@protobase/server 0.19.14 → 0.19.16

package/dist/better-auth/create-auth.d.ts

@@ -77,6 +77,11 @@ export type CreateAuthOptions = {
   encryptOAuthTokens?: boolean;
   /** Runs after a user is created, by any route: `createUser`, an admin, or a social sign-up. Default none. */
   onUserCreated?: UserCreatedHook;
+  /**
+   * The id of a new user, by any route. Default Better Auth's random 32-character text. `.owner()` fields hold it: a
+   * `text` column for the default, or an integer column when this takes the next value of the app's own users sequence.
+   */
+  generateUserId?: () => string | Promise<string>;
   /**
    * The identity provider the operator's staff sign in with to sign in as people of this app, for support. Defaults
    * to the one the platform passes in `PROTOBASE_OPERATOR_ISSUER`, `PROTOBASE_OPERATOR_CLIENT_ID` and
@@ -3744,7 +3749,15 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
           name?: string;
           slug?: string;
           logo?: string | null;
-          metadata?: Record<string, any>;
+          metadata?
+          /**
+           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+           * sign-in provider already resolved.
+           */
+          /**
+           * The options `createAuth` gives Better Auth, with the roles, default role, mailer, operator provider and platform
+           * sign-in provider already resolved.
+           */ : Record<string, any>;
           [key: string]: any;
         };
       }>;
@@ -4354,6 +4367,8 @@ export declare const createAuth: (options: CreateAuthOptions) => import("better-
   roleDefinitions: RoleDefinitions;
   organizations: ResolvedOrganizations | undefined;
   defaultRole: string | undefined;
+  /** New users get their ids from `generateUserId` instead of Better Auth's random text. */
+  generatesUserIds: boolean;
   mail: boolean;
   passwordReset: boolean;
   /** Open sign-up is on and offered: the app asks for it, and can mail the codes. */

package/dist/better-auth/create-auth.js

@@ -163,10 +163,14 @@ const betterAuthOptions = (options, { origins = [], passkeyDomain, roles, defini
 					const given = String(user.role ?? "").split(",").map((name) => name.trim()).filter(Boolean);
 					const unknown = given.find((name) => !roles.includes(name));
 					if (given.length === 0 || unknown !== void 0) throw new APIError("BAD_REQUEST", { message: `Choose a role for the new user: ${roles.join(", ")}` });
-					return { data: context?.path === "/admin/create-user" ? {
+					const withId = options.generateUserId ? {
 						...user,
+						id: await options.generateUserId()
+					} : user;
+					return { data: context?.path === "/admin/create-user" ? {
+						...withId,
 						emailVerified: true
-					} : user };
+					} : withId };
 				},
 				...options.onUserCreated && { after: options.onUserCreated }
 			} },
@@ -266,6 +270,8 @@ const createAuth = (options) => {
 		roleDefinitions: definitions,
 		organizations,
 		defaultRole,
+		/** New users get their ids from `generateUserId` instead of Better Auth's random text. */
+		generatesUserIds: Boolean(options.generateUserId),
 		mail: Boolean(mailer),
 		passwordReset: Boolean(mailer),
 		/** Open sign-up is on and offered: the app asks for it, and can mail the codes. */

package/dist/check-owners.js

@@ -0,0 +1,15 @@
+//#region src/check-owners.ts
+/**
+* Stops startup on an `.owner()` field that cannot hold the ids of the auth instance's users: Better Auth's own ids
+* are random text, so the field must be text unless `generateUserId` makes the ids. Without an auth instance the
+* ids come from the app's own authenticator, which this cannot see.
+*/
+const checkOwnerFields = (registry, auth) => {
+	if (!auth || auth.generatesUserIds) return;
+	for (const entry of registry.entries) {
+		if (entry.ownerType === void 0 || entry.ownerType === "text") continue;
+		throw new Error(`${entry.name}.${entry.model.owner} is the owner of its records, so it holds the signed-in user's id, but it holds ${entry.ownerType} values and Better Auth's user ids are random text: make it a text column, or give createAuth a generateUserId that makes ${entry.ownerType} ids`);
+	}
+};
+//#endregion
+export { checkOwnerFields };

