@protobase/server 0.28.0 → 0.28.1

package/dist/check-parents.js

@@ -0,0 +1,16 @@
+//#region src/check-parents.ts
+/**
+* Stops startup on a `.parent()` whose relation cannot find the parent record: a resource the app does not have, or one
+* whose key is not exactly one field, the relation's one column.
+*/
+const checkParents = (registry) => {
+	const problems = registry.entries.flatMap(({ name, model }) => (model.parents ?? []).flatMap(({ field }) => {
+		const resource = model.fields[field].relation.resource;
+		const parent = registry.find(resource)?.model;
+		if (!parent) return [`${name} parent "${field}": unknown resource "${resource}"`];
+		return parent.primaryKey.length === 1 ? [] : [`${name} parent "${field}": "${resource}" has a key of ${parent.primaryKey.length} fields, not one`];
+	}));
+	if (problems.length > 0) throw new Error(`The parents cannot find the records they point at:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+};
+//#endregion
+export { checkParents };

package/dist/comments/comment-access.js

@@ -1,6 +1,6 @@
 import { forbidden, notFound } from "../problem.js";
 import { requestAccess, requireOperation } from "../request-access.js";
-import { fetchReadable } from "../read-service.js";
+import { fetchReadable } from "../fetch-readable.js";
 //#region src/comments/comment-access.ts
 /** The caller's access to a resource with comments, who must be allowed to read it; a resource without is a 404. */
 const commentAccess = async (deps, entry, session) => {

package/dist/create-admin.js

@@ -41,6 +41,7 @@ import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
+import { checkParents } from "./check-parents.js";
 import { checkPositionAfter } from "./check-position-after.js";
 import { checkViews } from "./check-views.js";
 import { liveRoutes } from "./live/live-route.js";
@@ -111,6 +112,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkRoleLimits(registry, options.roles?.limits ?? []);
 	checkOwnerFields(registry, auth);
 	checkPositionAfter(registry);
+	checkParents(registry);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name))),

package/dist/error-handler.js

@@ -28,6 +28,7 @@ const databaseProblem = (error) => {
 	if (error.code === "57014") return new HttpProblem(504, "statement-timeout", "Gateway Timeout", "The query exceeded the statement timeout");
 	if (error.code === "23505") return new HttpProblem(409, "conflict", "Conflict", "A record with the same unique value already exists");
 	if (error.code === "23503") return new HttpProblem(409, "conflict", "Conflict", "The record points at, or is pointed at by, another record");
+	if (error.code === "40P01") return new HttpProblem(409, "conflict", "Conflict", "The record was written at the same time as another; send it again");
 	if (error.code === "23502") return new HttpProblem(400, "invalid-record", "Bad Request", "A required column has no value");
 	if (error.code === "23514") return new HttpProblem(400, "invalid-record", "Bad Request", "A check constraint rejected the record");
 	if (error.code.startsWith("22")) return new HttpProblem(400, "invalid-value", "Bad Request", "A value has the wrong format for its column");

package/dist/fetch-readable.js

@@ -0,0 +1,33 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, targetFilter } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+//#region src/fetch-readable.ts
+/**
+* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
+* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
+* `lock` locks the row the first read finds.
+*/
+const fetchReadable = async (trx, access, key, deleted, { fields, lock, ...shape }) => {
+	const { entry } = access;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const recordRule = access.resolved.recordChecks.includes("read");
+	const filter = targetFilter(access, "read");
+	const current = await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		...filter && { filter },
+		...lock && { lock },
+		...shape,
+		...!recordRule && fields && { fields }
+	});
+	if (!current || !recordRule) return current;
+	const decision = await recordDecision(access, "read", current.record);
+	if (decision === false) return void 0;
+	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		filter: decision,
+		fields: [access.full.fields[access.full.primaryKey[0]]]
+	})) return void 0;
+	return current;
+};
+//#endregion
+export { fetchReadable };

package/dist/history/read-history.js

@@ -1,8 +1,8 @@
 import { notFound } from "../problem.js";
 import { tenantScope } from "../tenant.js";
 import { requestAccess, requireOperation } from "../request-access.js";
+import { fetchReadable } from "../fetch-readable.js";
 import { readTransaction } from "../transactions.js";
-import { fetchReadable } from "../read-service.js";
 import { quoteIdent } from "../changes/capture-sql.js";
 import { parseParams } from "../params.js";
 import { encodeKey } from "@protobase/schema/internal";

