@protobase/server 0.54.6 → 0.55.0

package/dist/aggregate-service.js

@@ -8,7 +8,7 @@ import { parseParams } from "./params.js";
 import { rangeEnd, rangeStart } from "./range-ends.js";
 import { columnId, filterCondition, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { z } from "zod";
-import { facetCounts, histogram, series, tenantCondition, withoutField } from "@protobase/query";
+import { facetCounts, histogram, parentCondition, series, tenantCondition, withoutField } from "@protobase/query";
 import { sql } from "kysely";
 //#region src/aggregate-service.ts
 const field = z.string().min(1);
@@ -113,7 +113,8 @@ const earliest = async (deps, access, fieldName, scope) => {
 	const conditions = [
 		...scopeConditions(access.full, scope.tenantValue),
 		...across,
-		...filterCondition(access.full, scope.rowFilter)
+		...filterCondition(access.full, scope.rowFilter),
+		...(scope.parents ?? []).map(parentCondition)
 	];
 	return (await readTransaction(deps.db, deps.statementTimeoutMs, (trx) => sql`select min(${columnId(target)})::text as lowest from ${tableId(access.full)} as t${whereClause(conditions)}`.execute(trx))).rows[0]?.lowest ?? void 0;
 };

package/dist/check-parents.js

@@ -12,5 +12,10 @@ const checkParents = (registry) => {
 	}));
 	if (problems.length > 0) throw new Error(`The parents cannot find the records they point at:\n${problems.map((problem) => `  - ${problem}`).join("\n")}`);
 };
+/**
+* The resources whose lists would read across tenants (`tenantAcross`) but keep to the parents the caller reads, which
+* are resolved in the caller's own tenant only: they list that tenant alone.
+*/
+const parentWarnings = (registry) => registry.entries.filter(({ model }) => model.tenantAcross && model.parents?.some((parent) => parent.access === "read")).map(({ name }) => `"${name}" keeps to the parents its readers read (.parent(..., 'read')), so its lists read the caller's own tenant only: tenantAcross is ignored`);
 //#endregion
-export { checkParents };
+export { checkParents, parentWarnings };

package/dist/check-views.js

@@ -9,7 +9,7 @@ import { relatedColumnErrors } from "./view-related-column.js";
 import { editableErrors } from "./view-editable.js";
 import { actionWhenErrors, actionWhenFields } from "./view-action-when.js";
 import { conditionProblems } from "@protobase/layout";
-import { actionInputErrors, addressErrors, addressPlaceholders, boardErrors, chartFields, datesErrors, displayFields, fieldRefsIn, hrefField, hrefPlaceholders, layoutItems, linkActionError, promptError, promptFields, updateSetErrors, viewOfList } from "@protobase/schema/internal";
+import { actionInputErrors, addressErrors, addressPlaceholders, boardErrors, builtInFieldTypes, chartFields, datesErrors, displayFields, fieldRefsIn, hrefField, hrefPlaceholders, layoutItems, linkActionError, promptError, promptFields, updateSetErrors, viewOfList } from "@protobase/schema/internal";
 import { isRecordCondition } from "@protobase/schema";
 //#region src/check-views.ts
 const linkFields = (run) => run?.kind !== "link" ? [] : "to" in run ? addressPlaceholders(run.to) : hrefPlaceholders(run.href);
@@ -106,8 +106,12 @@ const unknownFieldErrors = (view, model) => {
 		...layoutItems(view.layout).flatMap((item) => item.kind === "gallery" && item.image !== void 0 ? unknown([item.image], `gallery "${item.title}"`) : [])
 	];
 };
-const widgetErrors = (view, model, fieldTypes) => Object.entries(view.fields).flatMap(([name, hints]) => {
-	const of = hints.widget && fieldTypes[hints.widget.name];
+const widgetErrors = (view, model, registered) => Object.entries(view.fields).flatMap(([name, hints]) => {
+	const fieldTypes = {
+		...builtInFieldTypes,
+		...registered
+	};
+	const of = hints.widget && Object.hasOwn(fieldTypes, hints.widget.name) ? fieldTypes[hints.widget.name] : void 0;
 	const field = model.fields[name];
 	if (!of || !field || of.includes(field.type)) return [];
 	return [`field "${name}" is ${field.type}, and its field type "${hints.widget.name}" shows only ${of.join(", ")}`];
@@ -144,7 +148,7 @@ const listOfErrors = (model, name, models) => {
 /**
 * Fails at startup when a view uses a sensitive field where it would show empty, a display or custom section names a
 * field the resource does not have, labels or colours values its enum does not have, shows a field with a field type of
-* `fieldTypes` (each with the storage types it shows) that does not show it,
+* `fieldTypes` (each with the storage types it shows) or a built-in one that does not show it,
 * edits a list column in its cell that is not a field with an editor of one line the API may write,
 * has a section, related section or sidebar whose `when` condition names what the app does not have, a related section or related list column, a cards display's or gallery's photos or a cards display's favorite button, a `listOf`, a "Save search" button or a
 * `searchesOf` that do not fit the resources, cards

