@svgrid/enterprise 2.2.1 → 2.3.1

package/src/studio/introspect-openapi.test.ts

@@ -0,0 +1,84 @@
+import { describe, expect, it } from 'vitest'
+import { introspectOpenApi } from './introspect-openapi'
+
+// A petstore-ish spec: bare-array list, $ref item schema, an enum, a nested $ref
+// relation (pet.category -> Category), and a wrapped-list resource (orders).
+const spec = {
+  openapi: '3.0.3',
+  servers: [{ url: 'https://api.example.com/v1/' }],
+  paths: {
+    '/pets': {
+      get: { responses: { '200': { content: { 'application/json': { schema: { type: 'array', items: { $ref: '#/components/schemas/Pet' } } } } } }, parameters: [{ name: 'status', in: 'query', schema: { type: 'string' } }] },
+      post: { requestBody: { content: { 'application/json': { schema: { $ref: '#/components/schemas/Pet' } } } } },
+    },
+    '/pets/{petId}': {
+      get: { responses: { '200': { content: { 'application/json': { schema: { $ref: '#/components/schemas/Pet' } } } } } },
+      put: { responses: { '200': {} } },
+      delete: { responses: { '204': {} } },
+    },
+    '/categories': { get: { responses: { '200': { content: { 'application/json': { schema: { type: 'array', items: { $ref: '#/components/schemas/Category' } } } } } } } },
+    '/orders': { get: { responses: { '200': { content: { 'application/json': { schema: { $ref: '#/components/schemas/OrderList' } } } } } } },
+  },
+  components: {
+    schemas: {
+      Pet: {
+        type: 'object',
+        required: ['name'],
+        properties: {
+          id: { type: 'integer' },
+          name: { type: 'string' },
+          status: { type: 'string', enum: ['available', 'pending', 'sold'] },
+          bornOn: { type: 'string', format: 'date' },
+          category: { $ref: '#/components/schemas/Category' },
+          tags: { type: 'array', items: { type: 'string' } },
+        },
+      },
+      Category: { type: 'object', properties: { id: { type: 'integer' }, name: { type: 'string' } } },
+      Order: { type: 'object', properties: { id: { type: 'integer' }, total: { type: 'number' }, placedAt: { type: 'string', format: 'date-time' } } },
+      OrderList: { type: 'object', properties: { data: { type: 'array', items: { $ref: '#/components/schemas/Order' } }, total: { type: 'integer' } } },
+    },
+  },
+}
+
+describe('introspectOpenApi', () => {
+  const out = introspectOpenApi(JSON.stringify(spec))
+
+  it('groups paths into one entity + one REST source per resource', () => {
+    expect(out.entities.map((e) => e.name).sort()).toEqual(['category', 'order', 'pet'])
+    const pet = out.sources.pet
+    expect(pet).toMatchObject({ kind: 'rest', baseUrl: 'https://api.example.com/v1', path: 'pets', method: 'GET', idField: 'id' })
+    // query parameters carried onto the source
+    if (pet?.kind === 'rest') expect(pet.params).toEqual([{ name: 'status', location: 'query', type: 'string' }])
+  })
+
+  it('maps JSON-Schema types + formats + enums + pk', () => {
+    const pet = out.entities.find((e) => e.name === 'pet')!
+    const byName = new Map(pet.fields.map((f) => [f.field, f]))
+    expect(byName.get('id')).toMatchObject({ type: 'number', primaryKey: true })
+    expect(byName.get('name')).toMatchObject({ type: 'text', required: true })
+    expect(byName.get('status')).toMatchObject({ type: 'enum' })
+    expect(byName.get('status')!.options!.map((o) => o.value)).toEqual(['available', 'pending', 'sold'])
+    expect(byName.get('bornOn')!.type).toBe('dateString')
+    expect(byName.get('tags')!.type).toBe('json')
+  })
+
+  it('turns a $ref property into a relation to the referenced entity', () => {
+    const pet = out.entities.find((e) => e.name === 'pet')!
