@object-ui/react 16.0.0 → 16.1.0

package/CHANGELOG.md

@@ -1,5 +1,153 @@
 # @object-ui/react
 
+## 16.1.0
+
+### Minor Changes
+
+- 803558e: feat(data): thread the host's authenticated fetch into `provider: 'api'` data sources (#2725)
+
+  `provider: 'api'` view data sources went through a bare `globalThis.fetch`, so
+  custom endpoints (gantt composite trees, report aggregates) carried only
+  same-origin cookies while every native `/api/v1/*` request carried
+  `Authorization: Bearer` — the moment cookie HMAC verification failed (dev
+  restart rotating the fallback auth secret, cookie expiry/rotation in prod)
+  those views 401'd while the rest of the app kept working.
+
+  - **`@object-ui/react`** — `SchemaRendererProvider` accepts an optional
+    `apiFetch`; nested providers inherit it from their parent so re-wrapped
+    subtrees (react pages, preview surfaces) keep the host's authentication.
+    `useViewData` defaults the api-provider adapter's fetch to the context
+    `apiFetch` (explicit `adapterOptions.fetch` still wins).
+  - **`@object-ui/auth`** — `createAuthenticatedFetch` gains a
+    `sameOriginOnly` option: cross-origin URLs pass through to the bare fetch
+    with no `Authorization` / `X-Tenant-ID` / `Accept-Language`, so metadata-
+    supplied third-party URLs never see the platform token.
+  - **`@object-ui/app-shell`** — the console wires
+    `createAuthenticatedFetch({ sameOriginOnly: true })` (settle-signal wrapped)
+    as `apiFetch` on the root `SchemaRendererProvider`.
+  - **`@object-ui/plugin-gantt`** — `ObjectGantt` resolves its api-provider
+    DataSource with the context `apiFetch`, covering reads and write-backs.
+
+  Behaviour is unchanged for hosts that don't provide `apiFetch` (bare fetch +
+  cookies, as before).
+
+- 2e7d7f0: feat(evaluator): route `{ dialect: 'cel' }` component/action predicates to the canonical CEL engine (#2661)
+
+  Component and action `visible` / `disabled` / `hidden` predicates were evaluated
+  by the home-grown JS `ExpressionEvaluator`, while field rules
+  (`visibleWhen`/`readonlyWhen`/`requiredWhen`, via `fieldRules.ts`) and row/list
+  conditionals (via `evalRowPredicate`) already delegate to the canonical
+  `@objectstack/formula` engine. That split meant a `{ dialect: 'cel' }` predicate
+  in a renderer/action surface was executed as **JavaScript** — CEL-only forms
+  (`x in list`, `has()`, typed `==`, the `today()`/`daysFromNow()` catalog) behaved
+  differently from, or faulted against, the server's enforcement.
+
+  This converges the remaining tier onto the same engine:
+
+  - **`@object-ui/core`** — `ExpressionEvaluator.evaluateCondition` now detects a
+    `{ dialect: 'cel', source }` envelope and evaluates it on `@objectstack/formula`
+    (via `evalFieldPredicate`), binding the `record` namespace plus the whole
+    context bag as top-level scope (`record.*`, `features.*`, `user.*`, `app.*`).
+    Fail-soft to visible/enabled to match the legacy default; `throwOnError`
+    callers still fail closed on a _faulting_ predicate (a genuine `false` never
+    throws). This fixes every `SchemaRenderer` visibility/disabled read at once.
+  - **`@object-ui/react`** — `toPredicateInput` preserves a CEL envelope instead of
+    collapsing it to a `${source}` string, and `useCondition` accepts and forwards
+    the envelope (keyed on a stable `(dialect, source)` so it doesn't re-evaluate
+    each render). Action buttons (`action-icon`/`group`/`bar`/`button`) therefore
+    evaluate CEL `visible`/`enabled`/`disabled` on the canonical engine.
+
+  **Back-compat:** bare strings and `${…}` templates stay on the legacy JS path
+  (deprecation window); only an explicit `{ dialect: 'cel' }` envelope is rerouted.
+  `{ dialect: 'template' }` is unaffected.
+
+  Together with the `^15.1.1` alignment (#2662), a renderer CEL predicate now
+  reaches the identical verdict as the server — including the framework's
+  `dateField == today()` equality fix (objectstack-ai/framework#3205) once it
+  lands in a published 15.x. The broader home-grown-vs-canonical divergence
