@pilotiq/pilotiq 0.7.2 → 0.8.0

package/dist/pageData/relationPages.js

@@ -0,0 +1,867 @@
+import { resourceBasePath } from '../clusterPaths.js';
+import { resolveSchema } from '../schema/resolveSchema.js';
+import { Form } from '../elements/Form.js';
+import { Table } from '../elements/Table.js';
+import { Filter } from '../filters/Filter.js';
+import { TrashedFilter } from '../filters/TrashedFilter.js';
+import { loadTableRecords } from '../elements/dispatchTable.js';
+import { consumeFlashedNotifications } from '../notifications/flash.js';
+import { serializeIcon } from '../icons/types.js';
+import { safeManagerPolicy as safeManagerPolicyImpl, } from '../RelationManager.js';
+import { findRecord, getPrimaryKey, getRelationType, modelLoadRecord, modelRelationTableRecords, modelSave, } from '../orm/modelDefaults.js';
+import { normalizeRelationMode } from '../RelationManager.js';
+import { nestedRelationCreateBreadcrumbs, nestedRelationEditBreadcrumbs, nestedRelationListBreadcrumbs, nestedRelationViewBreadcrumbs, relationCreateBreadcrumbs, relationEditBreadcrumbs, relationListBreadcrumbs, relationViewBreadcrumbs, } from './breadcrumbs.js';
+import { applyFillPipeline, tagActionDispatch, tagFormActions, uploadCtx, userCtx, } from './helpers.js';
+import { applyRoleHooks, panelInfo, } from './navigation.js';
+import { buildNestedRelationTabs, buildRelationTabs, deriveParentTitle, safeBool, } from './relationTabs.js';
+/**
+ * Discover the related Resource for a manager. Order:
+ *   1. `M.relatedResource` explicit override (skip discovery).
+ *   2. Rudder ORM convention: walk
+ *      `R.model.relations[manager.relationship].model()` and find
+ *      `cfg.resources[i].model === relatedModel`.
+ *   3. Otherwise undefined — caller must error or fall back.
+ *
+ * A returned Resource is the one whose `model` backs the related
+ * table. Callers use it for `Related.model.find(childId)`,
+ * `Related.canEdit(user, child)`, and the auto-wired form save handler.
+ */
+export function findRelatedResource(M, R, cfg) {
+    if (M.relatedResource)
+        return M.relatedResource;
+    const ParentModel = R.model;
+    if (!ParentModel)
+        return undefined;
+    const def = ParentModel.relations?.[M.getRelationship()];
+    const RelatedModel = typeof def?.model === 'function' ? def.model() : undefined;
+    if (!RelatedModel)
+        return undefined;
+    return cfg.resources.find(r => r.model === RelatedModel);
+}
+/** Find a registered manager on a Resource by its relationship key.
+ *  Throws on unknown manager — so the route can 404 cleanly. */
+function findManager(R, relationship) {
+    return R.relations().find(M => {
+        try {
+            return M.getRelationship() === relationship;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/**
+ * Verify a child record actually belongs to the given parent under the
+ * declared relationship. Anti-IDOR — without this an attacker can swap
+ * the `:childId` segment to load any related-model row regardless of
+ * whether it's actually owned by the parent.
+ *
+ * Strategy: re-resolve the parent's relation query and check whether
+ * the child's primary key shows up in `where(pk, '=', childId).paginate(1, 1)`.
+ * Yes, it's a second round-trip — but it's the single point of trust
+ * for IDOR safety, and it fits naturally into the same query path
+ * `modelRelationTableRecords` uses.
+ */
+async function childBelongsToParent(parentModel, parent, relationship, childPk, childId) {
+    try {
+        const q = (parentModel.relatedQuery
+            ? parentModel.relatedQuery(parent, relationship)
+            : parent.related(relationship));
+        const result = await q.where(childPk, '=', childId).paginate(1, 1);
+        return result.total > 0;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Auto-wire the manager's table records loader against the parent's
+ * relation query when the user didn't set `Table.records()` themselves.
+ * Mirrors `defaultPages`'s wiring of `Table.records()` from `R.model`
+ * for the resource list page.
