@protobase/server 0.38.0 → 0.39.1

package/dist/batch/reorder.js

@@ -3,7 +3,7 @@ import { tenantScope } from "../tenant.js";
 import { requireOperation, targetFilter, writableFields } from "../request-access.js";
 import { columnId, keyConditions, scopeConditions, tableId, whereClause } from "../sql-parts.js";
 import { fetchRecord } from "../records.js";
-import { validateBody } from "../validate-body.js";
+import { refuseUnknownField, validateBody } from "../validate-body.js";
 import { missing, shown } from "../write-shared.js";
 import { applyUpdate, planUpdate } from "../write-update.js";
 import { checkRankAfter } from "../rank-after.js";
@@ -50,6 +50,7 @@ const reorderIn = async (trx, deps, access, input) => {
 	const { entry, full } = access;
 	requireOperation(access, "update");
 	const field = full.fields[input.field];
+	if (!Object.hasOwn(access.readable.fields, input.field)) refuseUnknownField(input.field);
 	validateBody(access, "update", { [input.field]: 1 });
 	if (field?.type !== "integer" && field?.type !== "bigint") throw badRequest("invalid-parameter", `"${input.field}" must be an integer field to order by`);
 	if (!writableFields(access, "update").includes(input.field)) throw badRequest("invalid-parameter", `"${input.field}" is read-only`);

package/dist/meta-model.js

@@ -0,0 +1,27 @@
+import { writeOnlyFields } from "./request-access.js";
+//#region src/meta-model.ts
+const writeOnly = (field) => ({
+	...field,
+	readOnly: false,
+	filterable: false,
+	sortable: false,
+	aliases: [],
+	sensitive: true,
+	writeOnly: true
+});
+/** The resource as `/meta` sends it to the caller: the fields they read, and their write-only ones marked `writeOnly`. */
+const metaModel = (access) => {
+	const names = new Set(writeOnlyFields(access));
+	if (names.size === 0) return access.readable;
+	const fields = Object.entries(access.full.fields).flatMap(([name, field]) => {
+		if (names.has(name)) return [[name, writeOnly(field)]];
+		const readable = access.readable.fields[name];
+		return readable ? [[name, readable]] : [];
+	});
+	return {
+		...access.readable,
+		fields: Object.fromEntries(fields)
+	};
+};
+//#endregion
+export { metaModel };

package/dist/meta.d.ts

@@ -60,7 +60,7 @@ export type CallerMeta = {
 };
 /**
  * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
- * absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
+ * absent, `readOnly` unless writable, write-only ones marked), the view for their roles with hidden fields pruned, what they may do, and the
  * user menu and their bottom bar without the resources they cannot see. A visitor also gets the prompts of the resources
  * they could use once signed in, which keep their place in the bottom bar and the user menu.
  * The ETag hashes all of it, so it differs per user and per roles.

package/dist/meta.js

@@ -1,9 +1,10 @@
-import { requestAccess } from "./request-access.js";
+import { requestAccess, writeOnlyFields } from "./request-access.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { seesAssistant } from "./assistant/assistant-settings.js";
 import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
+import { metaModel } from "./meta-model.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
 import { prunePage } from "@protobase/layout";
@@ -23,7 +24,7 @@ const signInView = (view) => {
 const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((entry) => entry.model))).then((hash) => hash.slice(0, 32));
 /**
 * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
-* absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
+* absent, `readOnly` unless writable, write-only ones marked), the view for their roles with hidden fields pruned, what they may do, and the
 * user menu and their bottom bar without the resources they cannot see. A visitor also gets the prompts of the resources
 * they could use once signed in, which keep their place in the bottom bar and the user menu.
 * The ETag hashes all of it, so it differs per user and per roles.
@@ -44,7 +45,7 @@ const createMeta = (deps, appName, appIcon) => {
 			}] : [];
 		});
 		const createPages = new Set(picked.filter(({ view }) => view.create).map(({ view }) => view.resource));
-		const views = picked.map(({ access, view }) => pruneView(view, access.readable, listed, prompted, createPages));
+		const views = picked.map(({ access, view }) => pruneView(view, access.readable, listed, prompted, createPages, new Set(writeOnlyFields(access))));
 		const callerAccess = {
 			createPages,
 			models: listed,
@@ -63,7 +64,7 @@ const createMeta = (deps, appName, appIcon) => {
 		const body = {
 			appName,
 			...appIcon && { appIcon },
-			resources: visible.map((access) => access.readable),
+			resources: visible.map(metaModel),
 			views,
 			pages,
 			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {

package/dist/openapi/schemas.js

@@ -69,7 +69,7 @@ const only = (schema, names) => ({
 });
 /**
 * Component schemas of a resource for one caller: the record with the fields they may read, and the create and update
-* bodies with the fields they may write. Hidden fields appear nowhere.
+* bodies with the fields they may write. Hidden fields appear nowhere; a write-only one only in the bodies.
 */
 const resourceSchemas = (access) => {
 	const { entry, model, resolved } = access;
@@ -104,7 +104,7 @@ const resourceSchemas = (access) => {
 		}
 	};
 	record.required = [...record.required ?? [], "etag"];
-	const writable = access.readable;
+	const writable = access.full;
 	const body = (names) => {
 		const properties = only(input.schema, names).properties;
 		const optional = new Set(names.filter((field) => writable.fields[field]?.nullable || writable.fields[field]?.default && "db" in writable.fields[field].default));

