@open-mercato/ui 0.4.2-canary-c02407ff85

package/src/backend/utils/__tests__/customFieldValues.test.ts

@@ -0,0 +1,35 @@
+import { collectCustomFieldValues } from '../customFieldValues'
+
+describe('collectCustomFieldValues', () => {
+  it('strips cf_ prefix by default', () => {
+    const input = { cf_name: 'Alice', cf_age: 30, email: 'alice@example.com' }
+    expect(collectCustomFieldValues(input)).toEqual({ name: 'Alice', age: 30 })
+  })
+
+  it('handles cf: prefix and keeps both by default', () => {
+    const input = { 'cf:city': 'Berlin', cf_country: 'DE' }
+    expect(collectCustomFieldValues(input)).toEqual({ city: 'Berlin', country: 'DE' })
+  })
+
+  it('applies transform and accept hooks', () => {
+    const input = { cf_name: 'Alice', cf_notes: '', cf_skip: 'value' }
+    const result = collectCustomFieldValues(input, {
+      transform: (value) => (typeof value === 'string' ? value.trim() : value),
+      accept: (fieldId) => fieldId !== 'skip',
+    })
+    expect(result).toEqual({ name: 'Alice', notes: '' })
+  })
+
+  it('retains prefix when stripPrefix is false', () => {
+    const input = { cf_name: 'Alice' }
+    expect(collectCustomFieldValues(input, { stripPrefix: false })).toEqual({ cf_name: 'Alice' })
+  })
+
+  it('omits undefined results when requested', () => {
+    const input = { cf_name: 'Alice', cf_age: 30, cf_extra: null }
+    const result = collectCustomFieldValues(input, {
+      transform: (value, key) => (key === 'extra' ? undefined : value),
+    })
+    expect(result).toEqual({ name: 'Alice', age: 30 })
+  })
+})

