@protobase/server 0.28.0 → 0.28.2

package/dist/aggregate-groups.js

@@ -13,9 +13,12 @@ const aggregateParams = z.object({
 	filter: z.string().optional(),
 	sum: name.optional(),
 	average: name.optional(),
+	maximum: name.optional(),
 	limit: z.coerce.number().int().optional(),
 	label: name.optional(),
 	range: z.enum([
+		"1h",
+		"24h",
 		"7d",
 		"30d",
 		"90d",
@@ -25,6 +28,9 @@ const aggregateParams = z.object({
 	from: z.string().optional(),
 	to: z.string().optional(),
 	granularity: z.enum([
+		"minute",
+		"5_minutes",
+		"15_minutes",
 		"hour",
 		"day",
 		"week",
@@ -41,14 +47,16 @@ const invalid = (parameter, message) => badRequest("invalid-parameter", `Invalid
 	message
 }] });
 const measureOf = (params) => {
-	if (params.sum !== void 0 && params.average !== void 0) throw invalid("average", "Give sum or average, not both");
-	if (params.sum !== void 0) return {
-		kind: "sum",
-		field: params.sum
-	};
-	if (params.average !== void 0) return {
-		kind: "average",
-		field: params.average
+	const given = [
+		"sum",
+		"average",
+		"maximum"
+	].filter((kind) => params[kind] !== void 0);
+	if (given.length > 1) throw invalid(given[1], "Give one of sum, average and maximum");
+	const [kind] = given;
+	return kind === void 0 ? void 0 : {
+		kind,
+		field: params[kind]
 	};
 };
 const optionErrors = (params, dated) => {
@@ -75,7 +83,7 @@ const isDated = (model, field) => {
 };
 /**
 * Records per value of a field, or per hour, day, week, month or year of a date field with the empty ones included,
-* each with how many there are and, with `sum` or `average`, that of a numeric field. Read as a list is: the caller's
+* each with how many there are and, with `sum`, `average` or `maximum`, that of a numeric field. Read as a list is: the caller's
 * filter on the model as they see it, inside their tenant and row filter; the scan guard judges the grouped field.
 */
 const aggregate = async (deps, entry, session, input) => {

package/dist/aggregate-service.js

@@ -22,6 +22,8 @@ const seriesParams = z.object({
 	field,
 	filter,
 	range: z.enum([
+		"1h",
+		"24h",
 		"7d",
 		"30d",
 		"90d",
@@ -31,6 +33,9 @@ const seriesParams = z.object({
 	from: z.string().optional(),
 	to: z.string().optional(),
 	granularity: z.enum([
+		"minute",
+		"5_minutes",
+		"15_minutes",
 		"hour",
 		"day",
 		"week",
@@ -43,11 +48,14 @@ const histogramParams = z.object({
 	filter,
 	buckets: z.coerce.number().int().default(20)
 });
-const rangeDays = {
-	"7d": 7,
-	"30d": 30,
-	"90d": 90,
-	"1y": 365
+const hourMs = 36e5;
+const rangeMs = {
+	"1h": hourMs,
+	"24h": 24 * hourMs,
+	"7d": 168 * hourMs,
+	"30d": 720 * hourMs,
+	"90d": 2160 * hourMs,
+	"1y": 8760 * hourMs
 };
 const scoped = async (deps, entry, session, source) => {
 	const access = await requestAccess(deps, entry, session);
@@ -119,7 +127,7 @@ const seriesRange = async (deps, access, field, params, timeZone, scope) => {
 	};
 	const range = params.range ?? "30d";
 	if (range !== "all") return {
-		from: rangeStart(type, now - rangeDays[range] * 864e5, timeZone),
+		from: rangeStart(type, now - rangeMs[range], timeZone),
 		to: bound(model, field, to)
 	};
 	const lowest = await earliest(deps, access, field, scope);

package/dist/check-parents.js

@@ -0,0 +1,16 @@
+//#region src/check-parents.ts
+/**
+* Stops startup on a `.parent()` whose relation cannot find the parent record: a resource the app does not have, or one
+* whose key is not exactly one field, the relation's one column.
+*/
+const checkParents = (registry) => {
+	const problems = registry.entries.flatMap(({ name, model }) => (model.parents ?? []).flatMap(({ field }) => {
+		const resource = model.fields[field].relation.resource;
+		const parent = registry.find(resource)?.model;
+		if (!parent) return [`${name} parent "${field}": unknown resource "${resource}"`];
+		return parent.primaryKey.length === 1 ? [] : [`${name} parent "${field}": "${resource}" has a key of ${parent.primaryKey.length} fields, not one`];
+	}));
+	if (problems.length > 0) throw new Error(`The parents cannot find the records they point at:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
+};
+//#endregion
+export { checkParents };

