@rebasepro/app 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/collections/summary-property.ts

@@ -0,0 +1,114 @@
+import type { Property } from "@rebasepro/types";
+
+/**
+ * Whether a property can stand in for a record in *one line*.
+ *
+ * Preview surfaces — the reference card, a list row, a board card — have a
+ * single line per property and no way to grow. That is a constraint on the
+ * *value*, not on the property's importance: a Markdown biography is the most
+ * interesting column on an author, and it is still the wrong thing to paste
+ * into a 44px card. Ranking it here means the picker can skip it without
+ * anyone having to configure their way out of a broken card.
+ *
+ * Kept beside {@link getTitlePropertyCandidates} because the two answer
+ * neighbouring questions — "what is this record called" and "what else can be
+ * said about it in a line" — from the same property schema.
+ *
+ * @group Collections
+ */
+export const SUMMARY_RANK = {
+    /**
+     * No single-line form exists. A map renders as a key/value table and an
+     * array of maps as a stack of them; there is no first line to take.
+     */
+    UNUSABLE: 0,
+    /**
+     * Readable in one line, but only as an excerpt — the property holds a
+     * document, and the line is its opening. Worth showing when nothing better
+     * is available, never in preference to a value that fits whole.
+     */
+    EXCERPT: 1,
+    /** Short and self-contained: the line *is* the value. */
+    DIRECT: 2
+} as const;
+
+/** One of the three summary ranks. */
+export type SummaryRank = typeof SUMMARY_RANK[keyof typeof SUMMARY_RANK];
+
+/**
+ * File-storage backed content (single image, array of images, generic upload…).
+ * Preview surfaces give these their own image slot, so they are never also a
+ * text line.
+ *
+ * @group Collections
+ */
+export function isStorageProperty(property: Property | undefined): boolean {
+    if (!property) return false;
+    if (property.type === "string" && (property.storage || property.admin?.urlPreview === "image")) return true;
+    if (property.type === "array" && property.of && !Array.isArray(property.of)) {
+        const inner = property.of;
+        if (inner.type === "string" && (inner.storage || inner.admin?.urlPreview === "image")) return true;
+    }
+    return false;
+}
+
+/**
+ * True when the property holds free text long enough to be a document rather
+ * than a value — Markdown, or an explicitly multi-line string.
+ *
+ * @group Collections
+ */
+export function isLongTextProperty(property: Property | undefined): boolean {
+    if (!property || property.type !== "string") return false;
+    return Boolean(property.admin?.markdown || property.admin?.multiline);
+}
+
+/**
+ * How well a property reads as one line of a preview. See {@link SUMMARY_RANK}.
+ *
+ * Decided from the property *schema* only: no values are consulted, so the
+ * answer is stable for a collection and can be memoised per collection rather
+ * than per row.
+ *
+ * @group Collections
+ */
+export function rankSummaryProperty(property: Property | undefined): SummaryRank {
+    if (!property) return SUMMARY_RANK.UNUSABLE;
+
+    // Rendered by the image slot, not as text.
+    if (isStorageProperty(property)) return SUMMARY_RANK.UNUSABLE;
+
+    // A map is a table of its own, whether it declares its properties (a row
+    // per sub-property) or not (a key/value dump). Neither has a first line.
+    if (property.type === "map") return SUMMARY_RANK.UNUSABLE;
+
+    if (property.type === "array") {
+        // A tuple: several properties side by side, so there is nothing single
+        // about the line it would produce.
+        if (Array.isArray(property.of)) return SUMMARY_RANK.UNUSABLE;
+        if (!property.of) return property.oneOf ? SUMMARY_RANK.UNUSABLE : SUMMARY_RANK.DIRECT;
+        // Arrays of block-shaped things inherit the block shape.
+        const innerRank = rankSummaryProperty(property.of);
+        if (innerRank === SUMMARY_RANK.UNUSABLE) return SUMMARY_RANK.UNUSABLE;
+        // An array of documents is a stack of excerpts — worse than one
+        // excerpt, and never what a card should lead with.
+        if (innerRank === SUMMARY_RANK.EXCERPT) return SUMMARY_RANK.UNUSABLE;
+        // Short values render as a run of chips, which fits a line.
+        return SUMMARY_RANK.DIRECT;
+    }
+
+    if (isLongTextProperty(property)) return SUMMARY_RANK.EXCERPT;
+
+    // Numbers, dates, booleans, enums, plain strings, and single references or
+    // relations (which collapse to one linked line) all fit as they are.
+    return SUMMARY_RANK.DIRECT;
+}
+
+/**
+ * True when the property has any single-line form at all.
+ *
+ * @group Collections
+ */
+export function canSummariseProperty(property: Property | undefined): boolean {
+    return rankSummaryProperty(property) !== SUMMARY_RANK.UNUSABLE;
+}