package/src/backend/utils/api.ts

@@ -0,0 +1,149 @@
+"use client"
+// Simple fetch wrapper that redirects to session refresh on 401 (Unauthorized)
+// Used across UI data utilities to avoid duplication.
+import { flash } from '../FlashMessages'
+import { deserializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import { pushOperation } from '../operations/store'
+import { pushPartialIndexWarning } from '../indexes/store'
+export class UnauthorizedError extends Error {
+  readonly status = 401
+  constructor(message = 'Unauthorized') {
+    super(message)
+    this.name = 'UnauthorizedError'
+  }
+}
+
+export function redirectToSessionRefresh() {
+  if (typeof window === 'undefined') return
+  const current = window.location.pathname + window.location.search
+  // Avoid redirect loops if already on an auth/session route
+  if (window.location.pathname.startsWith('/api/auth')) return
+  try {
+    flash('Session expired. Redirecting to sign in…', 'warning')
+    setTimeout(() => {
+      window.location.href = `/api/auth/session/refresh?redirect=${encodeURIComponent(current)}`
+    }, 20)
+  } catch {
+    // no-op
+  }
+}
+
+export class ForbiddenError extends Error {
+  readonly status = 403
+  constructor(message = 'Forbidden') {
+    super(message)
+    this.name = 'ForbiddenError'
+  }
+}
+
+let DEFAULT_FORBIDDEN_ROLES: string[] = ['admin']
+
+export function setAuthRedirectConfig(cfg: { defaultForbiddenRoles?: readonly string[] }) {
+  if (cfg?.defaultForbiddenRoles && cfg.defaultForbiddenRoles.length) {
+    DEFAULT_FORBIDDEN_ROLES = [...cfg.defaultForbiddenRoles].map(String)
+  }
+}
+
+export function redirectToForbiddenLogin(options?: { requiredRoles?: string[] | null; requiredFeatures?: string[] | null }) {
+  if (typeof window === 'undefined') return
+  // We don't know required roles from the API response; use a generic hint.
+  if (window.location.pathname.startsWith('/login')) return
+  try {
+    const current = window.location.pathname + window.location.search
+    const features = options?.requiredFeatures?.filter(Boolean) ?? []
+    const roles = options?.requiredRoles?.filter(Boolean) ?? []
+    const query = features.length
+      ? `requireFeature=${encodeURIComponent(features.join(','))}`
+      : `requireRole=${encodeURIComponent((roles.length ? roles : DEFAULT_FORBIDDEN_ROLES).map(String).join(','))}`
+    const url = `/login?${query}&redirect=${encodeURIComponent(current)}`
+    flash('Insufficient permissions. Redirecting to login…', 'warning')
+    setTimeout(() => { window.location.href = url }, 60)
+  } catch {
+    // no-op
+  }
+}
+
+export async function apiFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  type FetchType = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+  const baseFetch: FetchType = (typeof window !== 'undefined' && (window as any).__omOriginalFetch)
+    ? ((window as any).__omOriginalFetch as FetchType)
+    : fetch;
+  const res = await baseFetch(input, init);
+  const onLoginPage = typeof window !== 'undefined' && window.location.pathname.startsWith('/login')
+  if (res.status === 401) {
+    // Trigger same redirect flow as protected pages
+    if (!onLoginPage) {
+      redirectToSessionRefresh()
+      // Throw a typed error for callers that might still handle it
+      throw new UnauthorizedError(await res.text().catch(() => 'Unauthorized'))
+    }
+    return res
+  }
+  if (res.status === 403) {
+    // Try to read requiredRoles from JSON body; ignore if not JSON
+    let roles: string[] | null = null
+    let features: string[] | null = null
+    let payload: unknown = null
+    try {
+      const clone = res.clone()
+      const data = await clone.json()
+      if (Array.isArray(data?.requiredRoles)) roles = data.requiredRoles.map((r: any) => String(r))
+      if (Array.isArray(data?.requiredFeatures)) features = data.requiredFeatures.map((f: any) => String(f))
+      if (data && typeof data === 'object') payload = data
+    } catch {}
+    // Only redirect if not already on login page
+    if (!onLoginPage) {
+      const target =
+        typeof input === 'string'
+          ? input
+          : input instanceof URL
+            ? input.toString()
+            : (typeof Request !== 'undefined' && input instanceof Request)
+              ? input.url
+              : 'unknown'
+      try {
+        // eslint-disable-next-line no-console
+        console.warn('[apiFetch] Forbidden response', {
+          url: target,
+          status: res.status,
+          requiredRoles: roles,
+          requiredFeatures: features,
+          details: payload,
+        })
+      } catch {}
+      redirectToForbiddenLogin({ requiredRoles: roles, requiredFeatures: features })
+      const msg = await res.text().catch(() => 'Forbidden')
+      throw new ForbiddenError(msg)
+    }
+    // If already on login, just return the response for the caller to handle
+  }
+  try {
+    const header = res.headers.get('x-om-operation')
+    const metadata = deserializeOperationMetadata(header)
+    if (metadata) pushOperation(metadata)
+  } catch {
+    // ignore malformed headers
+  }
+  try {
+    const warningRaw = res.headers.get('x-om-partial-index')
+    if (warningRaw) {
+      const parsed = JSON.parse(warningRaw) as Record<string, unknown>
+      if (parsed && typeof parsed === 'object' && parsed.type === 'partial_index') {
+        const entity = typeof parsed.entity === 'string' ? parsed.entity : String(parsed.entity ?? '')
+        if (entity) {
+          const baseCount = typeof parsed.baseCount === 'number' ? parsed.baseCount : null
+          const indexedCount = typeof parsed.indexedCount === 'number' ? parsed.indexedCount : null
+          const scope = parsed.scope === 'global' ? 'global' : 'scoped'
+          const entityLabel =
+            typeof parsed.entityLabel === 'string' && parsed.entityLabel.trim()
+              ? parsed.entityLabel.trim()
+              : entity
+          pushPartialIndexWarning({ entity, entityLabel, baseCount, indexedCount, scope })
+        }
+      }
+    }
+  } catch {
+    // ignore malformed headers
+  }
+  return res
+}