package/dist/check-views.js

@@ -4,6 +4,7 @@ import { cardFavoriteErrors, favoriteOwnerErrors } from "./view-card-favorite.js
 import { saveSearchErrors, searchesOfErrors } from "./view-saved-search.js";
 import { chartErrors } from "./view-chart.js";
 import { mapDisplayErrors, mapErrors } from "./view-map.js";
+import { recordChartErrors } from "./view-record-chart.js";
 import { relatedColumnErrors } from "./view-related-column.js";
 import { editableErrors } from "./view-editable.js";
 import { actionWhenErrors, actionWhenFields } from "./view-action-when.js";
@@ -147,7 +148,7 @@ const listOfErrors = (model, name, models) => {
 * edits a list column in its cell that is not a field with an editor of one line the API may write,
 * has a section, related section or sidebar whose `when` condition names what the app does not have, a related section or related list column, a cards display's or gallery's photos or a cards display's favorite button, a `listOf`, a "Save search" button or a
 * `searchesOf` that do not fit the resources, cards
-* displays of one list that name different photos, a chart per value that cannot group or add up its fields, a map that cannot show the
+* displays of one list that name different photos, a chart per value that cannot group or add up its fields, a chart of related records that does not fit them, a map that cannot show the
 * record's position or a map display that cannot find the records in its view, a board whose columns are no filterable enum, a calendar or timeline whose dates are no filterable date or timestamp fields, a link to an address the app does not have, an action whose `when` reads what the record does not have, an AI action that cannot write its field, action inputs that do not fit, or a create page that is not one of `pages`.
 */
 const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
@@ -167,7 +168,7 @@ const checkViews = (registry, views, pages = [], fieldTypes = {}) => {
 		const maps = [...layoutItems(view.layout).flatMap((item) => item.kind === "map" ? mapErrors(item, model).map((error) => `map "${item.title}": ${error}`) : []), ...(view.list?.displays ?? []).flatMap((display) => display.kind === "map" ? mapDisplayErrors(display, model).map((error) => `display "${display.name}": ${error}`) : [])];
 		const boards = (view.list?.displays ?? []).flatMap((display) => display.kind === "board" ? boardErrors(display, model).map((error) => `display "${display.name}": ${error}`) : []);
 		const calendars = (view.list?.displays ?? []).flatMap((display) => display.kind === "calendar" || display.kind === "timeline" ? datesErrors(display, model).map((error) => `display "${display.name}": ${error}`) : []);
-		const chart = view.chart ? chartErrors(view.chart, model).map((error) => `chart: ${error}`) : [];
+		const chart = [...view.chart ? chartErrors(view.chart, model).map((error) => `chart: ${error}`) : [], ...layoutItems(view.layout).flatMap((item) => item.kind === "chart" ? recordChartErrors(item, view.resource, models).map((error) => `chart "${item.title}": ${error}`) : [])];
 		const history = model.history ? [] : layoutItems(view.layout).flatMap((item) => item.kind === "history" ? [`history "${item.title}" needs .history() on resource "${view.resource}"`] : []);
 		const comments = model.comments ? [] : layoutItems(view.layout).flatMap((item) => item.kind === "comments" ? [`comments "${item.title}" needs .comments() on resource "${view.resource}"`] : []);
 		return [

package/dist/comments/comment-access.js

@@ -1,6 +1,6 @@
 import { forbidden, notFound } from "../problem.js";
 import { requestAccess, requireOperation } from "../request-access.js";
-import { fetchReadable } from "../read-service.js";
+import { fetchReadable } from "../fetch-readable.js";
 //#region src/comments/comment-access.ts
 /** The caller's access to a resource with comments, who must be allowed to read it; a resource without is a 404. */
 const commentAccess = async (deps, entry, session) => {

package/dist/create-admin.js

@@ -41,6 +41,7 @@ import { visitorsBrowse, withAnonymous } from "./anonymous.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
+import { checkParents } from "./check-parents.js";
 import { checkPositionAfter } from "./check-position-after.js";
 import { checkViews } from "./check-views.js";
 import { liveRoutes } from "./live/live-route.js";
@@ -111,6 +112,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	checkRoleLimits(registry, options.roles?.limits ?? []);
 	checkOwnerFields(registry, auth);
 	checkPositionAfter(registry);
+	checkParents(registry);
 	checkPages(pageModels, {
 		models: Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model])),
 		actions: (resource) => new Set(viewModels.filter((view) => view.resource === resource).flatMap((view) => view.actions.map((action) => action.name))),

