@svadmin/lite 0.12.0 → 0.14.0

package/dist/components/LitePivotTable.svelte.d.ts

@@ -1,6 +1,7 @@
-export type AggregationFn = 'sum' | 'count' | 'avg' | 'min' | 'max';
+export type AggregationFn = import('@svadmin/core/pivot').PivotAggregation;
 interface Props {
     data?: Record<string, unknown>[];
+    aggregateData?: unknown;
     rowField: string;
     rowLabel?: string;
     columnField: string;
@@ -8,6 +9,17 @@ interface Props {
     valueField: string;
     valueLabel?: string;
     aggregator?: AggregationFn;
+    formatValue?: (value: number) => string;
+    loading?: boolean;
+    error?: string | undefined;
+    retryHref?: string;
+    exportHref?: string;
+    drilldownHref?: (input: import('@svadmin/core/pivot').PivotDrilldown) => string | undefined;
+    resource?: string;
+    scopeKey?: string;
+    filters?: import('@svadmin/core').Filter[];
+    meta?: Record<string, unknown>;
+    ariaLabel?: string;
     class?: string;
 }
 declare const LitePivotTable: import("svelte").Component<Props, {}, "">;

package/dist/components/LiteSpreadsheetView.svelte

@@ -1,4 +1,7 @@
 <script lang="ts">
+  import { useTranslation } from '@svadmin/core/i18n';
+  const i18n = useTranslation();
+
   export interface SheetData {
     id: string;
     name: string;
@@ -11,6 +14,8 @@
     sheets?: SheetData[];
     activeSheetId?: string;
     formAction?: string;
+    readonly?: boolean;
+    limits?: Partial<{ maxRows: number; maxCols: number; maxCells: number; maxSheets: number; maxCellLength: number }>;
     class?: string;
   }
 
@@ -26,25 +31,63 @@
     ],
     activeSheetId = 'sheet1',
     formAction = '',
+    readonly = false,
+    limits: limitOverrides = {},
     class: className = '',
   }: Props = $props();
 
-  const currentSheet = $derived(
-    sheets.find((s) => s.id === activeSheetId) ?? sheets[0]
-  );
+  const limits = $derived.by(() => {
+    const bounded = (value: number | undefined, ceiling: number) =>
+      typeof value === 'number' && Number.isSafeInteger(value) && value > 0 ? Math.min(value, ceiling) : ceiling;
+    return {
+      maxRows: bounded(limitOverrides.maxRows, 1000),
+      maxCols: bounded(limitOverrides.maxCols, 100),
+      maxCells: bounded(limitOverrides.maxCells, 10_000),
+      maxSheets: bounded(limitOverrides.maxSheets, 32),
+      maxCellLength: bounded(limitOverrides.maxCellLength, 10_000),
+    };
+  });
+  const validWorkbook = $derived(sheets.length <= limits.maxSheets && new Set(sheets.map(sheet => sheet.id)).size === sheets.length);
+  const currentSheet = $derived(validWorkbook ? (sheets.find(s => s.id === activeSheetId) ?? sheets[0]) : undefined);
+  const canRender = $derived.by(() => {
+    if (!currentSheet || !currentSheet.cells || typeof currentSheet.cells !== 'object'
+      || !Number.isSafeInteger(currentSheet.rows) || currentSheet.rows < 1 || currentSheet.rows > limits.maxRows
+      || !Number.isSafeInteger(currentSheet.cols) || currentSheet.cols < 1 || currentSheet.cols > limits.maxCols
+      || currentSheet.rows * currentSheet.cols > limits.maxCells) return false;
+    let textLength = 0;
+    for (let row = 1; row <= currentSheet.rows; row++) {
+      for (let col = 0; col < currentSheet.cols; col++) {
+        const key = `${getColName(col)}${row}`;
+        const raw = Object.hasOwn(currentSheet.cells, key) ? currentSheet.cells[key] : '';
+        if (typeof raw !== 'string' || raw.length > limits.maxCellLength) return false;
+        textLength += raw.length;
+        if (textLength > 1_000_000) return false;
+      }
+    }
+    return true;
+  });
 
   function getColName(index: number): string {
-    return String.fromCharCode(index + 65);
+    let result = '';
+    for (let i = index; i >= 0; i = Math.floor(i / 26) - 1) {
+      result = String.fromCharCode(i % 26 + 65) + result;
+    }
+    return result;
   }
 </script>
 