package/dist/create-admin.js

@@ -66,7 +66,7 @@ import { liveSessions } from "./better-auth/live-sessions.js";
 import { checkBottomBars, checkShell } from "./check-shell.js";
 import { checkOwnerFields } from "./check-owners.js";
 import { checkRoleLimits } from "./check-roles.js";
-import { checkParents } from "./check-parents.js";
+import { checkParents, parentWarnings } from "./check-parents.js";
 import { checkPositionAfter } from "./check-position-after.js";
 import { checkViews } from "./check-views.js";
 import { liveRoutes } from "./live/live-route.js";
@@ -147,6 +147,7 @@ const createAdmin = ({ resources: appResources, views: appViews = [], pages = []
 	if (options.mcp) checkMcpWrites(registry, declaredRoles(auth, options.roles), options.mcp.writes);
 	checkPositionAfter(registry);
 	checkParents(registry);
+	for (const warning of parentWarnings(registry)) console.warn(warning);
 	const resourceModels = Object.fromEntries(registry.entries.map((entry) => [entry.name, entry.model]));
 	checkPages([...pageModels, accountModel], {
 		models: resourceModels,

package/dist/fetch-readable.js

@@ -3,9 +3,9 @@ import { recordDecision, targetFilter } from "./request-access.js";
 import { fetchRecord } from "./records.js";
 //#region src/fetch-readable.ts
 /**
-* The row with this key if the caller may read it: inside their tenant and row filter, and passing a record-level read
-* rule. Such a rule may look at fields the caller cannot see, so then the whole row is read; the caller cuts it down.
-* `lock` locks the row the first read finds.
+* The row with this key if the caller may read it: inside their tenant, row filter and the parents they read, and
+* passing a record-level read rule. Such a rule may look at fields the caller cannot see, so then the whole row is read;
+* the caller cuts it down. `lock` locks the row the first read finds.
 */
 const fetchReadable = async (trx, access, key, deleted, { fields, lock, ...shape }) => {
 	const { entry } = access;
@@ -15,6 +15,7 @@ const fetchReadable = async (trx, access, key, deleted, { fields, lock, ...shape
 	const current = await fetchRecord(trx, entry, key, tenant, {
 		deleted,
 		...filter && { filter },
+		parents: access.parents,
 		...lock && { lock },
 		...shape,
 		...!recordRule && fields && { fields }

package/dist/package.js

@@ -1,4 +1,4 @@
 //#region package.json
-var version = "0.54.6";
+var version = "0.55.0";
 //#endregion
 export { version };

package/dist/parent-reads.js

@@ -0,0 +1,30 @@
+//#region src/parent-reads.ts
+/**
+* The parents the caller must read for a record of `entry` to be seen (`.parent(fk, 'read')`), each with the caller's
+* scope on the parent's resource: tenant, read row filter, soft delete and its own parents. A caller who cannot read the
+* parent resource, or whose read rule there needs the record, which no query can express, reads no parent. `chain` holds
+* the resources whose parents led here: one already on it is not followed further, so a resource that is its own parent,
+* such as a tree, is checked one level up.
+*/
+const parentReads = async (entry, session, chain, accessOf, find) => {
+	if (chain.includes(entry.name)) return [];
+	const reads = (entry.model.parents ?? []).filter((parent) => parent.access === "read");
+	return Promise.all(reads.map(async ({ field }) => {
+		const relation = entry.model.fields[field];
+		const parentEntry = find(relation.relation.resource);
+		if (!parentEntry) throw new Error(`Parent "${field}" of "${entry.name}" points at "${relation.relation.resource}", which the app does not have`);
+		if (parentEntry.model.tenant && session.tenant === void 0) return { field: relation };
+		const access = await accessOf(parentEntry, [...chain, entry.name]);
+		if (!access.resolved.operations.read || access.resolved.recordChecks.includes("read")) return { field: relation };
+		return {
+			field: relation,
+			parent: {
+				model: access.full,
+				key: access.full.fields[access.full.primaryKey[0]],
+				scope: access.scope
+			}
+		};
+	}));
+};
+//#endregion
+export { parentReads };