package/dist/check-views.js

@@ -4,7 +4,8 @@ import { cardFavoriteErrors, favoriteOwnerErrors } from "./view-card-favorite.js
 import { saveSearchErrors, searchesOfErrors } from "./view-saved-search.js";
 import { mapDisplayErrors, mapErrors } from "./view-map.js";
 import { relatedColumnErrors } from "./view-related-column.js";
-import { addressErrors, addressPlaceholders, displayFields, fieldRefsIn, hrefField, hrefPlaceholders, linkActionError } from "@protobase/schema/internal";
+import { editableErrors } from "./view-editable.js";
+import { actionInputErrors, addressErrors, addressPlaceholders, boardErrors, displayFields, fieldRefsIn, hrefField, hrefPlaceholders, linkActionError } from "@protobase/schema/internal";
 //#region src/check-views.ts
 const linkFields = (run) => run?.kind !== "link" ? [] : "to" in run ? addressPlaceholders(run.to) : hrefPlaceholders(run.href);
 const sensitiveErrors = (view, model) => {
@@ -57,6 +58,14 @@ const linkErrors = (view, model, models, pages) => view.actions.flatMap(({ name,
 		source: model
 	}).map((error) => `action "${name}": ${error}`) : [];
 });
+const inputErrors = (view, models) => view.actions.flatMap(({ name, run, inputs }) => {
+	if (!inputs) return [];
+	return [
+		...run ? [`inputs need a handler, and a${run.kind === "update" ? "n" : ""} ${run.kind} action has none`] : [],
+		...actionInputErrors(inputs),
+		...inputs.flatMap((input) => input.resource !== void 0 && !models[input.resource] ? [`input "${input.name}" picks from resource "${input.resource}", which the app does not have`] : [])
+	].map((error) => `action "${name}": ${error}`);
+});
 const createErrors = (view, pages) => view.create && !pages.has(view.create.page) ? [`create: unknown page "${view.create.page}"`] : [];
 const unknownFieldErrors = (view, model) => {
 	const unknown = (names, what) => names.filter((name) => !Object.hasOwn(model.fields, name)).map((name) => `${what} names field "${name}", which ${model.name} does not have`);
@@ -85,6 +94,7 @@ const relatedColumnsErrors = (view, model, models) => (view.list?.relatedColumns
 	...view.list.columns.includes(column.name) ? [] : ["it is not among the list's columns"],
 	...relatedColumnErrors(column, view.resource, models)
 ].map((error) => `related column "${column.name}": ${error}`));
+const listEditErrors = (view, model) => (view.list?.editable ?? []).flatMap((name) => [...view.list.columns.includes(name) ? [] : ["it is not among the list's columns"], ...editableErrors(name, model, view.fields[name])].map((error) => `editable field "${name}": ${error}`));
 const galleryErrors = (item, resource, model, models) => {
 	const image = item.image === void 0 ? void 0 : model.fields[item.image];
 	return [...image && image.type !== "file" ? [`"${item.image}" is not a file field`] : [], ...item.photos ? cardPhotosErrors(item.photos, resource, models).map((error) => `photos: ${error}`) : []];
@@ -98,10 +108,11 @@ const listOfErrors = (model, name, models) => {
 * Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
 * field the resource does not have, labels or colours values its enum does not have, shows a field with a field type of
 * `fieldTypes` (each with the storage types it shows) that does not show it,
+* edits a list column in its cell that is not a field with an editor of one line the API may write,
 * has a related section or related list column, a cards display's or gallery's photos or a cards display's favorite button, a `listOf`, a "Save search" button or a
 * `searchesOf` that do not fit the resources, cards
 * displays of one list that name different photos, a map that cannot show the
-* record's position or a map display that cannot find the records in its view, a link to an address the app does not have, or a create page that is not one of `pages`.
+* record's position or a map display that cannot find the records in its view, a board whose columns are no filterable enum, a link to an address the app does not have, action inputs that do not fit, or a create page that is not one of `pages`.
 */
 const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 	const models = Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model]));
@@ -119,12 +130,14 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 		const listOf = view.listOf === void 0 ? [] : listOfErrors(model, view.listOf, models).map((error) => `listOf: ${error}`);
 		const searches = [...view.saveSearch ? saveSearchErrors(view.saveSearch, view.resource, models, views).map((error) => `saveSearch: ${error}`) : [], ...view.searchesOf ? searchesOfErrors(view.searchesOf, view.resource, models).map((error) => `searchesOf: ${error}`) : []];
 		const maps = [...view.layout.flatMap((item) => item.kind === "map" ? mapErrors(item, model).map((error) => `map "${item.title}": ${error}`) : []), ...(view.list?.displays ?? []).flatMap((display) => display.kind === "map" ? mapDisplayErrors(display, model).map((error) => `display "${display.name}": ${error}`) : [])];
+		const boards = (view.list?.displays ?? []).flatMap((display) => display.kind === "board" ? boardErrors(display, model).map((error) => `display "${display.name}": ${error}`) : []);
 		return [
 			...sensitiveErrors(view, model),
 			...unknownFieldErrors(view, model),
 			...valueLabelErrors(view, model),
 			...valueColorErrors(view, model),
 			...textHintErrors(view, model),
+			...listEditErrors(view, model),
 			...widgetErrors(view, model, fieldTypes),
 			...related,
 			...photos,
@@ -132,7 +145,9 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 			...listOf,
 			...searches,
 			...maps,
+			...boards,
 			...linkErrors(view, model, models, pageNames),
+			...inputErrors(view, models),
 			...createErrors(view, pageNames)
 		].map((problem) => `View "${view.resource}": ${problem}`);
 	});

