@protobase/schema 0.53.4 → 0.53.6

package/dist/access/resolve.js

@@ -124,7 +124,7 @@ const resolveAccess = async (source, ctx, options = {}) => {
 			if (await verdict(rules?.read, fieldContext("read"), true, `The read rule of field "${name}"`)) readableFields.push(name);
 		}
 		for (const operation of ["create", "update"]) {
-			if (!allowed[operation] || field.readOnly || !inList(lists[operation], name)) continue;
+			if (!allowed[operation] || field.readOnly || name === model.author || !inList(lists[operation], name)) continue;
 			if (await verdict(rules?.[operation], fieldContext(operation), true, `The ${operation} rule of field "${name}"`)) writable[operation].push(name);
 		}
 	}

package/dist/access/restrict.d.ts

@@ -4,7 +4,7 @@ import { ResolvedAccess } from "./resolve.js";
 /**
  * The resource as one user may see it: only readable fields remain, and a field is `readOnly`
  * unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant` (with
- * `tenantAcross`), `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
+ * `tenantAcross`), `softDelete`, `owner` and `author` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
  * field, is dropped. Key columns always stay,
  * because records are addressed by them.
  *

package/dist/access/restrict.js

@@ -2,7 +2,7 @@
 /**
 * The resource as one user may see it: only readable fields remain, and a field is `readOnly`
 * unless it is writable on create or update. `search` (and `searchMatch`) shrinks to readable fields, and `tenant` (with
-* `tenantAcross`), `softDelete` and `owner` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
+* `tenantAcross`), `softDelete`, `owner` and `author` are dropped when their field is hidden, `position` when its field or its `within` is, and each of `parents` whose field is. The event catalogue, whose conditions may use any
 * field, is dropped. Key columns always stay,
 * because records are addressed by them.
 *
@@ -17,10 +17,11 @@ const restrictModel = (model, access) => {
 	const keep = (name) => name !== void 0 && visible.has(name) ? name : void 0;
 	const search = model.search?.filter((name) => visible.has(name));
 	const searchMatch = model.searchMatch && Object.entries(model.searchMatch).filter(([name]) => visible.has(name));
-	const { search: _search, searchMatch: _searchMatch, tenant: _tenant, tenantAcross: _tenantAcross, softDelete: _softDelete, owner: _owner, position: _position, parents: _parents, events: _events, ...rest } = model;
+	const { search: _search, searchMatch: _searchMatch, tenant: _tenant, tenantAcross: _tenantAcross, softDelete: _softDelete, owner: _owner, author: _author, position: _position, parents: _parents, events: _events, ...rest } = model;
 	const tenant = keep(model.tenant);
 	const softDelete = keep(model.softDelete);
 	const owner = keep(model.owner);
+	const author = keep(model.author);
 	const position = model.position && keep(model.position.field) && (model.position.within === void 0 || keep(model.position.within)) ? model.position : void 0;
 	const parents = model.parents?.filter((parent) => visible.has(parent.field));
 	return {
@@ -35,6 +36,7 @@ const restrictModel = (model, access) => {
 		...tenant && model.tenantAcross && { tenantAcross: model.tenantAcross },
 		...softDelete && { softDelete },
 		...owner && { owner },
+		...author && { author },
 		...position && { position: { ...position } },
 		...parents?.length && { parents: parents.map((parent) => ({ ...parent })) }
 	};

package/dist/model.d.ts

@@ -128,6 +128,8 @@ export type ResourceModel = {
   searchMatch?: Record<string, SearchMatch>;
   /** The field holding the owning user's id; `.own` capability scopes filter on it. */
   owner?: string;
+  /** The field holding the id of the user who created the record (`.author()`): creates set it, no request may. */
+  author?: string;
   /** The integer field holding the records' order by hand (`.position()`), 1 the first. */
   position?: {
     /** The integer field, 1 the first record. */

package/dist/resource-model.d.ts

@@ -13,6 +13,7 @@ export type ResourceState = {
   search?: string[];
   searchMatch?: Record<string, SearchMatch>;
   owner?: string;
+  author?: string;
   position?: {
     field: string;
     within?: string;

package/dist/resource-model.js

@@ -70,6 +70,7 @@ const assembleModel = (state) => {
 		...state.search && { search: [...state.search] },
 		...state.searchMatch && Object.keys(state.searchMatch).length > 0 && { searchMatch: { ...state.searchMatch } },
 		...state.owner && { owner: state.owner },
+		...state.author && { author: state.author },
 		...state.history && { history: true },
 		...state.comments && { comments: true },
 		...state.live && { live: true },

package/dist/resource.d.ts

@@ -82,6 +82,17 @@ export declare class ResourceBuilder<F extends FieldsInput = {}, K = never> {
   search(pick: (r: SearchRefs<F>) => SearchRef[]): ResourceBuilder<F, K>;
   /** The field holding the owning user's id, which `.own` capability scopes filter on. */
   owner(pick: (r: FieldRefs<F>) => Ref): ResourceBuilder<F, K>;
+  /**
+   * The field holding the id of the user who created the record, such as a chat message's sender: every create sets it
+   * to the signed-in user's id, and no request may write it, so it is never the client's word. A create by no user
+   * leaves it empty.
+   *
+   * @example
+   * ```ts
+   * .author((r) => r.author_id)
+   * ```
+   */
+  author(pick: (r: FieldRefs<F>) => Ref): ResourceBuilder<F, K>;
   /**
    * The integer field holding the records' order, 1 the first, which a list's **Reorder** button changes by dragging the
    * records; a move renumbers them 1, 2, 3, ... in one batch `reorder`. With `within`, a relation, each parent's records

package/dist/resource.js

@@ -84,6 +84,19 @@ var ResourceBuilder = class ResourceBuilder {
 		return this.next({ owner: pick(this.refs()).name });
 	}
 	/**
+	* The field holding the id of the user who created the record, such as a chat message's sender: every create sets it
+	* to the signed-in user's id, and no request may write it, so it is never the client's word. A create by no user
+	* leaves it empty.
+	*
+	* @example
+	* ```ts
+	* .author((r) => r.author_id)
+	* ```
+	*/
+	author(pick) {
+		return this.next({ author: pick(this.refs()).name });
+	}
+	/**
 	* The integer field holding the records' order, 1 the first, which a list's **Reorder** button changes by dragging the
 	* records; a move renumbers them 1, 2, 3, ... in one batch `reorder`. With `within`, a relation, each parent's records
 	* have an order of their own, as an invoice's items do, sorted in the parent's related section. The field must be

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/schema",
-  "version": "0.53.4",
+  "version": "0.53.6",
   "description": "Resource, field, view and access definitions for Protobase configs.",
   "license": "Apache-2.0",
   "repository": {