 <div class="sv-lite-sheet-container {className}">
   <div class="sv-lite-sheet-header">
-    <strong>Spreadsheet: {currentSheet?.name ?? 'Sheet'}</strong>
+    <strong>{i18n.t('spreadsheet.title')}: {currentSheet?.name ?? ''}</strong>
   </div>
 
-  {#if currentSheet}
+  {#if !validWorkbook || (currentSheet && !canRender)}
+    <p role="alert">{i18n.t('spreadsheet.invalid')}</p>
+  {:else if !currentSheet}
+    <p role="status">{i18n.t('spreadsheet.empty')}</p>
+  {:else}
     <form method="POST" action={formAction}>
+      <input type="hidden" name="sheetId" value={currentSheet.id} />
       <table class="sv-lite-sheet-table">
         <thead>
           <tr>
@@ -64,8 +107,11 @@
                 <td class="sv-lite-sheet-td">
                   <input
                     type="text"
+                    {readonly}
+                    aria-label={key}
+                    maxlength={limits.maxCellLength}
                     name={`cell_${key}`}
-                    value={currentSheet.cells[key] ?? ''}
+                    value={Object.hasOwn(currentSheet.cells, key) ? currentSheet.cells[key] ?? '' : ''}
                     class="sv-lite-cell-input"
                   />
                 </td>
@@ -75,9 +121,9 @@
         </tbody>
       </table>
 
-      {#if formAction}
+      {#if formAction && !readonly}
         <div class="sv-lite-sheet-footer">
-          <button type="submit" class="sv-lite-sheet-save">Save Spreadsheet</button>
+          <button type="submit" class="sv-lite-sheet-save">{i18n.t('common.save')}</button>
         </div>
       {/if}
     </form>

package/dist/components/LiteSpreadsheetView.svelte.d.ts

@@ -9,6 +9,14 @@ interface Props {
     sheets?: SheetData[];
     activeSheetId?: string;
     formAction?: string;
+    readonly?: boolean;
+    limits?: Partial<{
+        maxRows: number;
+        maxCols: number;
+        maxCells: number;
+        maxSheets: number;
+        maxCellLength: number;
+    }>;
     class?: string;
 }
 declare const LiteSpreadsheetView: import("svelte").Component<Props, {}, "">;

package/dist/filter-form.d.ts

@@ -0,0 +1,3 @@
+import type { FieldDefinition, Filter } from '@svadmin/core';
+/** 使用已有拓扑读取当前表单值，不把用户字段名解释成对象路径。服务端仍须独立授权。 */
+export declare function readFilterForm(filters: readonly Filter[], fields: readonly FieldDefinition[], data: FormData): Filter[];

package/dist/filter-form.js

@@ -0,0 +1,34 @@
+/** 使用已有拓扑读取当前表单值，不把用户字段名解释成对象路径。服务端仍须独立授权。 */
+export function readFilterForm(filters, fields, data) {
+    const operators = new Set(['eq', 'ne', 'contains', 'ncontains', 'gt', 'gte', 'lt', 'lte', 'null', 'nnull']);
+    function read(filter, path) {
+        const get = (key) => data.get(`filters[${path}][${key}]`);
+        if (!('field' in filter)) {
+            const operator = get('operator');
+            if (operator !== 'and' && operator !== 'or')
+                throw new TypeError('Invalid filter group');
+            return { operator, value: filter.value.map((child, index) => read(child, `${path}.value.${index}`)) };
+        }
+        const field = fields.find(candidate => candidate.key === get('field') && candidate.filterable !== false);
+        const operator = get('operator');
+        if (!field || typeof operator !== 'string' || !operators.has(operator))
+            throw new TypeError('Invalid filter rule');
+        let value = get('value');
+        if (operator === 'null' || operator === 'nnull')
+            value = null;
+        else if (typeof value !== 'string')
+            throw new TypeError('Invalid filter value');
+        else if (['number', 'currency', 'percent'].includes(field.type)) {
+            if (!value.trim() || !Number.isFinite(Number(value)))
+                throw new TypeError('Invalid numeric filter');
+            value = Number(value);
+        }
+        else if (field.type === 'boolean') {
+            if (value !== 'true' && value !== 'false')
+                throw new TypeError('Invalid boolean filter');
+            value = value === 'true';
+        }
+        return { field: field.key, operator: operator, value };
+    }
+    return filters.map((filter, index) => read(filter, String(index)));
+}