+    const category = pet.fields.find((f) => f.field === 'category')!
+    expect(category).toMatchObject({ type: 'relation', relation: { entity: 'category', foreignKey: 'category' } })
+  })
+
+  it('detects a wrapped list response (rowsPath = data) + item schema behind it', () => {
+    const src = out.sources.order
+    expect(src?.kind === 'rest' ? src.rowsPath : null).toBe('data')
+    const order = out.entities.find((e) => e.name === 'order')!
+    expect(order.fields.map((f) => f.field).sort()).toEqual(['id', 'placedAt', 'total'])
+    expect(order.fields.find((f) => f.field === 'placedAt')!.type).toBe('datetime')
+  })
+
+  it('rejects non-JSON and non-OpenAPI input with clear errors', () => {
+    expect(() => introspectOpenApi('name: swagger')).toThrow(/JSON only/)
+    expect(() => introspectOpenApi('{"foo":1}')).toThrow(/no "paths"/)
+    expect(() => introspectOpenApi('{"paths":{}}')).toThrow(/No REST resources/)
+  })
+})

package/src/studio/introspect-openapi.ts

@@ -0,0 +1,252 @@
+/**
+ * Import an OpenAPI 3.x document (JSON) into Studio entities + REST data sources.
+ * Point at a spec and get a modelled app: each REST resource ( `GET /pets` +
+ * `GET /pets/{id}` + POST/PUT/DELETE ) becomes one EntitySchema and one
+ * `RestSource`, with fields mapped from the resource's JSON Schema.
+ *
+ * v1 scope: OpenAPI 3.x JSON only (YAML deferred), single-file `$ref` into
+ * `components/schemas`. Pure + Svelte-free like the rest of the studio core.
+ */
+import type { EntityField, EntityFieldType, EntitySchema } from '../schema.js'
+import type { EntityDataSource, RequestParam, RestSource } from './project.js'
+
+type Json = Record<string, unknown>
+type OpenApiDoc = {
+  openapi?: string
+  servers?: Array<{ url?: string }>
+  paths?: Record<string, Json>
+  components?: { schemas?: Record<string, Json> }
+}
+
+export type OpenApiImport = {
+  entities: EntitySchema[]
+  sources: Record<string, EntityDataSource>
+  /** Non-fatal notes (skipped paths, unresolved refs) to surface in the UI. */
+  warnings: string[]
+}
+
+const HTTP_METHODS = ['get', 'post', 'put', 'patch', 'delete'] as const
+
+/** Resolve a local `#/components/schemas/Foo` ref (one level). */
+function resolveRef(doc: OpenApiDoc, ref: string): Json | null {
+  const m = ref.match(/^#\/components\/schemas\/(.+)$/)
+  if (!m) return null
+  return (doc.components?.schemas?.[m[1]!] as Json) ?? null
+}
+
+/** Follow a `$ref` to its target schema (guards against a self/cyclic ref). */
+function deref(doc: OpenApiDoc, node: Json | undefined, seen = new Set<string>()): Json | null {
+  if (!node) return null
+  const ref = node['$ref']
+  if (typeof ref === 'string') {
+    if (seen.has(ref)) return null
+    seen.add(ref)
+    return deref(doc, resolveRef(doc, ref) ?? undefined, seen)
+  }
+  return node
+}
+
+/** The component-schema name a `$ref` points at, or null. */
+function refName(node: Json | undefined): string | null {
+  const ref = node?.['$ref']
+  const m = typeof ref === 'string' ? ref.match(/^#\/components\/schemas\/(.+)$/) : null
+  return m ? m[1]! : null
+}
+
+const titleCase = (s: string) => s.replace(/[-_]+/g, ' ').replace(/([a-z0-9])([A-Z])/g, '$1 $2').replace(/^./, (c) => c.toUpperCase()).trim()
+const singular = (s: string) => (s.endsWith('ies') ? s.slice(0, -3) + 'y' : s.endsWith('ses') ? s.slice(0, -2) : s.endsWith('s') && !s.endsWith('ss') ? s.slice(0, -1) : s)
+
+/** Map one JSON-Schema property to an EntityField type (+ enum options). */
+function fieldType(doc: OpenApiDoc, prop: Json, entityByRef: Map<string, string>): { type: EntityFieldType; options?: Array<{ value: string; label: string }>; relation?: string } {
+  // A `$ref` to a schema that became one of our entities -> a relation.
