@objectstack/lint 16.0.0-rc.1 → 16.1.0

package/README.md

@@ -14,8 +14,11 @@ It never depends on a runtime and is never bundled into a frontend.
 ## API
 
 - `validateWidgetBindings(stack)` — dashboard widget → dataset → measure/dimension
-  reference integrity, chart-config bindings, and measure-aggregation coherence
-  (e.g. SUM of a `percent` field is meaningless).
+  reference integrity, chart-config bindings, measure-aggregation coherence
+  (e.g. SUM of a `percent` field is meaningless), and dashboard-level filter
+  field existence — every `dateRange` / `globalFilters[]` field (after any
+  `filterBindings` re-target) must exist on each bound widget's object, else the
+  broadcast filter emits invalid SQL and the widget crashes at render (#3365).
 - `validateStackExpressions(stack)` — CEL/predicate validity for field
   conditionals, sharing rules, action `visible`/`disabled`, lifecycle hooks
   (ADR-0032).

package/dist/index.cjs

@@ -27,6 +27,9 @@ __export(index_exports, {
   CAPABILITY_REFERENCE_UNKNOWN: () => CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING: () => CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN: () => CHART_FIELD_UNKNOWN,
+  DASHBOARD_ACTION_ROUTE_UNRESOLVED: () => DASHBOARD_ACTION_ROUTE_UNRESOLVED,
+  DASHBOARD_ACTION_TARGET_UNDEFINED: () => DASHBOARD_ACTION_TARGET_UNDEFINED,
+  DASHBOARD_FILTER_FIELD_UNKNOWN: () => DASHBOARD_FILTER_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY: () => FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED: () => FIELD_GROUP_UNDECLARED,
   FLOW_DRAFT_STATUS_AMBIGUOUS: () => FLOW_DRAFT_STATUS_AMBIGUOUS,
@@ -66,6 +69,7 @@ __export(index_exports, {
   diffAccessMatrix: () => diffAccessMatrix,
   validateApprovalApprovers: () => validateApprovalApprovers,
   validateCapabilityReferences: () => validateCapabilityReferences,
+  validateDashboardActionRefs: () => validateDashboardActionRefs,
   validateFlowTriggerReadiness: () => validateFlowTriggerReadiness,
   validateFormLayout: () => validateFormLayout,
   validateJsxPages: () => validateJsxPages,
@@ -95,6 +99,7 @@ var TABLE_COUNT_ONLY = "table-count-only";
 var MEASURE_AGGREGATE_INCOHERENT = "measure-aggregate-incoherent";
 var WIDGET_LEGACY_ANALYTICS_SHAPE = "widget-legacy-analytics-shape";
 var WIDGET_LEGACY_ANALYTICS_UNRENDERABLE = "widget-legacy-analytics-unrenderable";
+var DASHBOARD_FILTER_FIELD_UNKNOWN = "dashboard-filter-field-unknown";
 var LEGACY_ANALYTICS_KEYS = [
   "categoryField",
   "valueField",
@@ -172,6 +177,47 @@ function list(names) {
   const arr = [...names];
   return arr.length > 0 ? arr.join(", ") : "(none)";
 }
+var DATE_RANGE_FILTER_NAME = "dateRange";
+var DATE_RANGE_DEFAULT_FIELD = "created_at";
+var SYSTEM_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "created_by",
+  "updated_at",
+  "updated_by",
+  "owner_id",
+  "organization_id",
+  "tenant_id",
+  "user_id",
+  "deleted_at"
+]);
+function dashboardFilterDefs(dash) {
+  const byName = /* @__PURE__ */ new Map();
+  const dateRange = dash.dateRange;
+  if (dateRange && typeof dateRange === "object") {
+    const declared = dateRange.field;
+    const field = typeof declared === "string" && declared ? declared : DATE_RANGE_DEFAULT_FIELD;
+    byName.set(DATE_RANGE_FILTER_NAME, { name: DATE_RANGE_FILTER_NAME, field });
+  }
+  for (const f of asArray(dash.globalFilters)) {
+    if (typeof f.field !== "string" || !f.field) continue;
+    const name = typeof f.name === "string" && f.name ? f.name : f.field;
+    const targetWidgets = Array.isArray(f.targetWidgets) ? f.targetWidgets.filter((w) => typeof w === "string") : void 0;
+    byName.set(name, { name, field: f.field, targetWidgets });
+  }
+  return [...byName.values()];
+}
+function effectiveFilterField(widget, def) {