package/dist/index.d.ts

@@ -9,10 +9,13 @@ export { default as LiteTable } from './components/LiteTable.svelte';
 export { default as LitePagination } from './components/LitePagination.svelte';
 export { default as LiteForm } from './components/LiteForm.svelte';
 export { default as LiteFileInput } from './components/LiteFileInput.svelte';
+export { default as LiteFileUpload } from './components/LiteFileUpload.svelte';
 export { default as LiteLogin } from './components/LiteLogin.svelte';
 export { default as LiteShow } from './components/LiteShow.svelte';
 export { default as LiteSearch } from './components/LiteSearch.svelte';
 export { default as LiteAlert } from './components/LiteAlert.svelte';
+export { default as LiteErrorSummary } from './components/LiteErrorSummary.svelte';
+export type { LiteFormErrorEntry } from './components/LiteErrorSummary.svelte';
 export { default as LitePermissionMatrix } from './components/LitePermissionMatrix.svelte';
 export { default as LiteAuditLog } from './components/LiteAuditLog.svelte';
 export { default as LiteArrayField } from './components/LiteArrayField.svelte';
@@ -56,6 +59,8 @@ export { default as LiteActivityFeed } from './components/LiteActivityFeed.svelt
 export { default as LitePresenceAvatarGroup } from './components/LitePresenceAvatarGroup.svelte';
 export { default as LitePrintableBill } from './components/LitePrintableBill.svelte';
 export { default as LiteJsonSchemaForm } from './components/LiteJsonSchemaForm.svelte';
+export { decodeSchemaFormArrayAction, decodeSchemaFormData, decodeSchemaFormSubmission, encodeSchemaFormArrayAction, schemaFormActionName, schemaFormFieldName, } from './schema-form-data';
+export type { SchemaFormArrayAction, SchemaFormSchema } from './schema-form-data';
 export { default as LiteMentionsInput } from './components/LiteMentionsInput.svelte';
 export { default as LiteKanbanBoard } from './components/LiteKanbanBoard.svelte';
 export { default as LitePivotTable } from './components/LitePivotTable.svelte';

package/dist/index.js

@@ -13,10 +13,12 @@ export { default as LiteTable } from './components/LiteTable.svelte';
 export { default as LitePagination } from './components/LitePagination.svelte';
 export { default as LiteForm } from './components/LiteForm.svelte';
 export { default as LiteFileInput } from './components/LiteFileInput.svelte';
+export { default as LiteFileUpload } from './components/LiteFileUpload.svelte';
 export { default as LiteLogin } from './components/LiteLogin.svelte';
 export { default as LiteShow } from './components/LiteShow.svelte';
 export { default as LiteSearch } from './components/LiteSearch.svelte';
 export { default as LiteAlert } from './components/LiteAlert.svelte';
+export { default as LiteErrorSummary } from './components/LiteErrorSummary.svelte';
 export { default as LitePermissionMatrix } from './components/LitePermissionMatrix.svelte';
 export { default as LiteAuditLog } from './components/LiteAuditLog.svelte';
 export { default as LiteArrayField } from './components/LiteArrayField.svelte';
@@ -56,6 +58,7 @@ export { default as LiteActivityFeed } from './components/LiteActivityFeed.svelt
 export { default as LitePresenceAvatarGroup } from './components/LitePresenceAvatarGroup.svelte';
 export { default as LitePrintableBill } from './components/LitePrintableBill.svelte';
 export { default as LiteJsonSchemaForm } from './components/LiteJsonSchemaForm.svelte';
+export { decodeSchemaFormArrayAction, decodeSchemaFormData, decodeSchemaFormSubmission, encodeSchemaFormArrayAction, schemaFormActionName, schemaFormFieldName, } from './schema-form-data';
 export { default as LiteMentionsInput } from './components/LiteMentionsInput.svelte';
 export { default as LiteKanbanBoard } from './components/LiteKanbanBoard.svelte';
 export { default as LitePivotTable } from './components/LitePivotTable.svelte';