+  const rn = refName(prop)
+  if (rn && entityByRef.has(rn)) return { type: 'relation', relation: entityByRef.get(rn)! }
+  const schema = deref(doc, prop) ?? prop
+  const enumVals = schema['enum']
+  if (Array.isArray(enumVals) && enumVals.every((v) => typeof v === 'string' || typeof v === 'number')) {
+    return { type: 'enum', options: enumVals.map((v) => ({ value: String(v), label: titleCase(String(v)) })) }
+  }
+  const t = schema['type']
+  const fmt = schema['format']
+  if (t === 'integer' || t === 'number') return { type: 'number' }
+  if (t === 'boolean') return { type: 'boolean' }
+  if (t === 'array' || t === 'object') return { type: 'json' }
+  if (t === 'string') {
+    if (fmt === 'date') return { type: 'dateString' }
+    if (fmt === 'date-time') return { type: 'datetime' }
+    return { type: 'text' }
+  }
+  return { type: 'text' }
+}
+
+/** Object schema -> EntityField[]. `id`/pk detection + required + relations. */
+function schemaToFields(doc: OpenApiDoc, objectSchema: Json, entityByRef: Map<string, string>): EntityField[] {
+  const props = (deref(doc, objectSchema)?.['properties'] as Record<string, Json> | undefined) ?? {}
+  const required = new Set((deref(doc, objectSchema)?.['required'] as string[] | undefined) ?? [])
+  const fields: EntityField[] = []
+  for (const [name, rawProp] of Object.entries(props)) {
+    const ft = fieldType(doc, rawProp, entityByRef)
+    const isPk = name === 'id' || name === '_id'
+    const field: EntityField = {
+      field: name,
+      label: titleCase(name),
+      type: ft.type,
+      ...(isPk ? { primaryKey: true } : {}),
+      ...(required.has(name) && !isPk ? { required: true } : {}),
+      ...(ft.options ? { options: ft.options } : {}),
+      ...(ft.relation ? { relation: { entity: ft.relation, labelField: 'name', foreignKey: name } } : {}),
+    }
+    fields.push(field)
+  }
+  return fields
+}
+
+/** The item schema for a resource: the 200 response of GET-by-id, else the array
+ *  item of the list response, else the POST request body. */
+function itemSchemaFor(doc: OpenApiDoc, ops: Record<string, Json>): Json | null {
+  const bodySchema = (op: Json | undefined, kind: 'response' | 'request'): Json | null => {
+    if (!op) return null
+    const content =
+      kind === 'response'
+        ? ((op['responses'] as Json | undefined)?.['200'] as Json | undefined)?.['content']
+        : (op['requestBody'] as Json | undefined)?.['content']
+    const json = (content as Json | undefined)?.['application/json'] as Json | undefined
+    return (json?.['schema'] as Json | undefined) ?? null
+  }
+  const byId = bodySchema(ops.getOne, 'response')
+  if (byId) return deref(doc, byId)
+  const list = bodySchema(ops.list, 'response')
+  if (list) {
+    const s = deref(doc, list)
+    if (s?.['type'] === 'array') return deref(doc, s['items'] as Json)
+    // wrapped: { data: [ item ] } / { items: [...] } / { results: [...] }
+    for (const key of ['data', 'items', 'results', 'rows']) {
+      const wrapped = deref(doc, (s?.['properties'] as Record<string, Json> | undefined)?.[key])
+      if (wrapped?.['type'] === 'array') return deref(doc, wrapped['items'] as Json)
+    }
+  }
+  const created = bodySchema(ops.create, 'request')
+  return created ? deref(doc, created) : null
+}
+
+/** The `application/json` schema node of an operation's 200 response, else null. */
+function responseSchema(op: Json | undefined): Json | undefined {
+  const content = ((op?.['responses'] as Json | undefined)?.['200'] as Json | undefined)?.['content'] as Json | undefined
