@protobase/schema 0.12.7 → 0.12.9

package/dist/access/index.d.ts

@@ -1,8 +1,9 @@
 import { AccessAction, AccessContext, AccessFn, AccessResult, AccessUser, FieldAccess, FieldRule } from "./types.js";
 import { Capability, CapabilityAction, CapabilityScope } from "./capability.js";
+import { CapabilityLimit, RoleEntry, anonymousRole } from "./role-entry.js";
 import { Rule, rule } from "./rule.js";
-import { Roles, RolesOptions, defineRoles } from "./roles.js";
+import { RoleLimit, Roles, RolesOptions, defineRoles } from "./roles.js";
 import { pickView } from "./pick-view.js";
 import { AccessSource, ResolveOptions, ResolvedAccess, RowFilterOperation, accessWarnings, checkRecord, fieldsUsedBy, resolveAccess } from "./resolve.js";
 import { restrictModel } from "./restrict.js";
-export { type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type Capability, type CapabilityAction, type CapabilityScope, type FieldAccess, type FieldRule, type ResolveOptions, type ResolvedAccess, type Roles, type RolesOptions, type RowFilterOperation, type Rule, accessWarnings, checkRecord, defineRoles, fieldsUsedBy, pickView, resolveAccess, restrictModel, rule };
+export { type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type FieldAccess, type FieldRule, type ResolveOptions, type ResolvedAccess, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type RowFilterOperation, type Rule, accessWarnings, anonymousRole, checkRecord, defineRoles, fieldsUsedBy, pickView, resolveAccess, restrictModel, rule };

package/dist/access/resolve.d.ts

@@ -1,5 +1,5 @@
 import { CheckedFilter, ResourceModel } from "../model.js";
-import { AccessAction, AccessContext, AccessFn, FieldAccess } from "./types.js";
+import { AccessAction, AccessContext, AccessFn, AccessUser, FieldAccess } from "./types.js";
 import { EvaluateOptions } from "../filter/evaluate.js";
 import "../filter/index.js";
 import { Rule } from "./rule.js";
@@ -14,10 +14,12 @@ export type ResolveOptions = {
   /**
    * The project's roles. When given, an operation without a rule is denied unless the user's
    * roles grant `<resource>.<action>` (so admin's `*` still passes). Fields without a rule
-   * follow their resource.
+   * follow their resource, within the fields the roles list for the capability. With an `anonymous` role, a caller
+   * holding only that role needs its capability even where a rule or `defaultAccess` would allow.
    */
   roles?: {
     can: (capability: any) => Rule;
+    fields?: (user: AccessUser, capability: string) => readonly string[] | undefined;
     definitions?: Record<string, unknown>;
   };
   /**