+  motivation is #2661.
+
+### Patch Changes
+
+- 7cf4051: chore(deps): align every `@objectstack/*` dependency to `^16.0.0-rc.0`
+
+  Bumps `@objectstack/spec` / `client` / `formula` / `lint` from `^15.1.1` to the
+  `16.0.0-rc.0` pre-release across the workspace (root + `apps/console` +
+  `apps/site` + all consuming packages). ObjectUI's own packages are already on
+  major 16, so this closes the 15↔16 skew between ObjectUI and the `@objectstack`
+  contract libraries (which publish in lockstep with `spec`).
+
+  This is a dependency alignment, not a behavioral migration: the full workspace
+  build (43/43) and the `@objectstack`-consuming package test suites
+  (`core` / `app-shell` / `data-objectstack` / `plugin-form` / `types`) are green
+  against `16.0.0-rc.0` with no source changes required.
+
+  Practical effect: `@objectstack/client@16.0.0-rc.0` now ships
+  `data.batchTransaction` (framework #3271), so `ObjectStackAdapter`'s feature
+  detect (`typeof client.data.batchTransaction === 'function'`) routes
+  master-detail cross-object saves through the typed SDK method instead of the
+  raw `fetch('/api/v1/batch')` fallback — realizing the "verify SDK path" half of
+  #2694. The raw-fetch branch stays as a defensive fallback (removal tracked in
+  #2694).
+
+- 549c67d: chore(lint): clear the mechanical baseline lint errors so these packages' lint gates protect them again
+
+  Extends the fields/core cleanup from #2709 (objectui#2713). These eight package
+  lints were red at baseline on `main`, so their per-package `lint` gate could not
+  catch new violations of the same class. Cleared every **error** (no behavior
+  change; warnings are out of scope):
+
+  - **`no-useless-catch`** (`data-objectstack`) — unwrapped five try/catch blocks
+    whose `catch` only re-threw; errors still propagate identically.
+  - **`preserve-caught-error`** (`cli`, `data-objectstack`, `react`) — the caught
+    error's message is inlined into the thrown `Error`; a scoped disable with a
+    justifying comment carries each one, because these packages target ES2020
+    whose lib types the 1-arg `Error` constructor only (so `{ cause }` won't
+    compile) — same reasoning as the core case in #2709.
+  - **`prefer-const`** (`plugin-calendar`, `plugin-map`) — `let`→`const` for
+    never-reassigned bindings.
+  - **`no-empty-object-type`** (`plugin-designer`) — empty extend-only interfaces
+    → equivalent `type` aliases.
+  - **`no-useless-assignment`** (`react`) — dropped a dead initializer that both
+    branches overwrite before it is read.
+  - **`no-require-imports`** (`plugin-calendar`, `plugin-timeline` tests) —
+    hoisted `vi.mock` factories now use an `async` factory with
+    `await import('react')` instead of `require('react')`.
+  - **stale `eslint-disable` directive** (`plugin-markdown`) — removed a
+    `react/no-danger` disable whose plugin is not loaded in the flat config (an
+    unknown-rule reference that ESLint v10 reports as an error); the rationale is
+    kept as a plain comment.
+
+- Updated dependencies [0318118]
+- Updated dependencies [1c8935a]
+- Updated dependencies [af1b0db]
+- Updated dependencies [8b8b744]
+- Updated dependencies [7cf4051]
+- Updated dependencies [8c1e415]
+- Updated dependencies [0ea5036]
+- Updated dependencies [2e7d7f0]
+- Updated dependencies [94d4876]
+- Updated dependencies [1100a8b]
+- Updated dependencies [7abe4cd]
+- Updated dependencies [549c67d]
+- Updated dependencies [ebe6494]
+- Updated dependencies [2b17339]
+- Updated dependencies [31b77d4]
+- Updated dependencies [6d4fbe6]
+- Updated dependencies [0a3710b]
+- Updated dependencies [f80aaf2]
+- Updated dependencies [62b9ab5]
+- Updated dependencies [1629313]
+- Updated dependencies [29c6040]
+- Updated dependencies [faebac3]
+- Updated dependencies [2331ac9]
+- Updated dependencies [199fa83]
+- Updated dependencies [eee4ded]
+  - @object-ui/i18n@16.1.0
+  - @object-ui/core@16.1.0
+  - @object-ui/data-objectstack@16.1.0
+  - @object-ui/types@16.1.0
+
 ## 16.0.0
 