package/src/backend/utils/apiCall.ts

@@ -0,0 +1,96 @@
+"use client"
+
+import { apiFetch } from './api'
+import { raiseCrudError, readJsonSafe } from './serverErrors'
+
+export type ApiCallOptions<TReturn> = {
+  parse?: (res: Response) => Promise<TReturn | null>
+  fallback?: TReturn | null
+}
+
+export type ApiCallResult<TReturn> = {
+  ok: boolean
+  status: number
+  result: TReturn | null
+  response: Response
+  cacheStatus: 'hit' | 'miss' | null
+}
+
+export async function apiCall<TReturn = Record<string, unknown>>(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+  options?: ApiCallOptions<TReturn>,
+): Promise<ApiCallResult<TReturn>> {
+  const response = await apiFetch(input, init)
+  const parser = options?.parse
+  const fallback = options?.fallback ?? null
+  let result: TReturn | null = null
+  const rawCacheStatus =
+    response.headers?.get?.('x-om-cache') ??
+    response.headers?.get?.('x-cache-status') ??
+    null
+  const cacheStatus = rawCacheStatus === 'hit' || rawCacheStatus === 'miss' ? rawCacheStatus : null
+  try {
+    const source = typeof (response as Response & { clone?: () => Response }).clone === 'function'
+      ? response.clone()
+      : response
+    if (parser) result = await parser(source)
+    else result = await readJsonSafe<TReturn>(source, fallback)
+  } catch {
+    result = fallback
+  }
+  return {
+    ok: response.ok,
+    status: response.status,
+    result,
+    response,
+    cacheStatus,
+  }
+}
+
+export type ApiCallOrThrowOptions<TReturn> = ApiCallOptions<TReturn> & {
+  errorMessage?: string
+}
+
+export async function apiCallOrThrow<TReturn = Record<string, unknown>>(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+  options?: ApiCallOrThrowOptions<TReturn>,
+): Promise<ApiCallResult<TReturn>> {
+  const { errorMessage, ...callOptions } = options ?? {}
+  const call = await apiCall<TReturn>(input, init, callOptions)
+  if (!call.ok) {
+    await raiseCrudError(call.response, errorMessage)
+  }
+  return call
+}
+
+export type ReadApiResultOrThrowOptions<TReturn> = ApiCallOrThrowOptions<TReturn> & {
+  allowNullResult?: boolean
+  emptyResultMessage?: string
+}
+
+export async function readApiResultOrThrow<TReturn = Record<string, unknown>>(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+  options?: ReadApiResultOrThrowOptions<TReturn> & { allowNullResult?: false },
+): Promise<TReturn>
+export async function readApiResultOrThrow<TReturn = Record<string, unknown>>(
+  input: RequestInfo | URL,
+  init: RequestInit | undefined,
+  options: ReadApiResultOrThrowOptions<TReturn> & { allowNullResult: true },
+): Promise<TReturn | null>
+export async function readApiResultOrThrow<TReturn = Record<string, unknown>>(
+  input: RequestInfo | URL,
+  init?: RequestInit,
+  options?: ReadApiResultOrThrowOptions<TReturn>,
+): Promise<TReturn | null> {
+  const { allowNullResult = false, emptyResultMessage, ...callOptions } = options ?? {}
+  const call = await apiCallOrThrow<TReturn>(input, init, callOptions)
+  if (call.result == null && !allowNullResult) {
+    const fallback =
+      emptyResultMessage ?? callOptions.errorMessage ?? `Missing response payload (${call.status})`
+    throw new Error(fallback)
+  }
+  return call.result
+}