package/dist/access/resolve.js

@@ -1,6 +1,7 @@
 import { checkFilter } from "../filter/check.js";
 import { evaluateFilter } from "../filter/evaluate.js";
 import { andResults, normalize } from "./combine.js";
+import "./role-entry.js";
 //#region src/access/resolve.ts
 /** Startup warnings for risky option combinations; the caller decides how to report them. */
 const accessWarnings = (options) => options.roles && options.defaultAccess === "allow" ? ["Roles are configured but defaultAccess is \"allow\": operations without an access rule are open to every user."] : [];
@@ -11,12 +12,19 @@ const operations = [
 	"update",
 	"delete"
 ];
-const ruleFor = (source, model, operation, options) => {
-	const explicit = source.accessRules[operation] ?? (operation === "list" ? source.accessRules.read : void 0);
+const capabilityOf = (model, operation) => `${model.name}.${operation === "list" ? "read" : operation}`;
+const explicitRule = (source, operation) => source.accessRules[operation] ?? (operation === "list" ? source.accessRules.read : void 0);
+const anonymousCaller = (options, user) => {
+	const roles = user?.roles ?? [];
+	return Object.hasOwn(options.roles?.definitions ?? {}, "anonymous") && roles.length > 0 && roles.every((role) => role === "anonymous");
+};
+const ruleFor = (source, model, operation, options, anonymous = false) => {
+	const explicit = explicitRule(source, operation);
 	if (explicit) return explicit;
+	if (anonymous) return options.roles.can(capabilityOf(model, operation));
 	if (options.defaultAccess) return options.defaultAccess === "allow";
 	if (!options.roles) return true;
-	return options.roles.can(`${model.name}.${operation === "list" ? "read" : operation}`);
+	return options.roles.can(capabilityOf(model, operation));
 };
 const checked = (model, expr, operation) => {
 	const trusted = {
@@ -54,25 +62,30 @@ const resolveAccess = async (source, ctx, options = {}) => {
 	const allowed = {};
 	const recordChecks = [];
 	const filters = {};
+	const anonymous = anonymousCaller(options, ctx.user);
 	for (const operation of operations) {
 		if (operation === "list" && !source.accessRules.list) {
 			allowed.list = allowed.read;
 			if (recordChecks.includes("read")) recordChecks.push("list");
 			continue;
 		}
-		const rule = ruleFor(source, model, operation, options);
-		const decision = typeof rule === "boolean" ? rule : await decide(rule, {
+		const context = {
 			...ctx,
 			model,
 			operation
-		});
-		if (decision === "record") {
+		};
+		const rule = ruleFor(source, model, operation, options, anonymous);
+		const decision = typeof rule === "boolean" ? rule : await decide(rule, context);
+		const required = anonymous && explicitRule(source, operation) ? normalize(await options.roles.can(capabilityOf(model, operation))(context)) : true;
+		if (required === false) allowed[operation] = false;
+		else if (decision === "record") {
 			allowed[operation] = true;
 			recordChecks.push(operation);
-		} else if (typeof decision === "boolean") allowed[operation] = decision;
-		else {
-			allowed[operation] = true;
-			filters[operation] = decision;
+			if (required !== true) filters[operation] = required;
+		} else {
+			const combined = andResults(decision, required);
+			allowed[operation] = combined !== false;
+			if (typeof combined === "object") filters[operation] = combined;
 		}
 	}
 	const fieldRules = source.fieldAccess();
@@ -81,6 +94,13 @@ const resolveAccess = async (source, ctx, options = {}) => {
 		model,
 		operation
 	});
+	const listed = (operation) => options.roles?.fields?.(ctx.user, capabilityOf(model, operation));
+	const lists = {
+		read: listed("read"),
+		create: listed("create"),
+		update: listed("update")
+	};
+	const inList = (list, name) => list === void 0 || list.includes(name);
 	const names = Object.keys(model.fields);
 	const readableFields = [];
 	const writable = {
@@ -90,11 +110,11 @@ const resolveAccess = async (source, ctx, options = {}) => {
 	for (const name of names) {
 		const rules = fieldRules[name];
 		const field = model.fields[name];
-		if (allowed.list || allowed.read) {
+		if ((allowed.list || allowed.read) && inList(lists.read, name)) {
 			if (await verdict(rules?.read, fieldContext("read"), true, `The read rule of field "${name}"`)) readableFields.push(name);
 		}
 		for (const operation of ["create", "update"]) {
-			if (!allowed[operation] || field.readOnly) continue;
+			if (!allowed[operation] || field.readOnly || !inList(lists[operation], name)) continue;
 			if (await verdict(rules?.[operation], fieldContext(operation), true, `The ${operation} rule of field "${name}"`)) writable[operation].push(name);
 		}
 	}
@@ -123,7 +143,9 @@ const resolveAccess = async (source, ctx, options = {}) => {
 */
 const checkRecord = async (source, ctx, operation, record, input, options = {}) => {
 	const model = source.toModel();
-	const rule = ruleFor(source, model, operation, options);
+	const anonymous = anonymousCaller(options, ctx.user);
+	const found = ruleFor(source, model, operation, options, anonymous);
+	const rule = anonymous && explicitRule(source, operation) ? options.roles.can(capabilityOf(model, operation)).and(found) : found;
 	if (typeof rule === "boolean") return rule;
 	const result = normalize(await rule({
 		...ctx,

