@things-factory/auth-ui 10.1.16 → 10.1.18

package/dist-client/utils/application-status.d.ts

@@ -0,0 +1,32 @@
+/**
+ * How an application's status is shown.
+ *
+ * ── The rule that matters: a value we do not know is shown as it is ──────────
+ * `ApplicationStatus` is DRAFT or ACTIVATED today. A screen that maps those two to friendly
+ * words has to decide what to do with a third, and the tempting answer — fall through to one
+ * of the two, or to an empty cell — is the one that lies.
+ *
+ * This is the same mistake the role screen made with privilege axes, where anything that was
+ * not `query` was drawn as "write" and so a value first seen on the day it shipped landed in
+ * the dangerous bucket by accident rather than by verification. The fix there and here is the
+ * same: translate what is declared, and print anything else verbatim.
+ *
+ * An unknown status is not a failure either — the server is free to add one, and a screen a
+ * version behind should say "PENDING" rather than pretend it knows what PENDING means.
+ */
+/** The statuses this screen has words for. Everything else is printed as it arrives. */
+export declare const KNOWN_APPLICATION_STATUSES: string[];
+/**
+ * The i18n key for a status, or nothing when there is no key for it.
+ *
+ * Returning nothing rather than a guess lets the caller print the raw value, which is the
+ * whole point. `translate` is passed in so this stays testable without i18next.
+ */
+export declare function applicationStatusKey(status: string | null | undefined): string | undefined;
+/**
+ * What the cell shows.
+ *
+ * Empty for a missing status — the row genuinely has none, and an empty cell says that more
+ * honestly than the word "unknown", which reads as a status of its own.
+ */
+export declare function applicationStatusLabel(status: string | null | undefined, translate: (key: string) => string): string;

package/dist-client/utils/application-status.js

@@ -0,0 +1,45 @@
+/**
+ * How an application's status is shown.
+ *
+ * ── The rule that matters: a value we do not know is shown as it is ──────────
+ * `ApplicationStatus` is DRAFT or ACTIVATED today. A screen that maps those two to friendly
+ * words has to decide what to do with a third, and the tempting answer — fall through to one
+ * of the two, or to an empty cell — is the one that lies.
+ *
+ * This is the same mistake the role screen made with privilege axes, where anything that was
+ * not `query` was drawn as "write" and so a value first seen on the day it shipped landed in
+ * the dangerous bucket by accident rather than by verification. The fix there and here is the
+ * same: translate what is declared, and print anything else verbatim.
+ *
+ * An unknown status is not a failure either — the server is free to add one, and a screen a
+ * version behind should say "PENDING" rather than pretend it knows what PENDING means.
+ */
+/** The statuses this screen has words for. Everything else is printed as it arrives. */
+export const KNOWN_APPLICATION_STATUSES = ['DRAFT', 'ACTIVATED'];
+const LABEL = {
+    DRAFT: 'label.draft',
+    ACTIVATED: 'label.activated'
+};
+/**
+ * The i18n key for a status, or nothing when there is no key for it.
+ *
+ * Returning nothing rather than a guess lets the caller print the raw value, which is the
+ * whole point. `translate` is passed in so this stays testable without i18next.
+ */
+export function applicationStatusKey(status) {
+    return status ? LABEL[status] : undefined;
+}
+/**
+ * What the cell shows.
+ *
+ * Empty for a missing status — the row genuinely has none, and an empty cell says that more
+ * honestly than the word "unknown", which reads as a status of its own.
+ */
+export function applicationStatusLabel(status, translate) {
+    if (!status) {
+        return '';
+    }
+    const key = applicationStatusKey(status);
+    return key ? translate(key) : status;
+}
+//# sourceMappingURL=application-status.js.map

package/dist-client/utils/application-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-status.js","sourceRoot":"","sources":["../../client/utils/application-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,wFAAwF;AACxF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;AAEhE,MAAM,KAAK,GAA2B;IACpC,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE,iBAAiB;CAC7B,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAiC,EACjC,SAAkC;IAElC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,GAAG,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAExC,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;AACtC,CAAC","sourcesContent":["/**\n * How an application's status is shown.\n *\n * ── The rule that matters: a value we do not know is shown as it is ──────────\n * `ApplicationStatus` is DRAFT or ACTIVATED today. A screen that maps those two to friendly\n * words has to decide what to do with a third, and the tempting answer — fall through to one\n * of the two, or to an empty cell — is the one that lies.\n *\n * This is the same mistake the role screen made with privilege axes, where anything that was\n * not `query` was drawn as \"write\" and so a value first seen on the day it shipped landed in\n * the dangerous bucket by accident rather than by verification. The fix there and here is the\n * same: translate what is declared, and print anything else verbatim.\n *\n * An unknown status is not a failure either — the server is free to add one, and a screen a\n * version behind should say \"PENDING\" rather than pretend it knows what PENDING means.\n */\n\n/** The statuses this screen has words for. Everything else is printed as it arrives. */\nexport const KNOWN_APPLICATION_STATUSES = ['DRAFT', 'ACTIVATED']\n\nconst LABEL: Record<string, string> = {\n  DRAFT: 'label.draft',\n  ACTIVATED: 'label.activated'\n}\n\n/**\n * The i18n key for a status, or nothing when there is no key for it.\n *\n * Returning nothing rather than a guess lets the caller print the raw value, which is the\n * whole point. `translate` is passed in so this stays testable without i18next.\n */\nexport function applicationStatusKey(status: string | null | undefined): string | undefined {\n  return status ? LABEL[status] : undefined\n}\n\n/**\n * What the cell shows.\n *\n * Empty for a missing status — the row genuinely has none, and an empty cell says that more\n * honestly than the word \"unknown\", which reads as a status of its own.\n */\nexport function applicationStatusLabel(\n  status: string | null | undefined,\n  translate: (key: string) => string\n): string {\n  if (!status) {\n    return ''\n  }\n\n  const key = applicationStatusKey(status)\n\n  return key ? translate(key) : status\n}\n"]}

package/dist-client/utils/application-status.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/application-status.test.js