package/dist/meta.js

@@ -66,7 +66,7 @@ const createMeta = (deps, appName, appIcon) => {
 			resources: visible.map((access) => access.readable),
 			views,
 			pages,
-			permissions: Object.fromEntries(visible.map(({ entry, resolved }) => [entry.name, {
+			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {
 				read: resolved.operations.read || resolved.operations.list,
 				create: resolved.operations.create,
 				update: resolved.operations.update,
@@ -75,7 +75,7 @@ const createMeta = (deps, appName, appIcon) => {
 					"create",
 					"update",
 					"delete"
-				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0))
+				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0 || (full.parents?.length ?? 0) > 0))
 			}])),
 			...signIn.length > 0 && { signIn },
 			...deps.userMenu && { userMenu: { items: deps.userMenu.items.filter(shown) } },

package/dist/parent-access.js

@@ -0,0 +1,84 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, requestAccess } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
+//#region src/parent-access.ts
+/** A record's identity across resources; `1` and `"1"` are the same record. */
+const pathKey = (resource, key) => JSON.stringify([resource, ...key.map(String)]);
+/**
+* The parents these records name through `model.parents`, a null or missing relation naming none, sorted by path key:
+* the order they are locked in, so two writes naming the same parents lock them in the same order. A parent named twice
+* with the same need is checked once.
+*/
+const parentTargets = (model, records) => {
+	const targets = records.flatMap((record) => (model.parents ?? []).flatMap(({ field, access }) => {
+		const value = record[field];
+		if (value === void 0 || value === null) return [];
+		const resource = model.fields[field].relation.resource;
+		return [{
+			field,
+			access,
+			resource,
+			value,
+			key: pathKey(resource, [value])
+		}];
+	}));
+	return targets.filter((target, index) => targets.findIndex((other) => other.key === target.key && other.access === target.access) === index).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+};
+const mayOn = async (scope, entry, key, need, path) => {
+	const access = await scope.accessOf(entry);
+	if (!access.resolved.operations.read) return false;
+	const found = await fetchReadable(scope.trx, access, key, "hide", scope.lock ? { lock: "no-key-update" } : {});
+	if (!found) return false;
+	if (need === "read") return true;
+	if (!access.resolved.operations.update) return false;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const keyField = [access.full.fields[access.full.primaryKey[0]]];
+	const filter = access.resolved.rowFilter.update;
+	if (filter && !await fetchRecord(scope.trx, entry, key, tenant, {
+		filter,
+		fields: keyField
+	})) return false;
+	if (access.resolved.recordChecks.includes("update")) {
+		const decision = await recordDecision(access, "update", found.record, {});
+		if (decision === false) return false;
+		if (decision !== true && !await fetchRecord(scope.trx, entry, key, tenant, {
+			filter: decision,
+			fields: keyField
+		})) return false;
+	}
+	return parentsAllow(scope, access, [found.record], [...path, pathKey(entry.name, key)]);
+};
+const parentsAllow = async (scope, access, records, path) => {
+	for (const target of parentTargets(access.full, records)) {
+		if (path.includes(target.key)) return false;
+		const entry = scope.deps.registry.find(target.resource);
+		if (!entry) throw new Error(`Parent "${target.field}" of "${access.entry.name}" points at "${target.resource}", which the app does not have`);
+		if (!await mayOn(scope, entry, [target.value], target.access, path)) return false;
+	}
+	return true;
+};
+const ownPath = (access, records) => records.filter((record) => access.full.primaryKey.every((name) => record[name] !== void 0 && record[name] !== null)).map((record) => pathKey(access.entry.name, access.full.primaryKey.map((name) => record[name])));
+/**
+* Whether the caller may write records of `access`'s resource given the parents they name (`.parent()`): an update passes
+* the record before and after, so the parent it leaves and the one it moves to are locked in one order. With `lock`,
+* each parent is locked FOR NO KEY UPDATE until the transaction ends, so a parent changed or deleted at the same moment
+* cannot slip through; a read-only transaction cannot lock. Every call checks again; only each resource's access for
+* the session is reused.
+*/
+const parentGuard = (trx, access, lock) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const accessOf = (entry) => {
+		if (!resolved.has(entry.name)) resolved.set(entry.name, requestAccess(access.deps, entry, access.session));
+		return resolved.get(entry.name);
+	};
+	const scope = {
+		trx,
+		deps: access.deps,
+		lock,
+		accessOf
+	};
+	return (...records) => parentsAllow(scope, access, records, ownPath(access, records));
+};
+//#endregion
+export { parentGuard, parentTargets, pathKey };