+  return (content?.['application/json'] as Json | undefined)?.['schema'] as Json | undefined
+}
+
+/** The dotted rows path for a list response ('data'/'items'/...), or undefined
+ *  when the response is a bare array. */
+function rowsPathFor(doc: OpenApiDoc, listOp: Json | undefined): string | undefined {
+  const s = deref(doc, responseSchema(listOp))
+  if (!s || s['type'] === 'array') return undefined
+  for (const key of ['data', 'items', 'results', 'rows']) {
+    if (deref(doc, (s['properties'] as Record<string, Json> | undefined)?.[key])?.['type'] === 'array') return key
+  }
+  return undefined
+}
+
+function paramsFor(doc: OpenApiDoc, op: Json | undefined): RequestParam[] {
+  const raw = (op?.['parameters'] as Json[] | undefined) ?? []
+  const out: RequestParam[] = []
+  for (const p of raw) {
+    const param = deref(doc, p) ?? p
+    const loc = param['in']
+    const name = param['name']
+    if (typeof name !== 'string' || (loc !== 'query' && loc !== 'path' && loc !== 'header')) continue
+    out.push({ name, location: loc, type: 'string' })
+  }
+  return out
+}
+
+/** Split "/pets/{petId}" -> { collection: "/pets", isItem: true }. A collection
+ *  path ends in a static segment; an item path ends in a `{param}`. */
+function classifyPath(path: string): { collection: string; isItem: boolean } {
+  const segs = path.split('/').filter(Boolean)
+  if (segs.length && /^\{.+\}$/.test(segs.at(-1)!)) return { collection: '/' + segs.slice(0, -1).join('/'), isItem: true }
+  return { collection: path, isItem: false }
+}
+
+/** Parse + introspect an OpenAPI 3.x JSON document into entities + REST sources. */
+export function introspectOpenApi(specText: string): OpenApiImport {
+  let doc: OpenApiDoc
+  try {
+    doc = JSON.parse(specText) as OpenApiDoc
+  } catch {
+    throw new Error('Could not parse the OpenAPI document. v1 supports JSON only - convert a YAML spec to JSON first (e.g. https://editor.swagger.io export).')
+  }
+  if (!doc || typeof doc !== 'object' || !doc.paths) throw new Error('Not an OpenAPI document: no "paths" object found.')
+
+  const warnings: string[] = []
+  const baseUrl = (doc.servers?.[0]?.url ?? '').replace(/\/+$/, '')
+
+  // Group operations by resource (collection path).
+  type Res = { name: string; collection: string; ops: Record<string, Json> }
+  const byCollection = new Map<string, Res>()
+  for (const [path, item] of Object.entries(doc.paths)) {
+    const { collection, isItem } = classifyPath(path)
+    const segs = collection.split('/').filter(Boolean)
+    const last = segs.at(-1)
+    if (!last || /^\{.+\}$/.test(last)) { warnings.push(`Skipped path "${path}" (no clear resource name).`); continue }
+    const name = singular(last).replace(/[^a-zA-Z0-9]+/g, '_').toLowerCase()
+    const res = byCollection.get(collection) ?? { name, collection, ops: {} }
+    for (const method of HTTP_METHODS) {
+      const op = item[method] as Json | undefined
+      if (!op) continue
+      if (method === 'get') res.ops[isItem ? 'getOne' : 'list'] = op
+      else if (method === 'post' && !isItem) res.ops.create = op
+      else if ((method === 'put' || method === 'patch') && isItem) res.ops.update = op
+      else if (method === 'delete' && isItem) res.ops.delete = op
+    }
+    byCollection.set(collection, res)
+  }
+
+  // Two passes: map each resource's component schema NAME -> entity name first,
+  // so a property that `$ref`s another resource's schema becomes a relation.