@@ -0,0 +1,45 @@
+import { applicationStatusKey, applicationStatusLabel, KNOWN_APPLICATION_STATUSES } from './application-status';
+/**
+ * The applications list used to print "draft" for every row, hardcoded, so an activated
+ * application read as a draft. The column now comes from the row — and the question that
+ * replaces it is what to print for a value this screen has no word for.
+ */
+const translate = (key) => ({ 'label.draft': '초안', 'label.activated': '사용 중' })[key] || key;
+describe('the statuses this screen has words for', () => {
+    it('translates the two the server declares', () => {
+        expect(applicationStatusLabel('DRAFT', translate)).toBe('초안');
+        expect(applicationStatusLabel('ACTIVATED', translate)).toBe('사용 중');
+        expect(KNOWN_APPLICATION_STATUSES).toEqual(['DRAFT', 'ACTIVATED']);
+    });
+});
+describe('a status this screen has never seen', () => {
+    it('prints it as it arrived instead of guessing', () => {
+        /*
+         * ⚠ The case this file exists for. The server may add a status; a client one release
+         * behind must not decide what it means. Mapping the unknown onto DRAFT or ACTIVATED
+         * would make the screen wrong with full confidence.
+         */
+        expect(applicationStatusLabel('PENDING', translate)).toBe('PENDING');
+        expect(applicationStatusKey('PENDING')).toBeUndefined();
+    });
+    it('does not fall through to either known word', () => {
+        const shown = applicationStatusLabel('SUSPENDED', translate);
+        expect(shown).not.toBe('초안');
+        expect(shown).not.toBe('사용 중');
+    });
+    it('is not treated as an error — it is a status, just an unfamiliar one', () => {
+        expect(applicationStatusLabel('PENDING', translate)).toBeTruthy();
+    });
+});
+describe('a row with no status at all', () => {
+    it('shows nothing rather than a word', () => {
+        /*
+         * Empty, not "unknown". "Unknown" reads as a status the server assigned; empty reads as
+         * the absence this actually is.
+         */
+        expect(applicationStatusLabel(undefined, translate)).toBe('');
+        expect(applicationStatusLabel(null, translate)).toBe('');
+        expect(applicationStatusLabel('', translate)).toBe('');
+    });
+});
+//# sourceMappingURL=application-status.test.js.map

package/dist-client/utils/application-status.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"application-status.test.js","sourceRoot":"","sources":["../../client/utils/application-status.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAA;AAE/G;;;;GAIG;AAEH,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,CAAA;AAEnG,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,sBAAsB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC7D,MAAM,CAAC,sBAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnE,MAAM,CAAC,0BAA0B,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAA;IACpE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD;;;;WAIG;QACH,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACpE,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,KAAK,GAAG,sBAAsB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAA;QAE5D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C;;;WAGG;QACH,MAAM,CAAC,sBAAsB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC7D,MAAM,CAAC,sBAAsB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACxD,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { applicationStatusKey, applicationStatusLabel, KNOWN_APPLICATION_STATUSES } from './application-status'\n\n/**\n * The applications list used to print \"draft\" for every row, hardcoded, so an activated\n * application read as a draft. The column now comes from the row — and the question that\n * replaces it is what to print for a value this screen has no word for.\n */\n\nconst translate = (key: string) => ({ 'label.draft': '초안', 'label.activated': '사용 중' })[key] || key\n\ndescribe('the statuses this screen has words for', () => {\n  it('translates the two the server declares', () => {\n    expect(applicationStatusLabel('DRAFT', translate)).toBe('초안')\n    expect(applicationStatusLabel('ACTIVATED', translate)).toBe('사용 중')\n    expect(KNOWN_APPLICATION_STATUSES).toEqual(['DRAFT', 'ACTIVATED'])\n  })\n})\n\ndescribe('a status this screen has never seen', () => {\n  it('prints it as it arrived instead of guessing', () => {\n    /*\n     * ⚠ The case this file exists for. The server may add a status; a client one release\n     * behind must not decide what it means. Mapping the unknown onto DRAFT or ACTIVATED\n     * would make the screen wrong with full confidence.\n     */\n    expect(applicationStatusLabel('PENDING', translate)).toBe('PENDING')\n    expect(applicationStatusKey('PENDING')).toBeUndefined()\n  })\n\n  it('does not fall through to either known word', () => {\n    const shown = applicationStatusLabel('SUSPENDED', translate)\n\n    expect(shown).not.toBe('초안')\n    expect(shown).not.toBe('사용 중')\n  })\n\n  it('is not treated as an error — it is a status, just an unfamiliar one', () => {\n    expect(applicationStatusLabel('PENDING', translate)).toBeTruthy()\n  })\n})\n\ndescribe('a row with no status at all', () => {\n  it('shows nothing rather than a word', () => {\n    /*\n     * Empty, not \"unknown\". \"Unknown\" reads as a status the server assigned; empty reads as\n     * the absence this actually is.\n     */\n    expect(applicationStatusLabel(undefined, translate)).toBe('')\n    expect(applicationStatusLabel(null, translate)).toBe('')\n    expect(applicationStatusLabel('', translate)).toBe('')\n  })\n})\n"]}