package/dist/schema-form-data.d.ts

@@ -0,0 +1,18 @@
+import type { SchemaFormSchema } from '@svadmin/core/schema-form';
+export type { SchemaFormSchema } from '@svadmin/core/schema-form';
+export declare function schemaFormFieldName(path: readonly string[]): string;
+export declare const schemaFormActionName = "schemaFormAction";
+export type SchemaFormArrayAction = {
+    type: 'add' | 'remove';
+    path: string[];
+    index?: number;
+};
+export declare function encodeSchemaFormArrayAction(action: SchemaFormArrayAction): string;
+export declare function decodeSchemaFormArrayAction(form: FormData): SchemaFormArrayAction | undefined;
+/** 按可信 Schema 解码并验证支持的约束；不替代资源授权和业务命令校验。 */
+export declare function decodeSchemaFormData(schema: SchemaFormSchema, form: FormData): Record<string, unknown>;
+/** 数组动作只生成下一份草稿；只有 submit 分支才可进入业务写入。 */
+export declare function decodeSchemaFormSubmission(schema: SchemaFormSchema, form: FormData): {
+    kind: 'draft' | 'submit';
+    data: Record<string, unknown>;
+};

package/dist/schema-form-data.js

@@ -0,0 +1,264 @@
+import { assertSchemaFormSchema, isSchemaFormNodeVisible, prepareSchemaFormValue, validateSchemaFormValue } from '@svadmin/core/schema-form';
+export function schemaFormFieldName(path) {
+    return `data:${JSON.stringify(path)}`;
+}
+export const schemaFormActionName = 'schemaFormAction';
+export function encodeSchemaFormArrayAction(action) {
+    if (!['add', 'remove'].includes(action.type) ||
+        !Array.isArray(action.path) || action.path.length === 0 || action.path.length > 32 ||
+        !action.path.every(segment => typeof segment === 'string' && segment.length > 0 && segment.length <= 200)) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (action['type'] === 'remove' &&
+        (!Number.isSafeInteger(action.index) || action.index < 0 || action.index > 1000)) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (action['type'] === 'add' && action['index'] !== undefined)
+        throw new Error('Invalid schema form action.');
+    return JSON.stringify(action);
+}
+export function decodeSchemaFormArrayAction(form) {
+    const values = form.getAll(schemaFormActionName);
+    if (values.length === 0)
+        return;
+    if (values.length !== 1 || typeof values[0] !== 'string' || values[0].length > 10000)
+        throw new Error('Invalid schema form action.');
+    let parsed;
+    try {
+        parsed = JSON.parse(values[0]);
+    }
+    catch {
+        throw new Error('Invalid schema form action.');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+        throw new Error('Invalid schema form action.');
+    const candidate = parsed;
+    if ((candidate['type'] !== 'add' && candidate['type'] !== 'remove') ||
+        !Array.isArray(candidate['path']) ||
+        !candidate['path'].every(segment => typeof segment === 'string' && segment.length > 0 && segment.length <= 200) ||
+        candidate['path'].length === 0 || candidate['path'].length > 32 ||
+        Object.keys(candidate).some(key => !['type', 'path', 'index'].includes(key))) {
+        throw new Error('Invalid schema form action.');
+    }
+    if (candidate['type'] === 'add' && Object.hasOwn(candidate, 'index'))
+        throw new Error('Invalid schema form action.');
+    if (candidate['type'] === 'remove' &&
+        (!Number.isSafeInteger(candidate['index']) || candidate['index'] < 0 || candidate['index'] > 1000)) {
+        throw new Error('Invalid schema form action.');
+    }
+    return candidate;
+}
+/** 按可信 Schema 解码并验证支持的约束；不替代资源授权和业务命令校验。 */
+export function decodeSchemaFormData(schema, form) {
+    if (decodeSchemaFormArrayAction(form))
+        throw new Error('Array actions require decodeSchemaFormSubmission.');
+    return decodeFields(schema, form, true);
+}
+function decodeFields(schema, form, validate) {
+    assertSchemaFormSchema(schema);
+    decodeSchemaFormArrayAction(form);
+    const allowed = new Set();
+    const controllers = {};
+    const controllerValues = new Map();
+    let nodes = 0;
+    let textLength = 0;
+    const fail = () => { throw new Error('Invalid schema form data.'); };