package/src/collections/title-property.ts

@@ -2,6 +2,9 @@ import { isRelationalCollectionConfig, type Property, type Relation } from "@reb
 import { generateForeignKeyName } from "@rebasepro/utils";
 import type { AdminCollection } from "@rebasepro/admin-types";
 import { getPrimaryKeys, isPropertyBuilder } from "@rebasepro/common";
+import { getPropertyInPath } from "./property-path";
+import { getDisplayPropertyKey, hasDeclaredDisplay } from "./entity-display";
+import { isStorageProperty } from "./summary-property";
 
 /**
  * How good a property is as the human-readable title of an entity.
@@ -56,19 +59,6 @@ function isHidden(property: Property): boolean {
     return Boolean(property.admin?.hideFromCollection);
 }
 
-/**
- * File-storage backed content (single image, array of images, generic upload…).
- * Rendered by the dedicated image slot, so never a title.
- */
-function isStorageProperty(property: Property): boolean {
-    if (property.type === "string" && (property.storage || property.admin?.urlPreview === "image")) return true;
-    if (property.type === "array" && property.of && !Array.isArray(property.of)) {
-        const inner = property.of;
-        if (inner.type === "string" && (inner.storage || inner.admin?.urlPreview === "image")) return true;
-    }
-    return false;
-}
-
 /**
  * Every column on this collection that stores a foreign key: the `localKey` of
  * each owning relation (declared inline on a property or in `relations[]`), the
@@ -182,8 +172,13 @@ export function getTitlePropertyCandidates<M extends Record<string, unknown>>(
 ): string[] {
     if (!collection.properties) return [];
 
-    if (collection.titleProperty && collection.properties[collection.titleProperty as string]) {
-        return [collection.titleProperty as string];
+    // `getPropertyInPath`, not `properties[key]`: a declared title on a nested
+    // field — `profile.display_name` — was looked up flat, found nothing, and
+    // silently fell through to the derived ranking. The dotted form has been
+    // documented as valid the whole time.
+    const declared = getDisplayPropertyKey(collection, "title");
+    if (declared && getPropertyInPath(collection.properties, declared)) {
+        return [declared];
     }
 
     const idKeys = new Set<string>(getPrimaryKeys(collection) as string[]);
@@ -237,7 +232,9 @@ export function getLeadingRelationTitleKey<M extends Record<string, unknown>>(
     collection: AdminCollection<M>
 ): string | undefined {
     if (!collection.properties) return undefined;
-    if (collection.titleProperty) return undefined;
+    // The collection states what it is called, in one form or the other; either
+    // way it is not asking for the leading-relation heuristic.
+    if (hasDeclaredDisplay(collection, "title")) return undefined;
 
     const idKeys = new Set<string>(getPrimaryKeys(collection) as string[]);
     const foreignKeys = getForeignKeyColumns(collection);

package/src/components/LoginView/LoginView.tsx

@@ -41,6 +41,7 @@ import { ErrorView } from "../ErrorView";
 import { RebaseLogo } from "../RebaseLogo";
 import { LanguageToggle } from "../LanguageToggle";
 import { useModeController, useTranslation } from "../../hooks";
+import { consumeOAuthCallback, startOAuthRedirect } from "./oauth-redirect-flow";
 
 /**
  * Props for the generic LoginView.
@@ -274,25 +275,38 @@ export function LoginView({
         return () => clearTimeout(timer);
     }, []);
 
