@protobase/schema 0.46.8 → 0.46.9

package/dist/computed/computed-reveal.d.ts

@@ -0,0 +1,28 @@
+import { AccessUser, FieldRule } from "../access/types.js";
+//#region src/computed/computed-reveal.d.ts
+/** Who asks for a computed reveal: the user, and with organizations the one the request works in. */
+export type RevealCaller = {
+  /** The user, with the roles they act with. */
+  user: AccessUser;
+  /** With organizations, the one the request works in. */
+  organization?: {
+    /** The organization's id. */
+    id: string | number;
+  };
+};
+/**
+ * A value revealed like a sensitive field, but made when it is asked for instead of read from a column, such as a
+ * secret another service keeps (`.reveals()`).
+ */
+export type ComputedReveal<R> = {
+  /** The value, from the record as the caller may read it, without its sensitive fields; `null` reveals nothing. */
+  value: (record: R, caller: RevealCaller) => unknown;
+  /** Who may reveal it, among those who may read the record: a role rule, as a field's read rule is. Default: all of them. */
+  read?: FieldRule;
+  /** Revealing it needs a strong sign-in this recent, as the field option `.strongSignIn()` does; `minutes` is 15 by default. */
+  strongSignIn?: {
+    /** The most minutes since the sign-in, or its confirmation, proved a passkey or a second step. */
+    minutes?: number;
+  };
+};
+//#endregion

package/dist/field.d.ts

@@ -35,6 +35,11 @@ export type FieldMeta = {
   sensitive?: boolean;
   /** Whether it is stored encrypted, and so sensitive too (`.encrypted()`). */
   encrypted?: boolean;
+  /** How recent a strong sign-in its reveal needs, and so sensitive too (`.strongSignIn()`). */
+  strongSignIn?: {
+    /** The most minutes since the sign-in, or its confirmation, proved a passkey or a second step. */
+    minutes: number;
+  };
   /** An enum's values (`f.enum()`). */
   enumValues?: string[];
   /** A relation's resource and the columns that hold its key (`f.relation()`, `.columns()`). */
@@ -121,6 +126,15 @@ export declare class Field<V> {
    * [Encrypted fields](website/src/content/docs/reference/data-config.mdx#encrypted-fields).
    */
   encrypted(): Field<V | Encrypted>;
+  /**
+   * Revealing it needs a strong sign-in: one that proved a passkey or a second step, made or confirmed in the last
+   * `minutes` (15 by default). Otherwise the reveal is refused with `403 strong-sign-in-required`, and the record page
+   * asks the person to confirm it's them first. It is sensitive too. See
+   * [Recent strong sign-in](website/src/content/docs/reference/data-config.mdx#recent-strong-sign-in).
+   */
+  strongSignIn(o?: {
+    minutes?: number;
+  }): Field<V>;
   /** The database supplies a value when none is given (identity, now(), ...). */
   dbDefault(): Field<V>;
   /** Other names filters may use for the field. */

package/dist/field.js

@@ -69,6 +69,20 @@ var Field = class Field {
 			sensitive: true
 		});
 	}
+	/**
+	* Revealing it needs a strong sign-in: one that proved a passkey or a second step, made or confirmed in the last
+	* `minutes` (15 by default). Otherwise the reveal is refused with `403 strong-sign-in-required`, and the record page
+	* asks the person to confirm it's them first. It is sensitive too. See
+	* [Recent strong sign-in](website/src/content/docs/reference/data-config.mdx#recent-strong-sign-in).
+	*/
+	strongSignIn(o = {}) {
+		const minutes = o.minutes ?? 15;
+		if (!Number.isInteger(minutes) || minutes < 1) throw new Error(".strongSignIn(): minutes must be a whole number of at least 1");
+		return this.with({
+			strongSignIn: { minutes },
+			sensitive: true
+		});
+	}
 	/** The database supplies a value when none is given (identity, now(), ...). */
 	dbDefault() {
 		return this.with({ dbDefault: true });