package/src/backend/utils/crud.ts

@@ -0,0 +1,174 @@
+export type SortDir = 'asc' | 'desc'
+
+export type ListResponse<T> = {
+  items: T[]
+  total: number
+  page: number
+  pageSize: number
+  totalPages: number
+}
+
+export type CrudExportFormat = 'csv' | 'json' | 'xml' | 'markdown'
+
+function toQuery(params: Record<string, any>) {
+  const sp = new URLSearchParams()
+  for (const [k, v] of Object.entries(params)) {
+    if (v === undefined || v === null) continue
+    if (Array.isArray(v)) {
+      if (v.length === 0) continue
+      sp.set(k, v.join(','))
+    } else {
+      sp.set(k, String(v))
+    }
+  }
+  return sp.toString()
+}
+
+export function buildCrudQuery(params: Record<string, any>): string {
+  return toQuery(params)
+}
+
+import { apiCall, readApiResultOrThrow, type ApiCallResult } from './apiCall'
+import { raiseCrudError } from './serverErrors'
+
+function mergeHeaders(base: HeadersInit | undefined, extra: Record<string, string>): HeadersInit {
+  if (!base) return extra
+  const hasHeadersCtor = typeof Headers !== 'undefined'
+  if (hasHeadersCtor && base instanceof Headers) {
+    const merged = new Headers(base)
+    Object.entries(extra).forEach(([key, value]) => merged.set(key, value))
+    return merged
+  }
+  if (Array.isArray(base)) {
+    return [...base, ...Object.entries(extra)]
+  }
+  return { ...(base as Record<string, string>), ...extra }
+}
+
+type CrudRequestExtras<TReturn> = {
+  parseResult?: (res: Response) => Promise<TReturn | null>
+  fallbackResult?: TReturn | null
+  errorMessage?: string
+}
+
+export type CrudRequestInit<TReturn> = Omit<RequestInit, 'body' | 'method'> & CrudRequestExtras<TReturn>
+type CrudDeleteOptions<TReturn> = Omit<RequestInit, 'method' | 'body'> &
+  CrudRequestExtras<TReturn> & {
+    body?: unknown
+    id?: string
+  }
+
+export type CrudResponse<TReturn> = ApiCallResult<TReturn>
+
+export async function fetchCrudList<T>(apiPath: string, params: Record<string, any>, init?: RequestInit): Promise<ListResponse<T>> {
+  const qs = buildCrudQuery(params)
+  return readApiResultOrThrow<ListResponse<T>>(`/api/${apiPath}?${qs}`, init, {
+    errorMessage: 'Failed to fetch list',
+  })
+}
+
+export function buildCrudExportUrl(apiPath: string, params: Record<string, any>, format: CrudExportFormat): string {
+  const qs = buildCrudQuery({ ...params, format })
+  return `/api/${apiPath}?${qs}`
+}
+
+export function buildCrudCsvUrl(apiPath: string, params: Record<string, any>): string {
+  return buildCrudExportUrl(apiPath, params, 'csv')
+}
+
+export async function createCrud<TReturn = Record<string, unknown>>(
+  apiPath: string,
+  body: any,
+  init?: CrudRequestInit<TReturn>,
+): Promise<CrudResponse<TReturn>> {
+  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {}
+  const call = await apiCall<TReturn>(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: 'POST',
+      headers: mergeHeaders(headers, { 'content-type': 'application/json' }),
+      body: JSON.stringify(body),
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null,
+    },
+  )
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to create')
+  return call
+}
+
+export async function updateCrud<TReturn = Record<string, unknown>>(
+  apiPath: string,
+  body: any,
+  init?: CrudRequestInit<TReturn>,
+): Promise<CrudResponse<TReturn>> {
+  const { parseResult, fallbackResult, errorMessage, headers, ...rest } = init ?? {}
+  const call = await apiCall<TReturn>(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: 'PUT',
+      headers: mergeHeaders(headers, { 'content-type': 'application/json' }),
+      body: JSON.stringify(body),
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null,
+    },
+  )
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to update')
+  return call
+}
+
+export async function deleteCrud<TReturn = Record<string, unknown>>(
+  apiPath: string,
+  id: string,
+  init?: CrudRequestInit<TReturn>,
+): Promise<CrudResponse<TReturn>>
+export async function deleteCrud<TReturn = Record<string, unknown>>(
+  apiPath: string,
+  options: CrudDeleteOptions<TReturn>,
+): Promise<CrudResponse<TReturn>>
+export async function deleteCrud<TReturn = Record<string, unknown>>(
+  apiPath: string,
+  idOrOptions: string | CrudDeleteOptions<TReturn>,
+  maybeInit?: CrudRequestInit<TReturn>,
+): Promise<CrudResponse<TReturn>> {
+  if (typeof idOrOptions === 'string') {
+    const { parseResult, fallbackResult, errorMessage, ...rest } = maybeInit ?? {}
+    const call = await apiCall<TReturn>(
+      `/api/${apiPath}?id=${encodeURIComponent(idOrOptions)}`,
+      {
+        ...rest,
+        method: 'DELETE',
+      },
+      {
+        parse: parseResult,
+        fallback: fallbackResult ?? null,
+      },
+    )
+    if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to delete')
+    return call
+  }
+  const { parseResult, fallbackResult, errorMessage, headers, body, id, ...rest } = idOrOptions
+  const payload = body ?? (id ? { id } : undefined)
+  const requestHeaders =
+    payload !== undefined ? mergeHeaders(headers, { 'content-type': 'application/json' }) : headers
+  const call = await apiCall<TReturn>(
+    `/api/${apiPath}`,
+    {
+      ...rest,
+      method: 'DELETE',
+      headers: requestHeaders,
+      body: payload !== undefined ? JSON.stringify(payload) : undefined,
+    },
+    {
+      parse: parseResult,
+      fallback: fallbackResult ?? null,
+    },
+  )
+  if (!call.ok) await raiseCrudError(call.response, errorMessage ?? 'Failed to delete')
+  return call
+}