package/dist/access/role-entry.d.ts

@@ -0,0 +1,22 @@
+import { FilterExpr } from "../model.js";
+import { Capability } from "./capability.js";
+//#region src/access/role-entry.d.ts
+/**
+ * What a capability is limited to: the fields it allows, an allowlist (`['sku', 'price']`), a row filter in AIP-160
+ * text that is ANDed into its rows (`{ filter: 'published = true' }`), or both (`{ fields: [...], filter: '...' }`).
+ */
+export type CapabilityLimit = readonly string[] | {
+  readonly fields?: readonly string[];
+  readonly filter?: string;
+};
+/** One entry of a role: a capability, or capabilities each with its limit, `{ 'products.read': ['sku', 'price'] }`. */
+export type RoleEntry<Name extends string = string> = Capability<Name> | { readonly [C in Capability<Name>]?: CapabilityLimit; };
+/** A capability a role holds, with the fields and rows it is limited to when it has a limit. */
+export type HeldCapability = {
+  capability: string;
+  fields?: readonly string[];
+  filter?: FilterExpr;
+};
+/** Requests without a token act as this role, when the project defines it. */
+export declare const anonymousRole = "anonymous";
+//#endregion

package/dist/access/role-entry.js

@@ -0,0 +1,55 @@
+import { parseFilter } from "../filter/parse.js";
+import { parseCapability } from "./capability.js";
+//#region src/access/role-entry.ts
+/** Requests without a token act as this role, when the project defines it. */
+const anonymousRole = "anonymous";
+const fieldActions = [
+	"read",
+	"create",
+	"update"
+];
+const parsedFilter = (role, capability, text) => {
+	const parsed = parseFilter(text);
+	if (!parsed.ok || !parsed.ast) throw new Error(`Role "${role}" limits "${capability}" to an invalid filter "${text}": ${parsed.errors[0]?.message ?? "empty"}`);
+	return parsed.ast;
+};
+const limited = (role, capability, limit) => {
+	const { name, action } = parseCapability(capability);
+	const { fields, filter } = Array.isArray(limit) ? {
+		fields: limit,
+		filter: void 0
+	} : limit;
+	const unknown = Array.isArray(limit) ? [] : Object.keys(limit).filter((key) => key !== "fields" && key !== "filter");
+	if (unknown.length > 0) throw new Error(`Role "${role}" limits "${capability}" with "${unknown[0]}"; a limit has \`fields\` and \`filter\``);
+	if (fields === void 0 && filter === void 0) throw new Error(`Role "${role}" limits "${capability}" to nothing; give \`fields\`, \`filter\` or both, or the plain capability`);
+	if (name === "*") throw new Error(`Role "${role}" limits "${capability}" but fields and filters belong to one resource; name it instead of "*"`);
+	if (fields !== void 0 && !fieldActions.includes(action)) throw new Error(`Role "${role}" lists fields for "${capability}"; fields apply to ${fieldActions.join(", ")}`);
+	return {
+		capability,
+		...fields !== void 0 && { fields: [...fields] },
+		...filter !== void 0 && { filter: parsedFilter(role, capability, filter) }
+	};
+};
+const checkAnonymous = (held) => {
+	for (const { capability, fields } of held) {
+		const { name, action, scope } = parseCapability(capability);
+		if (action !== "read") throw new Error(`The anonymous role may only read, but it grants "${capability}"`);
+		if (name === "*") throw new Error(`The anonymous role must name each resource it reads, not "${capability}"`);
+		if (scope !== void 0) throw new Error(`The anonymous role grants "${capability}", but an anonymous caller owns no rows`);
+		if (!fields) throw new Error(`The anonymous role must list the fields it reads: { '${capability}': ['name', ...] }`);
+	}
+};
+/** A role's entries as the capabilities it holds; throws on anything that is not a capability or a valid limit. */
+const heldCapabilities = (role, entries) => {
+	const held = entries.flatMap((entry) => {
+		if (typeof entry === "string") {
+			parseCapability(entry);
+			return [{ capability: entry }];
+		}
+		return Object.entries(entry).map(([capability, limit]) => limited(role, capability, limit));
+	});
+	if (role === "anonymous") checkAnonymous(held);
+	return held;
+};
+//#endregion
+export { anonymousRole, heldCapabilities };