+  const resources = [...byCollection.values()].filter((r) => r.ops.list || r.ops.getOne || r.ops.create)
+  const entityByRef = new Map<string, string>()
+  for (const r of resources) {
+    for (const opKey of ['getOne', 'list', 'create'] as const) {
+      const op = r.ops[opKey]
+      const schema = responseSchema(op) ?? ((((op?.['requestBody'] as Json | undefined)?.['content'] as Json | undefined)?.['application/json'] as Json | undefined)?.['schema'] as Json | undefined)
+      const direct = refName(schema)
+      if (direct) entityByRef.set(direct, r.name)
+      const arrItem = refName(deref(doc, schema)?.['items'] as Json | undefined)
+      if (arrItem) entityByRef.set(arrItem, r.name)
+    }
+  }
+
+  const entities: EntitySchema[] = []
+  const sources: Record<string, EntityDataSource> = {}
+  const seenNames = new Set<string>()
+  for (const r of resources) {
+    let name = r.name
+    while (seenNames.has(name)) name = name + '_'
+    seenNames.add(name)
+    const item = itemSchemaFor(doc, r.ops)
+    if (!item) { warnings.push(`Resource "${r.collection}" has no readable schema - skipped.`); continue }
+    const fields = schemaToFields(doc, item, entityByRef)
+    if (!fields.length) { warnings.push(`Resource "${r.collection}" resolved no fields - skipped.`); continue }
+    if (!fields.some((f) => f.primaryKey)) {
+      const idish = fields.find((f) => /id$/i.test(f.field))
+      if (idish) idish.primaryKey = true
+      else fields.unshift({ field: 'id', label: 'Id', type: 'text', primaryKey: true })
+    }
+    const idField = fields.find((f) => f.primaryKey)!.field
+    entities.push({ name, label: titleCase(name), idField, fields })
+    const path = r.collection.replace(/^\/+/, '')
+    const source: RestSource = {
+      kind: 'rest',
+      baseUrl,
+      path,
+      method: 'GET',
+      params: paramsFor(doc, r.ops.list),
+      idField,
+      ...(rowsPathFor(doc, r.ops.list) ? { rowsPath: rowsPathFor(doc, r.ops.list) } : {}),
+    }
+    sources[name] = source
+  }
+
+  if (!entities.length) throw new Error('No REST resources with a readable schema were found in the document.')
+  return { entities, sources, warnings }
+}

package/src/studio/project.test.ts

@@ -4,6 +4,8 @@ import {
   addBlock,
   applyGridPreset,
   addStateVar,
+  setDataLayer,
+  setDeployTarget,
   updateStateVar,
   removeStateVar,
   stateInitExpr,
@@ -37,7 +39,6 @@ import {
   blockPalette,
   createProject,
   defaultBlockConfig,
-  defaultScreenFor,
   gridColumns,
   moveBlock,
   removeBlock,
@@ -55,6 +56,7 @@ import {
   reorderScreen,
   insertBlock,
   validateProject,
+  setAuth,
   addTab,
   removeTab,
   renameTab,
@@ -599,6 +601,22 @@ describe('component blocks', () => {
     p = addComponentBlock(p, sid, 'button', {})
     expect(validateProject(p).some((i) => /is empty/.test(i.message))).toBe(false)
   })
+
+  it('Supabase Auth warns without a Supabase connection, and clears once one is set', () => {
+    let p = setAuth(createProject([customers]), { enabled: true, provider: 'supabase' })
+    const needsConn = (pr: typeof p) => validateProject(pr).some((i) => /Supabase Auth needs a Supabase connection/.test(i.message))
+    expect(needsConn(p)).toBe(true)
+    // Shared project connection satisfies it.