package/dist-client/utils/form-values.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Turning a form into the object a mutation takes.
+ *
+ * ── The bug this exists for ──────────────────────────────────────────────────
+ * The application register screen built its input like this:
+ *
+ *     Array.from(formData.entries()).reduce((app, [key, value]) => { app[key] = value; … })
+ *
+ * `FormData` carries **every named input**, including the ones nobody typed in, each as an
+ * empty string. So an untouched optional field went to the server as `''` rather than as
+ * absent — and for `email` that is not the same thing at all:
+ *
+ *     NewApplication.email is GraphQLEmailAddress, nullable
+ *     EmailAddressResolver.parseValue('')  →  "Value is not a valid email address"
+ *
+ * Registering an application without a contact email therefore failed, on a field the schema
+ * marks optional. The screen said nothing useful about why.
+ *
+ * ── What "absent" means here ─────────────────────────────────────────────────
+ * An empty text input means the person did not fill it in. It does not mean "set this to the
+ * empty string" — HTML has no way to say that, and no field in these forms wants it. So an
+ * empty value is dropped and the key never appears, which is what "optional" means on the
+ * wire.
+ *
+ * Whitespace counts as empty for the same reason: a space typed by accident is not an answer,
+ * and every scalar that rejects `''` rejects `' '` too.
+ */
+/** Values a form can carry. Files pass through untouched — there is no empty file to drop. */
+export type FormValue = string | File;
+/**
+ * The filled-in fields, as an object.
+ *
+ * Keys whose value is empty or whitespace are left out entirely rather than sent as `''`.
+ */
+export declare function filledValues(formData: FormData): Record<string, FormValue>;
+/**
+ * Which of the named fields are still missing.
+ *
+ * The screen asks before it sends, so the person is told which box to fill rather than
+ * watching a mutation fail on a rule the form never mentioned.
+ */
+export declare function missingRequired(formData: FormData, required: string[]): string[];
+/**
+ * What the person changed, as a patch.
+ *
+ * ── Why this is not `filledValues` ──────────────────────────────────────────
+ * On a create, an empty box means "I did not fill this in" and the key is left out — that is
+ * what optional means on the wire, and it is what `filledValues` does.
+ *
+ * On an **update** that reading is wrong. `AppliancePatch` and `ApplicationPatch` are applied
+ * by spreading over the loaded row (`applianceRepository.save({ ...appliance, ...patch })`),
+ * so a key that is absent means "leave it alone" and a key set to `''` means "clear it".
+ * Those are two different intentions and a form has to tell them apart:
+ *
+ *     netmask was '10.0.0.0/8', box is now empty   →  the person cleared it   →  send ''
+ *     netmask was never set,    box is still empty →  nothing happened        →  send nothing
+ *
+ * `filledValues` cannot express the first one — it drops every empty box — so an update
+ * screen built on it can never clear a field. Sending the whole form instead has the opposite
+ * fault: every untouched box goes as `''`, which clears fields nobody touched, and for
+ * `ApplicationPatch.email` (a GraphQLEmailAddress) `''` is not "no email" but an invalid one,
+ * so the whole update is refused over a box the person never visited.
+ *
+ * Comparing against the record that was loaded is the only thing that tells the two apart.
+ *
+ * ── The other thing this buys ───────────────────────────────────────────────
+ * The patch carries only what moved. A screen that sends every field back writes values it
+ * merely displayed, so a row edited from a stale copy silently overwrites whatever someone
+ * else changed in between.
+ */
+export declare function changedValues(formData: FormData, original: Record<string, any> | null | undefined): Record<string, FormValue>;