package/dist/index.d.ts

@@ -7,6 +7,7 @@ import { AnyField, Constraint, Field, FieldMeta, FieldTypeDef } from "./field.js
 import { RelationField } from "./relation-field.js";
 import { FileField } from "./file-field.js";
 import { f } from "./fields.js";
+import { ComputedReveal, RevealCaller } from "./computed/computed-reveal.js";
 import { FieldRefs, FieldsInput, Ref, Refs } from "./refs.js";
 import { CreatedOptions, DeletedOptions, EventActor, EventContext, EventHelpers, EventMatch, EventSpec, UndeletedOptions, UpdatedOptions } from "./events/event-helpers.js";
 import { Access, InferRecord, Issue, KeyOf, KeyRefs, RecordKey, RecordOf } from "./resource-types.js";
@@ -45,4 +46,4 @@ import { AccessSource, ResolveOptions, ResolvedAccess, RowFilterOperation, acces
 import { restrictModel } from "./access/restrict.js";
 import "./access/index.js";
 import { AssistantAction, AssistantActionRequest, AssistantCardPart, AssistantDiff, AssistantEvent, AssistantMessage, AssistantMessageRequest, AssistantPart, AssistantState, AssistantStep, AssistantStepState, AssistantTablePart, AssistantTextPart, AssistantTone, AssistantWidgetPart } from "./assistant/protocol.js";
-export { type Access, type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionInputKind, type ActionInputModel, type ActionModel, type ActionRun, type AnyField, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BadgeShape, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type CalendarView, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type CardFavoriteModel, type CardPhotosModel, type ChartGranularity, type ChartInput, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CommentsSectionModel, type CompareOp, type ComponentRef, type ConnectAddress, type Constraint, type CreateModel, type CreatedOptions, type CustomSectionModel, type DatePreset, type DeletedOptions, type DurationLiteral, type DurationUnit, type Encrypted, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type ExactCapability, type ExportModel, type Field, type FieldAccess, type FieldFormat, type FieldMeta, type FieldModel, type FieldPath, type FieldRefValue, type FieldRefs, type FieldRule, type FieldType, type FieldTypeDef, type FieldView, type FieldViewModel, type FieldViews, type FieldWidgetModel, type FieldsInput, type FileField, type FileFieldModel, type FileOptions, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type FormAddress, type FormInput, type FormModel, type GalleryModel, type Grant, type GroupChartInput, type GroupChartModel, type GroupItemModel, type GroupModel, type HeldCapability, type HelpWhen, type HistorySectionModel, type ImageFormat, type ImageVariant, type ImageVariantOptions, type InferRecord, type Issue, type JsonValue, type KeyOf, type KeyRefs, type KeyType, type KeyValue, type LayoutItemModel, type ListColumn, type ListDisplayModel, type ListDragModel, type ListModel, type ListQuery, type Literal, type MapSectionModel, type MapView, type NamedListModel, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type ParentAccess, type ParentModel, type PeriodChartInput, type PeriodChartModel, type PositionAfterModel, type RecordChartModel, type RecordChartRange, type RecordKey, type RecordMode, type RecordOf, type RecordWhen, type Ref, type Refs, type RelatedColumnModel, type RelatedModel, type RelatedPresentation, type RelationField, type ResolveOptions, type ResolvedAccess, type ResourceBuilder, type ResourceModel, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type Rollup, type RollupCount, type RollupFn, type RollupSource, type RollupValue, type RowFilterOperation, type Rule, type SaveFeedback, type SaveSearchModel, type SearchMatch, type SearchRef, type SearchRefs, type SearchResultModel, type SearchesOfModel, type SectionModel, type SectionPresentation, type ShowWhen, type SignInAddress, type SignInPromptModel, type SignInStep, type SignInViewModel, type SortSpec, type Span, type StatusTone, type TabItemModel, type TabModel, type TenantOptions, type TimelineView, type UndeletedOptions, type UpdatedOptions, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type Validator, type ViewBuilder, type ViewModel, type ViewProps, accessWarnings, addressWords, anonymousRole, appPath, bottomBar, bottomBarErrors, checkFilter, checkOrderBy, checkRecord, connectParams, connectPath, connectRoute, createWhere, defineRoles, encrypted, enumLabel, evaluateFilter, f, fieldRef, fieldsUsedBy, fitsKeyType, formPath, formRoute, imageFormats, isRecordCondition, keyTypes, layout as l, maxBottomBarItems, parseFilter, parseOrderBy, pickView, printFilter, printOrderBy, readAppPath, readConnectAddress, readFormAddress, readSignInAddress, resolveAccess, resource, restrictModel, rule, signInParams, signInPath, signInRoute, signInSteps, userMenu, view, where };