+    p = { ...p, supabase: { url: 'https://x.supabase.co', key: 'anon' } }
+    expect(needsConn(p)).toBe(false)
+  })
+
+  it('Supabase Auth + RBAC warns that the client session does not populate the server role', () => {
+    let p = createProject([customers])
+    p = { ...p, supabase: { url: 'https://x.supabase.co', key: 'anon' }, access: { enabled: true, roles: [] } as never }
+    p = setAuth(p, { enabled: true, provider: 'supabase' })
+    expect(validateProject(p).some((i) => /Row Level Security/.test(i.message))).toBe(true)
+  })
 })
 
 describe('validateProject', () => {
@@ -618,6 +636,33 @@ describe('validateProject', () => {
     expect(validateProject(broken).some((i) => /missing entity/.test(i.message))).toBe(true)
   })
 
+  it('warns when SQL entities have no Drizzle data layer (tables must pre-exist)', () => {
+    let p = createProject([customers])
+    p = setEntityDataSource(p, 'customers', { kind: 'sql', table: 'customers', dialect: 'postgres' })
+    const warn = validateProject(p).find((i) => /tables must already exist/.test(i.message))
+    expect(warn?.level).toBe('warning')
+    // Enabling the Drizzle layer clears it.
+    expect(validateProject(setDataLayer(p, true)).some((i) => /tables must already exist/.test(i.message))).toBe(false)
+  })
+
+  it('warns on cloudflare deploy + a socket Postgres driver', () => {
+    let p = createProject([customers])
+    p = setEntityDataSource(p, 'customers', { kind: 'sql', table: 'customers', dialect: 'postgres' })
+    p = setDeployTarget(p, 'cloudflare')
+    expect(validateProject(p).some((i) => /Cloudflare Workers cannot run the socket/.test(i.message))).toBe(true)
+    // sqlite on cloudflare doesn't trip the pg warning.
+    p = setEntityDataSource(p, 'customers', { kind: 'sql', table: 'customers', dialect: 'sqlite' })
+    expect(validateProject(p).some((i) => /Cloudflare Workers cannot run the socket/.test(i.message))).toBe(false)
+  })
+
+  it('warns when a supabase source has no url/key (stub client)', () => {
+    let p = createProject([customers])
+    p = setEntityDataSource(p, 'customers', { kind: 'supabase', table: 'customers' })
+    expect(validateProject(p).some((i) => /has no URL\/key/.test(i.message))).toBe(true)
+    p = setEntityDataSource(p, 'customers', { kind: 'supabase', table: 'customers', url: 'https://x.supabase.co', key: 'anon' })
+    expect(validateProject(p).some((i) => /has no URL\/key/.test(i.message))).toBe(false)
+  })
+
   it('the palette lists every block kind', () => {
     expect(blockPalette.map((p) => p.kind)).toContain('grid')
     expect(blockPalette.map((p) => p.kind)).toContain('dashboard')
@@ -761,6 +806,17 @@ describe('per-entity data sources', () => {
     expect(p1.dataSources).toMatchObject({ customers: { kind: 'rest' } })
   })
 
+  it('an unbound entity inherits the project default source (not always memory)', () => {
+    const p0 = createProject([customers]) // dataSource: 'memory'
+    expect(entityDataSource(p0, 'customers')).toEqual({ kind: 'memory' })
+    // Flip the project default to SQL: unbound entities now resolve to the SQL skeleton.
+    const pSql = { ...p0, dataSource: 'sql' as const }
+    expect(entityDataSource(pSql, 'customers')).toEqual({ kind: 'sql', table: 'customers' })
+    // An explicit per-entity binding still wins over the default.
+    const pOverride = setEntityDataSource(pSql, 'customers', { kind: 'memory' })
+    expect(entityDataSource(pOverride, 'customers')).toEqual({ kind: 'memory' })
+  })
+
   it('defaultEntitySource seeds a skeleton per kind', () => {
     expect(defaultEntitySource('rest', 'customers')).toMatchObject({ kind: 'rest', path: 'customers', method: 'GET', params: [] })
     expect(defaultEntitySource('sql', 'orders')).toEqual({ kind: 'sql', table: 'orders' })