package/dist-client/utils/form-values.js

@@ -0,0 +1,102 @@
+/**
+ * Turning a form into the object a mutation takes.
+ *
+ * ── The bug this exists for ──────────────────────────────────────────────────
+ * The application register screen built its input like this:
+ *
+ *     Array.from(formData.entries()).reduce((app, [key, value]) => { app[key] = value; … })
+ *
+ * `FormData` carries **every named input**, including the ones nobody typed in, each as an
+ * empty string. So an untouched optional field went to the server as `''` rather than as
+ * absent — and for `email` that is not the same thing at all:
+ *
+ *     NewApplication.email is GraphQLEmailAddress, nullable
+ *     EmailAddressResolver.parseValue('')  →  "Value is not a valid email address"
+ *
+ * Registering an application without a contact email therefore failed, on a field the schema
+ * marks optional. The screen said nothing useful about why.
+ *
+ * ── What "absent" means here ─────────────────────────────────────────────────
+ * An empty text input means the person did not fill it in. It does not mean "set this to the
+ * empty string" — HTML has no way to say that, and no field in these forms wants it. So an
+ * empty value is dropped and the key never appears, which is what "optional" means on the
+ * wire.
+ *
+ * Whitespace counts as empty for the same reason: a space typed by accident is not an answer,
+ * and every scalar that rejects `''` rejects `' '` too.
+ */
+/**
+ * The filled-in fields, as an object.
+ *
+ * Keys whose value is empty or whitespace are left out entirely rather than sent as `''`.
+ */
+export function filledValues(formData) {
+    const values = {};
+    for (const [key, value] of Array.from(formData.entries())) {
+        if (typeof value === 'string') {
+            const trimmed = value.trim();
+            if (trimmed) {
+                values[key] = trimmed;
+            }
+            continue;
+        }
+        values[key] = value;
+    }
+    return values;
+}
+/**
+ * Which of the named fields are still missing.
+ *
+ * The screen asks before it sends, so the person is told which box to fill rather than
+ * watching a mutation fail on a rule the form never mentioned.
+ */
+export function missingRequired(formData, required) {
+    const values = filledValues(formData);
+    return required.filter(name => !values[name]);
+}
+/**
+ * What the person changed, as a patch.
+ *
+ * ── Why this is not `filledValues` ──────────────────────────────────────────
+ * On a create, an empty box means "I did not fill this in" and the key is left out — that is
+ * what optional means on the wire, and it is what `filledValues` does.
+ *
+ * On an **update** that reading is wrong. `AppliancePatch` and `ApplicationPatch` are applied
+ * by spreading over the loaded row (`applianceRepository.save({ ...appliance, ...patch })`),
+ * so a key that is absent means "leave it alone" and a key set to `''` means "clear it".
+ * Those are two different intentions and a form has to tell them apart:
+ *
+ *     netmask was '10.0.0.0/8', box is now empty   →  the person cleared it   →  send ''
+ *     netmask was never set,    box is still empty →  nothing happened        →  send nothing
+ *
+ * `filledValues` cannot express the first one — it drops every empty box — so an update
+ * screen built on it can never clear a field. Sending the whole form instead has the opposite
+ * fault: every untouched box goes as `''`, which clears fields nobody touched, and for
+ * `ApplicationPatch.email` (a GraphQLEmailAddress) `''` is not "no email" but an invalid one,
+ * so the whole update is refused over a box the person never visited.
+ *
+ * Comparing against the record that was loaded is the only thing that tells the two apart.
+ *
+ * ── The other thing this buys ───────────────────────────────────────────────
+ * The patch carries only what moved. A screen that sends every field back writes values it
+ * merely displayed, so a row edited from a stale copy silently overwrites whatever someone
+ * else changed in between.
+ */
+export function changedValues(formData, original) {
+    const record = original || {};
+    const patch = {};
+    for (const [key, value] of Array.from(formData.entries())) {
+        if (typeof value !== 'string') {
+            /* A file is never "unchanged" — there is nothing on the record to compare it against. */
+            patch[key] = value;
+            continue;
+        }
+        const next = value.trim();
+        const before = record[key] === null || record[key] === undefined ? '' : String(record[key]).trim();
+        if (next !== before) {
+            patch[key] = next;
+        }
+    }
+    return patch;
+}
+//# sourceMappingURL=form-values.js.map