package/dist/read-service.js

@@ -6,8 +6,16 @@ import { fetchReadable } from "./fetch-readable.js";
 import { rowPermissions } from "./row-permissions.js";
 import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
-/** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
-const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));
+/**
+* `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields
+* are not listed at all, nor is a write-only one unless the caller may change it here.
+*/
+const fieldModes = (access, canUpdate) => {
+	const writable = canUpdate ? writableFields(access, "update") : [];
+	const readable = Object.keys(access.readable.fields).map((name) => [name, writable.includes(name) ? "edit" : "read"]);
+	const writeOnly = writable.filter((name) => !Object.hasOwn(access.readable.fields, name)).map((name) => [name, "edit"]);
+	return Object.fromEntries([...readable, ...writeOnly]);
+};
 /**
 * The record with this key as the caller may see it: readable fields only, inside the caller's tenant and row filter.
 * A key outside the tenant, outside the row filter, or failing a record-level read rule is a plain 404.

package/dist/request-access.js

@@ -65,11 +65,18 @@ const requireOperation = (access, operation) => {
 	if (access.session.anonymous) throw unauthorized(`Send a bearer token to ${operation} ${access.entry.name}`);
 	throw forbidden("access-denied", `You may not ${operation} ${access.entry.name}`);
 };
+const writesBlind = (access, name, mode) => access.entry.source.fieldAccess()[name]?.[mode] !== void 0 && !access.full.fields[name]?.file && name !== access.full.position?.field;
 /**
-* Fields the caller may write on create or update. A field they cannot read is never writable, even when its write rule
-* allows it (nobody writes blind; a sensitive field counts as readable); the tenant column is always set by the server.
+* Fields the caller may write on create or update: those they read (a sensitive field counts as read), and write-only
+* ones, which they cannot read but whose own write rule allows them (see `writesBlind`). The tenant column is always set
+* by the server.
 */
-const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => Object.hasOwn(access.readable.fields, name) && name !== access.full.tenant);
+const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => (Object.hasOwn(access.readable.fields, name) || writesBlind(access, name, mode)) && name !== access.full.tenant);
+/** The write-only fields: those the caller may write on create or on update but not read, in the model's order. */
+const writeOnlyFields = (access) => {
+	const writable = /* @__PURE__ */ new Set([...writableFields(access, "create"), ...writableFields(access, "update")]);
+	return Object.keys(access.full.fields).filter((name) => writable.has(name) && !Object.hasOwn(access.readable.fields, name));
+};
 const visibleFields = (access) => Object.values(access.model.fields);
 const andFilters = (filters) => {
 	const present = filters.filter((filter) => filter !== void 0);
@@ -133,4 +140,4 @@ const recordDecision = async (access, operation, record, input) => {
 	return asFilter(access, result, operation);
 };
 //#endregion
-export { andFilters, readScope, recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields };
+export { andFilters, readScope, recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields, writeOnlyFields };

package/dist/validate-body.js

@@ -17,6 +17,15 @@ const invalidValue = (field, issue) => {
 		...params && { params }
 	};
 };
+const unknownField = (name) => ({
+	field: name,
+	code: "unknown-field",
+	message: `Unknown field "${name}"`
+});
+/** Refuses a field the caller may not name in this request as `validateBody` refuses an unknown one. */
+const refuseUnknownField = (name) => {
+	throw fail([unknownField(name)]);
+};
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const reserved = ["etag", "permissions"];
 const isEmptyText = (field, value) => field.type === "text" && !field.nullable && value === "";
@@ -26,11 +35,11 @@ const isEmptyText = (field, value) => field.type === "text" && !field.nullable &
 */
 const requiredOnCreate = (field, schema) => !(field.default && "db" in field.default) && !field.nullable && !schema.safeParse(void 0).success;
 /**
-* Checks a create or update body for this caller. A field the caller cannot read is an unknown field, one they can read
-* but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always read-only);
-* every provided value goes through its field's zod schema, then `.validate()` rules run on the result. An empty text
-* for a text field that may not be null counts as not given: a create fills in its default or reports it required,
-* an update reports it required. Only the values written are checked, so a stored '' still reads.
+* Checks a create or update body for this caller. A field the caller can neither read nor write is an unknown field, one
+* they can read but not write is read-only (the tenant column and the API's own `etag` and `permissions` keys are always
+* read-only), and a write-only one (see `writableFields`) is written like any other; every provided value goes through
+* its field's zod schema, then `.validate()` rules run on the result. An empty text for a text field that may not be null
+* counts as not given: a create fills in its default or reports it required, an update reports it required. Only the values written are checked, so a stored '' still reads.
 * Returns only the values to write: on create the defaults are filled in, on update only the provided fields.
 * `current` is the stored record an update merges into for `.validate()` rules, which get a set encrypted field of it as
 * `encrypted`: they see an encrypted value as text only when this write gives it.
@@ -46,11 +55,7 @@ const validateBody = (access, mode, body, current = {}) => {
 		code: "read-only",
 		message: name === "etag" ? "The version is not part of the body; send it in the If-Match header" : `"${name}" is read-only`
 	});
-	else if (!Object.hasOwn(model.fields, name)) errors.push({
-		field: name,
-		code: "unknown-field",
-		message: `Unknown field "${name}"`
-	});
+	else if (!Object.hasOwn(model.fields, name) && !writable.has(name)) errors.push(unknownField(name));
 	else if (!writable.has(name) || name === full.tenant) errors.push({
 		field: name,
 		code: "read-only",
@@ -92,11 +97,11 @@ const validateBody = (access, mode, body, current = {}) => {
 	};
 	const issues = entry.source.validators.flatMap((validate) => validate(merged) ?? []);
 	if (issues.length > 0) throw fail(issues.map((issue) => ({
-		field: Object.hasOwn(model.fields, issue.field) ? issue.field : "_record",
+		field: Object.hasOwn(model.fields, issue.field) || writable.has(issue.field) ? issue.field : "_record",
 		code: "invalid-record",
 		message: issue.message
 	})));
 	return values;
 };
 //#endregion
-export { requiredOnCreate, validateBody };
+export { refuseUnknownField, requiredOnCreate, validateBody };