 ### Minor Changes

package/README.md

@@ -81,6 +81,30 @@ function App() {
 }
 ```
 
+### SchemaRendererProvider
+
+Injects the host's data source (and optional capabilities) into every renderer
+below it:
+
+```tsx
+import { SchemaRendererProvider } from '@object-ui/react'
+
+<SchemaRendererProvider
+  dataSource={adapter}
+  // Optional: host-authenticated fetch used by `provider: 'api'` view data
+  // sources, so custom endpoints carry the same credentials (Authorization,
+  // tenant, locale headers) as the native data channel. When omitted,
+  // ApiDataSource falls back to the bare global fetch (cookies only).
+  apiFetch={authenticatedFetch}
+>
+  <SchemaRenderer schema={schema} />
+</SchemaRendererProvider>
+```
+
+Nested providers inherit `apiFetch` from their parent when they don't supply
+their own, so re-wrapped subtrees (embedded pages, preview surfaces) keep the
+host's authentication.
+
 ## Hooks
 
 ### useSchemaContext

package/dist/context/SchemaRendererContext.d.ts

@@ -1,17 +1,26 @@
 import React from 'react';
 import type { DebugFlags } from '@object-ui/core';
+/**
+ * Host-provided fetch used for `provider: 'api'` view data sources so custom
+ * endpoints carry the same credentials (Authorization, tenant, locale headers)
+ * as the native data channel. Optional — when absent, ApiDataSource falls back
+ * to the bare global fetch (cookies only).
+ */
+export type ApiFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
 interface SchemaRendererContextType {
     dataSource: any;
     debug?: boolean;
     debugFlags?: DebugFlags;
+    apiFetch?: ApiFetch;
 }
 declare const SchemaRendererContext: React.Context<SchemaRendererContextType | null>;
 export { SchemaRendererContext };
-export declare const SchemaRendererProvider: ({ children, dataSource, debug, debugFlags, }: {
+export declare const SchemaRendererProvider: ({ children, dataSource, debug, debugFlags, apiFetch, }: {
     children: React.ReactNode;
     dataSource: any;
     debug?: boolean;
     debugFlags?: DebugFlags;
+    apiFetch?: ApiFetch;
 }) => React.JSX.Element;
 export declare const useSchemaContext: () => SchemaRendererContextType;
 export declare const useDataScope: (path?: string) => any;

package/dist/context/SchemaRendererContext.js

@@ -2,8 +2,13 @@ import { jsx as _jsx } from "react/jsx-runtime";
 import { createContext, useContext, useMemo } from 'react';
 const SchemaRendererContext = createContext(null);
 export { SchemaRendererContext };
-export const SchemaRendererProvider = ({ children, dataSource, debug, debugFlags, }) => {
