@opensaas/stack-core 0.30.0 → 0.31.1

package/src/access/relationship-label-filter.test.ts

@@ -0,0 +1,177 @@
+import { describe, it, expect } from 'vitest'
+import { list } from '../config/index.js'
+import { text, relationship, integer } from '../fields/index.js'
+import type { OpenSaasConfig } from '../config/types.js'
+import type { AccessContext } from './types.js'
+import {
+  resolveRelationshipLabelFilters,
+  isToOneRelationshipField,
+} from './relationship-label-filter.js'
+
+/**
+ * Access-scoped to-one relationship label filters (issue #749). Verifies that
+ * `author:Ada` → `{ author: { is: { name: { contains: 'Ada' } } } }` gets the
+ * related list's `query` access folded into the nested `is` clause, so a
+ * session can never distinguish parent rows by a related field it cannot
+ * itself read.
+ */
+
+// Post is fully open; User (the `author` relation target) is scoped so only
+// active users are queryable; Widget ships fully closed (no access block).
+function makeConfig(): OpenSaasConfig {
+  return {
+    db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+    lists: {
+      User: list({
+        fields: { name: text(), active: integer() },
+        access: { operation: { query: () => ({ active: { equals: 1 } }) } },
+      }),
+      Post: list({
+        fields: {
+          title: text(),
+          views: integer(),
+          author: relationship({ ref: 'User.posts' }),
+          widget: relationship({ ref: 'Widget' }),
+        },
+        access: { operation: { query: () => true } },
+      }),
+      // Widget ships closed (no access block) → query denied by default.
+      Widget: list({ fields: { name: text() } }),
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+  } as any
+}
+
+function makeContext(): AccessContext {
+  return {
+    session: null,
+    _isSudo: false,
+    _resolveOutputCounter: { depth: 0 },
+    db: {},
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal context for unit test
+  } as any
+}
+
+describe('isToOneRelationshipField', () => {
+  const config = makeConfig()
+  const postFields = config.lists.Post.fields
+
+  it('is true only for a to-one relationship', () => {
+    expect(isToOneRelationshipField(postFields.author)).toBe(true)
+    expect(isToOneRelationshipField(postFields.widget)).toBe(true)
+    expect(isToOneRelationshipField(postFields.title)).toBe(false)
+  })
+})
+
+describe('resolveRelationshipLabelFilters', () => {
+  it('returns the where unchanged when there are no label-filter members', async () => {
+    const config = makeConfig()
+    const where = { title: { contains: 'hello' } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toBe(where)
+  })
+
+  it("ANDs the related list's access filter into the nested `is` clause", async () => {
+    const config = makeConfig()
+    const where = { author: { is: { name: { contains: 'Ada' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } },
+    })
+  })
+
+  it('leaves the member unchanged when the related list is fully readable', async () => {
+    const config: OpenSaasConfig = {
+      db: { provider: 'sqlite', prismaClientConstructor: () => null as never },
+      lists: {
+        Tag: list({ fields: { name: text() }, access: { operation: { query: () => true } } }),
+        Post: list({ fields: { title: text(), tag: relationship({ ref: 'Tag' }) } }),
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- minimal config for unit test
+    } as any
+    const where = { tag: { is: { name: { contains: 'news' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual(where)
+  })
+
+  it('resolves a fully denied related list to a never-matching member (no leak)', async () => {
+    const config = makeConfig()
+    const where = { widget: { is: { name: { contains: 'Gadget' } } } }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({ id: { in: [] } })
+  })
+
+  it('preserves sibling conditions, ANDing the resolved id constraint for a denied member', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ title: { contains: 'hello' } }, { widget: { is: { name: { contains: 'Gadget' } } } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [{ title: { contains: 'hello' } }, { id: { in: [] } }],
+    })
+  })
+
+  it('preserves sibling conditions alongside the access-scoped nested `is` clause', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ title: { contains: 'hello' } }, { author: { is: { name: { contains: 'Ada' } } } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [
+        { title: { contains: 'hello' } },
+        { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+      ],
+    })
+  })
+
+  it('composes with a to-many count marker member left untouched by this resolver', async () => {
+    const config = makeConfig()
+    const where = {
+      AND: [{ author: { is: { name: { contains: 'Ada' } } } }, { views: { gt: 10 } }],
+    }
+    const resolved = await resolveRelationshipLabelFilters(
+      where,
+      config.lists.Post,
+      { session: null, context: makeContext() },
+      config,
+    )
+    expect(resolved).toEqual({
+      AND: [
+        { author: { is: { AND: [{ active: { equals: 1 } }, { name: { contains: 'Ada' } }] } } },
+        { views: { gt: 10 } },
+      ],
+    })
+  })
+})