package/dist/view-access.js

@@ -187,7 +187,13 @@ const widgetShape = shapes.oneOf({
 		secondary: shapes.data
 	}, { requires: ["fields"] })
 });
-const layoutShape = (resource, model, models) => {
+const formFields = (model, writeOnly) => (name) => Object.hasOwn(model.fields, name) || writeOnly.has(name);
+const sectionFields = (model, writeOnly) => shapes.map((names) => {
+	const kept = names.filter(formFields(model, writeOnly));
+	return kept.length > 0 ? kept : void 0;
+});
+const fieldHints = (model, writeOnly) => shapes.map((hints) => Object.fromEntries(Object.entries(hints).filter(([name]) => formFields(model, writeOnly)(name))));
+const layoutShape = (resource, model, models, writeOnly) => {
 	const when = recordWhenShape(resource, models);
 	const section = shapes.object({
 		kind: shapes.data,
@@ -196,7 +202,7 @@ const layoutShape = (resource, model, models) => {
 		helpWhen: shapes.data,
 		presentation: shapes.data,
 		when,
-		fields: shapes.list(shapes.field, { nonEmpty: true })
+		fields: sectionFields(model, writeOnly)
 	}, { requires: ["fields", "when"] });
 	const related = shapes.map((item) => pruneRelated(item, resource, models));
 	const main = {
@@ -297,7 +303,7 @@ const actionShape = (model, models, createPages) => shapes.object({
 	"inputs",
 	"when"
 ] });
-const viewShape = (resource, model, models, prompted, createPages) => {
+const viewShape = (resource, model, models, prompted, createPages, writeOnly) => {
 	const nav = shapes.object({
 		hidden: shapes.data,
 		group: shapes.data,
@@ -317,10 +323,10 @@ const viewShape = (resource, model, models, prompted, createPages) => {
 		names: shapes.data,
 		icon: shapes.data,
 		help: shapes.data,
-		fields: shapes.keys(),
+		fields: fieldHints(model, writeOnly),
 		list: listShape(resource, model, models, prompted),
 		filters: shapes.list(widgetShape),
-		layout: shapes.list(layoutShape(resource, model, models)),
+		layout: shapes.list(layoutShape(resource, model, models, writeOnly)),
 		chart,
 		recordMode: shapes.data,
 		helpWhen: shapes.data,
@@ -352,10 +358,10 @@ const viewShape = (resource, model, models, prompted, createPages) => {
 * and links are checked against `models`, the caller's view of every resource, and so are `searchesOf`, cards' favorite
 * buttons and the "Save search" button; the buttons stay for a visitor when their resource is one of `prompted`, those
 * that ask the visitor to sign in. A create link may give values of any name to a resource of `createPages`, whose view
-* for the caller opens a create page.
+* for the caller opens a create page. The caller's `writeOnly` fields stay in record sections and field hints only.
 */
-const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set(), createPages = /* @__PURE__ */ new Set()) => {
-	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted, createPages), (name) => Object.hasOwn(model.fields, name));
+const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set(), createPages = /* @__PURE__ */ new Set(), writeOnly = /* @__PURE__ */ new Set()) => {
+	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted, createPages, writeOnly), (name) => Object.hasOwn(model.fields, name));
 	if (!pruned) throw new Error(`The view of ${view.resource} is not an object`);
 	return pruned;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.38.0",
+  "version": "0.39.1",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.38.0",
-    "@protobase/query": "0.38.0",
-    "@protobase/schema": "0.38.0",
+    "@protobase/layout": "0.39.1",
+    "@protobase/query": "0.39.1",
+    "@protobase/schema": "0.39.1",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",