-    // Effect to handle incoming redirect OAuth codes (GitHub, LinkedIn, etc.)
+    // Effect to handle incoming redirect OAuth codes (GitHub, LinkedIn, etc.).
+    //
+    // The `code` is only spent when it belongs to an authorization this browser
+    // started: `consumeOAuthCallback` matches the returned `state` against the
+    // one generated at button-click time. Without that, an attacker who starts
+    // their own authorization, captures the code and gets the victim to load
+    // `?code=<theirs>` hands the victim a session on the *attacker's* account.
     useEffect(() => {
-        const params = new URLSearchParams(window.location.search);
-        const code = params.get("code");
-        const provider = localStorage.getItem("rebase_oauth_provider");
-        if (code && provider) {
-            localStorage.removeItem("rebase_oauth_provider");
-            // Clear URL search params without page reload
-            const cleanUrl = window.location.origin + window.location.pathname;
-            window.history.replaceState({}, document.title, cleanUrl);
-
-            if (authController.oauthLogin) {
-                authController.oauthLogin(provider, {
-                    code,
-                    redirectUri: cleanUrl
-                }).catch((err) => {
-                    console.error(`${provider} login failed:`, err);
-                });
-            }
+        const result = consumeOAuthCallback(window.location.search);
+        if (result.status === "none") return;
+
+        // Clear URL search params without page reload
+        const cleanUrl = window.location.origin + window.location.pathname;
+        window.history.replaceState({}, document.title, cleanUrl);
+
+        if (result.status === "error") {
+            console.error(`OAuth sign-in failed: ${result.error}`);
+            return;
+        }
+        if (result.status === "mismatch") {
+            console.error("Ignoring an OAuth code that does not match a sign-in this browser started.");
+            return;
+        }
+
+        if (authController.oauthLogin) {
+            authController.oauthLogin(result.provider, {
+                code: result.code,
+                redirectUri: result.redirectUri,
+                ...(result.codeVerifier ? { codeVerifier: result.codeVerifier } : {})
+            }).catch((err: unknown) => {
+                console.error(`${result.provider} login failed:`, err);
+            });
         }
     }, [authController]);
 
@@ -612,10 +626,15 @@ function GitHubLoginButton({
     githubClientId: string
 }) {
     const handleClick = () => {
-        localStorage.setItem("rebase_oauth_provider", "github");
-        const redirectUri = encodeURIComponent(window.location.origin + window.location.pathname);
-        const scope = "read:user,user:email";
-        window.location.href = `https://github.com/login/oauth/authorize?client_id=${githubClientId}&redirect_uri=${redirectUri}&scope=${scope}`;
+        // GitHub OAuth Apps do not implement PKCE, so `state` is the whole
+        // binding between this click and the code that comes back.
+        void startOAuthRedirect({
+            provider: "github",
+            authorizeUrl: "https://github.com/login/oauth/authorize",
+            clientId: githubClientId,
+            redirectUri: window.location.origin + window.location.pathname,
+            scope: "read:user,user:email"
+        });
     };
 
     return (
@@ -642,10 +661,13 @@ function LinkedInLoginButton({
     linkedinClientId: string
 }) {
     const handleClick = () => {
-        localStorage.setItem("rebase_oauth_provider", "linkedin");
-        const redirectUri = encodeURIComponent(window.location.origin + window.location.pathname);
-        const scope = "openid profile email";
-        window.location.href = `https://www.linkedin.com/oauth/v2/authorization?response_type=code&client_id=${linkedinClientId}&redirect_uri=${redirectUri}&scope=${scope}`;
+        void startOAuthRedirect({
+            provider: "linkedin",
+            authorizeUrl: "https://www.linkedin.com/oauth/v2/authorization",
+            clientId: linkedinClientId,
+            redirectUri: window.location.origin + window.location.pathname,
+            scope: "openid profile email"
+        });
     };
 