+ */
+function autoWireManagerTable(table, parentModel, parent, relationship) {
+    if (table.getRecords())
+        return; // user wired it explicitly
+    table.records(modelRelationTableRecords(parentModel, parent, relationship, table));
+}
+/**
+ * Plan #13 polish — auto-inject `TrashedFilter` on a relation manager's
+ * table when the **related** Resource opts into soft deletes. Mirrors the
+ * resource-list pattern in `defaultPages.applyTableDefaults`. The check
+ * is on the related Resource (not the manager), because soft-delete is a
+ * model-level capability — if the child model supports trashing, the
+ * manager's table should expose the toggle.
+ *
+ * No-op when:
+ *   - the related Resource hasn't set `softDeletes = true`
+ *   - the user already attached a `TrashedFilter` in `M.table()`
+ */
+function injectManagerTrashedFilter(table, Related) {
+    if (!Related?.softDeletes)
+        return;
+    const children = table.getChildren() ?? [];
+    const hasTrashed = children.some(c => c instanceof TrashedFilter);
+    if (hasTrashed)
+        return;
+    const existing = children.filter(c => c instanceof Filter);
+    table.filters([...existing, TrashedFilter.make()]);
+}
+/**
+ * Auto-wire the manager's form save + loadRecord handlers against the
+ * **related** Resource's `model` when the user didn't set them. The
+ * route handler is responsible for stamping the parent context
+ * (parent, parentRecord, parentId, relationship) onto the
+ * `FormContext` so user-supplied `mutateDataBeforeCreate` etc. can
+ * read them.
+ */
+function autoWireManagerForm(form, Related) {
+    const RelatedModel = Related.model;
+    if (!RelatedModel)
+        return;
+    if (!form.getSave())
+        form.save(modelSave(RelatedModel));
+    if (!form.getLoadRecord())
+        form.loadRecord(modelLoadRecord(Related));
+}
+/** Plan #11 — authorize a relation-manager action with sensible defaults.
+ *  Re-exported from `RelationManager.ts` so external callers (route
+ *  handlers, third-party plugins) keep their existing import path. */
+export const safeManagerPolicy = safeManagerPolicyImpl;
+/**
+ * Plan #11 — render data for the three relation-manager URL scopes.
+ * Mirrors the resource* builders' shape so routes and Vike +data hooks
+ * consume identical props. Authorization runs inline (parent
+ * `canAccess + canEdit(parent)` then manager-scoped predicate); IDOR
+ * check on `relation-edit` runs against the parent's relation query.
+ *
+ * Returns:
+ *   - `null` when panel / parent / manager / child don't exist.
+ *   - `{ ok: false, status: 403 }` when authorization denies.
+ *   - the props record on success (route picks SSR view / SPA prop
+ *     downstream).
+ */
+export async function relationManagerData(pilotiq, scope, req) {
+    // Phase B nested-relation-* scopes split out into their own pipeline
+    // — the chain walking + per-layer auth differs enough from the
+    // depth-1 path that interleaving them would mostly hurt readability.
+    if (scope.kind === 'nested-relation-list'
+        || scope.kind === 'nested-relation-create'
+        || scope.kind === 'nested-relation-view'
+        || scope.kind === 'nested-relation-edit') {
+        return nestedRelationManagerData(pilotiq, scope, req);
+    }
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+    if (!R)
+        return null;
+    const M = findManager(R, scope.relationship);
+    if (!M)
+        return null;
+    const user = await pilotiq.resolveUser(req);
+    // Layer 1: parent access. canAccess gates the resource entirely;
+    // canEdit gates managing its relations (managers are read-write
+    // surfaces — read-only inline views opt in by overriding the
+    // manager's can*). Cluster gate composes with R.canAccess — both
+    // must pass when the parent resource is inside a cluster.
+    const [clusterOk, accessOk] = await Promise.all([
+        R.cluster ? safeBool(() => R.cluster.canAccess(user)) : Promise.resolve(true),
+        safeBool(() => R.canAccess(user)),
+    ]);
+    if (!clusterOk || !accessOk)
+        return { ok: false, status: 403 };
+    if (!R.model) {
+        // Without a model on the parent we can't load the parent record,
+        // and without that we can't IDOR-check children. Point users at
+        // the missing wiring rather than silent 500s.