package/src/access/relationship-label-filter.ts

@@ -0,0 +1,140 @@
+import type { Session, AccessContext } from './types.js'
+import type { OpenSaasConfig, ListConfig, FieldConfig } from '../config/types.js'
+import { checkAccess, getRelatedListConfig } from './engine.js'
+import { mergeResolvedMember } from './relationship-count.js'
+
+/**
+ * Access-scoped to-one relationship label filters for the admin list view
+ * (issue #749).
+ *
+ * A to-one relationship's Filter spec (`author:Ada` → `{ author: { is: { name:
+ * { contains: 'Ada' } } } }`) is a pure mapper (see `relationship()` in
+ * `fields/index.ts`) — it has no way to consult the related list's access
+ * control, so the nested `is` clause it emits runs as an unscoped Prisma
+ * sub-filter against the related table. The parent list's own access filter
+ * still scopes which parent rows are visible, but the nested condition itself
+ * is evaluated with no reference to the related list's `query` access — a
+ * session could distinguish parent rows by a related field it is not itself
+ * allowed to read (e.g. binary-searching `author:A`, `author:Ad`, `author:Ada`
+ * against a `User` list it cannot query).
+ *
+ * This module is the single place the related list's operation-level `query`
+ * access is folded into that nested `is` clause, mirroring how
+ * `relationship-count.ts` folds it into `_count` selects and count-filter
+ * markers. A fully denied related list makes the member never match — the
+ * token cannot be used to confirm or rule out a value on a field the session
+ * cannot read (narrowing-only, matching the count resolver's denied path).
+ */
+
+type LabelFilterArgs = {
+  session: Session | null
+  context: AccessContext
+}
+
+/**
+ * Whether a field is a to-one relationship — the only field kind whose Filter
+ * spec emits a nested `{ is: {...} } }` condition against the related list's
+ * label field.
+ */
+export function isToOneRelationshipField(field: FieldConfig | undefined): boolean {
+  return (
+    field?.type === 'relationship' &&
+    !('many' in field && field.many === true) &&
+    'ref' in field &&
+    typeof field.ref === 'string' &&
+    field.ref.length > 0
+  )
+}
+
+/** Narrow a filter member's field value to a `{ is: {...} } }` clause, if it is one. */
+function readIsClause(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object') return null
+  const isValue = (value as Record<string, unknown>).is
+  if (!isValue || typeof isValue !== 'object') return null
+  return isValue as Record<string, unknown>
+}
+
+/**
+ * Resolve one to-one relationship label-filter member into an access-scoped
+ * condition by ANDing the related list's `query` access filter into the nested
+ * `is` clause. Returns `{ id: { in: [] } }` (never matches) when the related
+ * list is fully denied, the original member unchanged when it is fully
+ * readable, and the `is` clause ANDed with the access filter otherwise.
+ */
+async function resolveOneLabelFilter(
+  field: FieldConfig,
+  fieldName: string,
+  isClause: Record<string, unknown>,
+  args: LabelFilterArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown>> {
+  if (!('ref' in field) || typeof field.ref !== 'string') {
+    return { [fieldName]: { is: isClause } }
+  }
+  const related = getRelatedListConfig(field.ref, config)
+  if (!related) return { [fieldName]: { is: isClause } }
+
+  const queryAccess = related.listConfig.access?.operation?.query
+  const result = await checkAccess(queryAccess, { session: args.session, context: args.context })
+
+  if (result === false) return { id: { in: [] } }
+  if (result === true) return { [fieldName]: { is: isClause } }
+  return { [fieldName]: { is: { AND: [result, isClause] } } }
+}
+
+/**
+ * Replace any to-one relationship label-filter members in a filter `where`
+ * with access-scoped equivalents. Label-filter members only ever appear as
+ * top-level AND members (the relationship Filter spec does not declare
+ * `freeText`, so it never participates in the free-text OR), so this walks
+ * only the top level. Returns the `where` unchanged when it contains no such
+ * members, so lists without to-one relationship filters pay nothing.
+ */
+export async function resolveRelationshipLabelFilters(
+  where: Record<string, unknown> | undefined,
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+  args: LabelFilterArgs,
+  config: OpenSaasConfig,
+): Promise<Record<string, unknown> | undefined> {
+  if (!where) return where
+
+  const andValue = where.AND
+  const members: Array<Record<string, unknown>> = Array.isArray(andValue)
+    ? (andValue as Array<Record<string, unknown>>)
+    : [where]
+
+  const findLabelFilter = (
+    member: Record<string, unknown>,
+  ): { field: string; isClause: Record<string, unknown> } | null => {
+    for (const key of Object.keys(member)) {
+      const field = listConfig.fields[key]
+      if (!isToOneRelationshipField(field)) continue
+      const isClause = readIsClause(member[key])
+      if (!isClause) continue
+      return { field: key, isClause }
+    }
+    return null
+  }
+
+  if (!members.some((member) => findLabelFilter(member) !== null)) {
+    return where
+  }
+
+  const resolvedMembers: Array<Record<string, unknown>> = []
+  for (const member of members) {
+    const found = findLabelFilter(member)
+    if (!found) {
+      resolvedMembers.push(member)
+      continue
+    }
+    const field = listConfig.fields[found.field]
+    const resolved = await resolveOneLabelFilter(field, found.field, found.isClause, args, config)
+
+    const siblings: Record<string, unknown> = { ...member }
+    delete siblings[found.field]
+    resolvedMembers.push(mergeResolvedMember(siblings, resolved))
+  }
+
+  return resolvedMembers.length === 1 ? resolvedMembers[0] : { AND: resolvedMembers }
+}