package/dist/access/roles.d.ts

@@ -1,5 +1,6 @@
 import { AccessUser } from "./types.js";
 import { Capability, Grant } from "./capability.js";
+import { HeldCapability, RoleEntry } from "./role-entry.js";
 import { Rule } from "./rule.js";
 //#region src/access/roles.d.ts
 export type RolesOptions = {
@@ -8,19 +9,34 @@ export type RolesOptions = {
   /** Resource and area names; when given, unknown names in capabilities throw at definition. */
   names?: readonly string[];
 };
+/** A capability of a role that is limited to fields or rows; the server checks them against the resources at startup. */
+export type RoleLimit = HeldCapability & {
+  role: string;
+};
 /**
  * Defines roles as bundles of capability strings. Pass the resource and area names as the type
  * parameter to reject unknown names at compile time:
  * `defineRoles<'orders' | 'costs'>({ sales: ['orders.read.own'] })`.
+ *
+ * An entry may limit capabilities to fields (an allowlist) and rows (an AIP-160 filter):
+ * `{ 'products.read': ['sku', 'price'] }`, `{ 'products.read': { fields: ['name'], filter: 'published = true' } }`.
+ * The role `anonymous`, when defined, is what requests without a token act as; it may only read listed fields.
  */
-export declare const defineRoles: <Name extends string = string>(definitions: Record<string, readonly Capability<Name>[]>, options?: RolesOptions) => {
-  definitions: Record<string, readonly Capability<Name>[]>;
+export declare const defineRoles: <Name extends string = string>(definitions: Record<string, readonly RoleEntry<Name>[]>, options?: RolesOptions) => {
+  definitions: Record<string, readonly RoleEntry<Name>[]>;
   grants: (user: AccessUser, capability: string) => Set<Grant>;
+  /** The capabilities limited to fields or rows, by role. */
+  limits: RoleLimit[];
   /** Whether the user holds the capability at all, in any scope. For areas and field rules. */
   has: (user: AccessUser, capability: Capability<Name>) => boolean;
+  /**
+   * The fields the user's roles allow for a capability: the union of their lists, or `undefined` when a role grants
+   * it without a list (every field) or none grants it.
+   */
+  fields: (user: AccessUser, capability: string) => readonly string[] | undefined;
   /**
    * A rule that allows when the user's roles grant the capability: `true` for an unscoped
-   * grant, a row filter for `.own` and `.team`, `false` otherwise.
+   * grant, a row filter for `.own`, `.team` and a limit's filter, `false` otherwise.
    */
   can: (capability: Capability<Name>) => Rule;
   /** A rule that allows when the user has any of the roles. */