package/dist-client/utils/form-values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-values.js","sourceRoot":"","sources":["../../client/utils/form-values.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAkB;IAC7C,MAAM,MAAM,GAA8B,EAAE,CAAA;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;YAE5B,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAA;YACvB,CAAC;YAED,SAAQ;QACV,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,KAAa,CAAA;IAC7B,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAkB,EAAE,QAAkB;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;IAErC,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAkB,EAClB,QAAgD;IAEhD,MAAM,MAAM,GAAG,QAAQ,IAAI,EAAE,CAAA;IAC7B,MAAM,KAAK,GAA8B,EAAE,CAAA;IAE3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,yFAAyF;YACzF,KAAK,CAAC,GAAG,CAAC,GAAG,KAAa,CAAA;YAC1B,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAElG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;QACnB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC","sourcesContent":["/**\n * Turning a form into the object a mutation takes.\n *\n * ── The bug this exists for ──────────────────────────────────────────────────\n * The application register screen built its input like this:\n *\n *     Array.from(formData.entries()).reduce((app, [key, value]) => { app[key] = value; … })\n *\n * `FormData` carries **every named input**, including the ones nobody typed in, each as an\n * empty string. So an untouched optional field went to the server as `''` rather than as\n * absent — and for `email` that is not the same thing at all:\n *\n *     NewApplication.email is GraphQLEmailAddress, nullable\n *     EmailAddressResolver.parseValue('')  →  \"Value is not a valid email address\"\n *\n * Registering an application without a contact email therefore failed, on a field the schema\n * marks optional. The screen said nothing useful about why.\n *\n * ── What \"absent\" means here ─────────────────────────────────────────────────\n * An empty text input means the person did not fill it in. It does not mean \"set this to the\n * empty string\" — HTML has no way to say that, and no field in these forms wants it. So an\n * empty value is dropped and the key never appears, which is what \"optional\" means on the\n * wire.\n *\n * Whitespace counts as empty for the same reason: a space typed by accident is not an answer,\n * and every scalar that rejects `''` rejects `' '` too.\n */\n\n/** Values a form can carry. Files pass through untouched — there is no empty file to drop. */\nexport type FormValue = string | File\n\n/**\n * The filled-in fields, as an object.\n *\n * Keys whose value is empty or whitespace are left out entirely rather than sent as `''`.\n */\nexport function filledValues(formData: FormData): Record<string, FormValue> {\n  const values: Record<string, FormValue> = {}\n\n  for (const [key, value] of Array.from(formData.entries())) {\n    if (typeof value === 'string') {\n      const trimmed = value.trim()\n\n      if (trimmed) {\n        values[key] = trimmed\n      }\n\n      continue\n    }\n\n    values[key] = value as File\n  }\n\n  return values\n}\n\n/**\n * Which of the named fields are still missing.\n *\n * The screen asks before it sends, so the person is told which box to fill rather than\n * watching a mutation fail on a rule the form never mentioned.\n */\nexport function missingRequired(formData: FormData, required: string[]): string[] {\n  const values = filledValues(formData)\n\n  return required.filter(name => !values[name])\n}\n\n/**\n * What the person changed, as a patch.\n *\n * ── Why this is not `filledValues` ──────────────────────────────────────────\n * On a create, an empty box means \"I did not fill this in\" and the key is left out — that is\n * what optional means on the wire, and it is what `filledValues` does.\n *\n * On an **update** that reading is wrong. `AppliancePatch` and `ApplicationPatch` are applied\n * by spreading over the loaded row (`applianceRepository.save({ ...appliance, ...patch })`),\n * so a key that is absent means \"leave it alone\" and a key set to `''` means \"clear it\".\n * Those are two different intentions and a form has to tell them apart:\n *\n *     netmask was '10.0.0.0/8', box is now empty   →  the person cleared it   →  send ''\n *     netmask was never set,    box is still empty →  nothing happened        →  send nothing\n *\n * `filledValues` cannot express the first one — it drops every empty box — so an update\n * screen built on it can never clear a field. Sending the whole form instead has the opposite\n * fault: every untouched box goes as `''`, which clears fields nobody touched, and for\n * `ApplicationPatch.email` (a GraphQLEmailAddress) `''` is not \"no email\" but an invalid one,\n * so the whole update is refused over a box the person never visited.\n *\n * Comparing against the record that was loaded is the only thing that tells the two apart.\n *\n * ── The other thing this buys ───────────────────────────────────────────────\n * The patch carries only what moved. A screen that sends every field back writes values it\n * merely displayed, so a row edited from a stale copy silently overwrites whatever someone\n * else changed in between.\n */\nexport function changedValues(\n  formData: FormData,\n  original: Record<string, any> | null | undefined\n): Record<string, FormValue> {\n  const record = original || {}\n  const patch: Record<string, FormValue> = {}\n\n  for (const [key, value] of Array.from(formData.entries())) {\n    if (typeof value !== 'string') {\n      /* A file is never \"unchanged\" — there is nothing on the record to compare it against. */\n      patch[key] = value as File\n      continue\n    }\n\n    const next = value.trim()\n    const before = record[key] === null || record[key] === undefined ? '' : String(record[key]).trim()\n\n    if (next !== before) {\n      patch[key] = next\n    }\n  }\n\n  return patch\n}\n"]}

