id error detail for the user.
+ * 2. Otherwise → per-row via Promise.allSettled.
+ *
+ * Symmetric for update + delete + any future same-shape bulk op.
+ */
+export declare function executeBulkBatch(input: BulkBatchInput, ops: BulkBatchOps): Promise<BulkBatchOutcome>;

package/dist/actions/bulkFastPath.js

@@ -0,0 +1,59 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Execute one batch with bulk-first / per-row-fallback semantics.
+ *
+ * Decision tree:
+ * 1. `allowBulk` AND `ops.bulkCall` provided → call it.
+ *    - returned `n === ids.length` → all good, no per-row pass.
+ *    - returned `n < ids.length`   → aggregate error for the shortfall,
+ *      no per-row pass (the server already accepted the request; calling
+ *      per-row would re-mutate the rows that already succeeded).
+ *    - threw                       → fall through to per-row to recover
+ *      actionable per-id error detail for the user.
+ * 2. Otherwise → per-row via Promise.allSettled.
+ *
+ * Symmetric for update + delete + any future same-shape bulk op.
+ */
+export async function executeBulkBatch(input, ops) {
+    const { ids, allowBulk, offset, label = 'bulk' } = input;
+    const outcome = { succeeded: 0, failed: 0, errors: [] };
+    if (allowBulk && typeof ops.bulkCall === 'function') {
+        try {
+            const n = await ops.bulkCall(ids);
+            const bulkSucceeded = Math.max(0, Math.min(n, ids.length));
+            outcome.succeeded += bulkSucceeded;
+            const bulkFailed = ids.length - bulkSucceeded;
+            if (bulkFailed > 0) {
+                outcome.failed += bulkFailed;
+                outcome.errors.push({
+                    id: `batch_${offset}`,
+                    error: `${bulkFailed} record${bulkFailed === 1 ? '' : 's'} failed in ${label}`,
+                });
+            }
+            return outcome;
+        }
+        catch {
+            // Fall through to per-row — gives the user actionable detail.
+        }
+    }
+    const settled = await Promise.allSettled(ids.map((id) => ops.perRow(id)));
+    settled.forEach((res, idx) => {
+        if (res.status === 'fulfilled') {
+            outcome.succeeded += 1;
+        }
+        else {
+            outcome.failed += 1;
+            outcome.errors.push({
+                id: ids[idx],
+                error: res.reason instanceof Error ? res.reason.message : String(res.reason),
+            });
+        }
+    });
+    return outcome;
+}

package/dist/actions/index.d.ts

@@ -9,3 +9,4 @@ export * from './ActionRunner.js';
 export * from './ActionEngine.js';
 export * from './TransactionManager.js';
 export * from './UndoManager.js';
+export * from './bulkFastPath.js';

package/dist/actions/index.js

@@ -9,3 +9,4 @@ export * from './ActionRunner.js';
 export * from './ActionEngine.js';
 export * from './TransactionManager.js';
 export * from './UndoManager.js';
+export * from './bulkFastPath.js';

package/dist/adapters/ApiDataSource.d.ts

@@ -48,8 +48,12 @@ export declare class ApiDataSource<T = any> implements DataSource<T> {
     find(_resource: string, params?: QueryParams): Promise<QueryResult<T>>;
     findOne(_resource: string, id: string | number, params?: QueryParams): Promise<T | null>;
     create(_resource: string, data: Partial<T>): Promise<T>;
-    update(_resource: string, id: string | number, data: Partial<T>): Promise<T>;
-    delete(_resource: string, id: string | number): Promise<boolean>;
+    update(_resource: string, id: string | number, data: Partial<T>, opts?: {
+        ifMatch?: string;
+    }): Promise<T>;
+    delete(_resource: string, id: string | number, opts?: {
+        ifMatch?: string;
+    }): Promise<boolean>;
     getObjectSchema(_objectName: string): Promise<any>;
     getView(_objectName: string, _viewId: string): Promise<any | null>;
     getApp(_appId: string): Promise<any | null>;

package/dist/adapters/ApiDataSource.js

@@ -214,20 +214,26 @@ export class ApiDataSource {
             body: data,
         });
     }
-    async update(_resource, id, data) {
+    async update(_resource, id, data, opts) {
         const config = this.writeConfig ?? this.readConfig;
         return this.request(config, {
             pathSuffix: String(id),
             method: 'PATCH',
             body: data,
+            ...(opts?.ifMatch
+                ? { headers: { 'If-Match': String(opts.ifMatch) } }
+                : {}),
         });
     }
-    async delete(_resource, id) {
+    async delete(_resource, id, opts) {
         const config = this.writeConfig ?? this.readConfig;
         try {
             await this.request(config, {
                 pathSuffix: String(id),
                 method: 'DELETE',
+                ...(opts?.ifMatch
+                    ? { headers: { 'If-Match': String(opts.ifMatch) } }
+                    : {}),
             });
             return true;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/core",
-  "version": "5.0.2",
+  "version": "5.2.1",
   "type": "module",
   "sideEffects": false,
   "license": "MIT",
@@ -28,7 +28,7 @@
     "@objectstack/spec": "^4.0.5",
     "lodash": "^4.18.1",
     "zod": "^4.4.3",
-    "@object-ui/types": "5.0.2"
+    "@object-ui/types": "5.2.1"
   },
   "devDependencies": {
     "typescript": "^6.0.3",