package/dist/read-scope.js

@@ -15,7 +15,7 @@ const listsAsMuch = (own, other) => other.resolved.operations.list && Object.key
 const otherTenants = async (access) => {
 	const { deps, entry, session } = access;
 	const own = session.tenant;
-	if (!access.model.tenantAcross || own === void 0 || !session.memberships) return [];
+	if (!access.model.tenantAcross || own === void 0 || !session.memberships || access.parents.length > 0) return [];
 	const memberships = new Map((await session.memberships()).filter((membership) => !sameTenant(membership.tenant, own)).map((membership) => [String(membership.tenant), membership]));
 	return (await Promise.all([...memberships.values()].map(async (membership) => {
 		const other = await requestAccess(deps, entry, memberSession(session, membership));

package/dist/records.js

@@ -2,6 +2,7 @@ import { exposeRow, pickFields } from "./rows.js";
 import { columnId, filterCondition, keyConditions, returningList, scopeConditions, tableId, whereClause } from "./sql-parts.js";
 import { etagOf } from "./etag.js";
 import { storedValue } from "./encryption/stored-value.js";
+import { parentCondition } from "@protobase/query";
 import { sql } from "kysely";
 //#region src/records.ts
 const stored = async (entry, raw, shape = {}) => {
@@ -14,13 +15,17 @@ const stored = async (entry, raw, shape = {}) => {
 };
 const rowsOf = async (db, query) => (await query.execute(db)).rows;
 const lockClause = (lock) => lock === "no-key-update" ? sql` for no key update` : lock ? sql` for update` : sql``;
-/** The row of the caller's tenant with this key (live unless `deleted` says otherwise), optionally narrowed by a filter. */
+/**
+* The row of the caller's tenant with this key (live unless `deleted` says otherwise), optionally narrowed by a filter
+* and the parents the caller reads.
+*/
 const fetchRecord = async (db, entry, key, tenant, options = {}) => {
-	const { filter, deleted, lock = false, ...shape } = options;
+	const { filter, parents = [], deleted, lock = false, ...shape } = options;
 	const conditions = [
 		...scopeConditions(entry.model, tenant, deleted),
 		...keyConditions(entry.model, key),
-		...filterCondition(entry.model, filter)
+		...filterCondition(entry.model, filter),
+		...parents.map(parentCondition)
 	];
 	const query = sql`select ${returningList(entry, shape.fields)} from ${tableId(entry.model)} as t${whereClause(conditions)} limit 1${lockClause(lock)}`;
 	return stored(entry, (await rowsOf(db, query))[0], shape);

package/dist/request-access.js

@@ -2,6 +2,7 @@ import { maskEncrypted } from "./encryption/mask-stored.js";
 import { forbidden, notFound, unauthorized } from "./problem.js";
 import { checkedFilter } from "./filter-input.js";
 import { checkOwnerId } from "./owner-id.js";
+import { parentReads } from "./parent-reads.js";
 import { tenantScope } from "./tenant.js";
 import { checkFilter, resolveAccess, restrictModel, where } from "@protobase/schema";
 //#region src/request-access.ts
@@ -64,8 +65,11 @@ const ownOnly = (resolved, entry, session) => {
 		}
 	};
 };
-/** `form` is the public form a visitor sends, the only way a caller without a token creates. */
-const requestAccess = async (deps, entry, session, form) => {
+/**
+* `form` is the public form a visitor sends, the only way a caller without a token creates. `chain` holds the resources
+* whose parents led to this one (see `parentReads`).
+*/
+const requestAccess = async (deps, entry, session, form, chain = []) => {
 	const all = await resolveAccess(entry.source, {
 		user: {
 			id: session.user.id,
@@ -77,6 +81,15 @@ const requestAccess = async (deps, entry, session, form) => {
 	const resolved = deps.settingsResources.has(entry.name) ? ownOnly(allowed, entry, session) : allowed;
 	checkOwnerId(entry, session.user, resolved);
 	const readable = restrictModel(entry.model, resolved);
+	const parentAccess = async (parent, along) => {
+		const access = await requestAccess(deps, parent, session, void 0, along);
+		return {
+			resolved: access.resolved,
+			full: access.full,
+			scope: ownScope(access)
+		};
+	};
+	const parents = await parentReads(entry, session, chain, parentAccess, deps.registry.find);
 	return {
 		entry,
 		session,
@@ -84,6 +97,7 @@ const requestAccess = async (deps, entry, session, form) => {
 		full: entry.model,
 		readable,
 		model: withoutSensitive(readable),
+		parents,
 		deps
 	};
 };
@@ -125,13 +139,17 @@ const andFilters = (filters) => {
 };
 /** The row filter that narrows which rows an operation may target: the read filter, plus the operation's own. */
 const targetFilter = (access, operation) => operation === "read" ? access.resolved.rowFilter.read : andFilters([access.resolved.rowFilter.read, access.resolved.rowFilter[operation]]);
-/** The query-layer scope of the caller's own tenant: it, the access row filter against the full model, soft delete from the full model. */
+/**
+* The query-layer scope of the caller's own tenant: it, the access row filter and the parents the caller reads against
+* the full model, soft delete from the full model.
+*/
 const ownScope = (access, fullModel = access.full) => {
 	const tenant = tenantScope(access.entry, access.session);
 	const rowFilter = access.resolved.rowFilter.read;
 	return {
 		...tenant && { tenantValue: tenant.tenantValue },
 		...rowFilter && { rowFilter },
+		...access.parents.length > 0 && { parents: access.parents },
 		fullModel
 	};
 };

