@protobase/server 0.25.4 → 0.25.5

package/dist/batch/rank-after.js

@@ -0,0 +1,46 @@
+import { HttpProblem } from "../problem.js";
+import { checkedFilter } from "../filter-input.js";
+import { tenantScope } from "../tenant.js";
+import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "../sql-parts.js";
+import { newlyAbove } from "./rank-pairs.js";
+import { encodeKey } from "@protobase/schema/internal";
+import { sql } from "kysely";
+//#region src/batch/rank-after.ts
+/**
+* Refuses a reorder by the resource's position that puts a record at or above a record it depends on, or one of those
+* at or below it (see `PositionAfterModel`), in one query of the pairs that involve the changed records. Pairs out of
+* order before the reorder do not count, so existing data never blocks a move that did not break it.
+*/
+const checkRankAfter = async (trx, deps, access, field, moved) => {
+	const { full, entry, session } = access;
+	const after = full.position?.after;
+	if (!after || full.position.field !== field || moved.length === 0) return;
+	const via = deps.registry.find(after.resource).model;
+	const id = columnId(full.fields[full.primaryKey[0]]);
+	const rank = columnId(full.fields[field]);
+	const from = columnId(via.fields[after.field]);
+	const to = columnId(via.fields[after.key]);
+	const keys = sql.join(moved.map((record) => record.key[0]));
+	const links = [
+		...scopeConditions(via, tenantScope(deps.registry.find(after.resource), session)?.tenantValue),
+		...filterCondition(via, checkedFilter(via, after.filter)),
+		sql`(${from} in (${keys}) or ${to} in (${keys}))`
+	];
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	const ranked = (pending) => {
+		const conditions = [...scopeConditions(full, tenant), ...pending ? filterCondition(full, checkedFilter(full, after.while)) : []];
+		return sql`(select ${id} as id, ${rank} as rank from ${tableId(full)} as t${whereClause(conditions)})`;
+	};
+	const { rows } = await sql`select l.dependent, l.depended, d.rank as dependent_rank, p.rank as depended_rank
+    from (select ${from} as dependent, ${to} as depended from ${tableId(via)} as t${whereClause(links)}) as l
+    join ${ranked(false)} as d on d.id = l.dependent
+    join ${ranked(true)} as p on p.id = l.depended`.execute(trx);
+	const broken = newlyAbove(rows, new Map(moved.map((record) => [encodeKey(record.key), record.before])));
+	if (!broken) return;
+	throw new HttpProblem(409, "ranks-above-dependency", "Conflict", `${entry.name} ${broken.dependent} cannot rank above ${broken.depended}, which it depends on`, {
+		record: broken.dependent,
+		dependsOn: broken.depended
+	});
+};
+//#endregion
+export { checkRankAfter };

package/dist/batch/rank-pairs.js

@@ -0,0 +1,17 @@
+import { encodeKey } from "@protobase/schema/internal";
+//#region src/batch/rank-pairs.ts
+const atOrAbove = (dependent, depended) => dependent !== null && depended !== null && Number(dependent) <= Number(depended);
+/**
+* The first pair whose record now ranks at or above the record it depends on but did not before: `before` holds the
+* ranks the records a reorder changed had, by their encoded key. A pair out of order already stays as it is, so a
+* reorder never fails on an order it did not break.
+*/
+const newlyAbove = (pairs, before) => {
+	const was = (key, now) => {
+		const name = encodeKey([key]);
+		return before.has(name) ? before.get(name) : now;
+	};
+	return pairs.find((pair) => atOrAbove(pair.dependent_rank, pair.depended_rank) && !atOrAbove(was(pair.dependent, pair.dependent_rank), was(pair.depended, pair.depended_rank)));
+};
+//#endregion
+export { newlyAbove };

package/dist/batch/reorder.js

@@ -6,6 +6,7 @@ import { fetchRecord } from "../records.js";
 import { validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
+import { checkRankAfter } from "./rank-after.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
 //#region src/batch/reorder.ts
@@ -42,7 +43,8 @@ const moveAside = async (trx, access, field, keys) => {
 * `reorder`: the listed records end up with `field` = `start`, `start` + 1, ... in the given order, `start` 1 unless
 * given, so a client sends only the stretch of a long list that moved. Only records whose value changes
 * are written, each as an ordinary update (validation, access, ETag, hooks); they are first moved aside (see `moveAside`)
-* so that a unique index such as (invoice_id, position) is never violated half way. Everything checks out before any row moves.
+* so that a unique index such as (invoice_id, position) is never violated half way. Everything checks out before any row moves,
+* and with the position's `after` the new order must keep each record below the records it depends on (see `checkRankAfter`).
 */
 const reorderIn = async (trx, deps, access, input) => {
 	const { entry, full } = access;
@@ -74,6 +76,10 @@ const reorderIn = async (trx, deps, access, input) => {
 		const plan = plans.get(i);
 		results.push(await shown(access, plan ? await applyUpdate(trx, deps, access, key, plan) : current[i]));
 	}
+	await checkRankAfter(trx, deps, access, input.field, changing.map((i) => ({
+		key: input.keys[i],
+		before: current[i].record[input.field]
+	})));
 	return results;
 };
 //#endregion

package/dist/check-position-after.js

@@ -0,0 +1,23 @@
+import { filterErrors, matchErrors } from "./view-related.js";
+//#region src/check-position-after.ts
+/**
+* Stops startup on a `.position(..., { after })` that cannot find the records each record ranks after: a join resource
+* the app does not have, `field` and `key` that are no filterable relations to the ranked resource, or a `filter` or
+* `while` that does not fit the join or the ranked resource.
+*/
+const checkPositionAfter = (registry) => {
+	const problems = registry.entries.flatMap(({ name, model }) => {
+		const after = model.position?.after;
+		if (!after) return [];
+		const via = registry.find(after.resource)?.model;
+		return (via ? [
+			...matchErrors(via, after.field, name),
+			...matchErrors(via, after.key, name),
+			...filterErrors(via, after.filter).map((error) => `filter: ${error}`),
+			...filterErrors(model, after.while).map((error) => `while: ${error}`)
+		] : [`unknown resource "${after.resource}"`]).map((error) => `${name} position after: ${error}`);
+	});
+	if (problems.length > 0) throw new Error(`The positions cannot find the records they rank after:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+};
+//#endregion
+export { checkPositionAfter };

package/dist/create-admin.js

@@ -32,6 +32,7 @@ import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
+import { checkPositionAfter } from "./check-position-after.js";
 import { checkViews } from "./check-views.js";
 import { liveRoutes } from "./live/live-route.js";
 import { tableFeed } from "./live/notice-feed.js";
@@ -99,6 +100,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkViews(registry, viewModels, pageModels.map((entry) => entry.name), fieldTypes);
 	checkRoleLimits(registry, options.roles?.limits ?? []);
 	checkOwnerFields(registry, auth);
+	checkPositionAfter(registry);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name))),

package/dist/view-related.js

@@ -79,4 +79,4 @@ const relatedErrors = (item, resource, models) => {
 	];
 };
 //#endregion
-export { matchErrors, openErrors, relatedErrors, sortErrors, throughKey };
+export { filterErrors, matchErrors, openErrors, relatedErrors, sortErrors, throughKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.4",
+  "version": "0.25.5",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.4",
-    "@protobase/query": "0.25.4",
-    "@protobase/schema": "0.25.4",
+    "@protobase/layout": "0.25.5",
+    "@protobase/query": "0.25.5",
+    "@protobase/schema": "0.25.5",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",