-    const value = useMemo(() => ({ dataSource, debug, debugFlags }), [dataSource, debug, debugFlags]);
+export const SchemaRendererProvider = ({ children, dataSource, debug, debugFlags, apiFetch, }) => {
+    // Nested providers (react-page, studio preview surfaces) re-wrap with their
+    // own dataSource but rarely know about the host's authenticated fetch —
+    // inherit it from the parent context so provider:'api' auth survives nesting.
+    const parent = useContext(SchemaRendererContext);
+    const effectiveApiFetch = apiFetch ?? parent?.apiFetch;
+    const value = useMemo(() => ({ dataSource, debug, debugFlags, apiFetch: effectiveApiFetch }), [dataSource, debug, debugFlags, effectiveApiFetch]);
     return (_jsx(SchemaRendererContext.Provider, { value: value, children: children }));
 };
 export const useSchemaContext = () => {

package/dist/hooks/useETagCache.js

@@ -222,6 +222,10 @@ export function useETagCache(userConfig = {}) {
             catch (e) {
                 if (e instanceof Error && e.message.startsWith('Unsupported'))
                     throw e;
+                // Any other parse failure collapses to a generic message; we can't
+                // attach `e` as the `Error` `cause` because this package targets
+                // ES2020, whose lib types the 1-arg `Error` constructor only.
+                // eslint-disable-next-line preserve-caught-error
                 throw new Error('Invalid URL');
             }
         }

package/dist/hooks/useExpression.d.ts

@@ -40,7 +40,10 @@ export declare function usePredicateScope(): Record<string, any>;
  * This is the canonical helper to use in renderers so we never end up with
  * `${[object Object]}` after JS template-literal interpolation.
  */
-export declare function toPredicateInput(value: unknown): string | boolean | undefined;
+export declare function toPredicateInput(value: unknown): string | boolean | {
+    dialect: 'cel';
+    source: string;
+} | undefined;
 /**
  * Hook for evaluating expressions with dynamic context
  *
@@ -51,7 +54,10 @@ export declare function toPredicateInput(value: unknown): string | boolean | und
  * ```
  */
 export declare function useExpression(expression: string | boolean | number | null | undefined, context?: Record<string, any>): any;
-export declare function useCondition(condition: string | boolean | undefined, context?: Record<string, any>, options?: {
+export declare function useCondition(condition: string | boolean | undefined | {
+    dialect?: string;
+    source?: string;
+}, context?: Record<string, any>, options?: {
     throwOnError?: boolean;
     label?: string;
 }): boolean;