+        throw new Error(`[Pilotiq] Resource "${R.name}" has relations(${M.name}) but no static model. ` +
+            `Set Resource.model = … to enable relation managers, or remove the manager.`);
+    }
+    const parentRecord = await findRecord(R, scope.recordId, { user }).catch(() => undefined);
+    if (!parentRecord)
+        return null;
+    if (!await safeBool(() => R.canEdit(user, parentRecord)))
+        return { ok: false, status: 403 };
+    // Read the relation type off the parent's relations map once,
+    // normalize to the six-way `RelationMode` the manager-side logic
+    // uses. `belongsToMany` / `morphToMany` (owning polymorphic) /
+    // `morphedByMany` (inverse polymorphic) all flip into pivot-mutation
+    // mode (attach / detach / sync — same accessor surface), `morphMany|
+    // morphOne` collapses to `'morphMany'` (parent-side polymorphic —
+    // auto-fills morph columns on create), `morphTo` is the child-side
+    // polymorphic (no auto-actions; requires explicit `M.relatedResource`).
+    // Everything else collapses to `'hasMany'`.
+    const relationType = getRelationType(R.model, scope.relationship);
+    const mode = normalizeRelationMode(relationType);
+    const Related = findRelatedResource(M, R, cfg);
+    // Related Resource is required for: edit/create form auto-wire,
+    // child loading on edit, related URL generation. Throw when missing
+    // *only* if we'd otherwise need it — for `relation-list` it's
+    // optional (the table can be hand-wired by the user).
+    const needRelated = scope.kind !== 'relation-list';
+    if (needRelated && !Related) {
+        throw new Error(`[Pilotiq] RelationManager ${M.name} on ${R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares relations[${JSON.stringify(M.getRelationship())}].`);
+    }
+    switch (scope.kind) {
+        case 'relation-list':
+            return buildRelationListData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-create':
+            return buildRelationCreateData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-view':
+            return buildRelationViewData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+        case 'relation-edit':
+            return buildRelationEditData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode);
+    }
+}
+async function buildRelationListData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!await safeManagerPolicy(M, 'canViewAny', Related, user, parentRecord))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const listUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}`;
+    // Build a single Table by piping a fresh Table through M.table(table, ctx).
+    // Context lets the user wire `Action.relationCreate / relationEdit /
+    // relationDelete(M, ctx)` factories inside `static table()` to template
+    // URLs without threading basePath / parentId by hand.
+    const managerCtx = buildRelationManagerCtx(base, scope, parentRecord, Related, mode);
+    const table = M.table(Table.make(), managerCtx);
+    autoWireManagerTable(table, R.model, parentRecord, scope.relationship);
+    injectManagerTrashedFilter(table, Related);
+    const ctx = uploadCtx(userCtx({
+        mode: 'table',
+        basePath: base,
+        record: parentRecord,
+    }, user), cfg);
+    const elements = [table];
+    tagActionDispatch(elements, listUrl);
+    // Independent work — records load against the parent's relation
+    // accessor; tabs probe per-tab `safeManagerPolicy` predicates that
+    // don't touch the records pipeline.
+    const [, tabs] = await Promise.all([
+        loadTableRecords(elements, scope.query ?? {}, listUrl, user),
+        buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord),
+    ]);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationListBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const relationListRoute = { resource: R, recordId: scope.recordId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, relationListRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-list', metas, relationListRoute)),
+    ]);
+    return {
+        pageType: 'relation-list',
+        panel,
+        resource: { name: R.name, label: R.label, labelSingular: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related?.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildRelationCreateData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!await safeManagerPolicy(M, 'canCreate', Related, user, parentRecord))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const createUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}/create`;
+    const managerCtx = buildRelationManagerCtx(base, scope, parentRecord, Related, mode);
+    const form = M.form(Form.make(), managerCtx);
+    if (Related.model)
+        autoWireManagerForm(form, Related);
+    const elements = [form];
+    tagFormActions(elements, createUrl);
+    if (scope.prefill) {
+        if (scope.prefill.values)
+            form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationCreateBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'create',
+        basePath: base,
+        record: parentRecord,
+    }, user), cfg);
+    const relationCreateRoute = { resource: R, recordId: scope.recordId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, relationCreateRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-create', metas, relationCreateRoute)),
+    ]);
+    return {
+        pageType: 'relation-create',
+        panel,
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'create',
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Phase A — read-only view page for a related record at depth-2:
+ * `${base}/${slug}/:id/${rel}/:childId`. Mirrors `buildRelationEditData`'s
+ * IDOR + auth posture but resolves the manager's `static detail(child,
+ * parent)` instead of its form. The default `detail()` returns `[]` —
+ * managers opt in by overriding it; the chrome (RelationTabs strip)
+ * still renders so users can sideways-nav between sibling managers.