+  const bindings = widget.filterBindings;
+  const binding = bindings && typeof bindings === "object" ? bindings[def.name] : void 0;
+  if (binding === false) return void 0;
+  if (typeof binding === "string" && binding) return { field: binding, explicit: true };
+  if (def.targetWidgets && def.targetWidgets.length > 0) {
+    const id = typeof widget.id === "string" ? widget.id : void 0;
+    if (!id || !def.targetWidgets.includes(id)) return void 0;
+  }
+  return { field: def.field, explicit: false };
+}
 function validateWidgetBindings(stack) {
   const findings = [];
   const datasets = /* @__PURE__ */ new Map();
@@ -216,6 +262,7 @@ function validateWidgetBindings(stack) {
     const dash = dashboards[i];
     const dashName = typeof dash.name === "string" ? dash.name : `(dashboard ${i})`;
     const widgets = Array.isArray(dash.widgets) ? dash.widgets : [];
+    const dashFilterDefs = dashboardFilterDefs(dash);
     for (let j = 0; j < widgets.length; j++) {
       const w = widgets[j];
       const widgetId = typeof w.id === "string" ? w.id : `(widget ${j})`;
@@ -260,6 +307,25 @@ function validateWidgetBindings(stack) {
         });
       }
       if (!dataset) continue;
+      if (dashFilterDefs.length > 0) {
+        const datasetObject = typeof dataset.object === "string" ? dataset.object : void 0;
+        const objectFields = datasetObject ? objectFieldTypes.get(datasetObject) : void 0;
+        if (objectFields) {
+          for (const def of dashFilterDefs) {
+            const eff = effectiveFilterField(w, def);
+            if (!eff) continue;
+            const field = eff.field;
+            if (field.includes(".")) continue;
+            if (objectFields.has(field) || SYSTEM_FIELDS.has(field)) continue;
+            push({
+              severity: "error",
+              rule: DASHBOARD_FILTER_FIELD_UNKNOWN,
+              message: eff.explicit ? `binds dashboard filter \`${def.name}\` to field \`${field}\` (via filterBindings), but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.` : `inherits dashboard filter \`${def.name}(${field})\`, but object \`${datasetObject}\` (dataset "${dsName}") has no field \`${field}\`.`,
+              hint: eff.explicit ? `Point filterBindings: { ${def.name}: '<field>' } at a field that exists on \`${datasetObject}\`, or opt out with filterBindings: { ${def.name}: false }.${suggest(field, objectFields.keys())} Object fields: ${list(objectFields.keys())}.` : `Set filterBindings: { ${def.name}: false } on this widget to opt out, or re-target to an existing field with filterBindings: { ${def.name}: '<field>' }.${suggest(field, objectFields.keys())} Object fields: ${list(objectFields.keys())}.`
+            });
+          }
+        }
+      }
       const dimensionNames = /* @__PURE__ */ new Set();
       for (const d of asArray(dataset.dimensions)) {
         if (typeof d.name === "string") dimensionNames.add(d.name);
@@ -2115,7 +2181,9 @@ function validateSecurityPosture(stack, opts) {
   return findings;
 }
 
-// src/build-access-matrix.ts
+// src/validate-dashboard-action-refs.ts
+var DASHBOARD_ACTION_TARGET_UNDEFINED = "dashboard-action-target-undefined";
+var DASHBOARD_ACTION_ROUTE_UNRESOLVED = "dashboard-action-route-unresolved";
 function asArray17(v) {
   if (Array.isArray(v)) return v;
   if (v && typeof v === "object") {
@@ -2123,17 +2191,166 @@ function asArray17(v) {
   }
   return [];
 }
+function strName(v) {
+  return typeof v === "string" && v.length > 0 ? v : void 0;
+}
+var MODAL_VERB_RE = /^(?:create|new|add|edit|update)_(.+)$/;
+var URL_COLLECTION_TO_STACK_KEY = {
+  object: "objects",
+  objects: "objects",
+  report: "reports",
+  reports: "reports",
+  dashboard: "dashboards",
+  dashboards: "dashboards",
+  page: "pages",
+  pages: "pages",