package/dist/hooks/useExpression.js

@@ -63,7 +63,15 @@ export function toPredicateInput(value) {
         return `\${${value}}`;
     if (typeof value === 'object' && typeof value.source === 'string') {
         const src = value.source;
-        return src ? `\${${src}}` : undefined;
+        if (!src)
+            return undefined;
+        // #2661 — preserve a CEL-dialect envelope so `useCondition` routes it to the
+        // canonical `@objectstack/formula` engine (identical verdict to the server),
+        // instead of collapsing it to a `${source}` string on the legacy JS path.
+        // Every other dialect (template / unset) keeps the legacy `${…}` behavior.
+        if (value.dialect === 'cel')
+            return { dialect: 'cel', source: src };
+        return `\${${src}}`;
     }
     return undefined;
 }

package/dist/hooks/useRecordSearch.js

@@ -83,7 +83,8 @@ export function useRecordSearch(opts) {
     const candidates = useMemo(() => {
         if (!Array.isArray(objects) || objects.length === 0)
             return [];
-        let pool = objects;
+        // Assigned in both branches below before it's read; no dead initializer.
+        let pool;
         if (Array.isArray(objectNames) && objectNames.length > 0) {
             const byName = new Map();
             for (const obj of objects) {

package/dist/hooks/useViewData.js

@@ -44,18 +44,26 @@ import { SchemaRendererContext } from '../context/SchemaRendererContext';
  */
 export function useViewData(options) {
     const { viewData, resource = '', params, dataSource: explicitDataSource, adapterOptions, skip = false, } = options;
-    // Get context DataSource
+    // Get context DataSource + host-authenticated fetch
     const context = useContext(SchemaRendererContext);
     const contextDataSource = context?.dataSource ?? null;
+    const contextApiFetch = context?.apiFetch;
     // Resolve the DataSource — memoize to prevent re-creation on every render.
     // We key on the viewData provider + config identity.
     const resolvedDataSource = useMemo(() => {
         if (explicitDataSource)
             return explicitDataSource;
-        return resolveDataSource(viewData, contextDataSource, adapterOptions);
+        // Default the 'api' provider's fetch to the host's authenticated fetch
+        // (SchemaRendererContext.apiFetch) so custom endpoints carry the same
+        // credentials as native requests; explicit adapterOptions still win.
+        return resolveDataSource(viewData, contextDataSource, {
+            fetch: contextApiFetch,
+            ...adapterOptions,
+        });
         // eslint-disable-next-line react-hooks/exhaustive-deps
     }, [
         explicitDataSource,
+        contextApiFetch,
         viewData?.provider,
         // For 'api' provider, key on read/write URLs
         viewData?.provider === 'api' ? viewData.read?.url : undefined,

package/dist/index.d.ts

@@ -12,4 +12,5 @@ export * from './LazyPluginLoader';
 export * from './spec-bridge';
 export * from './data-invalidation';
 export { resolveI18nLabel } from './utils/i18n';
-export { I18nProvider, useObjectTranslation, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, type I18nConfig, type I18nProviderProps, type TranslationKeys, type DateFormatOptions, type CurrencyFormatOptions, type NumberFormatOptions, } from '@object-ui/i18n';
+export { extractWriteErrorMessage, isPermissionError } from './utils/error-message';
+export { I18nProvider, useObjectTranslation, useSafeTranslate, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, type I18nConfig, type I18nProviderProps, type TranslationKeys, type DateFormatOptions, type CurrencyFormatOptions, type NumberFormatOptions, } from '@object-ui/i18n';

package/dist/index.js

@@ -13,5 +13,8 @@ export * from './spec-bridge';
 export * from './data-invalidation';
 // i18n utilities
 export { resolveI18nLabel } from './utils/i18n';
+// Write-error surfacing utilities (shared by drag-write plugins so a failed
+// PATCH — e.g. an RLS 403 — is never silently swallowed).
+export { extractWriteErrorMessage, isPermissionError } from './utils/error-message';
 // Built-in i18n support
-export { I18nProvider, useObjectTranslation, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, } from '@object-ui/i18n';
+export { I18nProvider, useObjectTranslation, useSafeTranslate, useObjectLabel, useSafeFieldLabel, useI18nContext, createI18n, getDirection, getAvailableLanguages, formatDate, formatDateTime, formatRelativeTime, formatCurrency, formatNumber, } from '@object-ui/i18n';

package/dist/utils/error-message.d.ts

@@ -0,0 +1,21 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Pull a clean, human-readable message out of a failed write. Strips noisy
+ * backend prefixes (`[Security] `, `PERMISSION_DENIED: `) so it reads well in a
+ * toast — mirrors `plugin-detail`'s `cleanError`. Returns `null` when nothing
+ * usable can be extracted, so callers fall back to a generic localized string.
+ */
+export declare function extractWriteErrorMessage(err: unknown): string | null;
+/**
+ * True when a failed write was rejected for authorization reasons (HTTP 403 /
+ * `PERMISSION_DENIED` / `FORBIDDEN` / a row-level-security denial). Lets a
+ * caller show a friendly "you don't have permission" toast rather than dumping
+ * the raw server text.
+ */
+export declare function isPermissionError(err: unknown): boolean;