+ */
+async function buildRelationViewData(pilotiq, R, M, Related, parentRecord, scope, req, user, _mode) {
+    if (!Related.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for ${M.name}: Related Resource ${Related.name} has no static model.`);
+    }
+    const childPk = getPrimaryKey(Related.model);
+    const [belongs, child] = await Promise.all([
+        childBelongsToParent(R.model, parentRecord, scope.relationship, childPk, scope.childId),
+        findRecord(Related, scope.childId, { user }).catch(() => undefined),
+    ]);
+    if (!belongs || !child)
+        return null;
+    if (!await safeManagerPolicy(M, 'canView', Related, user, parentRecord, child))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const elements = M.detail(child, parentRecord);
+    // Phase B polish — when M declares nested managers, surface them on
+    // this page too. The strip lists the leaf parent's view tab plus one
+    // tab per sibling nested manager so users can jump from the Phase A
+    // view straight into a grandchild list / create / view / edit page.
+    // Active key `'__view'` because the user is currently viewing the
+    // leaf parent record itself, not any nested manager.
+    const nestedTabs = await buildNestedRelationTabs(R, M, base, { recordId: scope.recordId, relationship: scope.relationship }, scope.childId, '__view', user, child);
+    if (nestedTabs)
+        elements.unshift(nestedTabs);
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationViewBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), deriveParentTitle(Related, child, M));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'view',
+        basePath: base,
+        record: child,
+        recordId: scope.childId,
+    }, user), cfg);
+    const relationViewRoute = { resource: R, recordId: scope.childId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, relationViewRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-view', metas, relationViewRoute)),
+    ]);
+    return {
+        pageType: 'relation-view',
+        panel,
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'view',
+        childId: scope.childId,
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildRelationEditData(pilotiq, R, M, Related, parentRecord, scope, req, user, mode) {
+    if (!Related.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for ${M.name}: Related Resource ${Related.name} has no static model.`);
+    }
+    const childPk = getPrimaryKey(Related.model);
+    // IDOR check + child load in parallel. Both fail-paths collapse to
+    // the same `return null` so behavior matches the serial version; the
+    // independent queries (parent's relation accessor vs related model's
+    // find) save one RTT on every relation-edit request.
+    const [belongs, child] = await Promise.all([
+        childBelongsToParent(R.model, parentRecord, scope.relationship, childPk, scope.childId),
+        findRecord(Related, scope.childId, { user }).catch(() => undefined),
+    ]);
+    if (!belongs || !child)
+        return null;
+    if (!await safeManagerPolicy(M, 'canEdit', Related, user, parentRecord, child))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, R);
+    const editUrl = `${resourceBase}/${scope.recordId}/${scope.relationship}/${scope.childId}/edit`;
+    const managerCtx = buildRelationManagerCtx(base, scope, parentRecord, Related, mode);
+    const form = M.form(Form.make(), managerCtx);
+    autoWireManagerForm(form, Related);
+    const elements = [form];
+    tagFormActions(elements, editUrl);
+    // Prefill values: explicit prefill (re-render after 422) wins,
+    // otherwise pipe the loaded child through Form's fill pipeline.