package/dist-client/utils/form-values.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist-client/utils/form-values.test.js

@@ -0,0 +1,120 @@
+import { changedValues, filledValues, missingRequired } from './form-values';
+/**
+ * The application register screen sent every input it had, including the untouched ones, each
+ * as an empty string. `NewApplication.email` is a GraphQLEmailAddress and rejects `''`, so
+ * leaving the optional contact email blank made registration fail.
+ */
+function form(entries) {
+    const data = new FormData();
+    for (const [key, value] of Object.entries(entries)) {
+        data.append(key, value);
+    }
+    return data;
+}
+describe('the fields a person actually filled in', () => {
+    it('keeps what was typed', () => {
+        expect(filledValues(form({ name: 'Billing', url: 'https://example.com' }))).toEqual({
+            name: 'Billing',
+            url: 'https://example.com'
+        });
+    });
+    it('leaves an untouched field out instead of sending an empty string', () => {
+        /*
+         * ⚠ The case this file exists for. `email: ''` is not "no email" to a scalar that
+         * validates format — it is an invalid email, and the mutation fails on a field the
+         * schema marks optional.
+         */
+        const values = filledValues(form({ name: 'Billing', email: '', url: '' }));
+        expect(values).toEqual({ name: 'Billing' });
+        expect('email' in values).toBe(false);
+    });
+    it('treats whitespace as untouched', () => {
+        /* A space typed by accident is not an answer, and the scalars reject it too. */
+        expect(filledValues(form({ name: 'Billing', email: '   ' }))).toEqual({ name: 'Billing' });
+    });
+    it('trims what it keeps', () => {
+        expect(filledValues(form({ name: '  Billing  ' }))).toEqual({ name: 'Billing' });
+    });
+    it('keeps a value that only looks empty', () => {
+        /* '0' is falsy as a string in some hands. It is an answer. */
+        expect(filledValues(form({ name: '0' }))).toEqual({ name: '0' });
+    });
+});
+describe('what the form still needs', () => {
+    it('names the required field nobody filled in', () => {
+        expect(missingRequired(form({ name: '', description: 'x' }), ['name'])).toEqual(['name']);
+    });
+    it('counts whitespace as not filled in', () => {
+        expect(missingRequired(form({ name: '  ' }), ['name'])).toEqual(['name']);
+    });
+    it('says nothing when the required fields are there', () => {
+        expect(missingRequired(form({ name: 'Billing', email: '' }), ['name'])).toEqual([]);
+    });
+    it('does not require what the schema left optional', () => {
+        /*
+         * The list comes from the schema — NewApplication marks only `name` non-null. Adding a
+         * field here that the server accepts as absent would invent a rule the product does not
+         * have.
+         */
+        expect(missingRequired(form({ name: 'Billing' }), ['name'])).toEqual([]);
+    });
+});
+describe('what the person changed, as a patch', () => {
+    /*
+     * The patch is spread over the loaded row on the server, so an absent key means "leave it
+     * alone" and a key set to '' means "clear it". A form can only tell those apart by looking
+     * at what it loaded.
+     */
+    it('sends only what moved', () => {
+        const patch = changedValues(form({ name: 'Gate B', brand: 'Acme', model: 'X1' }), {
+            name: 'Gate A',
+            brand: 'Acme',
+            model: 'X1'
+        });
+        expect(patch).toEqual({ name: 'Gate B' });
+    });
+    it('sends an empty string for a field the person cleared', () => {
+        /*
+         * ⚠ The case `filledValues` cannot express. Dropping this key would mean the netmask can
+         * never be removed once it is set — the screen would look like it saved and the value
+         * would come back on the next load.
+         */
+        const patch = changedValues(form({ netmask: '' }), { netmask: '10.0.0.0/8' });
+        expect(patch).toEqual({ netmask: '' });
+        expect('netmask' in patch).toBe(true);
+    });
+    it('leaves out a field that was empty and stayed empty', () => {
+        /*
+         * ⚠ The case sending the whole form gets wrong. `ApplicationPatch.email` is a
+         * GraphQLEmailAddress: '' is not "no email", it is an invalid one, and the server refuses
+         * the whole update over a box nobody visited.
+         */
+        const patch = changedValues(form({ name: 'Billing', email: '' }), { name: 'Billing', email: null });
+        expect(patch).toEqual({});
+        expect('email' in patch).toBe(false);
+    });
+    it('treats an absent field on the record as empty', () => {
+        expect(changedValues(form({ description: '' }), {})).toEqual({});
+        expect(changedValues(form({ description: 'hello' }), {})).toEqual({ description: 'hello' });
+    });
+    it('does not count retyping the same value with stray spaces as a change', () => {
+        expect(changedValues(form({ name: '  Billing  ' }), { name: 'Billing' })).toEqual({});
+    });
+    it('compares a non-string field value as text', () => {
+        /* A record can carry a number or an enum; the box always holds text. */
+        expect(changedValues(form({ port: '8080' }), { port: 8080 })).toEqual({});
+        expect(changedValues(form({ port: '9090' }), { port: 8080 })).toEqual({ port: '9090' });
+    });
+    it('sends nothing at all when the person pressed save without touching anything', () => {
+        /*
+         * The whole point: an untouched form must not write. A screen that sends every field back
+         * overwrites whatever someone else changed while this copy was on screen.
+         */
+        const record = { name: 'Gate A', description: 'front door', brand: 'Acme', netmask: null };
+        expect(changedValues(form({ name: 'Gate A', description: 'front door', brand: 'Acme', netmask: '' }), record)).toEqual({});
+    });
+    it('treats a missing record as everything being new', () => {
+        expect(changedValues(form({ name: 'Gate A', netmask: '' }), null)).toEqual({ name: 'Gate A' });
+    });
+});
+//# sourceMappingURL=form-values.test.js.map