package/dist/error-handler.js

@@ -28,6 +28,7 @@ const databaseProblem = (error) => {
 	if (error.code === "57014") return new HttpProblem(504, "statement-timeout", "Gateway Timeout", "The query exceeded the statement timeout");
 	if (error.code === "23505") return new HttpProblem(409, "conflict", "Conflict", "A record with the same unique value already exists");
 	if (error.code === "23503") return new HttpProblem(409, "conflict", "Conflict", "The record points at, or is pointed at by, another record");
+	if (error.code === "40P01") return new HttpProblem(409, "conflict", "Conflict", "The record was written at the same time as another; send it again");
 	if (error.code === "23502") return new HttpProblem(400, "invalid-record", "Bad Request", "A required column has no value");
 	if (error.code === "23514") return new HttpProblem(400, "invalid-record", "Bad Request", "A check constraint rejected the record");
 	if (error.code.startsWith("22")) return new HttpProblem(400, "invalid-value", "Bad Request", "A value has the wrong format for its column");

package/dist/fetch-readable.js

@@ -0,0 +1,33 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, targetFilter } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+//#region src/fetch-readable.ts
+/**
+* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
+* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
+* `lock` locks the row the first read finds.
+*/
+const fetchReadable = async (trx, access, key, deleted, { fields, lock, ...shape }) => {
+	const { entry } = access;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const recordRule = access.resolved.recordChecks.includes("read");
+	const filter = targetFilter(access, "read");
+	const current = await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		...filter && { filter },
+		...lock && { lock },
+		...shape,
+		...!recordRule && fields && { fields }
+	});
+	if (!current || !recordRule) return current;
+	const decision = await recordDecision(access, "read", current.record);
+	if (decision === false) return void 0;
+	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
+		deleted,
+		filter: decision,
+		fields: [access.full.fields[access.full.primaryKey[0]]]
+	})) return void 0;
+	return current;
+};
+//#endregion
+export { fetchReadable };

package/dist/history/read-history.js

@@ -1,8 +1,8 @@
 import { notFound } from "../problem.js";
 import { tenantScope } from "../tenant.js";
 import { requestAccess, requireOperation } from "../request-access.js";
+import { fetchReadable } from "../fetch-readable.js";
 import { readTransaction } from "../transactions.js";
-import { fetchReadable } from "../read-service.js";
 import { quoteIdent } from "../changes/capture-sql.js";
 import { parseParams } from "../params.js";
 import { encodeKey } from "@protobase/schema/internal";

package/dist/meta.js

@@ -66,7 +66,7 @@ const createMeta = (deps, appName, appIcon) => {
 			resources: visible.map((access) => access.readable),
 			views,
 			pages,
-			permissions: Object.fromEntries(visible.map(({ entry, resolved }) => [entry.name, {
+			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {
 				read: resolved.operations.read || resolved.operations.list,
 				create: resolved.operations.create,
 				update: resolved.operations.update,
@@ -75,7 +75,7 @@ const createMeta = (deps, appName, appIcon) => {
 					"create",
 					"update",
 					"delete"
-				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0))
+				].filter((op) => resolved.operations[op] && (resolved.recordChecks.includes(op) || resolved.rowFilter[op] !== void 0 || (full.parents?.length ?? 0) > 0))
 			}])),
 			...signIn.length > 0 && { signIn },
 			...deps.userMenu && { userMenu: { items: deps.userMenu.items.filter(shown) } },