package/dist/read-service.js

@@ -1,40 +1,14 @@
 import { notFound } from "./problem.js";
-import { tenantScope } from "./tenant.js";
-import { recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields } from "./request-access.js";
+import { requestAccess, requireOperation, visibleFields, writableFields } from "./request-access.js";
 import { presentFiles } from "./files/present.js";
 import { pickFields } from "./rows.js";
-import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { rowPermissions } from "./row-permissions.js";
 import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
 /** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
 const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));
 /**
-* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
-* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
-*/
-const fetchReadable = async (trx, access, key, deleted, { fields, ...shape }) => {
-	const { entry } = access;
-	const tenant = tenantScope(entry, access.session)?.tenantValue;
-	const recordRule = access.resolved.recordChecks.includes("read");
-	const filter = targetFilter(access, "read");
-	const current = await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		...filter && { filter },
-		...shape,
-		...!recordRule && fields && { fields }
-	});
-	if (!current || !recordRule) return current;
-	const decision = await recordDecision(access, "read", current.record);
-	if (decision === false) return void 0;
-	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		filter: decision,
-		fields: [access.full.fields[access.full.primaryKey[0]]]
-	})) return void 0;
-	return current;
-};
-/**
 * The record with this key as the caller may see it: readable fields only, inside the caller's tenant and row filter.
 * A key outside the tenant, outside the row filter, or failing a record-level read rule is a plain 404.
 */
@@ -66,4 +40,4 @@ const readRecord = async (deps, entry, session, key, deleted = "hide") => {
 	};
 };
 //#endregion
-export { fetchReadable, fieldModes, readRecord };
+export { fieldModes, readRecord };

package/dist/records.js

@@ -12,6 +12,7 @@ const stored = async (entry, raw, shape = {}) => {
 	};
 };
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const lockClause = (lock) => lock === "no-key-update" ? sql` for no key update` : lock ? sql` for update` : sql``;
 /** The row of the caller's tenant with this key (live unless `deleted` says otherwise), optionally narrowed by a filter. */
 const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 	const { filter, deleted, lock = false, ...shape } = options;
@@ -20,7 +21,7 @@ const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 		...keyConditions(entry.model, key),
 		...filterCondition(entry.model, filter)
 	];
-	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lock ? sql` for update` : sql``}`;
+	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lockClause(lock)}`;
 	return stored(entry, (await rowsOf(db, query))[0], shape);
 };
 const writeValue = (field, value) => field.type === "json" && value !== null ? JSON.stringify(value) : value;

package/dist/reveal-service.js

@@ -1,8 +1,8 @@
 import { badRequest, notFound } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation } from "./request-access.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { readTransaction } from "./transactions.js";
-import { fetchReadable } from "./read-service.js";
 import { encodeKey } from "@protobase/schema/internal";
 //#region src/reveal-service.ts
 /**

package/dist/row-permissions.js

@@ -2,6 +2,7 @@ import { tenantScope } from "./tenant.js";
 import { recordDecision } from "./request-access.js";
 import { aliasedColumn, columnId, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { sql } from "kysely";
 import { compileFilter } from "@protobase/query";
 //#region src/row-permissions.ts
@@ -21,8 +22,8 @@ const matching = async (trx, access, rows, filter) => {
 };
 /**
 * What the caller may do with each of these (exposed) rows: the operation must be allowed, the row must match the
-* operation's row filter (checked in the database), and a record-level rule must pass for the stored record. This only
-* informs the UI; every write is checked again by the write pipeline.
+* operation's row filter (checked in the database), a record-level rule must pass for the stored record, and its parents
+* (`.parent()`) must allow writing it. This only informs the UI; every write is checked again by the write pipeline.
 */
 const rowPermissions = async (trx, access, rows) => {
 	const { resolved, entry, session } = access;
@@ -63,7 +64,23 @@ const rowPermissions = async (trx, access, rows) => {
 			if (decision !== true) result[i][operation] = (await matching(trx, access, [row], decision)).size > 0;
 		}
 	}
+	await withParents(trx, access, rows, result);
 	return result;
 };
+const withParents = async (trx, access, rows, result) => {
+	const { full, entry, session } = access;
+	if (!full.parents?.length) return;
+	const guard = parentGuard(trx, access, false);
+	const fields = [.../* @__PURE__ */ new Set([...full.primaryKey, ...full.parents.map((parent) => parent.field)])].map((name) => full.fields[name]);
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	for (const [i, row] of rows.entries()) {
+		const permissions = result[i];
+		if (!permissions.update && !permissions.delete) continue;
+		const stored = await fetchRecord(trx, entry, full.primaryKey.map((name) => row[name]), tenant, { fields });
+		const allowed = stored !== void 0 && await guard(stored.record);
+		permissions.update &&= allowed;
+		permissions.delete &&= allowed;
+	}
+};
 //#endregion
 export { rowPermissions };