package/dist-client/utils/form-values.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"form-values.test.js","sourceRoot":"","sources":["../../client/utils/form-values.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAE5E;;;;GAIG;AAEH,SAAS,IAAI,CAAC,OAA+B;IAC3C,MAAM,IAAI,GAAG,IAAI,QAAQ,EAAE,CAAA;IAE3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACzB,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,sBAAsB,EAAE,GAAG,EAAE;QAC9B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;YAClF,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,qBAAqB;SAC3B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E;;;;WAIG;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;QAE1E,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,gFAAgF;QAChF,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,8DAA8D;QAC9D,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD;;;;WAIG;QACH,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC1E,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD;;;;OAIG;IAEH,EAAE,CAAC,uBAAuB,EAAE,GAAG,EAAE;QAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE;YAChF,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,IAAI;SACZ,CAAC,CAAA;QAEF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D;;;;WAIG;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAA;QAE7E,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D;;;;WAIG;QACH,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAEnG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzB,MAAM,CAAC,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAChE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;IAC7F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,wEAAwE;QACxE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACzE,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACzF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF;;;WAGG;QACH,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;QAE1F,MAAM,CACJ,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CACvG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACf,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA","sourcesContent":["import { changedValues, filledValues, missingRequired } from './form-values'\n\n/**\n * The application register screen sent every input it had, including the untouched ones, each\n * as an empty string. `NewApplication.email` is a GraphQLEmailAddress and rejects `''`, so\n * leaving the optional contact email blank made registration fail.\n */\n\nfunction form(entries: Record<string, string>): FormData {\n  const data = new FormData()\n\n  for (const [key, value] of Object.entries(entries)) {\n    data.append(key, value)\n  }\n\n  return data\n}\n\ndescribe('the fields a person actually filled in', () => {\n  it('keeps what was typed', () => {\n    expect(filledValues(form({ name: 'Billing', url: 'https://example.com' }))).toEqual({\n      name: 'Billing',\n      url: 'https://example.com'\n    })\n  })\n\n  it('leaves an untouched field out instead of sending an empty string', () => {\n    /*\n     * ⚠ The case this file exists for. `email: ''` is not \"no email\" to a scalar that\n     * validates format — it is an invalid email, and the mutation fails on a field the\n     * schema marks optional.\n     */\n    const values = filledValues(form({ name: 'Billing', email: '', url: '' }))\n\n    expect(values).toEqual({ name: 'Billing' })\n    expect('email' in values).toBe(false)\n  })\n\n  it('treats whitespace as untouched', () => {\n    /* A space typed by accident is not an answer, and the scalars reject it too. */\n    expect(filledValues(form({ name: 'Billing', email: '   ' }))).toEqual({ name: 'Billing' })\n  })\n\n  it('trims what it keeps', () => {\n    expect(filledValues(form({ name: '  Billing  ' }))).toEqual({ name: 'Billing' })\n  })\n\n  it('keeps a value that only looks empty', () => {\n    /* '0' is falsy as a string in some hands. It is an answer. */\n    expect(filledValues(form({ name: '0' }))).toEqual({ name: '0' })\n  })\n})\n\ndescribe('what the form still needs', () => {\n  it('names the required field nobody filled in', () => {\n    expect(missingRequired(form({ name: '', description: 'x' }), ['name'])).toEqual(['name'])\n  })\n\n  it('counts whitespace as not filled in', () => {\n    expect(missingRequired(form({ name: '  ' }), ['name'])).toEqual(['name'])\n  })\n\n  it('says nothing when the required fields are there', () => {\n    expect(missingRequired(form({ name: 'Billing', email: '' }), ['name'])).toEqual([])\n  })\n\n  it('does not require what the schema left optional', () => {\n    /*\n     * The list comes from the schema — NewApplication marks only `name` non-null. Adding a\n     * field here that the server accepts as absent would invent a rule the product does not\n     * have.\n     */\n    expect(missingRequired(form({ name: 'Billing' }), ['name'])).toEqual([])\n  })\n})\n\ndescribe('what the person changed, as a patch', () => {\n  /*\n   * The patch is spread over the loaded row on the server, so an absent key means \"leave it\n   * alone\" and a key set to '' means \"clear it\". A form can only tell those apart by looking\n   * at what it loaded.\n   */\n\n  it('sends only what moved', () => {\n    const patch = changedValues(form({ name: 'Gate B', brand: 'Acme', model: 'X1' }), {\n      name: 'Gate A',\n      brand: 'Acme',\n      model: 'X1'\n    })\n\n    expect(patch).toEqual({ name: 'Gate B' })\n  })\n\n  it('sends an empty string for a field the person cleared', () => {\n    /*\n     * ⚠ The case `filledValues` cannot express. Dropping this key would mean the netmask can\n     * never be removed once it is set — the screen would look like it saved and the value\n     * would come back on the next load.\n     */\n    const patch = changedValues(form({ netmask: '' }), { netmask: '10.0.0.0/8' })\n\n    expect(patch).toEqual({ netmask: '' })\n    expect('netmask' in patch).toBe(true)\n  })\n\n  it('leaves out a field that was empty and stayed empty', () => {\n    /*\n     * ⚠ The case sending the whole form gets wrong. `ApplicationPatch.email` is a\n     * GraphQLEmailAddress: '' is not \"no email\", it is an invalid one, and the server refuses\n     * the whole update over a box nobody visited.\n     */\n    const patch = changedValues(form({ name: 'Billing', email: '' }), { name: 'Billing', email: null })\n\n    expect(patch).toEqual({})\n    expect('email' in patch).toBe(false)\n  })\n\n  it('treats an absent field on the record as empty', () => {\n    expect(changedValues(form({ description: '' }), {})).toEqual({})\n    expect(changedValues(form({ description: 'hello' }), {})).toEqual({ description: 'hello' })\n  })\n\n  it('does not count retyping the same value with stray spaces as a change', () => {\n    expect(changedValues(form({ name: '  Billing  ' }), { name: 'Billing' })).toEqual({})\n  })\n\n  it('compares a non-string field value as text', () => {\n    /* A record can carry a number or an enum; the box always holds text. */\n    expect(changedValues(form({ port: '8080' }), { port: 8080 })).toEqual({})\n    expect(changedValues(form({ port: '9090' }), { port: 8080 })).toEqual({ port: '9090' })\n  })\n\n  it('sends nothing at all when the person pressed save without touching anything', () => {\n    /*\n     * The whole point: an untouched form must not write. A screen that sends every field back\n     * overwrites whatever someone else changed while this copy was on screen.\n     */\n    const record = { name: 'Gate A', description: 'front door', brand: 'Acme', netmask: null }\n\n    expect(\n      changedValues(form({ name: 'Gate A', description: 'front door', brand: 'Acme', netmask: '' }), record)\n    ).toEqual({})\n  })\n\n  it('treats a missing record as everything being new', () => {\n    expect(changedValues(form({ name: 'Gate A', netmask: '' }), null)).toEqual({ name: 'Gate A' })\n  })\n})\n"]}