+export { type Access, type AccessAction, type AccessContext, type AccessFn, type AccessResult, type AccessSource, type AccessUser, type ActionInputKind, type ActionInputModel, type ActionModel, type ActionRun, type AnyField, type AppAddress, type AssistantAction, type AssistantActionRequest, type AssistantCardPart, type AssistantDiff, type AssistantEvent, type AssistantMessage, type AssistantMessageRequest, type AssistantPart, type AssistantState, type AssistantStep, type AssistantStepState, type AssistantTablePart, type AssistantTextPart, type AssistantTone, type AssistantWidgetPart, type BadgeShape, type BottomBarItemModel, type BottomBarModel, type BottomBarNames, type BottomBarSource, type CalendarView, type Capability, type CapabilityAction, type CapabilityLimit, type CapabilityScope, type CardFavoriteModel, type CardPhotosModel, type ChartGranularity, type ChartInput, type ChartModel, type ChartRange, type CheckResult, type CheckedFilter, type CommentsSectionModel, type CompareOp, type ComponentRef, type ComputedReveal, type ConnectAddress, type Constraint, type CreateModel, type CreatedOptions, type CustomSectionModel, type DatePreset, type DeletedOptions, type DurationLiteral, type DurationUnit, type Encrypted, type EvaluateOptions, type EventActor, type EventContext, type EventHelpers, type EventMatch, type EventModel, type EventOperation, type EventSpec, type ExactCapability, type ExportModel, type Field, type FieldAccess, type FieldFormat, type FieldMeta, type FieldModel, type FieldPath, type FieldRefValue, type FieldRefs, type FieldRule, type FieldType, type FieldTypeDef, type FieldView, type FieldViewModel, type FieldViews, type FieldWidgetModel, type FieldsInput, type FileField, type FileFieldModel, type FileOptions, type FileProcessor, type FileProcessorInput, type FilterError, type FilterErrorCode, type FilterExpr, type FilterLayout, type FilterLimits, type FilterOf, type FilterParse, type FilterValue, type FilterWidgetModel, type FormAddress, type FormInput, type FormModel, type GalleryModel, type Grant, type GroupChartInput, type GroupChartModel, type GroupItemModel, type GroupModel, type HeldCapability, type HelpWhen, type HistorySectionModel, type ImageFormat, type ImageVariant, type ImageVariantOptions, type InferRecord, type Issue, type JsonValue, type KeyOf, type KeyRefs, type KeyType, type KeyValue, type LayoutItemModel, type ListColumn, type ListDisplayModel, type ListDragModel, type ListModel, type ListQuery, type Literal, type MapSectionModel, type MapView, type NamedListModel, type NavModel, type NavRecentModel, type NowValue, type OrderByCheck, type OrderByItem, type OrderByParse, type ParentAccess, type ParentModel, type PeriodChartInput, type PeriodChartModel, type PositionAfterModel, type RecordChartModel, type RecordChartRange, type RecordKey, type RecordMode, type RecordOf, type RecordWhen, type Ref, type Refs, type RelatedColumnModel, type RelatedModel, type RelatedPresentation, type RelationField, type ResolveOptions, type ResolvedAccess, type ResourceBuilder, type ResourceModel, type RevealCaller, type RoleEntry, type RoleLimit, type Roles, type RolesOptions, type Rollup, type RollupCount, type RollupFn, type RollupSource, type RollupValue, type RowFilterOperation, type Rule, type SaveFeedback, type SaveSearchModel, type SearchMatch, type SearchRef, type SearchRefs, type SearchResultModel, type SearchesOfModel, type SectionModel, type SectionPresentation, type ShowWhen, type SignInAddress, type SignInPromptModel, type SignInStep, type SignInViewModel, type SortSpec, type Span, type StatusTone, type TabItemModel, type TabModel, type TenantOptions, type TimelineView, type UndeletedOptions, type UpdatedOptions, type UserMenuItemModel, type UserMenuModel, type UserMenuSource, type Validator, type ViewBuilder, type ViewModel, type ViewProps, accessWarnings, addressWords, anonymousRole, appPath, bottomBar, bottomBarErrors, checkFilter, checkOrderBy, checkRecord, connectParams, connectPath, connectRoute, createWhere, defineRoles, encrypted, enumLabel, evaluateFilter, f, fieldRef, fieldsUsedBy, fitsKeyType, formPath, formRoute, imageFormats, isRecordCondition, keyTypes, layout as l, maxBottomBarItems, parseFilter, parseOrderBy, pickView, printFilter, printOrderBy, readAppPath, readConnectAddress, readFormAddress, readSignInAddress, resolveAccess, resource, restrictModel, rule, signInParams, signInPath, signInRoute, signInSteps, userMenu, view, where };