     return (

package/src/components/LoginView/oauth-redirect-flow.ts

@@ -0,0 +1,184 @@
+/**
+ * The browser half of the OAuth authorization-code flow.
+ *
+ * The server only ever sees a `code` and a `redirectUri` taken from the
+ * request body, so `state`, PKCE and the binding between "this browser started
+ * a login" and "this code came back" are, by construction, the client's job.
+ * In the admin login they had been nobody's job: the authorize URL carried no
+ * `state`, and the return leg accepted any `?code=` as long as a localStorage
+ * marker naming the *provider* was set — a marker written on button click and
+ * removed only on a callback that carried a code, so abandoning the flow left
+ * it set indefinitely.
+ *
+ * Everything here is provider-agnostic on purpose. A button that wants a new
+ * provider calls {@link startOAuthRedirect} and gets state, expiry and PKCE
+ * without deciding anything, which is what stops the next provider shipping
+ * without them.
+ */
+
+/** sessionStorage, not localStorage: a login attempt belongs to one tab. */
+const STORAGE_KEY = "rebase_oauth_redirect";
+
+/** How long a started authorization stays valid. */
+const PENDING_TTL_MS = 10 * 60 * 1000;
+
+export interface OAuthRedirectRequest {
+    /** Provider id, as mounted at `POST /auth/<id>`. */
+    provider: string;
+    /** The provider's authorization endpoint. */
+    authorizeUrl: string;
+    clientId: string;
+    scope: string;
+    /** Where the provider sends the browser back. Echoed to the token exchange. */
+    redirectUri: string;
+    /** Set when the provider implements PKCE. */
+    pkce?: boolean;
+    /** Extra authorize-endpoint parameters (`response_type`, and so on). */
+    params?: Record<string, string>;
+}
+
+/** What the browser remembers between leaving for the provider and coming back. */
+export interface PendingOAuthRedirect {
+    provider: string;
+    state: string;
+    codeVerifier?: string;
+    redirectUri: string;
+    startedAt: number;
+}
+
+export type OAuthCallbackResult =
+    /** No OAuth callback in this URL. */
+    | { status: "none" }
+    /** The provider reported a failure, or the user declined. */
+    | { status: "error"; error: string }
+    /**
+     * A code arrived that this browser cannot account for: no pending
+     * authorization, an expired one, or a `state` that does not match. This is
+     * what a login-CSRF / code-injection attempt looks like.
+     */
+    | { status: "mismatch" }
+    | { status: "ok"; provider: string; code: string; codeVerifier?: string; redirectUri: string };
+
+type Storage = Pick<globalThis.Storage, "getItem" | "setItem" | "removeItem">;
+
+function defaultStorage(): Storage | null {
+    try {
+        return window.sessionStorage;
+    } catch {
+        return null;
+    }
+}
+
+function base64Url(bytes: Uint8Array): string {
+    let binary = "";
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+
+function randomToken(byteLength = 32): string {
+    const bytes = new Uint8Array(byteLength);
+    crypto.getRandomValues(bytes);
+    return base64Url(bytes);
+}
+
+async function pkceChallenge(verifier: string): Promise<string> {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+    return base64Url(new Uint8Array(digest));
+}
+
+export function readPendingOAuthRedirect(storage: Storage | null = defaultStorage()): PendingOAuthRedirect | null {
+    if (!storage) return null;
+    const raw = storage.getItem(STORAGE_KEY);
+    if (!raw) return null;
+    try {
+        const parsed = JSON.parse(raw) as PendingOAuthRedirect;
+        if (!parsed?.provider || !parsed?.state) return null;
+        return parsed;
+    } catch {
+        return null;
+    }
+}
+
+export function clearPendingOAuthRedirect(storage: Storage | null = defaultStorage()): void {
+    storage?.removeItem(STORAGE_KEY);
+}
+
+/**
+ * Build the authorize URL and the pending record that will validate its
+ * callback. Split out from {@link startOAuthRedirect} so it can be tested
+ * without navigating.
+ */
+export async function buildOAuthAuthorization(
+    request: OAuthRedirectRequest,
+    now: number = Date.now()
+): Promise<{ url: string; pending: PendingOAuthRedirect }> {
+    const state = randomToken();
+    const url = new URL(request.authorizeUrl);
+    url.searchParams.set("response_type", "code");
+    url.searchParams.set("client_id", request.clientId);
+    url.searchParams.set("redirect_uri", request.redirectUri);
+    url.searchParams.set("scope", request.scope);
+    url.searchParams.set("state", state);
+    for (const [key, value] of Object.entries(request.params ?? {})) {
+        url.searchParams.set(key, value);
+    }
+
+    let codeVerifier: string | undefined;
+    if (request.pkce) {
+        codeVerifier = randomToken(32);
+        url.searchParams.set("code_challenge", await pkceChallenge(codeVerifier));
+        url.searchParams.set("code_challenge_method", "S256");
+    }
+
+    return {
+        url: url.toString(),
+        pending: { provider: request.provider, state, codeVerifier, redirectUri: request.redirectUri, startedAt: now }
+    };
+}
+
+/** Remember the authorization and send the browser to the provider. */
+export async function startOAuthRedirect(
+    request: OAuthRedirectRequest,
+    storage: Storage | null = defaultStorage()
+): Promise<void> {
+    const { url, pending } = await buildOAuthAuthorization(request);
+    storage?.setItem(STORAGE_KEY, JSON.stringify(pending));
+    window.location.href = url;
+}
+
+/**
+ * Interpret a return from the provider.
+ *
+ * Clears the pending record on **every** path that saw a callback — including
+ * `?error=` and a state mismatch — so a declined or abandoned consent screen
+ * cannot leave the browser primed to accept somebody else's code later.
+ */
+export function consumeOAuthCallback(
+    search: string,
+    storage: Storage | null = defaultStorage(),
+    now: number = Date.now()
+): OAuthCallbackResult {
+    const params = new URLSearchParams(search);
+    const code = params.get("code");
+    const state = params.get("state");
+    const error = params.get("error");
+
+    if (!code && !error && !state) return { status: "none" };
+
+    const pending = readPendingOAuthRedirect(storage);
+    clearPendingOAuthRedirect(storage);
+
+    if (error) return { status: "error", error };
+    if (!code) return { status: "mismatch" };
+    if (!pending) return { status: "mismatch" };
+    if (now - pending.startedAt > PENDING_TTL_MS) return { status: "mismatch" };
+    if (!state || state !== pending.state) return { status: "mismatch" };
+
+    return {
+        status: "ok",
+        provider: pending.provider,
+        code,
+        codeVerifier: pending.codeVerifier,
+        redirectUri: pending.redirectUri
+    };
+}