package/dist/openapi/resource-paths.js

@@ -590,17 +590,21 @@ const resourcePaths = (access) => {
 			operationId: `aggregate_${entry.name}`,
 			tags: tag,
 			summary: `Totals per group of ${entry.name} records`,
-			description: "Groups the records the filter finds, its own terms on `group_by` included, by the value of a field, or by the hour, day, week, month or year of a date or timestamp field with the empty ones included. Each group has its count and, with `sum` or `average`, that of a numeric field, `null` when no record of the group has a value. Value groups come largest first. An index must serve the grouped field. A date group can be split: see `split_by`.",
+			description: "Groups the records the filter finds, its own terms on `group_by` included, by the value of a field, or by the minute, 5 or 15 minutes, hour, day, week, month or year of a date or timestamp field with the empty ones included. Each group has its count and, with `sum`, `average` or `maximum`, that of a numeric field, `null` when no record of the group has a value. Value groups come largest first. An index must serve the grouped field. A date group can be split: see `split_by`.",
 			parameters: [
 				query("group_by", "A filterable field", { type: "string" }, true),
 				param("filter"),
 				query("sum", "A numeric field to add up per group"),
 				query("average", "A numeric field to average per group, instead of `sum`"),
+				query("maximum", "A numeric field whose largest value per group it returns, instead of `sum`"),
 				query("limit", "Most value groups to return, default 100, at most 1000", { type: "integer" }),
 				query("label", "For a relation to a single-key resource: the field of that resource whose value each group carries as `label`"),
 				query("granularity", "For a date group_by: the bucket, default day", {
 					type: "string",
 					enum: [
+						"minute",
+						"5_minutes",
+						"15_minutes",
 						"hour",
 						"day",
 						"week",
@@ -611,6 +615,8 @@ const resourcePaths = (access) => {
 				query("range", "For a date group_by: the relative range ending now (default 30d); `all` starts at the earliest row", {
 					type: "string",
 					enum: [
+						"1h",
+						"24h",
 						"7d",
 						"30d",
 						"90d",
@@ -659,6 +665,7 @@ const resourcePaths = (access) => {
 										count: { type: "integer" },
 										sum: { type: ["number", "null"] },
 										average: { type: ["number", "null"] },
+										maximum: { type: ["number", "null"] },
 										splits: {
 											type: "array",
 											description: "Only with `split_by`: the kept values that have rows in the group, in rank order",
@@ -668,7 +675,8 @@ const resourcePaths = (access) => {
 													value: {},
 													count: { type: "integer" },
 													sum: { type: ["number", "null"] },
-													average: { type: ["number", "null"] }
+													average: { type: ["number", "null"] },
+													maximum: { type: ["number", "null"] }
 												}
 											}
 										}
@@ -692,6 +700,8 @@ const resourcePaths = (access) => {
 				query("range", "Relative range ending now (default 30d); `all` starts at the earliest row", {
 					type: "string",
 					enum: [
+						"1h",
+						"24h",
 						"7d",
 						"30d",
 						"90d",
@@ -704,6 +714,9 @@ const resourcePaths = (access) => {
 				query("granularity", "Default day", {
 					type: "string",
 					enum: [
+						"minute",
+						"5_minutes",
+						"15_minutes",
 						"hour",
 						"day",
 						"week",