+  view: "views",
+  views: "views"
+};
+function viewContainerName(item) {
+  return strName(item.name) ?? strName(item.id) ?? strName(item.object) ?? strName(item.list?.data && item.list.data.object) ?? strName(item.form?.data && item.form.data.object);
+}
+function collectKnownTargets(stack) {
+  const actions = /* @__PURE__ */ new Set();
+  const objects = /* @__PURE__ */ new Set();
+  const reports = /* @__PURE__ */ new Set();
+  const dashboards = /* @__PURE__ */ new Set();
+  const pages = /* @__PURE__ */ new Set();
+  const views = /* @__PURE__ */ new Set();
+  const collectNames = (v, into, name) => {
+    for (const item of asArray17(v)) {
+      if (!item || typeof item !== "object") continue;
+      const n = name(item);
+      if (n) into.add(n);
+    }
+  };
+  collectNames(stack.actions, actions, (a) => strName(a.name));
+  for (const obj of asArray17(stack.objects)) {
+    if (!obj || typeof obj !== "object") continue;
+    const n = strName(obj.name);
+    if (n) objects.add(n);
+    collectNames(obj.actions, actions, (a) => strName(a.name));
+  }
+  collectNames(stack.reports, reports, (r) => strName(r.name));
+  collectNames(stack.dashboards, dashboards, (d) => strName(d.name));
+  collectNames(stack.pages, pages, (p) => strName(p.name));
+  collectNames(stack.views, views, viewContainerName);
+  for (const o of objects) views.add(o);
+  return { actions, objects, reports, dashboards, pages, views };
+}
+function resolveActionTarget(actionType, target, known) {
+  if (known.actions.has(target)) return true;
+  if (actionType === "modal") {
+    if (known.objects.has(target)) return true;
+    const m = MODAL_VERB_RE.exec(target);
+    if (m && known.objects.has(m[1])) return true;
+  }
+  return false;
+}
+function resolveUrlRoute(target, known) {
+  if (/^[a-z][a-z0-9+.-]*:\/\//i.test(target) || target.startsWith("//")) return null;
+  if (target.includes("${")) return null;
+  if (!target.startsWith("/")) return null;
+  const pathPart = target.split(/[?#]/, 1)[0];
+  const segments = pathPart.split("/").filter(Boolean);
+  for (let i = 0; i < segments.length - 1; i++) {
+    const stackKey = URL_COLLECTION_TO_STACK_KEY[segments[i]];
+    if (!stackKey) continue;
+    const name = segments[i + 1];
+    if (known[stackKey].has(name)) return void 0;
+    return { collection: segments[i], name };
+  }
+  return null;
+}
+function validateDashboardActionRefs(stack) {
+  const findings = [];
+  if (!stack || typeof stack !== "object") return findings;
+  const dashboards = asArray17(stack.dashboards);
+  if (dashboards.length === 0) return findings;
+  const known = collectKnownTargets(stack);
+  const checkOne = (action, where, path) => {
+    const target = strName(action.actionUrl);
+    if (!target) return;
+    if (target.includes("${")) return;
+    const actionType = strName(action.actionType) ?? "url";
+    if (actionType === "script" || actionType === "modal") {
+      if (resolveActionTarget(actionType, target, known)) return;
+      const kindWord = actionType === "script" ? "script" : "modal";
+      findings.push({
+        severity: "error",
+        rule: DASHBOARD_ACTION_TARGET_UNDEFINED,
+        where,
+        path,
+        message: `${kindWord} action target "${target}" resolves to no defined action` + (actionType === "modal" ? " or object" : "") + `. The button renders but does nothing when clicked \u2014 a dangling reference the runtime cannot dispatch (ADR-0049: a declared reference must resolve).`,
+        hint: actionType === "modal" ? `Define an action named "${target}" (stack.actions or the object's actions), use the "<verb>_<object>" convention against a real object (e.g. "create_<object>"), point actionUrl at an existing object, or remove the button.` : `Define a script action named "${target}" (stack.actions or the object's actions) with an inline body or a registered handler, or remove the button.`