+    function values(name) {
+        allowed.add(name);
+        return form.getAll(name).map(value => {
+            if (typeof value !== 'string')
+                return fail();
+            textLength += value.length;
+            if (textLength > 1_000_000)
+                return fail();
+            return value;
+        });
+    }
+    function visit(node, path, depth) {
+        const cacheKey = JSON.stringify(path);
+        if (controllerValues.has(cacheKey))
+            return controllerValues.get(cacheKey);
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (node.type === 'object' || node.properties) {
+            const result = {};
+            for (const [key, child] of Object.entries(node.properties ?? {})) {
+                if (!isSchemaFormNodeVisible(child, controllers))
+                    continue;
+                Object.defineProperty(result, key, {
+                    value: visit(child, [...path, key], depth + 1),
+                    enumerable: true, configurable: true, writable: true,
+                });
+            }
+            return result;
+        }
+        if (node.type === 'array') {
+            const counts = values(`length:${JSON.stringify(path)}`);
+            if (counts.length !== 1 || !/^(0|[1-9]\d*)$/.test(counts[0] ?? ''))
+                return fail();
+            const count = Number(counts[0]);
+            if (!Number.isSafeInteger(count) || count > 1000 - nodes)
+                return fail();
+            return Array.from({ length: count }, (_, index) => visit(node.items ?? { type: 'string' }, [...path, String(index)], depth + 1));
+        }
+        const entries = values(schemaFormFieldName(path));
+        if (node.type === 'boolean' && !node.enum) {
+            if (entries.length === 1 && entries[0] === 'false')
+                return false;
+            if (entries.length === 2 && entries[0] === 'false' && entries[1] === 'true')
+                return true;
+            return fail();
+        }
+        if (entries.length !== 1)
+            return fail();
+        const raw = entries[0] ?? '';
+        if (node.enum) {
+            if (raw === '')
+                return undefined;
+            if (!/^__json_enum_(0|[1-9]\d*)$/.test(raw))
+                return fail();
+            const index = Number(raw.slice('__json_enum_'.length));
+            if (!Number.isSafeInteger(index) || index >= node.enum.length)
+                return fail();
+            return node.enum[index];
+        }
+        if (node.type === 'null')
+            return raw === 'null' ? null : fail();
+        if (node.type === 'number' || node.type === 'integer') {
+            if (raw === '')
+                return undefined;
+            if (!/^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/.test(raw))
+                return fail();
+            const number = Number(raw);
+            if (!Number.isFinite(number) || (node.type === 'integer' && !Number.isSafeInteger(number)))
+                return fail();
+            return number;
+        }
+        if (node.type !== undefined && node.type !== 'string')
+            return fail();
+        return raw;
+    }
+    if (schema.type !== 'object' && !schema.properties)
+        return fail();
+    // 控制字段只允许无条件标量，因此可先解码，不依赖属性声明顺序。
+    function collectControllers(node) {
+        const path = node.visibleWhen?.path;
+        if (path && !controllerValues.has(JSON.stringify(path))) {
+            let definition = schema;
+            for (const key of path) {
+                const next = definition.properties?.[key];
+                if (!next)
+                    return fail();
+                definition = next;
+            }
+            const decoded = visit(definition, [...path], path.length);
+            controllerValues.set(JSON.stringify(path), decoded);
+            let target = controllers;
+            path.forEach((key, index) => {
+                if (index === path.length - 1) {
+                    Object.defineProperty(target, key, { value: decoded, enumerable: true, configurable: true });
+                }