package/dist/parent-access.js

@@ -0,0 +1,84 @@
+import { tenantScope } from "./tenant.js";
+import { recordDecision, requestAccess } from "./request-access.js";
+import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
+//#region src/parent-access.ts
+/** A record's identity across resources; `1` and `"1"` are the same record. */
+const pathKey = (resource, key) => JSON.stringify([resource, ...key.map(String)]);
+/**
+* The parents these records name through `model.parents`, a null or missing relation naming none, sorted by path key:
+* the order they are locked in, so two writes naming the same parents lock them in the same order. A parent named twice
+* with the same need is checked once.
+*/
+const parentTargets = (model, records) => {
+	const targets = records.flatMap((record) => (model.parents ?? []).flatMap(({ field, access }) => {
+		const value = record[field];
+		if (value === void 0 || value === null) return [];
+		const resource = model.fields[field].relation.resource;
+		return [{
+			field,
+			access,
+			resource,
+			value,
+			key: pathKey(resource, [value])
+		}];
+	}));
+	return targets.filter((target, index) => targets.findIndex((other) => other.key === target.key && other.access === target.access) === index).sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+};
+const mayOn = async (scope, entry, key, need, path) => {
+	const access = await scope.accessOf(entry);
+	if (!access.resolved.operations.read) return false;
+	const found = await fetchReadable(scope.trx, access, key, "hide", scope.lock ? { lock: "no-key-update" } : {});
+	if (!found) return false;
+	if (need === "read") return true;
+	if (!access.resolved.operations.update) return false;
+	const tenant = tenantScope(entry, access.session)?.tenantValue;
+	const keyField = [access.full.fields[access.full.primaryKey[0]]];
+	const filter = access.resolved.rowFilter.update;
+	if (filter && !await fetchRecord(scope.trx, entry, key, tenant, {
+		filter,
+		fields: keyField
+	})) return false;
+	if (access.resolved.recordChecks.includes("update")) {
+		const decision = await recordDecision(access, "update", found.record, {});
+		if (decision === false) return false;
+		if (decision !== true && !await fetchRecord(scope.trx, entry, key, tenant, {
+			filter: decision,
+			fields: keyField
+		})) return false;
+	}
+	return parentsAllow(scope, access, [found.record], [...path, pathKey(entry.name, key)]);
+};
+const parentsAllow = async (scope, access, records, path) => {
+	for (const target of parentTargets(access.full, records)) {
+		if (path.includes(target.key)) return false;
+		const entry = scope.deps.registry.find(target.resource);
+		if (!entry) throw new Error(`Parent "${target.field}" of "${access.entry.name}" points at "${target.resource}", which the app does not have`);
+		if (!await mayOn(scope, entry, [target.value], target.access, path)) return false;
+	}
+	return true;
+};
+const ownPath = (access, records) => records.filter((record) => access.full.primaryKey.every((name) => record[name] !== void 0 && record[name] !== null)).map((record) => pathKey(access.entry.name, access.full.primaryKey.map((name) => record[name])));
+/**
+* Whether the caller may write records of `access`'s resource given the parents they name (`.parent()`): an update passes
+* the record before and after, so the parent it leaves and the one it moves to are locked in one order. With `lock`,
+* each parent is locked FOR NO KEY UPDATE until the transaction ends, so a parent changed or deleted at the same moment
+* cannot slip through; a read-only transaction cannot lock. Every call checks again; only each resource's access for
+* the session is reused.
+*/
+const parentGuard = (trx, access, lock) => {
+	const resolved = /* @__PURE__ */ new Map();
+	const accessOf = (entry) => {
+		if (!resolved.has(entry.name)) resolved.set(entry.name, requestAccess(access.deps, entry, access.session));
+		return resolved.get(entry.name);
+	};
+	const scope = {
+		trx,
+		deps: access.deps,
+		lock,
+		accessOf
+	};
+	return (...records) => parentsAllow(scope, access, records, ownPath(access, records));
+};
+//#endregion
+export { parentGuard, parentTargets, pathKey };

package/dist/read-service.js

@@ -1,40 +1,14 @@
 import { notFound } from "./problem.js";
-import { tenantScope } from "./tenant.js";
-import { recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields } from "./request-access.js";
+import { requestAccess, requireOperation, visibleFields, writableFields } from "./request-access.js";
 import { presentFiles } from "./files/present.js";
 import { pickFields } from "./rows.js";
-import { fetchRecord } from "./records.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { rowPermissions } from "./row-permissions.js";
 import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
 /** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
 const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));
 /**
-* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
-* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
-*/
-const fetchReadable = async (trx, access, key, deleted, { fields, ...shape }) => {
-	const { entry } = access;
-	const tenant = tenantScope(entry, access.session)?.tenantValue;
-	const recordRule = access.resolved.recordChecks.includes("read");
-	const filter = targetFilter(access, "read");
-	const current = await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		...filter && { filter },
-		...shape,
-		...!recordRule && fields && { fields }
-	});
-	if (!current || !recordRule) return current;
-	const decision = await recordDecision(access, "read", current.record);
-	if (decision === false) return void 0;
-	if (decision !== true && !await fetchRecord(trx, entry, key, tenant, {
-		deleted,
-		filter: decision,
-		fields: [access.full.fields[access.full.primaryKey[0]]]
-	})) return void 0;
-	return current;
-};
-/**
 * The record with this key as the caller may see it: readable fields only, inside the caller's tenant and row filter.
 * A key outside the tenant, outside the row filter, or failing a record-level read rule is a plain 404.
 */
@@ -66,4 +40,4 @@ const readRecord = async (deps, entry, session, key, deleted = "hide") => {
 	};
 };
 //#endregion
-export { fetchReadable, fieldModes, readRecord };
+export { fieldModes, readRecord };

package/dist/records.js

@@ -12,6 +12,7 @@ const stored = async (entry, raw, shape = {}) => {
 	};
 };
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
+const lockClause = (lock) => lock === "no-key-update" ? sql` for no key update` : lock ? sql` for update` : sql``;
 /** The row of the caller's tenant with this key (live unless `deleted` says otherwise), optionally narrowed by a filter. */
 const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 	const { filter, deleted, lock = false, ...shape } = options;
@@ -20,7 +21,7 @@ const fetchRecord = async (db, entry, key, tenant, options = {}) => {
 		...keyConditions(entry.model, key),
 		...filterCondition(entry.model, filter)
 	];
-	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lock ? sql` for update` : sql``}`;
+	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lockClause(lock)}`;
 	return stored(entry, (await rowsOf(db, query))[0], shape);
 };
 const writeValue = (field, value) => field.type === "json" && value !== null ? JSON.stringify(value) : value;