+    if (scope.prefill?.values) {
+        form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    else if (child != null) {
+        const values = await applyFillPipeline(form, child);
+        form.withValues(values);
+    }
+    const tabs = await buildRelationTabs(R, scope.recordId, base, scope.relationship, user, parentRecord);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = relationEditBreadcrumbs(cfg, R, M, scope.recordId, deriveParentTitle(R, parentRecord), scope.childId, deriveParentTitle(Related, child, M));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'edit',
+        basePath: base,
+        record: child,
+        recordId: scope.childId,
+    }, user), cfg);
+    const relationEditRoute = { resource: R, recordId: scope.childId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, relationEditRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-edit', metas, relationEditRoute)),
+    ]);
+    return {
+        pageType: 'relation-edit',
+        panel,
+        resource: { name: R.name, label: R.labelSingular, slug: scope.slug, icon: serializeIcon(R.icon, R.name) },
+        relation: {
+            name: M.name,
+            label: M.getLabel(),
+            labelSingular: M.getLabelSingular(),
+            relationship: scope.relationship,
+            icon: M.getIcon() ? serializeIcon(M.getIcon(), M.name) : undefined,
+            relatedSlug: Related.getSlug(),
+        },
+        parent: {
+            id: scope.recordId,
+            title: deriveParentTitle(R, parentRecord),
+        },
+        mode: 'edit',
+        childId: scope.childId,
+        basePath: base,
+        layout: cfg.layout,
+        schemaData,
+        notifications: consumeFlashedNotifications(req),
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+/**
+ * Phase B — resolve a depth-2 chain, running every auth + IDOR layer:
+ *   Layer 0 — top-level Resource: cluster gate, R.canAccess.
+ *   Layer 1 — parent record: R.canEdit(parent) (Phase A gate to manage relations).
+ *   Layer 2 — first manager M1: relationship discovered, related resource discovered.
+ *   IDOR #1 — child1 (the leaf parent) must belong to parentRecord under chain[0].relationship.
+ *   Layer 3 — M1.canView(child1, parent) (Filament-style: must be allowed
+ *             to view the child to drill into its sub-relations).
+ *   Layer 4 — second manager M2 lookup; relation type read off Related1.model.
+ *
+ * The leaf manager's per-scope predicate (canViewAny / canCreate /
+ * canView / canEdit) runs inside the per-scope builders below, since
+ * each predicate has different arguments.
+ */
+export async function resolveRelationChain(pilotiq, scope, user) {
+    const cfg = pilotiq.getConfig();
+    const R = cfg.resources.find(r => r.getSlug() === scope.slug);
+    if (!R)
+        return null;
+    // Layer 0 — same gates as the depth-1 pipeline.
+    const [clusterOk, accessOk] = await Promise.all([
+        R.cluster ? safeBool(() => R.cluster.canAccess(user)) : Promise.resolve(true),
+        safeBool(() => R.canAccess(user)),
+    ]);
+    if (!clusterOk || !accessOk)
+        return { ok: false, status: 403 };
+    if (!R.model) {
+        throw new Error(`[Pilotiq] Resource "${R.name}" has nested relations but no static model. ` +
+            `Set Resource.model = … or remove the manager.`);
+    }
+    const [step0, step1] = scope.chain;
+    const parentRecord = await findRecord(R, step0.recordId, { user }).catch(() => undefined);
+    if (!parentRecord)
+        return null;
+    // Layer 1 — parent record gate.
+    if (!await safeBool(() => R.canEdit(user, parentRecord)))
+        return { ok: false, status: 403 };
+    // Layer 2 — first manager M1.
+    const M1 = findManager(R, step0.relationship);
+    if (!M1)
+        return null;
+    const Related1 = findRelatedResource(M1, R, cfg);
+    if (!Related1) {
+        throw new Error(`[Pilotiq] RelationManager ${M1.name} on ${R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares relations[${JSON.stringify(M1.getRelationship())}].`);
+    }
+    if (!Related1.model) {
+        throw new Error(`[Pilotiq] Related Resource ${Related1.name} has no static model — ` +
+            `cannot resolve nested manager chain through it.`);
+    }
+    const child1Mode = normalizeRelationMode(getRelationType(R.model, step0.relationship));
+    // IDOR #1 + child1 load in parallel — confirm the leaf parent
+    // (`step1.recordId`) actually belongs to the top parent under the
+    // first relationship key. Independent queries.