package/src/components/common/useColumnsIds.tsx

@@ -1,28 +1,10 @@
-import type { Property, MapProperty, Properties } from "@rebasepro/types";
+import type { Property, MapProperty, Properties, RelationProperty } from "@rebasepro/types";
 import { useMemo } from "react";
 ;
-import { getSubcollections } from "@rebasepro/common";
+import { getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getSubcollections } from "@rebasepro/common";
 import type { AdminCollection } from "@rebasepro/admin-types";
-
-/**
- * Get a property in a property tree from a dot-path like `address.street`.
- * Inlined here to avoid importing property-aware utilities from the admin layer.
- */
-function getPropertyInPath(properties: Properties, path: string): Property | undefined {
-    if (typeof properties === "object") {
-        if (path in properties) {
-            return (properties as Record<string, Property>)[path];
-        }
-        if (path.includes(".")) {
-            const pathSegments = path.split(".");
-            const childProperty = (properties as Record<string, Property>)[pathSegments[0]];
-            if (typeof childProperty === "object" && childProperty.type === "map" && childProperty.properties) {
-                return getPropertyInPath(childProperty.properties, pathSegments.slice(1).join("."));
-            }
-        }
-    }
-    return undefined;
-}
+import { getPropertyInPath } from "../../collections/property-path";
+import { isDisabled } from "../../collections/property_presentation";
 