+                else {
+                    if (!Object.hasOwn(target, key))
+                        Object.defineProperty(target, key, {
+                            value: {}, enumerable: true, configurable: true,
+                        });
+                    target = target[key];
+                }
+            });
+        }
+        for (const child of Object.values(node.properties ?? {}))
+            collectControllers(child);
+        if (node.items)
+            collectControllers(node.items);
+    }
+    collectControllers(schema);
+    const result = visit(schema, [], 0);
+    if (validate && validateSchemaFormValue(schema, result).length > 0)
+        return fail();
+    for (const key of form.keys()) {
+        if ((key.startsWith('data:') || key.startsWith('length:')) && !allowed.has(key))
+            return fail();
+    }
+    return result;
+}
+/** 数组动作只生成下一份草稿；只有 submit 分支才可进入业务写入。 */
+export function decodeSchemaFormSubmission(schema, form) {
+    const action = decodeSchemaFormArrayAction(form);
+    if (!action)
+        return { kind: 'submit', data: decodeSchemaFormData(schema, form) };
+    const data = decodeFields(schema, form, false);
+    const fail = () => { throw new Error('Invalid schema form action.'); };
+    let node = schema;
+    let current = data;
+    for (const segment of action.path) {
+        if (node.type === 'array') {
+            if (!/^(0|[1-9]\d*)$/.test(segment) || !Array.isArray(current) ||
+                Number(segment) >= current.length)
+                return fail();
+            node = node.items ?? { type: 'string' };
+            current = current[Number(segment)];
+        }
+        else {
+            if (!node.properties || !Object.hasOwn(node.properties, segment) ||
+                current === null || typeof current !== 'object' || !Object.hasOwn(current, segment))
+                return fail();
+            const next = node.properties[segment];
+            if (!next)
+                return fail();
+            node = next;
+            current = current[segment];
+        }
+        if (!isSchemaFormNodeVisible(node, data))
+            return fail();
+    }
+    if (node.type !== 'array' || !Array.isArray(current))
+        return fail();
+    // 默认值也受结构预算约束，防止嵌套默认数组放大草稿。
+    let nodes = 0;
+    let length = 0;
+    function defaultValue(definition, depth) {
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (definition.default !== undefined)
+            return structuredClone(definition.default);
+        if (definition.type === 'object' || definition.properties) {
+            return Object.fromEntries(Object.entries(definition.properties ?? {})
+                .map(([key, child]) => [key, defaultValue(child, depth + 1)]));
+        }
+        if (definition.type === 'array')
+            return [];
+        if (definition.type === 'null')
+            return null;
+        if (definition.enum || definition.type === 'number' || definition.type === 'integer')
+            return undefined;
+        return definition.type === 'boolean' ? false : '';
+    }
+    if (action.type === 'add') {
+        if (current.length >= Math.min(node.maxItems ?? 1000, 1000))
+            return fail();
+        current.push(defaultValue(node.items ?? { type: 'string' }, action.path.length + 1));
+    }
+    else {
+        if (action.index === undefined || action.index >= current.length ||
+            current.length <= (node.minItems ?? 0))
+            return fail();
+        current.splice(action.index, 1);
+    }
+    nodes = 0;
+    function checkBudget(value, depth) {
+        if (++nodes > 1000 || depth > 32)
+            return fail();
+        if (typeof value === 'string')
+            length += value.length;
+        if (length > 1_000_000)
+            return fail();
+        if (value && typeof value === 'object') {
+            for (const child of Object.values(value))
+                checkBudget(child, depth + 1);
+        }
+    }
+    checkBudget(data, 0);
+    // 草稿允许尚未填写的必填项，但仍投影掉条件隐藏字段。
+    return { kind: 'draft', data: prepareSchemaFormValue(schema, data).data };
+}