package/dist/access/roles.js

@@ -1,5 +1,6 @@
-import { orResults, where } from "./combine.js";
+import { andResults, orResults, where } from "./combine.js";
 import { grantsOf, parseCapability } from "./capability.js";
+import { heldCapabilities } from "./role-entry.js";
 import { rule } from "./rule.js";
 //#region src/access/roles.ts
 const rolesOf = (user) => user.roles ?? [];
@@ -7,17 +8,22 @@ const rolesOf = (user) => user.roles ?? [];
 * Defines roles as bundles of capability strings. Pass the resource and area names as the type
 * parameter to reject unknown names at compile time:
 * `defineRoles<'orders' | 'costs'>({ sales: ['orders.read.own'] })`.
+*
+* An entry may limit capabilities to fields (an allowlist) and rows (an AIP-160 filter):
+* `{ 'products.read': ['sku', 'price'] }`, `{ 'products.read': { fields: ['name'], filter: 'published = true' } }`.
+* The role `anonymous`, when defined, is what requests without a token act as; it may only read listed fields.
 */
 const defineRoles = (definitions, options = {}) => {
-	for (const [role, capabilities] of Object.entries(definitions)) for (const capability of capabilities) {
+	const held = new Map(Object.entries(definitions).map(([role, entries]) => [role, heldCapabilities(role, entries)]));
+	for (const [role, capabilities] of held) for (const { capability } of capabilities) {
 		const { name } = parseCapability(capability);
 		if (options.names && name !== "*" && !options.names.includes(name)) throw new Error(`Role "${role}" grants "${capability}" but "${name}" is not a known resource or area`);
 	}
+	const heldBy = (user) => rolesOf(user).flatMap((role) => held.get(role) ?? []);
 	/** Scopes granted by the user's roles for a capability, without applying them. */
 	const grants = (user, capability) => {
 		const wanted = parseCapability(capability);
-		const held = rolesOf(user).flatMap((role) => definitions[role] ?? []);
-		return new Set(held.flatMap((capability) => grantsOf(capability, wanted)));
+		return new Set(heldBy(user).flatMap((held) => grantsOf(held.capability, wanted)));
 	};
 	const scoped = async (ctx, scope, capability) => {
 		const owner = ctx.model?.owner;
@@ -30,18 +36,43 @@ const defineRoles = (definitions, options = {}) => {
 	return {
 		definitions,
 		grants,
+		/** The capabilities limited to fields or rows, by role. */
+		limits: [...held].flatMap(([role, capabilities]) => capabilities.filter((held) => held.fields || held.filter).map((held) => ({
+			role,
+			...held
+		}))),
 		/** Whether the user holds the capability at all, in any scope. For areas and field rules. */
 		has: (user, capability) => grants(user, capability).size > 0,
 		/**
+		* The fields the user's roles allow for a capability: the union of their lists, or `undefined` when a role grants
+		* it without a list (every field) or none grants it.
+		*/
+		fields: (user, capability) => {
+			const wanted = parseCapability(capability);
+			const matching = heldBy(user).filter((held) => grantsOf(held.capability, wanted).length > 0);
+			if (matching.length === 0 || matching.some((held) => !held.fields)) return void 0;
+			return [...new Set(matching.flatMap((held) => held.fields))];
+		},
+		/**
 		* A rule that allows when the user's roles grant the capability: `true` for an unscoped
-		* grant, a row filter for `.own` and `.team`, `false` otherwise.
+		* grant, a row filter for `.own`, `.team` and a limit's filter, `false` otherwise.
 		*/
 		can: (capability) => {
-			parseCapability(capability);
+			const wanted = parseCapability(capability);
 			return rule(async (ctx) => {
-				const held = grants(ctx.user ?? {}, capability);
-				if (held.has("all")) return true;
-				return (await Promise.all([...held].map((scope) => scoped(ctx, scope, capability)))).reduce((result, filter) => orResults(result, filter), false);
+				const matching = heldBy(ctx.user ?? {}).flatMap((held) => grantsOf(held.capability, wanted).map((grant) => ({
+					grant,
+					filter: held.filter
+				})));
+				if (matching.some(({ grant, filter }) => grant === "all" && !filter)) return true;
+				const unfiltered = [...new Set(matching.filter(({ filter }) => !filter).map(({ grant }) => grant))].map((grant) => ({
+					grant,
+					filter: void 0
+				}));
+				return (await Promise.all([...unfiltered, ...matching.filter(({ filter }) => filter)].map(async ({ grant, filter }) => {
+					const rows = grant === "all" ? true : await scoped(ctx, grant, capability);
+					return filter ? andResults(rows, filter) : rows;
+				}))).reduce((result, filter) => orResults(result, filter), false);
 			});
 		},
 		/** A rule that allows when the user has any of the roles. */