+    const child1Pk = getPrimaryKey(Related1.model);
+    const [belongs1, child1] = await Promise.all([
+        childBelongsToParent(R.model, parentRecord, step0.relationship, child1Pk, step1.recordId),
+        findRecord(Related1, step1.recordId, { user }).catch(() => undefined),
+    ]);
+    if (!belongs1 || !child1)
+        return null;
+    // Layer 3 — M1.canView(child1, parent) gate. Filament-style: viewing
+    // the child is the prerequisite for entering its nested manager strip.
+    if (!await safeManagerPolicy(M1, 'canView', Related1, user, parentRecord, child1))
+        return { ok: false, status: 403 };
+    // Layer 4 — second manager M2 declared under M1.relations().
+    const M2 = M1.relations().find(N => {
+        try {
+            return N.getRelationship() === step1.relationship;
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!M2)
+        return null;
+    const Related2 = findRelatedResource(M2, Related1, cfg);
+    const child2Mode = normalizeRelationMode(getRelationType(Related1.model, step1.relationship));
+    return { R, parentRecord, M1, Related1, child1, child1Mode, M2, Related2, child2Mode };
+}
+/**
+ * Phase B dispatcher — splits the four nested scopes onto their builders
+ * after the shared chain walk. Mirrors the depth-1 `relationManagerData`
+ * function shape.
+ */
+async function nestedRelationManagerData(pilotiq, scope, req) {
+    const user = await pilotiq.resolveUser(req);
+    const resolved = await resolveRelationChain(pilotiq, scope, user);
+    if (resolved === null)
+        return null;
+    if ('ok' in resolved)
+        return resolved;
+    // For create / view / edit we strictly need a registered Related2 so
+    // we can load the leaf record + auto-wire the form save.
+    const needRelated2 = scope.kind !== 'nested-relation-list';
+    if (needRelated2 && !resolved.Related2) {
+        throw new Error(`[Pilotiq] Nested RelationManager ${resolved.M2.name} under ${resolved.M1.name} ` +
+            `on ${resolved.R.name} could not resolve its related Resource. ` +
+            `Set static relatedResource on the manager, or ensure the parent's model declares ` +
+            `relations[${JSON.stringify(resolved.M2.getRelationship())}].`);
+    }
+    switch (scope.kind) {
+        case 'nested-relation-list':
+            return buildNestedRelationListData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-create':
+            return buildNestedRelationCreateData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-view':
+            return buildNestedRelationViewData(pilotiq, scope, resolved, req, user);
+        case 'nested-relation-edit':
+            return buildNestedRelationEditData(pilotiq, scope, resolved, req, user);
+    }
+}
+/** Phase B — build the manager context for a nested leaf manager. The
+ *  parent here is `child1` (the chain's leaf parent record); the URL
+ *  prefix comes from `scope.chain[0]` via `Action.relation*` factories
+ *  reading `ctx.chain`. */
+/** Depth-1 manager context constructor — mirror of `nestedManagerCtx` for
+ *  the four `relation-*` page roles. Three call sites (list / create / edit)
+ *  build identical shapes; the helper keeps them in lock-step. */
+function buildRelationManagerCtx(base, scope, parentRecord, Related, mode) {
+    return {
+        basePath: base,
+        parentSlug: scope.slug,
+        parentId: scope.recordId,
+        relationship: scope.relationship,
+        parentRecord,
+        related: Related,
+        mode,
+    };
+}
+function nestedManagerCtx(base, scope, resolved) {
+    const [step0, step1] = scope.chain;
+    return {
+        basePath: base,
+        parentSlug: resolved.R.getSlug(),
+        parentId: step1.recordId, // immediate parent = child1's id
+        relationship: step1.relationship, // leaf manager's relationship
+        parentRecord: resolved.child1, // immediate parent record = child1
+        related: resolved.Related2,
+        mode: resolved.child2Mode,
+        chain: [{
+                slug: resolved.R.getSlug(),
+                recordId: step0.recordId,
+                relationship: step0.relationship,
+            }],
+    };
+}
+/** Phase B — assemble the response shape that mirrors the depth-1
+ *  builders but adds a `chain` array so renderers can build breadcrumbs
+ *  and back-links without re-deriving them. */
+function nestedResponseEnvelope(pageType, pilotiq, base, scope, resolved, req) {
+    const { R, M1, Related1, child1, M2, Related2 } = resolved;
+    const [step0, step1] = scope.chain;
+    const parentChildTitle = deriveParentTitle(Related1, child1, M1);
+    return {
+        pageType,
+        resource: { name: R.name, label: R.labelSingular, slug: R.getSlug(), icon: serializeIcon(R.icon, R.name) },
+        parentRelation: {
+            name: M1.name,
+            relationship: step0.relationship,
+            label: M1.getLabel(),
+            relatedSlug: Related1.getSlug(),
+        },
+        parentChild: {
+            id: step1.recordId,
+            title: parentChildTitle,
+        },
+        relation: {
+            name: M2.name,
+            relationship: step1.relationship,
+            label: M2.getLabel(),
+            labelSingular: M2.getLabelSingular(),
+            icon: M2.getIcon() ? serializeIcon(M2.getIcon(), M2.name) : undefined,
+            relatedSlug: Related2?.getSlug(),
+        },
+        parent: {
+            // Top-of-chain record — same shape the depth-1 builders ship as
+            // `parent` so renderers can reuse the back-to-resource link.