package/dist/scan-guard.js

@@ -5,6 +5,7 @@ const reading = (column) => {
 	switch (column.use) {
 		case "filter": return `Filtering on "${column.field}"`;
 		case "access": return `The filter your role is limited by, on "${column.field}",`;
+		case "parent": return `Keeping to the records whose "${column.field}" you may read`;
 		case "sort": return `Sorting by "${column.field}"`;
 		case "facet": return `Counting the values of "${column.field}"`;
 	}
@@ -20,17 +21,25 @@ const describe = (column) => {
 const createScanGuard = (db, options = {}) => {
 	const { mode = "reject" } = options;
 	const tables = /* @__PURE__ */ new Map();
-	const indexesOf = async (entry) => {
-		const known = tables.get(entry.name);
+	const indexesOfModel = async (model) => {
+		const known = tables.get(model.name);
 		if (known) return known;
-		const read = await tableIndexes(db, entry.model);
-		tables.set(entry.name, read);
+		const read = await tableIndexes(db, model);
+		tables.set(model.name, read);
 		return read;
 	};
+	const indexesOf = (entry) => indexesOfModel(entry.model);
+	const parentColumns = async (scope) => {
+		const parents = (scope.parents ?? []).flatMap((read) => read.parent ? [read.parent] : []);
+		return (await Promise.all(parents.map(async ({ model, scope: own }) => [...uncoveredColumns(model, await indexesOfModel(model), {}, own).map((column) => ({
+			...column,
+			field: `${model.name}.${column.field}`
+		})), ...await parentColumns(own)]))).flat();
+	};
 	/** Throws a 400 problem for a column no index serves in `reject` mode; in `warn` mode returns the warning text. */
 	const check = async (entry, query, context) => {
 		if (mode === "off") return void 0;
-		const columns = uncoveredColumns(context.model, await indexesOf(entry), query, context.scope);
+		const columns = [...uncoveredColumns(context.model, await indexesOf(entry), query, context.scope), ...await parentColumns(context.scope)];
 		const first = columns[0];
 		if (!first) return void 0;
 		const detail = describe(first);

package/dist/webhooks/subscriber-view.js

@@ -2,6 +2,7 @@ import { requestAccess } from "../request-access.js";
 import { EventCodeError } from "../changes/event-code-error.js";
 import { currentRecord } from "../changes/resource-change.js";
 import { checkRecord, evaluateFilter } from "@protobase/schema";
+import { readsParent } from "@protobase/query";
 //#region src/webhooks/subscriber-view.ts
 /**
 * The session a subscription delivers as, or `undefined` for the system: every record, every field but sensitive ones.
@@ -86,10 +87,19 @@ const withUnknownFields = (model, record) => {
 		check
 	};
 };
+const readsParents = async (access, record) => {
+	for (const read of access.parents) {
+		const value = record[read.field.name];
+		if (value === null || value === void 0) continue;
+		if (!await readsParent(access.deps.db, read, value)) return false;
+	}
+	return true;
+};
 const decide = async (access, record) => {
 	const { resolved, session, entry } = access;
 	if (!resolved.operations.read) return false;
 	if (resolved.rowFilter.read && evaluateFilter(resolved.rowFilter.read, record) !== true) return false;
+	if (!await readsParents(access, record)) return false;
 	if (!resolved.recordChecks.includes("read")) return true;
 	const context = {
 		user: session.user,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@protobase/server",
-  "version": "0.54.6",
+  "version": "0.55.0",
   "description": "The Protobase REST API as a Hono app, with Better Auth sign-in.",
   "license": "Apache-2.0",
   "repository": {
@@ -40,9 +40,9 @@
     "@better-auth/passkey": "^1.7.12",
     "@better-auth/sso": "^1.7.12",
     "@modelcontextprotocol/server": "^2.3.1",
-    "@protobase/layout": "0.54.6",
-    "@protobase/query": "0.54.6",
-    "@protobase/schema": "0.54.6",
+    "@protobase/layout": "0.55.0",
+    "@protobase/query": "0.55.0",
+    "@protobase/schema": "0.55.0",
     "@react-email/render": "^2.1.0",
     "@scalar/hono-api-reference": "^0.12.10",
     "@sentry/core": "^11.7.0",