@protobase/server 0.39.0 → 0.39.2

package/dist/meta-model.js

@@ -0,0 +1,27 @@
+import { writeOnlyFields } from "./request-access.js";
+//#region src/meta-model.ts
+const writeOnly = (field) => ({
+	...field,
+	readOnly: false,
+	filterable: false,
+	sortable: false,
+	aliases: [],
+	sensitive: true,
+	writeOnly: true
+});
+/** The resource as `/meta` sends it to the caller: the fields they read, and their write-only ones marked `writeOnly`. */
+const metaModel = (access) => {
+	const names = new Set(writeOnlyFields(access));
+	if (names.size === 0) return access.readable;
+	const fields = Object.entries(access.full.fields).flatMap(([name, field]) => {
+		if (names.has(name)) return [[name, writeOnly(field)]];
+		const readable = access.readable.fields[name];
+		return readable ? [[name, readable]] : [];
+	});
+	return {
+		...access.readable,
+		fields: Object.fromEntries(fields)
+	};
+};
+//#endregion
+export { metaModel };

package/dist/meta.d.ts

@@ -60,7 +60,7 @@ export type CallerMeta = {
 };
 /**
  * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
- * absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
+ * absent, `readOnly` unless writable, write-only ones marked), the view for their roles with hidden fields pruned, what they may do, and the
  * user menu and their bottom bar without the resources they cannot see. A visitor also gets the prompts of the resources
  * they could use once signed in, which keep their place in the bottom bar and the user menu.
  * The ETag hashes all of it, so it differs per user and per roles.

package/dist/meta.js

@@ -1,9 +1,10 @@
-import { requestAccess } from "./request-access.js";
+import { requestAccess, writeOnlyFields } from "./request-access.js";
 import { sha256Hex, stableJson } from "./hash.js";
 import { seesAssistant } from "./assistant/assistant-settings.js";
 import { pruneView } from "./view-access.js";
 import { activeRole } from "./active-role.js";
 import { pluginsFor } from "./plugins/plugin-settings.js";
+import { metaModel } from "./meta-model.js";
 import { seesRuntime } from "./runtime/runtime-settings.js";
 import { sourcesFor } from "./sources/source-settings.js";
 import { prunePage } from "@protobase/layout";
@@ -23,7 +24,7 @@ const signInView = (view) => {
 const modelsHash = (deps) => sha256Hex(stableJson(deps.registry.entries.map((entry) => entry.model))).then((hash) => hash.slice(0, 32));
 /**
 * `/meta` as one caller sees it: the resources they can do anything with, each as the restricted model (hidden fields
-* absent, `readOnly` unless writable), the view for their roles with hidden fields pruned, what they may do, and the
+* absent, `readOnly` unless writable, write-only ones marked), the view for their roles with hidden fields pruned, what they may do, and the
 * user menu and their bottom bar without the resources they cannot see. A visitor also gets the prompts of the resources
 * they could use once signed in, which keep their place in the bottom bar and the user menu.
 * The ETag hashes all of it, so it differs per user and per roles.
@@ -44,7 +45,7 @@ const createMeta = (deps, appName, appIcon) => {
 			}] : [];
 		});
 		const createPages = new Set(picked.filter(({ view }) => view.create).map(({ view }) => view.resource));
-		const views = picked.map(({ access, view }) => pruneView(view, access.readable, listed, prompted, createPages));
+		const views = picked.map(({ access, view }) => pruneView(view, access.readable, listed, prompted, createPages, new Set(writeOnlyFields(access))));
 		const callerAccess = {
 			createPages,
 			models: listed,
@@ -63,7 +64,7 @@ const createMeta = (deps, appName, appIcon) => {
 		const body = {
 			appName,
 			...appIcon && { appIcon },
-			resources: visible.map((access) => access.readable),
+			resources: visible.map(metaModel),
 			views,
 			pages,
 			permissions: Object.fromEntries(visible.map(({ entry, resolved, full }) => [entry.name, {

package/dist/read-service.js

@@ -6,8 +6,16 @@ import { fetchReadable } from "./fetch-readable.js";
 import { rowPermissions } from "./row-permissions.js";
 import { readTransaction } from "./transactions.js";
 //#region src/read-service.ts
-/** `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields are not listed at all. */
-const fieldModes = (access, canUpdate) => Object.fromEntries(Object.keys(access.readable.fields).map((name) => [name, canUpdate && writableFields(access, "update").includes(name) ? "edit" : "read"]));
+/**
+* `edit` for fields the caller may change on this record, `read` for the rest (sensitive ones included); hidden fields
+* are not listed at all, nor is a write-only one unless the caller may change it here.
+*/
+const fieldModes = (access, canUpdate) => {
+	const writable = canUpdate ? writableFields(access, "update") : [];
+	const readable = Object.keys(access.readable.fields).map((name) => [name, writable.includes(name) ? "edit" : "read"]);
+	const writeOnly = writable.filter((name) => !Object.hasOwn(access.readable.fields, name)).map((name) => [name, "edit"]);
+	return Object.fromEntries([...readable, ...writeOnly]);
+};
 /**
 * The record with this key as the caller may see it: readable fields only, inside the caller's tenant and row filter.
 * A key outside the tenant, outside the row filter, or failing a record-level read rule is a plain 404.