package/dist/index.d.ts

@@ -34,8 +34,9 @@ import { OrderByCheck, OrderByParse, checkOrderBy, parseOrderBy, printOrderBy }
 import { createWhere, where } from "./filter/where.js";
 import "./filter/index.js";
 import { Capability, CapabilityAction, CapabilityScope } from "./access/capability.js";
+import { CapabilityLimit, RoleEntry, anonymousRole } from "./access/role-entry.js";
 import { Rule, rule } from "./access/rule.js";
-import { Roles, RolesOptions, defineRoles } from "./access/roles.js";
+import { RoleLimit, Roles, RolesOptions, defineRoles } from "./access/roles.js";
 import { pickView } from "./access/pick-view.js";
 import { AccessSource, ResolveOptions, ResolvedAccess, RowFilterOperation, accessWarnings, checkRecord, fieldsUsedBy, resolveAccess } from "./access/resolve.js";
 import { restrictModel } from "./access/restrict.js";
@@ -43,4 +44,4 @@ import "./access/index.js";
 import { AssistantAction, AssistantActionRequest, AssistantCardPart, AssistantDiff, AssistantEvent, AssistantMessage, AssistantMessageRequest, AssistantPart, AssistantState, AssistantStep, AssistantStepState, AssistantTablePart, AssistantTextPart, AssistantTone, AssistantWidgetPart } from "./assistant/protocol.js";
 import { applyAssistantEvent, emptyAssistantState } from "./assistant/apply-event.js";
 import { readEventStream } from "./assistant/event-stream.js";
-export { type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionModel, type ActionRun, type AddressCheck, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type Capability, type CapabilityAction, type CapabilityScope, type ChartGranularity, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CompareOp, type ComponentRef, type CustomSectionModel, type DatePreset, type DurationLiteral, type DurationUnit, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type Field, type FieldAccess, type FieldFormat, type FieldModel, type FieldPath, type FieldRefValue, type FieldRule, type FieldType, type FieldViewModel, type FieldWidgetModel, type FileField, type FileFieldModel, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type InferRecord, type JsonValue, type KeyType, type KeyValue, type LayoutItemModel, type ListDisplayModel, type ListModel, type ListQuery, type Literal, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type PluginHost, type PluginRequirement, type PropShapes, type RecordKey, type RefShape, type RelatedModel, type ResolveOptions, type ResolvedAccess, type ResourceModel, type Roles, type RolesOptions, type RowFilterOperation, type Rule, type SaveFeedback, type SearchMatch, type SearchResultModel, type SearchTerm, type SortSpec, type Span, type StatusTone, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type ViewModel, type ViewProps, accessWarnings, addressErrors, addressPlaceholders, addressWords, appHrefError, appPath, applyAssistantEvent, bottomBar, bottomBarErrors, bottomBarFor, checkEventFilter, checkFilter, checkOrderBy, checkRecord, checkedAccept, checkedProvider, createWhere, decodeKey, defaultRecentLimit, defineRoles, displayFields, emptyAssistantState, encodeKey, enumLabel, evaluateFilter, f, fieldRef, fieldRefsIn, fieldsUsedBy, fillAddress, hrefPlaceholders, inRange, isFieldRef, keyTypes, layout as l, leavesApp, markFieldRefs, matchedSearchField, matchesSearch, maxBottomBarItems, navRecentErrors, parseFilter, parseOrderBy, parseSize, pickView, pluginProblem, printFilter, printOrderBy, pruneByShape, readAppPath, readEventStream, redactSecrets, resolveAccess, resource, restrictModel, rule, searchTerms, shapes, statusTones, tableDisplay, termMatches, unmarkFieldRefs, userMenu, view, webhookResources, where };
+export { type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionModel, type ActionRun, type AddressCheck, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type ChartGranularity, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CompareOp, type ComponentRef, type CustomSectionModel, type DatePreset, type DurationLiteral, type DurationUnit, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type Field, type FieldAccess, type FieldFormat, type FieldModel, type FieldPath, type FieldRefValue, type FieldRule, type FieldType, type FieldViewModel, type FieldWidgetModel, type FileField, type FileFieldModel, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type InferRecord, type JsonValue, type KeyType, type KeyValue, type LayoutItemModel, type ListDisplayModel, type ListModel, type ListQuery, type Literal, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type PluginHost, type PluginRequirement, type PropShapes, type RecordKey, type RefShape, type RelatedModel, type ResolveOptions, type ResolvedAccess, type ResourceModel, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type RowFilterOperation, type Rule, type SaveFeedback, type SearchMatch, type SearchResultModel, type SearchTerm, type SortSpec, type Span, type StatusTone, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type ViewModel, type ViewProps, accessWarnings, addressErrors, addressPlaceholders, addressWords, anonymousRole, appHrefError, appPath, applyAssistantEvent, bottomBar, bottomBarErrors, bottomBarFor, checkEventFilter, checkFilter, checkOrderBy, checkRecord, checkedAccept, checkedProvider, createWhere, decodeKey, defaultRecentLimit, defineRoles, displayFields, emptyAssistantState, encodeKey, enumLabel, evaluateFilter, f, fieldRef, fieldRefsIn, fieldsUsedBy, fillAddress, hrefPlaceholders, inRange, isFieldRef, keyTypes, layout as l, leavesApp, markFieldRefs, matchedSearchField, matchesSearch, maxBottomBarItems, navRecentErrors, parseFilter, parseOrderBy, parseSize, pickView, pluginProblem, printFilter, printOrderBy, pruneByShape, readAppPath, readEventStream, redactSecrets, resolveAccess, resource, restrictModel, rule, searchTerms, shapes, statusTones, tableDisplay, termMatches, unmarkFieldRefs, userMenu, view, webhookResources, where };