 export type PropertyColumnConfig = {
     key: string;
@@ -32,6 +14,43 @@ export type PropertyColumnConfig = {
 export function getSubcollectionColumnId(collection: AdminCollection<any>) {
     return `subcollection:${collection.slug}`;
 }
+
+/**
+ * The jump-to-tab columns a collection table does not need, because the relation
+ * behind them already has a column of its own.
+ *
+ * Every child view gets a 200px button column that opens its tab. For a relation
+ * declared in `relations` that button is the relation's only presence in the
+ * table. For one declared as a property it is the second: the property's own
+ * column is already there, hydrated by the list fetch's `include: ["*"]`, showing
+ * the child rows themselves — and carrying the *same heading*, because the tab
+ * takes its name from the declaring property. Two columns called "Applications",
+ * one of them a button, and nothing in the header to tell them apart.
+ *
+ * The property column wins: it shows what the children are, and each chip in it
+ * opens one. The tab stays reachable by opening the record, which is what the
+ * rest of the table's rows do anyway.
+ *
+ * Unless the author hid that column — `hideFromCollection` on the property, or a
+ * `propertiesOrder` that omits it, is a statement about the column and not about
+ * the relation, so the button comes back rather than the relation dropping out
+ * of the table altogether.
+ */
+export function getRedundantChildViewColumnIds<M extends Record<string, any>>(collection: AdminCollection<M>): Set<string> {
+    const redundant = new Set<string>();
+    const properties = collection.properties ?? {};
+    const order = collection.propertiesOrder as string[] | undefined;
+
+    for (const [viewKey, propertyKey] of getChildViewDeclaringProperties(collection)) {
+        const property = properties[propertyKey] as Property | undefined;
+        if (!property || property.admin?.hideFromCollection) continue;
+        if (order && !order.includes(propertyKey)) continue;
+        redundant.add(`subcollection:${viewKey}`);
+    }
+
+    return redundant;
+}
+
 export function useColumnIds<M extends Record<string, any>>(collection: AdminCollection<M>, includeSubcollections: boolean): PropertyColumnConfig[] {
     return useMemo(() => {
         if (collection.propertiesOrder) {
@@ -59,9 +78,14 @@ function hideAndExpandKeys<M extends Record<string, any>>(collection: AdminColle
     // Track processed keys to avoid duplicates
     const processedPropertyKeys = new Set<string>();
 
+    // Both column paths funnel through here, including a `propertiesOrder` that
+    // was saved back with the button column in it.
+    const redundantChildViewColumns = getRedundantChildViewColumnIds(collection);
+
     const result = keys.flatMap((key) => {
         // Skip if already processed (handles duplicates in propertiesOrder)
         if (processedPropertyKeys.has(key)) return [null];
+        if (redundantChildViewColumns.has(key)) return [null];
 
         // Check if it's a top-level property
         const property = collection.properties[key];
@@ -85,7 +109,7 @@ function hideAndExpandKeys<M extends Record<string, any>>(collection: AdminColle
             }
             return [{
                 key,
-                disabled: Boolean(property.admin?.disabled) || Boolean(property.admin?.readOnly)
+                disabled: isDisabled(property) || Boolean(property.admin?.readOnly)
             }];
         }
 
@@ -108,8 +132,8 @@ function hideAndExpandKeys<M extends Record<string, any>>(collection: AdminColle
 
                     return [{
                         key,
-                        disabled: Boolean(rootProperty.admin?.disabled) || Boolean(rootProperty.admin?.readOnly) ||
-                            Boolean(nestedProperty.admin?.disabled) || Boolean(nestedProperty.admin?.readOnly)
+                        disabled: isDisabled(rootProperty) || Boolean(rootProperty.admin?.readOnly) ||
+                            isDisabled(nestedProperty) || Boolean(nestedProperty.admin?.readOnly)
                     }];
                 }
             }
@@ -163,7 +187,7 @@ function hideAndExpandKeys<M extends Record<string, any>>(collection: AdminColle
         } else {
             result.push({
                 key: propKey,
-                disabled: Boolean(property.admin?.disabled) || Boolean(property.admin?.readOnly)
+                disabled: isDisabled(property) || Boolean(property.admin?.readOnly)
             });
             processedPropertyKeys.add(propKey);
         }
@@ -194,22 +218,36 @@ function getDefaultColumnKeys<M extends Record<string, any> = any>(collection: A
 }
 
