@protobase/server 0.25.5 → 0.25.7

package/dist/batch/reorder.js

@@ -6,7 +6,7 @@ import { fetchRecord } from "../records.js";
 import { validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
-import { checkRankAfter } from "./rank-after.js";
+import { checkRankAfter } from "../rank-after.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
 //#region src/batch/reorder.ts

package/dist/check-views.js

@@ -1,4 +1,4 @@
-import { relatedErrors } from "./view-related.js";
+import { relatedActionErrors, relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors, favoriteOwnerErrors } from "./view-card-favorite.js";
 import { saveSearchErrors, searchesOfErrors } from "./view-saved-search.js";
@@ -154,7 +154,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 	const pageNames = new Set(pages);
 	const createPages = new Set(views.filter((view) => view.create).map((view) => view.resource));
 	const viewProblems = (view, model) => {
-		const related = [...layoutItems(view.layout).flatMap((item) => item.kind === "related" ? relatedErrors(item, view.resource, models).map((error) => `related "${item.title}": ${error}`) : []), ...relatedColumnsErrors(view, model, models)];
+		const related = [...layoutItems(view.layout).flatMap((item) => item.kind === "related" ? [...relatedErrors(item, view.resource, models), ...relatedActionErrors(item, views)].map((error) => `related "${item.title}": ${error}`) : []), ...relatedColumnsErrors(view, model, models)];
 		const photos = [
 			...(view.list?.displays ?? []).flatMap((display) => display.kind === "cards" && display.photos ? cardPhotosErrors(display.photos, view.resource, models).map((error) => `display "${display.name}" photos: ${error}`) : []),
 			...sharedPhotosErrors(view),

package/dist/{batch/rank-after.js → rank-after.js}

@@ -1,15 +1,16 @@
-import { HttpProblem } from "../problem.js";
-import { checkedFilter } from "../filter-input.js";
-import { tenantScope } from "../tenant.js";
-import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "../sql-parts.js";
+import { HttpProblem } from "./problem.js";
+import { checkedFilter } from "./filter-input.js";
+import { tenantScope } from "./tenant.js";
+import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { newlyAbove } from "./rank-pairs.js";
 import { encodeKey } from "@protobase/schema/internal";
 import { sql } from "kysely";
-//#region src/batch/rank-after.ts
+//#region src/rank-after.ts
 /**
-* Refuses a reorder by the resource's position that puts a record at or above a record it depends on, or one of those
-* at or below it (see `PositionAfterModel`), in one query of the pairs that involve the changed records. Pairs out of
-* order before the reorder do not count, so existing data never blocks a move that did not break it.
+* Refuses a write of the resource's position (a create, an update or a reorder) that puts a record at or above a record
+* it depends on, or one of those at or below it (see `PositionAfterModel`), in one query of the pairs that involve the
+* changed records. Pairs out of order before the write do not count, so existing data never blocks a move that did not
+* break it.
 */
 const checkRankAfter = async (trx, deps, access, field, moved) => {
 	const { full, entry, session } = access;

package/dist/{batch/rank-pairs.js → rank-pairs.js}

@@ -1,10 +1,10 @@
 import { encodeKey } from "@protobase/schema/internal";
-//#region src/batch/rank-pairs.ts
+//#region src/rank-pairs.ts
 const atOrAbove = (dependent, depended) => dependent !== null && depended !== null && Number(dependent) <= Number(depended);
 /**
 * The first pair whose record now ranks at or above the record it depends on but did not before: `before` holds the
-* ranks the records a reorder changed had, by their encoded key. A pair out of order already stays as it is, so a
-* reorder never fails on an order it did not break.
+* ranks the records a write changed had, by their encoded key, `null` for a new one. A pair out of order already stays
+* as it is, so a write never fails on an order it did not break.
 */
 const newlyAbove = (pairs, before) => {
 	const was = (key, now) => {

package/dist/view-related.js

@@ -75,8 +75,15 @@ const relatedErrors = (item, resource, models) => {
 			return resolved.steps.at(-1).field.sensitive ? [`column: "${column}" is sensitive, so it cannot be listed`] : [];
 		}),
 		...item.limit === void 0 || Number.isInteger(item.limit) && item.limit >= 1 && item.limit <= 100 ? [] : ["limit must be a whole number from 1 to 100"],
-		...openErrors(item, models)
+		...openErrors(item, models),
+		...item.presentation === void 0 || item.presentation === "cards" ? [] : [`presentation must be "cards", not "${String(item.presentation)}"`],
+		...item.actions === void 0 || item.presentation === "cards" ? [] : ["actions need presentation \"cards\""]
 	];
 };
+/** The `actions` of a related section that are no named action of its resource's view, among `views`. */
+const relatedActionErrors = (item, views) => {
+	const named = new Set(views.find((view) => view.resource === item.resource)?.actions.map((action) => action.name));
+	return (item.actions ?? []).flatMap((name) => named.has(name) ? [] : [`actions: "${name}" is no named action of the ${item.resource} view`]);
+};
 //#endregion
-export { filterErrors, matchErrors, openErrors, relatedErrors, sortErrors, throughKey };
+export { filterErrors, matchErrors, openErrors, relatedActionErrors, relatedErrors, sortErrors, throughKey };

package/dist/write-pipeline.js

@@ -8,8 +8,9 @@ import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier, shown } from "./write-shared.js";
+import { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
+import { checkRankAfter } from "./rank-after.js";
 //#region src/write-pipeline.ts
 const withOwner = (access, values) => {
 	const { owner } = access.full;
@@ -32,13 +33,23 @@ const create = async (trx, deps, access, body) => {
 	const filter = await decide(access, "create", void 0, row);
 	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
+	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{
+		key: keyOf(access, created.record),
+		before: null
+	}]);
 	await notifier(deps, access)(trx, "create", void 0, created.record);
 	return shown(access, created);
 };
 const update = async (trx, deps, access, request) => {
 	const plan = await planUpdate(trx, access, request.key, request.body, request.ifMatch);
 	if (Object.keys(plan.values).length === 0) return shown(access, plan.current);
-	return shown(access, await applyUpdate(trx, deps, access, request.key, plan));
+	const updated = await applyUpdate(trx, deps, access, request.key, plan);
+	const rank = access.full.position?.field;
+	if (rank && rank in plan.values) await checkRankAfter(trx, deps, access, rank, [{
+		key: keyOf(access, updated.record),
+		before: plan.current.record[rank]
+	}]);
+	return shown(access, updated);
 };
 const removeOrRestore = async (trx, deps, access, request) => {
 	const { entry, full } = access;
@@ -83,7 +94,8 @@ const removeOrRestore = async (trx, deps, access, request) => {
 /**
 * One write inside an open transaction, for a caller whose access is already resolved: operations and field access,
 * tenant scope, validation against the fields they may write, optimistic concurrency, row filters and record-level
-* rules checked in the database, then the hooks. Batches run many of these in one transaction.
+* rules checked in the database, then the hooks; a rank written by the resource's position with `after` must keep the
+* record below what it depends on (see `checkRankAfter`). Batches run many of these in one transaction.
 */
 const writeIn = async (trx, deps, access, request) => {
 	requireOperation(access, request.operation === "undelete" ? "update" : request.operation);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.25.5",
+  "version": "0.25.7",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.25.5",
-    "@protobase/query": "0.25.5",
-    "@protobase/schema": "0.25.5",
+    "@protobase/layout": "0.25.7",
+    "@protobase/query": "0.25.7",
+    "@protobase/schema": "0.25.7",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",