package/dist/index.js

@@ -6,6 +6,7 @@ import { evaluateFilter } from "./filter/evaluate.js";
 import { printFilter } from "./filter/print.js";
 import { checkOrderBy, parseOrderBy, printOrderBy } from "./filter/order-by.js";
 import { createWhere, where } from "./filter/where.js";
+import { anonymousRole } from "./access/role-entry.js";
 import { accessWarnings, checkRecord, fieldsUsedBy, resolveAccess } from "./access/resolve.js";
 import { checkEventFilter } from "./events/event-models.js";
 import { resource } from "./resource.js";
@@ -33,4 +34,4 @@ import { pickView } from "./access/pick-view.js";
 import { restrictModel } from "./access/restrict.js";
 import { applyAssistantEvent, emptyAssistantState } from "./assistant/apply-event.js";
 import { readEventStream } from "./assistant/event-stream.js";
-export { accessWarnings, addressErrors, addressPlaceholders, addressWords, appHrefError, appPath, applyAssistantEvent, bottomBar, bottomBarErrors, bottomBarFor, checkEventFilter, checkFilter, checkOrderBy, checkRecord, checkedAccept, checkedProvider, createWhere, decodeKey, defaultRecentLimit, defineRoles, displayFields, emptyAssistantState, encodeKey, enumLabel, evaluateFilter, f, fieldRef, fieldRefsIn, fieldsUsedBy, fillAddress, hrefPlaceholders, inRange, isFieldRef, keyTypes, layout as l, leavesApp, markFieldRefs, matchedSearchField, matchesSearch, maxBottomBarItems, navRecentErrors, parseFilter, parseOrderBy, parseSize, pickView, pluginProblem, printFilter, printOrderBy, pruneByShape, readAppPath, readEventStream, redactSecrets, resolveAccess, resource, restrictModel, rule, searchTerms, shapes, statusTones, tableDisplay, termMatches, unmarkFieldRefs, userMenu, view, webhookResources, where };
+export { accessWarnings, addressErrors, addressPlaceholders, addressWords, anonymousRole, appHrefError, appPath, applyAssistantEvent, bottomBar, bottomBarErrors, bottomBarFor, checkEventFilter, checkFilter, checkOrderBy, checkRecord, checkedAccept, checkedProvider, createWhere, decodeKey, defaultRecentLimit, defineRoles, displayFields, emptyAssistantState, encodeKey, enumLabel, evaluateFilter, f, fieldRef, fieldRefsIn, fieldsUsedBy, fillAddress, hrefPlaceholders, inRange, isFieldRef, keyTypes, layout as l, leavesApp, markFieldRefs, matchedSearchField, matchesSearch, maxBottomBarItems, navRecentErrors, parseFilter, parseOrderBy, parseSize, pickView, pluginProblem, printFilter, printOrderBy, pruneByShape, readAppPath, readEventStream, redactSecrets, resolveAccess, resource, restrictModel, rule, searchTerms, shapes, statusTones, tableDisplay, termMatches, unmarkFieldRefs, userMenu, view, webhookResources, where };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/schema",
-  "version": "0.12.7",
+  "version": "0.12.9",
   "description": "Resource, field, view and access definitions for Protobase configs.",
   "license": "Apache-2.0",
   "repository": {