package/dist/reveal-service.js

@@ -1,8 +1,8 @@
 import { badRequest, notFound } from "./problem.js";
 import { tenantScope } from "./tenant.js";
 import { requestAccess, requireOperation } from "./request-access.js";
+import { fetchReadable } from "./fetch-readable.js";
 import { readTransaction } from "./transactions.js";
-import { fetchReadable } from "./read-service.js";
 import { encodeKey } from "@protobase/schema/internal";
 //#region src/reveal-service.ts
 /**

package/dist/row-permissions.js

@@ -2,6 +2,7 @@ import { tenantScope } from "./tenant.js";
 import { recordDecision } from "./request-access.js";
 import { aliasedColumn, columnId, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { sql } from "kysely";
 import { compileFilter } from "@protobase/query";
 //#region src/row-permissions.ts
@@ -21,8 +22,8 @@ const matching = async (trx, access, rows, filter) => {
 };
 /**
 * What the caller may do with each of these (exposed) rows: the operation must be allowed, the row must match the
-* operation's row filter (checked in the database), and a record-level rule must pass for the stored record. This only
-* informs the UI; every write is checked again by the write pipeline.
+* operation's row filter (checked in the database), a record-level rule must pass for the stored record, and its parents
+* (`.parent()`) must allow writing it. This only informs the UI; every write is checked again by the write pipeline.
 */
 const rowPermissions = async (trx, access, rows) => {
 	const { resolved, entry, session } = access;
@@ -63,7 +64,23 @@ const rowPermissions = async (trx, access, rows) => {
 			if (decision !== true) result[i][operation] = (await matching(trx, access, [row], decision)).size > 0;
 		}
 	}
+	await withParents(trx, access, rows, result);
 	return result;
 };
+const withParents = async (trx, access, rows, result) => {
+	const { full, entry, session } = access;
+	if (!full.parents?.length) return;
+	const guard = parentGuard(trx, access, false);
+	const fields = [.../* @__PURE__ */ new Set([...full.primaryKey, ...full.parents.map((parent) => parent.field)])].map((name) => full.fields[name]);
+	const tenant = tenantScope(entry, session)?.tenantValue;
+	for (const [i, row] of rows.entries()) {
+		const permissions = result[i];
+		if (!permissions.update && !permissions.delete) continue;
+		const stored = await fetchRecord(trx, entry, full.primaryKey.map((name) => row[name]), tenant, { fields });
+		const allowed = stored !== void 0 && await guard(stored.record);
+		permissions.update &&= allowed;
+		permissions.delete &&= allowed;
+	}
+};
 //#endregion
 export { rowPermissions };

package/dist/view-access.js

@@ -2,6 +2,7 @@ import { openErrors, relatedErrors } from "./view-related.js";
 import { cardPhotosErrors } from "./view-card-photos.js";
 import { cardFavoriteErrors } from "./view-card-favorite.js";
 import { searchesOfFor } from "./view-saved-search.js";
+import { recordChartErrors } from "./view-record-chart.js";
 import { relatedColumnErrors } from "./view-related-column.js";
 import { actionWhenFields } from "./view-action-when.js";
 import { conditionReadable, resolveFieldPath } from "@protobase/layout";
@@ -25,6 +26,16 @@ const pruneRelated = (item, resource, models) => {
 	} : narrowed;
 	return relatedErrors(opened, resource, models).length === 0 ? opened : void 0;
 };
+const pruneRecordChart = (item, resource, models) => {
+	const target = models[item.resource];
+	const series = target ? item.series.filter((name) => Object.hasOwn(target.fields, name)) : [];
+	if (series.length === 0) return void 0;
+	const narrowed = {
+		...item,
+		series
+	};
+	return recordChartErrors(narrowed, resource, models).length === 0 ? narrowed : void 0;
+};
 const recordWhenShape = (resource, models) => shapes.map((when) => isRecordCondition(when) && !conditionReadable(when, resource, models) ? void 0 : when);
 const pruneGallery = (item, resource, model, models) => {
 	const image = item.image !== void 0 && Object.hasOwn(model.fields, item.image) ? item.image : void 0;
@@ -218,6 +229,7 @@ const layoutShape = (resource, model, models) => {
 			sidebar: shapes.data,
 			when: shapes.data
 		}, { requires: ["latitude", "longitude"] }),
+		chart: shapes.map((item) => pruneRecordChart(item, resource, models)),
 		gallery: shapes.map((item) => pruneGallery(item, resource, model, models)),
 		history: shapes.object({
 			kind: shapes.data,
@@ -336,7 +348,7 @@ const viewShape = (resource, model, models, prompted, createPages) => {
 /**
 * The view with every reference to a field the caller cannot read removed: list columns, sort, search and displays,
 * field hints, filter widgets, record sections, maps, galleries and custom components' props, the chart, title and search result, the
-* actions that set or read one, and the sidebar's `recent` group. Nothing in it may name a hidden field. Related sections, related list columns
+* actions that set or read one, and the sidebar's `recent` group. Nothing in it may name a hidden field. Related sections, charts of related records, related list columns
 * and links are checked against `models`, the caller's view of every resource, and so are `searchesOf`, cards' favorite
 * buttons and the "Save search" button; the buttons stay for a visitor when their resource is one of `prompted`, those
 * that ask the visitor to sign in. A create link may give values of any name to a resource of `createPages`, whose view