package/src/config/index.ts

@@ -150,6 +150,12 @@ export type {
   UIConfig,
   ListUIConfig,
   ListViewUIConfig,
+  BulkAction,
+  BulkActionContext,
+  BulkActionResult,
+  BulkActionVariant,
+  ItemViewUIConfig,
+  RelationshipItemViewConfig,
   ThemeConfig,
   ThemePreset,
   ThemeColors,

package/src/config/nav-count.ts

@@ -0,0 +1,85 @@
+import type { AccessContext } from '../access/types.js'
+import { getDbKey } from '../lib/case-utils.js'
+import type { ListConfig, OpenSaasConfig, TypeInfo } from './types.js'
+
+/**
+ * The minimal shape a `context.db[list]` delegate needs for a nav count. The
+ * access-controlled DB carries an `any` index signature, so this narrows the
+ * lookup to just the access-scoped `count` we call.
+ */
+type CountDelegate = {
+  count?: (args?: { where?: unknown }) => Promise<number>
+}
+
+/**
+ * Whether a list's query access is **statically denied** — provably no session
+ * can read any row without evaluating a session-dependent function.
+ *
+ * Mirrors the list view's `canDeleteList` static check (issue #733): query
+ * access is statically denied when it is absent (deny-by-default, matching the
+ * access engine) or the literal boolean `false`. A function — or `true` —
+ * cannot be decided up front, so the count is fetched through the secured
+ * context, which re-applies the real rule per row.
+ *
+ * A statically-denied list must render no nav count at all: a `0` there would
+ * imply "this list is empty" when the truth is "you may see none of it".
+ */
+export function isListQueryStaticallyDenied(
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+  listConfig: ListConfig<any>,
+): boolean {
+  const queryAccess = listConfig.access?.operation?.query
+  if (queryAccess === undefined) return true
+  if (typeof queryAccess === 'boolean') return !queryAccess
+  return false
+}
+
+/**
+ * Resolve the access-scoped nav counts for the lists that opt in via
+ * `ui.navCount` (issue #735).
+ *
+ * The returned map is keyed by list key and contains an entry **only** for a
+ * list that:
+ *
+ * 1. opts in (`ui.navCount === true`) — no count query runs for any other list,
+ * 2. is not a singleton (a single-record list has no meaningful count), and
+ * 3. does not have statically-denied query access (see
+ *    {@link isListQueryStaticallyDenied}).
+ *
+ * Each count is read through the secured `context.db`, whose `count` applies the
+ * access filter, so the number reflects exactly what the current session may
+ * see (a denied row is not counted). Counts are fetched concurrently.
+ */
+export async function resolveNavCounts(
+  context: AccessContext,
+  config: OpenSaasConfig,
+): Promise<Record<string, number>> {
+  const counts: Record<string, number> = {}
+  const lists = config.lists ?? {}
+
+  const optedIn = Object.keys(lists).filter((listKey) => {
+    const listConfig = lists[listKey] as ListConfig<TypeInfo> | undefined
+    if (!listConfig) return false
+    if (listConfig.ui?.navCount !== true) return false
+    if (listConfig.isSingleton) return false
+    return !isListQueryStaticallyDenied(listConfig)
+  })
+
+  await Promise.all(
+    optedIn.map(async (listKey) => {
+      const delegate: CountDelegate | undefined = context.db?.[getDbKey(listKey)]
+      if (!delegate?.count) return
+      // A single list's count failing (a DB hiccup, a throwing access filter or
+      // hook) must not blank the whole admin chrome — `AdminUI` awaits this
+      // before rendering the shell. Degrade like the sibling `ListView`: log and
+      // omit just that badge. Other lists' counts are unaffected.
+      try {
+        counts[listKey] = await delegate.count()
+      } catch (error) {
+        console.error(`Failed to resolve nav count for ${listKey}:`, error)
+      }
+    }),
+  )
+
+  return counts
+}