package/dist/create-admin.js

@@ -16,6 +16,7 @@ import { webhookTable } from "./webhooks/table/webhook-table.js";
 import { subscriptionWriteCheck } from "./webhooks/table/validate-hook.js";
 import { withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
+import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
 import { checkViews } from "./check-views.js";
 import { errorReportingSettings } from "./error-reporting/error-reporting-settings.js";
@@ -59,6 +60,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkBottomBars(registry, bottomBarModels, pageModels.map((entry) => entry.name), declaredRoles(auth, options.roles));
 	checkViews(registry, viewModels, pageModels.map((entry) => entry.name), fieldTypes);
 	checkRoleLimits(registry, options.roles?.limits ?? []);
+	checkOwnerFields(registry, auth);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name)))

package/dist/owner-id.js

@@ -0,0 +1,21 @@
+import { HttpProblem } from "./problem.js";
+import { fitsKeyType } from "@protobase/schema";
+//#region src/owner-id.ts
+const mentions = (filter, name) => {
+	if (filter.kind === "and" || filter.kind === "or") return filter.args.some((arg) => mentions(arg, name));
+	if (filter.kind === "not") return mentions(filter.arg, name);
+	return "field" in filter && filter.field.name === name;
+};
+/**
+* Refuses a request whose row filters compare the `.owner()` field with a user id it cannot hold, such as Better
+* Auth's random text in an integer column, naming the field, instead of failing as a value of the wrong format.
+*/
+const checkOwnerId = (entry, user, resolved) => {
+	const { ownerType, model } = entry;
+	if (ownerType === void 0 || model.owner === void 0 || fitsKeyType(String(user.id), ownerType)) return;
+	const owner = model.owner;
+	if (!Object.values(resolved.rowFilter).some((filter) => filter && mentions(filter, owner))) return;
+	throw new HttpProblem(500, "owner-id-mismatch", "Internal Server Error", `${entry.name}.${owner} holds ${ownerType} user ids, and the signed-in user's id "${user.id}" is not one, so their own records cannot be found`);
+};
+//#endregion
+export { checkOwnerId };

package/dist/registry.js

@@ -13,6 +13,14 @@ const etagSource = (model) => {
 		kind: "timestamp"
 	};
 };
+const isKeyType = (type) => type === "text" || type === "integer" || type === "bigint" || type === "uuid";
+const ownerType = (model, resolve) => {
+	const field = model.owner === void 0 ? void 0 : model.fields[model.owner];
+	if (!field) return void 0;
+	if (isKeyType(field.type)) return field.type;
+	const target = field.type === "relation" && field.relation ? resolve(field.relation.resource) : void 0;
+	return target && keyTypes(target, resolve)[0];
+};
 const buildRegistry = (resources) => {
 	const built = resources.map((source) => ({
 		source,
@@ -25,11 +33,13 @@ const buildRegistry = (resources) => {
 		const types = keyTypes(model, (name) => models.get(name));
 		if (types.length !== model.primaryKey.length) throw new Error(`Not implemented: resource "${model.name}" has a primary key field that points at a composite-key resource; the server maps one key part per key field`);
 		const etag = etagSource(model);
+		const owner = ownerType(model, (name) => models.get(name));
 		return {
 			name: model.name,
 			source,
 			model,
 			keyTypes: types,
+			...owner && { ownerType: owner },
 			...etag && { etag }
 		};
 	});