+            id: step0.recordId,
+            title: deriveParentTitle(R, resolved.parentRecord),
+        },
+        basePath: base,
+        layout: pilotiq.getConfig().layout,
+        notifications: consumeFlashedNotifications(req),
+    };
+}
+async function buildNestedRelationListData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!await safeManagerPolicy(M2, 'canViewAny', Related2, user, child1))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const [step0, step1] = scope.chain;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const listUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const table = M2.table(Table.make(), managerCtx);
+    if (Related1.model) {
+        autoWireManagerTable(table, Related1.model, child1, step1.relationship);
+    }
+    injectManagerTrashedFilter(table, Related2);
+    const ctx = uploadCtx(userCtx({
+        mode: 'table',
+        basePath: base,
+        record: child1,
+    }, user), cfg);
+    const elements = [table];
+    tagActionDispatch(elements, listUrl);
+    const [, tabs] = await Promise.all([
+        loadTableRecords(elements, scope.query ?? {}, listUrl, user),
+        buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1),
+    ]);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationListBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const nestedListRoute = { resource: resolved.R, recordId: scope.chain[1].recordId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, nestedListRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-list', metas, nestedListRoute)),
+    ]);
+    return {
+        ...nestedResponseEnvelope('nested-relation-list', pilotiq, base, scope, resolved, req),
+        panel,
+        schemaData,
+    };
+}
+async function buildNestedRelationCreateData(pilotiq, scope, resolved, req, user) {
+    const { child1, M2, Related2 } = resolved;
+    if (!await safeManagerPolicy(M2, 'canCreate', Related2, user, child1))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const [step0, step1] = scope.chain;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const createUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}/create`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const form = M2.form(Form.make(), managerCtx);
+    if (Related2?.model)
+        autoWireManagerForm(form, Related2);
+    const elements = [form];
+    tagFormActions(elements, createUrl);
+    if (scope.prefill) {
+        if (scope.prefill.values)
+            form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationCreateBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(resolved.Related1, child1, resolved.M1));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'create',
+        basePath: base,
+        record: child1,
+    }, user), cfg);
+    const nestedCreateRoute = { resource: resolved.R, recordId: scope.chain[1].recordId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, nestedCreateRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-create', metas, nestedCreateRoute)),
+    ]);
+    return {
+        ...nestedResponseEnvelope('nested-relation-create', pilotiq, base, scope, resolved, req),
+        panel,
+        mode: 'create',
+        schemaData,
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+async function buildNestedRelationViewData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!Related2?.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for nested manager ${M2.name}: ` +
+            `Related Resource ${Related2?.name ?? '(none)'} has no static model.`);
+    }
+    const [, step1] = scope.chain;
+    const child2Pk = getPrimaryKey(Related2.model);
+    const [belongs2, child2] = await Promise.all([
+        childBelongsToParent(Related1.model, child1, step1.relationship, child2Pk, scope.childId),
+        findRecord(Related2, scope.childId, { user }).catch(() => undefined),
+    ]);
+    if (!belongs2 || !child2)
+        return null;