package/dist-client/utils/list-result.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Turning a list query's response into "what the screen may claim".
+ *
+ * ── Why this is not inline in each page ──────────────────────────────────────
+ * Three auth screens had the same two lines each, and all three were wrong the same way:
+ *
+ *     this.items = (await this.fetch()).items
+ *     …
+ *     if (!response.errors) { return response.data.applications }
+ *
+ * The shared client runs queries with `errorPolicy: 'all'`, so a GraphQL error comes back
+ * **in the response** instead of throwing. The helper then returned nothing, `.items` threw
+ * inside an async lifecycle method with nobody to catch it, and the table stayed empty. A
+ * failure and an empty list looked identical to the person reading the screen.
+ *
+ * The rule is small enough to get wrong in three places and small enough to test once.
+ */
+/** What a list query returns when it answers. */
+export type ListPage<T = any> = {
+    items: T[];
+    total?: number;
+};
+/**
+ * What a screen is entitled to say afterwards.
+ *
+ * `failed` is not "empty". A screen that could not ask has to say so; saying nothing reads
+ * as "there are none", which is a claim it has no basis for.
+ */
+export type ListOutcome<T = any> = {
+    items: T[];
+    total: number;
+    failed: boolean;
+};
+/**
+ * Read a list page out of an Apollo response, or nothing if the list did not arrive.
+ *
+ * Ways not to arrive:
+ *   · an error at the query itself (errorPolicy 'all' puts errors here rather than throwing)
+ *   · `data` missing entirely
+ *   · `data` present but the field we asked for is not, or is not a page
+ *
+ * An error *inside* the page is not one of them — see `stoppedTheList`.
+ */
+export declare function pageFromResponse<T = any>(response: any, field: string): ListPage<T> | undefined;
+/**
+ * The same question for a query that returns a bare array rather than a page.
+ *
+ * `domainOwners` is one: it answers with a list and no total. The screen was reading it as
+ * `response.data?.domainOwners || []`, which turns a refused query into "this domain has no
+ * owners" — a sentence with real consequences, since the reader may then go and add one.
+ *
+ * Returns nothing on failure for the same reason as `pageFromResponse`, so `listOutcome`
+ * can tell the two apart.
+ */
+export declare function arrayFromResponse<T = any>(response: any, field: string): ListPage<T> | undefined;
+/**
+ * What the screen shows, given a page or the absence of one.
+ *
+ * An absent page yields an empty list **and** `failed`, so the caller cannot accidentally
+ * render "none" — the flag is right there next to the rows.
+ */
+export declare function listOutcome<T = any>(page: ListPage<T> | undefined | null): ListOutcome<T>;

package/dist-client/utils/list-result.js

@@ -0,0 +1,92 @@
+/**
+ * Turning a list query's response into "what the screen may claim".
+ *
+ * ── Why this is not inline in each page ──────────────────────────────────────
+ * Three auth screens had the same two lines each, and all three were wrong the same way:
+ *
+ *     this.items = (await this.fetch()).items
+ *     …
+ *     if (!response.errors) { return response.data.applications }
+ *
+ * The shared client runs queries with `errorPolicy: 'all'`, so a GraphQL error comes back
+ * **in the response** instead of throwing. The helper then returned nothing, `.items` threw
+ * inside an async lifecycle method with nobody to catch it, and the table stayed empty. A
+ * failure and an empty list looked identical to the person reading the screen.
+ *
+ * The rule is small enough to get wrong in three places and small enough to test once.
+ */
+/**
+ * Did an error stop the list, or only withhold a field inside it?
+ *
+ * GraphQL says where an error happened. A gate on a whole query rejects at the root, so the
+ * path is the query field itself or nothing at all. A gate on one **column** — and this house
+ * has them, `Appliance.accessToken` and `AuthProvider.clientSecret` both carry their own
+ * `@privilege` — rejects deeper in, at `[field, 'items', 3, 'clientSecret']`.
+ *
+ * The difference decides what the screen may show. Treating both as failure blacks out a list
+ * that arrived intact apart from one column a viewer may not read; treating both as success
+ * renders a refused query as an empty list. Neither is acceptable, so the path is read.
+ *
+ * An error with no path at all is counted as fatal: unknown scope leans to the safe side.
+ */
+function stoppedTheList(response, field) {
+    const errors = response?.errors;
+    if (!errors || !errors.length) {
+        return false;
+    }
+    return errors.some((error) => {
+        const path = error?.path;
+        if (!Array.isArray(path) || path.length === 0) {
+            return true;
+        }
+        /* `[field]` alone is the query itself being refused; deeper is one value inside it. */
+        return path[0] === field && path.length === 1;
+    });
+}
+/**
+ * Read a list page out of an Apollo response, or nothing if the list did not arrive.
+ *
+ * Ways not to arrive:
+ *   · an error at the query itself (errorPolicy 'all' puts errors here rather than throwing)
+ *   · `data` missing entirely
+ *   · `data` present but the field we asked for is not, or is not a page
+ *
+ * An error *inside* the page is not one of them — see `stoppedTheList`.
+ */
+export function pageFromResponse(response, field) {
+    if (!response || stoppedTheList(response, field)) {
+        return undefined;
+    }
+    const page = response.data?.[field];
+    return page && Array.isArray(page.items) ? page : undefined;
+}
+/**
+ * The same question for a query that returns a bare array rather than a page.
+ *
+ * `domainOwners` is one: it answers with a list and no total. The screen was reading it as
+ * `response.data?.domainOwners || []`, which turns a refused query into "this domain has no
+ * owners" — a sentence with real consequences, since the reader may then go and add one.
+ *
+ * Returns nothing on failure for the same reason as `pageFromResponse`, so `listOutcome`
+ * can tell the two apart.
+ */
+export function arrayFromResponse(response, field) {
+    if (!response || stoppedTheList(response, field)) {
+        return undefined;
+    }
+    const rows = response.data?.[field];
+    return Array.isArray(rows) ? { items: rows, total: rows.length } : undefined;
+}
+/**
+ * What the screen shows, given a page or the absence of one.
+ *
+ * An absent page yields an empty list **and** `failed`, so the caller cannot accidentally
+ * render "none" — the flag is right there next to the rows.
+ */
+export function listOutcome(page) {
+    if (!page) {
+        return { items: [], total: 0, failed: true };
+    }
+    return { items: page.items, total: page.total ?? page.items.length, failed: false };
+}
+//# sourceMappingURL=list-result.js.map