package/dist/view-record-chart.js

@@ -0,0 +1,42 @@
+import { matchErrors } from "./view-related.js";
+//#region src/view-record-chart.ts
+const numericTypes = [
+	"integer",
+	"bigint",
+	"decimal"
+];
+const ranges = [
+	"1h",
+	"24h",
+	"7d"
+];
+const atErrors = (model, name) => {
+	const field = Object.hasOwn(model.fields, name) ? model.fields[name] : void 0;
+	if (!field) return [`at: unknown field "${name}" on ${model.name}`];
+	if (field.type !== "timestamp") return [`at: "${name}" on ${model.name} is ${field.type}, not a timestamp`];
+	return field.filterable ? [] : [`at: "${name}" on ${model.name} is not filterable`];
+};
+const seriesErrors = (model, name) => {
+	const field = Object.hasOwn(model.fields, name) ? model.fields[name] : void 0;
+	if (!field) return [`series: unknown field "${name}" on ${model.name}`];
+	if (!numericTypes.includes(field.type)) return [`series: "${name}" on ${model.name} is ${field.type}, not a number`];
+	return field.sensitive ? [`series: "${name}" on ${model.name} is sensitive`] : [];
+};
+/**
+* What is wrong with a chart of related records on the record page of `resource`, against these models; empty when it
+* can be shown. Against the full models it checks the config; against a caller's models, whether that caller can use it.
+*/
+const recordChartErrors = (item, resource, models) => {
+	const owner = models[resource];
+	const target = models[item.resource];
+	if (!owner || !target) return [`unknown resource "${owner ? item.resource : resource}"`];
+	if (owner.primaryKey.length !== 1) return [`${resource} has a composite key, so a chart cannot match its records`];
+	return [
+		...matchErrors(target, item.field, resource),
+		...atErrors(target, item.at),
+		...item.series.length === 0 ? ["series: name at least one field"] : item.series.flatMap((name) => seriesErrors(target, name)),
+		...item.range === void 0 || ranges.includes(item.range) ? [] : [`range must be one of ${ranges.join(", ")}, not "${String(item.range)}"`]
+	];
+};
+//#endregion
+export { recordChartErrors };

package/dist/write-pipeline.js

@@ -8,7 +8,7 @@ import { isDatabaseError } from "./error-handler.js";
 import { attachFiles } from "./files/attach.js";
 import { actorSettings, wakeDispatch } from "./changes/actor.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown } from "./write-shared.js";
 import { applyUpdate, planUpdate } from "./write-update.js";
 import { checkRankAfter } from "./rank-after.js";
 //#region src/write-pipeline.ts
@@ -31,8 +31,11 @@ const create = async (trx, deps, access, body) => {
 		...tenantValues
 	};
 	const filter = await decide(access, "create", void 0, row);
+	const parents = checkParents(trx, access, "create");
+	await parents(row);
 	const created = await insertRecord(trx, entry, row, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, created, "create", access.resolved.rowFilter.create, filter);
+	await parents(created.record);
 	if (full.position) await checkRankAfter(trx, deps, access, full.position.field, [{
 		key: keyOf(access, created.record),
 		before: null
@@ -77,6 +80,7 @@ const removeOrRestore = async (trx, deps, access, request) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, operation);
+	await checkParents(trx, access, operation)(current.record);
 	const notify = notifier(deps, access);
 	if (undelete) {
 		const restored = await restoreRecord(trx, entry, request.key, scope?.tenantValue, shape);