 export function getColumnKeysForProperty(property: Property, key: string, disabled?: boolean): PropertyColumnConfig[] {
+    // A key with no property behind it describes no column. Callers walk whole
+    // property maps here to build a table's columns, so reading `.type` off a
+    // hole threw away every other column with it.
+    if (!property) return [];
     if (property.type === "map" && property.admin?.spreadChildren && property.properties) {
         return Object.entries(property.properties)
             .flatMap(([childKey, childProperty]) => getColumnKeysForProperty(
                 childProperty as Readonly<Property>,
                 `${key}.${childKey}`,
-                disabled || Boolean(property.admin?.disabled) || Boolean(property.admin?.readOnly))
+                disabled || isDisabled(property) || Boolean(property.admin?.readOnly))
             );
     }
     return [{
         key,
-        disabled: disabled || Boolean(property.admin?.disabled) || Boolean(property.admin?.readOnly)
+        disabled: disabled || isDisabled(property) || Boolean(property.admin?.readOnly)
     }];
 }
 
 export function getFormFieldKeys(collection: AdminCollection): string[] {
-    const propertyKeys = collection.properties ? Object.keys(collection.properties) : [];
+    const properties = collection.properties ?? {};
+    // A many-relation the entity view already lists as a tab is not an input:
+    // the tab is the treatment, and rendering the same declaration again as a
+    // picker asked the author to select a collection's own children from a
+    // dropdown. `renderInForm` is how a project that wants the picker asks for
+    // it back — opt in, because the tab is the default.
+    const consumedByChildView = getChildViewRelationPropertyKeys(collection);
+    const propertyKeys = Object.keys(properties).filter(key => {
+        if (!consumedByChildView.has(key)) return true;
+        return (properties[key] as RelationProperty).admin?.renderInForm === true;
+    });
     const additionalFields = collection.additionalFields ?? [];
     const allKeys = [
         ...propertyKeys,

package/src/components/common/useDataTableController.tsx

@@ -5,6 +5,7 @@ import { useLocation } from "react-router";
 import { useData, useRebaseContext } from "../../hooks";
 import { useDataOrder } from "../../hooks/data/useDataOrder";
 import { populateFetchCache } from "../../hooks/data/useFetch";
+import { toFindParams } from "../../hooks/data/collectionQuery";
 import { getRelationIncludeParams } from "../../util/previews";
 import { Entity, EntityReference, EntityRelation, FilterValues, User, WhereFilterOp, FindResponse } from "@rebasepro/types";
 import { EntityTableController, RebaseContext, SelectedCellProps, AdminCollection } from "@rebasepro/admin-types";
@@ -260,21 +261,16 @@ export function useDataTableController<M extends Record<string, any> = any, USER
         const includeParams = getRelationIncludeParams(collection);
 
         if (accessor.listen) {
-            unsubscribe = accessor.listen({
-                where: whereParams,
-                limit: itemCount,
-                orderBy: orderByParams,
-                searchString,
-                include: includeParams
-            }, (res) => onEntitiesUpdate(res.data as Entity<M>[]), onError);
+            // Assembled in one place — see `toFindParams`. Listing the fields
+            // here is what let `searchExplain` reach three of four read paths.
+            unsubscribe = accessor.listen(
+                toFindParams({ where: whereParams, limit: itemCount, orderBy: orderByParams,
+                    searchString, include: includeParams }),
+                (res) => onEntitiesUpdate(res.data as Entity<M>[]), onError);
         } else {
-            accessor.find({
-                where: whereParams,
-                limit: itemCount,
-                orderBy: orderByParams,
-                searchString,
-                include: includeParams
-            })
+            accessor.find(
+                toFindParams({ where: whereParams, limit: itemCount, orderBy: orderByParams,
+                    searchString, include: includeParams }))
                 .then((res) => onEntitiesUpdate(res.data as Entity<M>[]))
                 .catch(onError);
             unsubscribe = () => undefined;