package/dist/model.d.ts

@@ -37,6 +37,11 @@ export type FieldModel = {
   sensitive?: true;
   /** Stored encrypted, and sensitive too (`.encrypted()`). */
   encrypted?: true;
+  /** Its reveal needs a strong sign-in this recent, and it is sensitive too (`.strongSignIn()`). */
+  strongSignIn?: {
+    /** The most minutes since the sign-in, or its confirmation, proved a passkey or a second step. */
+    minutes: number;
+  };
   /**
    * In `/meta` only: the caller may write the field but not read it, as its own `.access()` write rule allows. It comes
    * sensitive, with no value to reveal, and the form edits it only where the view's layout names it.

package/dist/resource-model.js

@@ -29,6 +29,7 @@ const fieldModel = (name, field) => {
 		...meta.dbDefault && !meta.hasDefault && { default: { db: true } },
 		...meta.sensitive && { sensitive: true },
 		...meta.encrypted && { encrypted: true },
+		...meta.strongSignIn && { strongSignIn: { minutes: meta.strongSignIn.minutes } },
 		...meta.enumValues && { enumValues: [...meta.enumValues] },
 		...meta.relation && { relation: {
 			resource: meta.relation.resource,

package/dist/resource.d.ts

@@ -1,5 +1,6 @@
 import { ParentAccess, PositionAfterModel, ResourceModel, SearchMatch } from "./model.js";
 import { FieldAccess } from "./access/types.js";
+import { ComputedReveal } from "./computed/computed-reveal.js";
 import { FieldRefs, FieldsInput, Ref } from "./refs.js";
 import { EventHelpers, EventMatch, EventSpec } from "./events/event-helpers.js";
 import { ResourceState } from "./resource-model.js";
@@ -38,6 +39,8 @@ export declare class ResourceBuilder<F extends FieldsInput = {}, K = never> {
   readonly validators: readonly Validator<F>[];
   /** @internal */
   readonly accessRules: Access<F>;
+  /** @internal */
+  readonly computedReveals: Readonly<Record<string, ComputedReveal<RecordOf<F>>>>;
   /** The fields, for the compiler only, which {@link InferRecord} reads; never set. */
   readonly $fields: F;
   /** The fields of the key, for the compiler only, which {@link RecordKey} reads; never set. */
@@ -49,7 +52,9 @@ export declare class ResourceBuilder<F extends FieldsInput = {}, K = never> {
   /** @internal */
   validators?: readonly Validator<F>[],
   /** @internal */
-  accessRules?: Access<F>);
+  accessRules?: Access<F>,
+  /** @internal */
+  computedReveals?: Readonly<Record<string, ComputedReveal<RecordOf<F>>>>);
   /** The table, with or without its schema: `'shop.repairs'` or `'repairs'`. Required. */
   table(table: string): ResourceBuilder<F, K>;
   /**
@@ -168,6 +173,19 @@ export declare class ResourceBuilder<F extends FieldsInput = {}, K = never> {
    * ```
    */
   access(rules: Access<F>): ResourceBuilder<F, K>;
+  /**
+   * Values revealed like sensitive fields, by name, but made when one is asked for instead of read from a column: a
+   * secret another service keeps, or a file of settings built from several. `POST /{resource}/{key}:reveal` with
+   * `{ "field": "<name>" }` answers one for a caller who may read the record, after the same audit event as a field's
+   * reveal. Each call adds names, which no field may have. See
+   * [Computed reveals](website/src/content/docs/reference/data-config.mdx#computed-reveals).
+   *
+   * @example
+   * ```ts
+   * .reveals({ env: { value: (app) => secrets.envFile(app.id), read: roles.is('owner'), strongSignIn: { minutes: 15 } } })
+   * ```
+   */
+  reveals(reveals: Record<string, ComputedReveal<RecordOf<F>>>): ResourceBuilder<F, K>;
   /** Role-based rules per field, for fields that declared `.access(...)`. */
   fieldAccess(): Record<string, FieldAccess>;
   /** The resource as the server and the app read it. Throws when the table, fields or key are missing, or a field option conflicts with another. */