package/dist/write-pipeline.js

@@ -8,7 +8,7 @@ import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
 import { checkRankAfter } from "./rank-after.js";
 //#region src/write-pipeline.ts
@@ -31,8 +31,11 @@ const create = async (trx, deps, access, body) => {
 		...tenantValues
 	};
 	const filter = await decide(access, "create", void 0, row);
+	const parents = checkParents(trx, access, "create");
+	await parents(row);
 	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
+	await parents(created.record);
 	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{
 		key: keyOf(access, created.record),
 		before: null
@@ -77,6 +80,7 @@ const removeOrRestore = async (trx, deps, access, request) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, operation);
+	await checkParents(trx, access, operation)(current.record);
 	const notify = notifier(deps, access);
 	if (undelete) {
 		const restored = await restoreRecord(trx, entry, request.key, scope?.tenantValue, shape);

package/dist/write-shared.js

@@ -5,6 +5,7 @@ import { presentFiles } from "./files/present.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { scheduleRemovedFiles } from "./files/attach.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
@@ -22,6 +23,17 @@ const decide = async (access, operation, record, input) => {
 	if (decision === false) throw denied(access.entry, operation);
 	return decision === true ? void 0 : decision;
 };
+/**
+* Refuses a write whose records' parents (`.parent()`) do not give the caller the access it needs, with the same answer
+* as a refused record-level rule; each parent stays locked until the write commits.
+*/
+const checkParents = (trx, access, operation) => {
+	if (!access.full.parents?.length) return async (..._records) => {};
+	const guard = parentGuard(trx, access, true);
+	return async (...records) => {
+		if (!await guard(...records)) throw denied(access.entry, operation);
+	};
+};
 const keyOf = (access, record) => access.full.primaryKey.map((name) => record[name]);
 const firstKeyField = (access) => access.full.fields[access.full.primaryKey[0]];
 const assertWritten = async (trx, access, written, operation, ...filters) => {
@@ -53,4 +65,4 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 	await scheduleRemovedFiles(access, kind, before, after);
 };
 //#endregion
-export { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };
+export { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };

package/dist/write-update.js

@@ -3,11 +3,12 @@ import { targetFilter } from "./request-access.js";
 import { fetchRecord, updateRecord } from "./records.js";
 import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
 /**
 * Everything an update needs before it writes: the row (locked, inside the caller's tenant and row filters), the ETag
-* precondition, validation against the fields the caller may write, and the record-level rule with its filter.
+* precondition, validation against the fields the caller may write, the record-level rule with its filter, and the
+* parents (`.parent()`) it leaves and moves to, checked in one call so they are locked in one order.
 */
 const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 	const { entry, full } = access;
@@ -27,10 +28,16 @@ const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, "update");
+	const parents = checkParents(trx, access, "update");
+	if (Object.keys(values).length > 0) await parents(current.record, {
+		...current.record,
+		...values
+	});
 	return {
 		current,
 		values,
-		...filter && { filter }
+		...filter && { filter },
+		parents
 	};
 };
 /** Writes a planned update, checks the row as written against the filters, and runs the hooks. */
@@ -39,6 +46,7 @@ const applyUpdate = async (trx, deps, access, key, plan) => {
 	const tenant = tenantScope(entry, access.session)?.tenantValue;
 	const updated = await updateRecord(trx, entry, key, tenant, plan.values, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, updated, "update", access.resolved.rowFilter.update, plan.filter);
+	await plan.parents(updated.record);
 	await notifier(deps, access)(trx, "update", plan.current.record, updated.record);
 	return updated;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.28.0",
-    "@protobase/query": "0.28.0",
-    "@protobase/schema": "0.28.0",
+    "@protobase/layout": "0.28.1",
+    "@protobase/query": "0.28.1",
+    "@protobase/schema": "0.28.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",