package/src/backend/utils/customFieldColumns.ts

@@ -0,0 +1,71 @@
+import type { ColumnDef } from '@tanstack/react-table'
+import type { CustomFieldDefDto, CustomFieldVisibility } from './customFieldDefs'
+import { isDefVisible } from './customFieldDefs'
+
+// Filters and annotates columns with custom-field definitions:
+// - Drops cf_* columns when no definition exists or listVisible === false
+// - Uses definition label as header when header is missing
+export function applyCustomFieldVisibility<T>(columns: ColumnDef<T, any>[], defs: CustomFieldDefDto[], mode: CustomFieldVisibility = 'list'): ColumnDef<T, any>[] {
+  const byKey = new Map(defs.map((d) => [d.key, d]))
+  // First, filter and annotate headers
+  const filtered = columns.filter((c) => {
+    const key = String((c as any).accessorKey || '')
+    if (!key.startsWith('cf_')) return true
+    const cfKey = key.slice(3)
+    const def = byKey.get(cfKey)
+    if (!def) return false
+    if (!isDefVisible(def, mode)) return false
+    const currentHeader = (c as any).header
+    const fallbackHeader = typeof currentHeader === 'string' && currentHeader.trim().length ? currentHeader : key
+    const label = def.label && def.label.trim().length ? def.label : fallbackHeader
+    if (currentHeader == null || typeof currentHeader === 'string') {
+      (c as any).header = label
+    }
+    const existingMeta = ((c as any).meta || {}) as Record<string, unknown>
+    const nextMeta = Object.assign({}, existingMeta, { label })
+    ;(c as any).meta = nextMeta
+    return true
+  })
+
+  // Then, reorder only the cf_* columns by definition priority while preserving
+  // the positions of non-cf columns and the count of cf slots.
+  const cfEntries: Array<{ col: ColumnDef<T, any>; key: string; prio: number }> = []
+  filtered.forEach((c) => {
+    const key = String((c as any).accessorKey || '')
+    if (key.startsWith('cf_')) {
+      const cfKey = key.slice(3)
+      const def = byKey.get(cfKey)
+      cfEntries.push({ col: c, key: cfKey, prio: def?.priority ?? 0 })
+    }
+  })
+  cfEntries.sort((a, b) => a.prio - b.prio)
+  let cfIdx = 0
+  const result = filtered.map((c) => {
+    const key = String((c as any).accessorKey || '')
+    if (!key.startsWith('cf_')) return c
+    const next = cfEntries[cfIdx++]?.col ?? c
+    return next
+  })
+
+  // Append any missing cf columns (defs visible but not present in incoming columns)
+  const existingCfKeys = new Set<string>(result
+    .map((c) => String((c as any).accessorKey || ''))
+    .filter((k) => k.startsWith('cf_'))
+    .map((k) => k.slice(3)))
+
+  const visibleSorted = defs
+    .filter((d) => isDefVisible(d, mode))
+    .sort((a, b) => (a.priority ?? 0) - (b.priority ?? 0))
+
+  const missing = visibleSorted.filter((d) => !existingCfKeys.has(d.key))
+  for (const d of missing) {
+    const col: ColumnDef<T, any> = {
+      accessorKey: `cf_${d.key}` as any,
+      header: d.label || `cf_${d.key}`,
+      // Respect responsive priority when provided; default leaves it visible
+      meta: { priority: (d as any).priority, label: d.label || `cf_${d.key}` } as any,
+    }
+    result.push(col)
+  }
+  return result
+}