package/dist/resource.js

@@ -12,11 +12,13 @@ var ResourceBuilder = class ResourceBuilder {
 	state;
 	validators;
 	accessRules;
+	computedReveals;
 	/** @internal */
-	constructor(state, validators = [], accessRules = {}) {
+	constructor(state, validators = [], accessRules = {}, computedReveals = {}) {
 		this.state = state;
 		this.validators = validators;
 		this.accessRules = accessRules;
+		this.computedReveals = computedReveals;
 	}
 	/** The table, with or without its schema: `'shop.repairs'` or `'repairs'`. Required. */
 	table(table) {
@@ -39,7 +41,7 @@ var ResourceBuilder = class ResourceBuilder {
 		return new ResourceBuilder({
 			...this.state,
 			primaryKey: refs.map((ref) => ref.name)
-		}, this.validators, this.accessRules);
+		}, this.validators, this.accessRules, this.computedReveals);
 	}
 	/**
 	* A nullable timestamp or date that marks a record deleted: deleting sets it, lists leave such rows out and
@@ -176,7 +178,7 @@ var ResourceBuilder = class ResourceBuilder {
 	* ```
 	*/
 	validate(validator) {
-		return new ResourceBuilder(this.state, [...this.validators, validator], this.accessRules);
+		return new ResourceBuilder(this.state, [...this.validators, validator], this.accessRules, this.computedReveals);
 	}
 	/**
 	* Rules per operation (`list`, `read`, `create`, `update`, `delete`). A rule returns `true`, `false`, or a filter that
@@ -196,6 +198,29 @@ var ResourceBuilder = class ResourceBuilder {
 		return new ResourceBuilder(this.state, this.validators, {
 			...this.accessRules,
 			...rules
+		}, this.computedReveals);
+	}
+	/**
+	* Values revealed like sensitive fields, by name, but made when one is asked for instead of read from a column: a
+	* secret another service keeps, or a file of settings built from several. `POST /{resource}/{key}:reveal` with
+	* `{ "field": "<name>" }` answers one for a caller who may read the record, after the same audit event as a field's
+	* reveal. Each call adds names, which no field may have. See
+	* [Computed reveals](website/src/content/docs/reference/data-config.mdx#computed-reveals).
+	*
+	* @example
+	* ```ts
+	* .reveals({ env: { value: (app) => secrets.envFile(app.id), read: roles.is('owner'), strongSignIn: { minutes: 15 } } })
+	* ```
+	*/
+	reveals(reveals) {
+		for (const [name, reveal] of Object.entries(reveals)) {
+			if (Object.hasOwn(this.state.fields ?? {}, name)) throw new Error(`Resource "${this.state.name}": the reveal "${name}" has the name of a field`);
+			const minutes = reveal.strongSignIn?.minutes;
+			if (minutes !== void 0 && (!Number.isInteger(minutes) || minutes < 1)) throw new Error(`Resource "${this.state.name}": the reveal "${name}" needs minutes of at least 1`);
+		}
+		return new ResourceBuilder(this.state, this.validators, this.accessRules, {
+			...this.computedReveals,
+			...reveals
 		});
 	}
 	/** Role-based rules per field, for fields that declared `.access(...)`. */
@@ -225,7 +250,7 @@ var ResourceBuilder = class ResourceBuilder {
 		return new ResourceBuilder({
 			...this.state,
 			...patch
-		}, this.validators, this.accessRules);
+		}, this.validators, this.accessRules, this.computedReveals);
 	}
 };
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/schema",
-  "version": "0.46.8",
+  "version": "0.46.9",
   "description": "Resource, field, view and access definitions for Protobase configs.",
   "license": "Apache-2.0",
   "repository": {