+    if (!await safeManagerPolicy(M2, 'canView', Related2, user, child1, child2))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const elements = M2.detail(child2, child1);
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationViewBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), deriveParentTitle(Related2, child2, M2));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'view',
+        basePath: base,
+        record: child2,
+        recordId: scope.childId,
+    }, user), cfg);
+    const nestedViewRoute = { resource: resolved.R, recordId: scope.childId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, nestedViewRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-view', metas, nestedViewRoute)),
+    ]);
+    return {
+        ...nestedResponseEnvelope('nested-relation-view', pilotiq, base, scope, resolved, req),
+        panel,
+        mode: 'view',
+        childId: scope.childId,
+        schemaData,
+    };
+}
+async function buildNestedRelationEditData(pilotiq, scope, resolved, req, user) {
+    const { Related1, child1, M2, Related2 } = resolved;
+    if (!Related2?.model) {
+        throw new Error(`[Pilotiq] Cannot load child record for nested manager ${M2.name}: ` +
+            `Related Resource ${Related2?.name ?? '(none)'} has no static model.`);
+    }
+    const [step0, step1] = scope.chain;
+    const child2Pk = getPrimaryKey(Related2.model);
+    const [belongs2, child2] = await Promise.all([
+        childBelongsToParent(Related1.model, child1, step1.relationship, child2Pk, scope.childId),
+        findRecord(Related2, scope.childId, { user }).catch(() => undefined),
+    ]);
+    if (!belongs2 || !child2)
+        return null;
+    if (!await safeManagerPolicy(M2, 'canEdit', Related2, user, child1, child2))
+        return { ok: false, status: 403 };
+    const cfg = pilotiq.getConfig();
+    const base = cfg.path;
+    const resourceBase = resourceBasePath(base, resolved.R);
+    const editUrl = `${resourceBase}/${step0.recordId}/${step0.relationship}/${step1.recordId}/${step1.relationship}/${scope.childId}/edit`;
+    const managerCtx = nestedManagerCtx(base, scope, resolved);
+    const form = M2.form(Form.make(), managerCtx);
+    autoWireManagerForm(form, Related2);
+    const elements = [form];
+    tagFormActions(elements, editUrl);
+    if (scope.prefill?.values) {
+        form.withValues(scope.prefill.values);
+        if (scope.prefill.errors)
+            form.withErrors(scope.prefill.errors);
+    }
+    else if (child2 != null) {
+        const values = await applyFillPipeline(form, child2);
+        form.withValues(values);
+    }
+    const tabs = await buildNestedRelationTabs(resolved.R, resolved.M1, base, scope.chain[0], scope.chain[1].recordId, scope.chain[1].relationship, user, resolved.child1);
+    if (tabs)
+        elements.unshift(tabs);
+    const breadcrumbs = nestedRelationEditBreadcrumbs(cfg, resolved.R, resolved.M1, M2, scope.chain[0], deriveParentTitle(resolved.R, resolved.parentRecord), scope.chain[1].recordId, deriveParentTitle(Related1, child1, resolved.M1), scope.childId, deriveParentTitle(Related2, child2, M2));
+    if (breadcrumbs)
+        elements.unshift(breadcrumbs);
+    const ctx = uploadCtx(userCtx({
+        mode: 'edit',
+        basePath: base,
+        record: child2,
+        recordId: scope.childId,
+    }, user), cfg);
+    const nestedEditRoute = { resource: resolved.R, recordId: scope.childId };
+    const [panel, schemaData] = await Promise.all([
+        panelInfo(pilotiq, req, nestedEditRoute),
+        resolveSchema(elements, ctx).then(metas => applyRoleHooks(pilotiq, user, 'relation-edit', metas, nestedEditRoute)),
+    ]);
+    return {
+        ...nestedResponseEnvelope('nested-relation-edit', pilotiq, base, scope, resolved, req),
+        panel,
+        mode: 'edit',
+        childId: scope.childId,
+        schemaData,
+        ...(scope.prefill?.errors ? { hasErrors: true } : {}),
+    };
+}
+//# sourceMappingURL=relationPages.js.map