package/dist/request-access.js

@@ -1,5 +1,6 @@
 import { forbidden, notFound, unauthorized } from "./problem.js";
 import { checkedFilter } from "./filter-input.js";
+import { checkOwnerId } from "./owner-id.js";
 import { tenantScope } from "./tenant.js";
 import { checkFilter, resolveAccess, restrictModel } from "@protobase/schema";
 //#region src/request-access.ts
@@ -16,6 +17,7 @@ const requestAccess = async (deps, entry, session) => {
 		},
 		...organizationOf(session)
 	}, deps.accessOptions);
+	checkOwnerId(entry, session.user, resolved);
 	const readable = restrictModel(entry.model, resolved);
 	return {
 		entry,

package/dist/validate-body.js

@@ -4,10 +4,13 @@ import { writableFields } from "./request-access.js";
 const fail = (errors) => badRequest("invalid-record", `The request body is invalid: ${errors[0].field}: ${errors[0].message}`, { errors });
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const reserved = ["etag", "permissions"];
+const isEmptyText = (field, value) => field.type === "text" && !field.nullable && value === "";
 /**
 * Checks a create or update body for this caller. A field the caller cannot read is an unknown field, one they can read
 * but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always read-only);
-* every provided value goes through its field's zod schema, then `.validate()` rules run on the result.
+* every provided value goes through its field's zod schema, then `.validate()` rules run on the result. An empty text
+* for a text field that may not be null counts as not given: a create fills in its default or reports it required,
+* an update reports it required. Only the values written are checked, so a stored '' still reads.
 * Returns only the values to write: on create the defaults are filled in, on update only the provided fields.
 * `current` is the stored record an update merges into for `.validate()` rules.
 */
@@ -36,7 +39,16 @@ const validateBody = (access, mode, body, current = {}) => {
 	for (const [name, source] of Object.entries(entry.source.state.fields ?? {})) {
 		const field = full.fields[name];
 		if (!source || !field || !writable.has(name) || name === full.tenant) continue;
-		const provided = Object.hasOwn(body, name);
+		const empty = Object.hasOwn(body, name) && isEmptyText(field, body[name]);
+		if (empty && mode === "update") {
+			errors.push({
+				field: name,
+				code: "required",
+				message: `"${name}" is required`
+			});
+			continue;
+		}
+		const provided = Object.hasOwn(body, name) && !empty;
 		if (!provided && mode === "update") continue;
 		if (!provided && field.default && "db" in field.default) continue;
 		const parsed = source.schema.safeParse(provided ? body[name] : void 0);