+      });
+      return;
+    }
+    if (actionType === "url") {
+      const route = resolveUrlRoute(target, known);
+      if (!route) return;
+      findings.push({
+        severity: "warning",
+        rule: DASHBOARD_ACTION_ROUTE_UNRESOLVED,
+        where,
+        path,
+        message: `url action target "${target}" points at ${route.collection}/${route.name}, but no ${route.collection.replace(/s$/, "")} named "${route.name}" is registered in this stack \u2014 the button likely navigates to a dead route.`,
+        hint: `Check the path for a typo, define the referenced ${route.collection.replace(/s$/, "")}, or ignore this if the route is served by another installed package or a host/console route.`
+      });
+      return;
+    }
+  };
+  for (let di = 0; di < dashboards.length; di++) {
+    const dash = dashboards[di];
+    if (!dash || typeof dash !== "object") continue;
+    const dashName = strName(dash.name) ?? `(dashboard ${di})`;
+    const dashPath = `dashboards[${di}]`;
+    const headerActions = asArray17(dash.header?.actions);
+    for (let ai = 0; ai < headerActions.length; ai++) {
+      const action = headerActions[ai];
+      if (!action || typeof action !== "object") continue;
+      const label = strName(action.label) ?? strName(action.actionUrl) ?? `#${ai}`;
+      checkOne(
+        action,
+        `dashboard "${dashName}" \xB7 header action "${label}"`,
+        `${dashPath}.header.actions[${ai}].actionUrl`
+      );
+    }
+    const widgets = asArray17(dash.widgets);
+    for (let wi = 0; wi < widgets.length; wi++) {
+      const widget = widgets[wi];
+      if (!widget || typeof widget !== "object") continue;
+      if (!strName(widget.actionUrl)) continue;
+      const widgetId = strName(widget.id) ?? `#${wi}`;
+      checkOne(
+        { actionType: widget.actionType, actionUrl: widget.actionUrl },
+        `dashboard "${dashName}" \xB7 widget "${widgetId}" action`,
+        `${dashPath}.widgets[${wi}].actionUrl`
+      );
+    }
+  }
+  return findings;
+}
+
+// src/build-access-matrix.ts
+function asArray18(v) {
+  if (Array.isArray(v)) return v;
+  if (v && typeof v === "object") {
+    return Object.entries(v).map(([name, def]) => ({ name, ...def }));
+  }
+  return [];
+}
 function buildAccessMatrix(stack) {
   const entries = [];
   if (!stack || typeof stack !== "object") return { version: 1, entries };
   const owdByObject = /* @__PURE__ */ new Map();
-  for (const obj of asArray17(stack.objects)) {
+  for (const obj of asArray18(stack.objects)) {
     const name = typeof obj.name === "string" ? obj.name : "";
     if (!name) continue;
     const owd = obj.sharingModel ?? obj.security?.sharingModel;
     if (typeof owd === "string") owdByObject.set(name, owd);
   }
-  for (const ps of asArray17(stack.permissions)) {
+  for (const ps of asArray18(stack.permissions)) {
     const psName = typeof ps.name === "string" ? ps.name : "";
     if (!psName) continue;
     const objects = ps.objects && typeof ps.objects === "object" ? ps.objects : {};
@@ -2212,6 +2429,9 @@ function diffAccessMatrix(before, after) {
   CAPABILITY_REFERENCE_UNKNOWN,
   CHART_CONFIG_MISSING,
   CHART_FIELD_UNKNOWN,
+  DASHBOARD_ACTION_ROUTE_UNRESOLVED,
+  DASHBOARD_ACTION_TARGET_UNDEFINED,
+  DASHBOARD_FILTER_FIELD_UNKNOWN,
   FIELD_GROUP_EMPTY,
   FIELD_GROUP_UNDECLARED,
   FLOW_DRAFT_STATUS_AMBIGUOUS,
@@ -2251,6 +2471,7 @@ function diffAccessMatrix(before, after) {
   diffAccessMatrix,
   validateApprovalApprovers,
   validateCapabilityReferences,
+  validateDashboardActionRefs,
   validateFlowTriggerReadiness,
   validateFormLayout,
   validateJsxPages,