package/dist/write-shared.js

@@ -5,6 +5,7 @@ import { presentFiles } from "./files/present.js";
 import { ifMatchSatisfied } from "./etag.js";
 import { pickFields } from "./rows.js";
 import { fetchRecord } from "./records.js";
+import { parentGuard } from "./parent-access.js";
 import { scheduleRemovedFiles } from "./files/attach.js";
 //#region src/write-shared.ts
 const missing = (entry) => notFound(`No ${entry.name} with this key`);
@@ -22,6 +23,17 @@ const decide = async (access, operation, record, input) => {
 	if (decision === false) throw denied(access.entry, operation);
 	return decision === true ? void 0 : decision;
 };
+/**
+* Refuses a write whose records' parents (`.parent()`) do not give the caller the access it needs, with the same answer
+* as a refused record-level rule; each parent stays locked until the write commits.
+*/
+const checkParents = (trx, access, operation) => {
+	if (!access.full.parents?.length) return async (..._records) => {};
+	const guard = parentGuard(trx, access, true);
+	return async (...records) => {
+		if (!await guard(...records)) throw denied(access.entry, operation);
+	};
+};
 const keyOf = (access, record) => access.full.primaryKey.map((name) => record[name]);
 const firstKeyField = (access) => access.full.fields[access.full.primaryKey[0]];
 const assertWritten = async (trx, access, written, operation, ...filters) => {
@@ -53,4 +65,4 @@ const notifier = (deps, access) => async (trx, kind, before, after) => {
 	await scheduleRemovedFiles(access, kind, before, after);
 };
 //#endregion
-export { assertWritten, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };
+export { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, keyOf, missing, notifier, shown };

package/dist/write-update.js

@@ -3,11 +3,12 @@ import { targetFilter } from "./request-access.js";
 import { fetchRecord, updateRecord } from "./records.js";
 import { attachFiles } from "./files/attach.js";
 import { validateBody } from "./validate-body.js";
-import { assertWritten, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
+import { assertWritten, checkParents, checkPrecondition, decide, denied, firstKeyField, missing, notifier } from "./write-shared.js";
 //#region src/write-update.ts
 /**
 * Everything an update needs before it writes: the row (locked, inside the caller's tenant and row filters), the ETag
-* precondition, validation against the fields the caller may write, and the record-level rule with its filter.
+* precondition, validation against the fields the caller may write, the record-level rule with its filter, and the
+* parents (`.parent()`) it leaves and moves to, checked in one call so they are locked in one order.
 */
 const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 	const { entry, full } = access;
@@ -27,10 +28,16 @@ const planUpdate = async (trx, access, key, body, ifMatch, required = true) => {
 		filter,
 		fields: [firstKeyField(access)]
 	})) throw denied(entry, "update");
+	const parents = checkParents(trx, access, "update");
+	if (Object.keys(values).length > 0) await parents(current.record, {
+		...current.record,
+		...values
+	});
 	return {
 		current,
 		values,
-		...filter && { filter }
+		...filter && { filter },
+		parents
 	};
 };
 /** Writes a planned update, checks the row as written against the filters, and runs the hooks. */
@@ -39,6 +46,7 @@ const applyUpdate = async (trx, deps, access, key, plan) => {
 	const tenant = tenantScope(entry, access.session)?.tenantValue;
 	const updated = await updateRecord(trx, entry, key, tenant, plan.values, { etagFields: Object.keys(access.model.fields) });
 	await assertWritten(trx, access, updated, "update", access.resolved.rowFilter.update, plan.filter);
+	await plan.parents(updated.record);
 	await notifier(deps, access)(trx, "update", plan.current.record, updated.record);
 	return updated;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.28.0",
+  "version": "0.28.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -32,9 +32,9 @@
   "dependencies": {
     "@better-auth/passkey": "^1.7.7",
     "@better-auth/sso": "^1.7.7",
-    "@protobase/layout": "0.28.0",
-    "@protobase/query": "0.28.0",
-    "@protobase/schema": "0.28.0",
+    "@protobase/layout": "0.28.2",
+    "@protobase/query": "0.28.2",
+    "@protobase/schema": "0.28.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",