package/dist/view-access.js

@@ -27,15 +27,26 @@ const pruneGallery = (item, resource, model, models) => {
 		...item.when !== void 0 && { when: item.when }
 	};
 };
-const tidyList = (model) => ({ default: opens, displays, columns, relatedColumns, ...list }) => {
-	const shown = displays && displays.length > 0 ? displays : void 0;
-	const kept = opens === tableDisplay || shown?.some((display) => display.name === opens);
+const withKeptDots = (display, related = []) => {
+	if (display.kind !== "cards" || display.dots === void 0) return display;
+	const { dots, ...card } = display;
+	const kept = dots.filter((name) => related.some((column) => column.name === name));
+	return kept.length > 0 ? {
+		...card,
+		dots: kept
+	} : card;
+};
+const tidyList = (model) => ({ default: opens, displays, columns, relatedColumns, editable, ...list }) => {
 	const related = relatedColumns && relatedColumns.length > 0 ? relatedColumns : void 0;
+	const shown = displays && displays.length > 0 ? displays.map((display) => withKeptDots(display, related)) : void 0;
+	const kept = opens === tableDisplay || shown?.some((display) => display.name === opens);
 	const visible = columns.filter((name) => Object.hasOwn(model.fields, name) || related?.some((column) => column.name === name));
+	const writable = editable?.filter((name) => visible.includes(name) && !model.fields[name].readOnly);
 	return {
 		...list,
 		columns: visible,
 		...related && { relatedColumns: related },
+		...writable && writable.length > 0 && { editable: writable },
 		...shown && { displays: shown },
 		...opens !== void 0 && kept && { default: opens }
 	};
@@ -45,6 +56,7 @@ const listShape = (resource, model, models, prompted) => shapes.object({
 	relatedColumns: shapes.list(shapes.map((column) => relatedColumnErrors(column, resource, models).length === 0 ? column : void 0)),
 	sort: shapes.list(shapes.tuple(shapes.field, shapes.data)),
 	search: shapes.list(shapes.field),
+	editable: shapes.list(shapes.field),
 	displays: shapes.list(shapes.oneOf({
 		cards: shapes.object({
 			kind: shapes.data,
@@ -59,6 +71,7 @@ const listShape = (resource, model, models, prompted) => shapes.object({
 			meta: shapes.list(shapes.field),
 			footer: shapes.list(shapes.field),
 			flags: shapes.list(shapes.field),
+			dots: shapes.data,
 			card: shapes.data,
 			photos: shapes.map((photos) => cardPhotosErrors(photos, resource, models).length === 0 ? photos : void 0),
 			favorite: shapes.map((favorite) => prompted.has(favorite.resource) || cardFavoriteErrors(favorite, resource, models).length === 0 ? favorite : void 0)
@@ -77,6 +90,17 @@ const listShape = (resource, model, models, prompted) => shapes.object({
 			defaultRadius: shapes.data,
 			area: shapes.field
 		}, { requires: ["latitude", "longitude"] }),
+		board: shapes.object({
+			kind: shapes.data,
+			name: shapes.data,
+			label: shapes.data,
+			icon: shapes.data,
+			by: shapes.field,
+			title: shapes.field,
+			subtitle: shapes.field,
+			badge: shapes.field,
+			meta: shapes.list(shapes.field)
+		}, { requires: ["by"] }),
 		custom: shapes.object({
 			kind: shapes.data,
 			name: shapes.data,
@@ -156,6 +180,7 @@ const linkShape = (model, models) => shapes.map((run) => {
 		source: model
 	}).length === 0 : hrefPlaceholders(run.href).every((name) => Object.hasOwn(model.fields, name))) ? run : void 0;
 });
+const inputsShape = (models) => shapes.map((inputs) => inputs.every((input) => input.resource === void 0 || Object.hasOwn(models, input.resource)) ? inputs : void 0);
 const actionShape = (model, models) => shapes.object({
 	name: shapes.data,
 	label: shapes.data,
@@ -169,8 +194,9 @@ const actionShape = (model, models) => shapes.object({
 		}, { requires: ["values"] }),
 		delete: shapes.data,
 		link: linkShape(model, models)
-	})
-}, { requires: ["run"] });
+	}),
+	inputs: inputsShape(models)
+}, { requires: ["run", "inputs"] });
 const viewShape = (resource, model, models, prompted) => shapes.object({
 	resource: shapes.data,
 	roles: shapes.data,

package/dist/view-editable.js

@@ -0,0 +1,23 @@
+//#region src/view-editable.ts
+const cellTypes = /* @__PURE__ */ new Set([
+	"text",
+	"integer",
+	"bigint",
+	"decimal",
+	"date",
+	"enum",
+	"boolean",
+	"currency",
+	"country"
+]);
+/** What is wrong with editing the field `name` of the list in its cell; empty when it can be. */
+const editableErrors = (name, model, hints) => {
+	const field = Object.hasOwn(model.fields, name) ? model.fields[name] : void 0;
+	if (!field) return [`"${name}" is not a field of ${model.name}`];
+	if (field.readOnly) return [`"${name}" is read-only`];
+	if (!cellTypes.has(field.type)) return [`"${name}" is a ${field.type} field, which is not edited in a cell`];
+	if (hints?.multiline || hints?.markdown) return [`"${name}" runs over several lines, which a cell does not hold`];
+	return [];
+};
+//#endregion
+export { editableErrors };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.19.14",
+  "version": "0.19.16",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -30,9 +30,9 @@
   },
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
-    "@protobase/layout": "0.19.14",
-    "@protobase/query": "0.19.14",
-    "@protobase/schema": "0.19.14",
+    "@protobase/layout": "0.19.16",
+    "@protobase/query": "0.19.16",
+    "@protobase/schema": "0.19.16",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",