package/dist/utils/error-message.js

@@ -0,0 +1,89 @@
+/**
+ * ObjectUI
+ * Copyright (c) 2024-present ObjectStack Inc.
+ *
+ * This source code is licensed under the MIT license found in the
+ * LICENSE file in the root directory of this source tree.
+ */
+/**
+ * Helpers for turning a failed data-source write into user-facing feedback.
+ *
+ * Different DataSource adapters throw differently shaped errors:
+ *   - the ObjectStack adapter (`@object-ui/data-objectstack`) decorates the
+ *     thrown Error with `httpStatus` + a machine-readable `code` and puts the
+ *     server text on `.message` (sometimes also a parsed body on `.details`);
+ *   - `ApiDataSource` appends the raw JSON response body as a tail on the
+ *     message string (`… — {"error":…,"code":…}`).
+ *
+ * These helpers normalise across both so a caller's `catch` can surface the
+ * real reason (e.g. a row-level-security denial) instead of swallowing it.
+ */
+function firstString(...vals) {
+    for (const v of vals) {
+        if (typeof v === 'string' && v.trim())
+            return v;
+    }
+    return null;
+}
+/**
+ * Pull a clean, human-readable message out of a failed write. Strips noisy
+ * backend prefixes (`[Security] `, `PERMISSION_DENIED: `) so it reads well in a
+ * toast — mirrors `plugin-detail`'s `cleanError`. Returns `null` when nothing
+ * usable can be extracted, so callers fall back to a generic localized string.
+ */
+export function extractWriteErrorMessage(err) {
+    const e = err;
+    // 1) Structured server body, when the adapter attaches one.
+    let msg = e && typeof e === 'object'
+        ? firstString(e.details?.error, e.details?.message, e.error)
+        : null;
+    // 2) Otherwise the Error message itself. ApiDataSource embeds the raw JSON
+    //    response body as a tail — parse it out when present.
+    if (!msg) {
+        const raw = err instanceof Error
+            ? err.message
+            : typeof err === 'string'
+                ? err
+                : typeof e?.message === 'string'
+                    ? e.message
+                    : '';
+        const brace = raw.indexOf('{');
+        if (brace >= 0) {
+            try {
+                const body = JSON.parse(raw.slice(brace));
+                msg = firstString(body?.error, body?.message);
+            }
+            catch {
+                /* tail wasn't JSON — fall through to the raw message */
+            }
+        }
+        if (!msg && raw.trim())
+            msg = raw;
+    }
+    if (!msg)
+        return null;
+    const clean = msg
+        .replace(/^\[[^\]]+\]\s*/, '')
+        .replace(/^[A-Z][A-Z0-9_]+:\s*/, '')
+        .trim();
+    return clean || null;
+}
+/**
+ * True when a failed write was rejected for authorization reasons (HTTP 403 /
+ * `PERMISSION_DENIED` / `FORBIDDEN` / a row-level-security denial). Lets a
+ * caller show a friendly "you don't have permission" toast rather than dumping
+ * the raw server text.
+ */
+export function isPermissionError(err) {
+    const e = err;
+    if (!e || typeof e !== 'object')
+        return false;
+    const status = e.httpStatus ?? e.status ?? e.statusCode;
+    if (status === 403)
+        return true;
+    const code = firstString(e.code, e.details?.code) ?? '';
+    if (code === 'PERMISSION_DENIED' || code === 'FORBIDDEN')
+        return true;
+    const text = `${typeof e.message === 'string' ? e.message : ''} ${e.details?.error ?? e.error ?? ''}`;
+    return /row-level security|access denied|permission denied|not permitted/i.test(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@object-ui/react",
-  "version": "16.0.0",
+  "version": "16.1.0",
   "type": "module",
   "license": "MIT",
   "description": "React bindings and SchemaRenderer component for Object UI",
@@ -24,12 +24,12 @@
     }
   },
   "dependencies": {
-    "@objectstack/spec": "^15.1.1",
-    "react-hook-form": "^7.81.0",
-    "@object-ui/core": "16.0.0",
-    "@object-ui/data-objectstack": "16.0.0",
-    "@object-ui/i18n": "16.0.0",
-    "@object-ui/types": "16.0.0"
+    "@objectstack/spec": "^16.0.0-rc.0",
+    "react-hook-form": "^7.82.0",
+    "@object-ui/core": "16.1.0",
+    "@object-ui/data-objectstack": "16.1.0",
+    "@object-ui/i18n": "16.1.0",
+    "@object-ui/types": "16.1.0"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0",