package/dist/request-access.js

@@ -72,6 +72,11 @@ const writesBlind = (access, name, mode) => access.entry.source.fieldAccess()[na
 * by the server.
 */
 const writableFields = (access, mode) => access.resolved.writableFields[mode].filter((name) => (Object.hasOwn(access.readable.fields, name) || writesBlind(access, name, mode)) && name !== access.full.tenant);
+/** The write-only fields: those the caller may write on create or on update but not read, in the model's order. */
+const writeOnlyFields = (access) => {
+	const writable = /* @__PURE__ */ new Set([...writableFields(access, "create"), ...writableFields(access, "update")]);
+	return Object.keys(access.full.fields).filter((name) => writable.has(name) && !Object.hasOwn(access.readable.fields, name));
+};
 const visibleFields = (access) => Object.values(access.model.fields);
 const andFilters = (filters) => {
 	const present = filters.filter((filter) => filter !== void 0);
@@ -135,4 +140,4 @@ const recordDecision = async (access, operation, record, input) => {
 	return asFilter(access, result, operation);
 };
 //#endregion
-export { andFilters, readScope, recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields };
+export { andFilters, readScope, recordDecision, requestAccess, requireOperation, targetFilter, visibleFields, writableFields, writeOnlyFields };

package/dist/view-access.js

@@ -187,7 +187,13 @@ const widgetShape = shapes.oneOf({
 		secondary: shapes.data
 	}, { requires: ["fields"] })
 });
-const layoutShape = (resource, model, models) => {
+const formFields = (model, writeOnly) => (name) => Object.hasOwn(model.fields, name) || writeOnly.has(name);
+const sectionFields = (model, writeOnly) => shapes.map((names) => {
+	const kept = names.filter(formFields(model, writeOnly));
+	return kept.length > 0 ? kept : void 0;
+});
+const fieldHints = (model, writeOnly) => shapes.map((hints) => Object.fromEntries(Object.entries(hints).filter(([name]) => formFields(model, writeOnly)(name))));
+const layoutShape = (resource, model, models, writeOnly) => {
 	const when = recordWhenShape(resource, models);
 	const section = shapes.object({
 		kind: shapes.data,
@@ -196,7 +202,7 @@ const layoutShape = (resource, model, models) => {
 		helpWhen: shapes.data,
 		presentation: shapes.data,
 		when,
-		fields: shapes.list(shapes.field, { nonEmpty: true })
+		fields: sectionFields(model, writeOnly)
 	}, { requires: ["fields", "when"] });
 	const related = shapes.map((item) => pruneRelated(item, resource, models));
 	const main = {
@@ -297,7 +303,7 @@ const actionShape = (model, models, createPages) => shapes.object({
 	"inputs",
 	"when"
 ] });
-const viewShape = (resource, model, models, prompted, createPages) => {
+const viewShape = (resource, model, models, prompted, createPages, writeOnly) => {
 	const nav = shapes.object({
 		hidden: shapes.data,
 		group: shapes.data,
@@ -317,10 +323,10 @@ const viewShape = (resource, model, models, prompted, createPages) => {
 		names: shapes.data,
 		icon: shapes.data,
 		help: shapes.data,
-		fields: shapes.keys(),
+		fields: fieldHints(model, writeOnly),
 		list: listShape(resource, model, models, prompted),
 		filters: shapes.list(widgetShape),
-		layout: shapes.list(layoutShape(resource, model, models)),
+		layout: shapes.list(layoutShape(resource, model, models, writeOnly)),
 		chart,
 		recordMode: shapes.data,
 		helpWhen: shapes.data,
@@ -352,10 +358,10 @@ const viewShape = (resource, model, models, prompted, createPages) => {
 * and links are checked against `models`, the caller's view of every resource, and so are `searchesOf`, cards' favorite
 * buttons and the "Save search" button; the buttons stay for a visitor when their resource is one of `prompted`, those
 * that ask the visitor to sign in. A create link may give values of any name to a resource of `createPages`, whose view
-* for the caller opens a create page.
+* for the caller opens a create page. The caller's `writeOnly` fields stay in record sections and field hints only.
 */
-const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set(), createPages = /* @__PURE__ */ new Set()) => {
-	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted, createPages), (name) => Object.hasOwn(model.fields, name));
+const pruneView = (view, model, models, prompted = /* @__PURE__ */ new Set(), createPages = /* @__PURE__ */ new Set(), writeOnly = /* @__PURE__ */ new Set()) => {
+	const pruned = pruneByShape(view, viewShape(view.resource, model, models, prompted, createPages, writeOnly), (name) => Object.hasOwn(model.fields, name));
 	if (!pruned) throw new Error(`The view of ${view.resource} is not an object`);
 	return pruned;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.39.0",
+  "version": "0.39.2",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -36,9 +36,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.39.0",
-    "@protobase/query": "0.39.0",
-    "@protobase/schema": "0.39.0",
+    "@protobase/layout": "0.39.2",
+    "@protobase/query": "0.39.2",
+    "@protobase/schema": "0.39.2",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",