@ultimat3/admin 22.15.0 → 24.0.0

package/src/routes.ts

@@ -1,83 +1,56 @@
-// The one bridge from the admin's route table to @ultimat3/render, and the one place a policy
-// is composed onto an admin page. Every admin route is `ssr`: it is behind auth, so its guard runs
-// on the server, there is nothing to prerender and nothing a CDN may hold — and `network-only`
-// keeps a stale org's rows out of a service worker cache.
+// The one place a route gets its SCREEN, and the matcher a host asks per request. The config a
+// route is served under — `ssr`, gated, `network-only` — is `route-config.ts`'s; this file binds
+// it to what renders there.
 
-import { t } from '@ultimat3/i18n';
-import { defineRoute, type RouteGuard } from '@ultimat3/render';
+import { compilePattern, type RouteConfig, type RouteGuard } from '@ultimat3/render';
 import type { AdminApp, AdminRoute } from './admin';
-import { AdminPagePathInvalidError, AdminPageUnguardedError } from './errors';
-import { guardedPage } from './page-guard';
-import type { AdminPageComponent } from './pages';
+import { AdminPagePathInvalidError } from './errors';
+import { adminRouteDefinition } from './route-config';
+import type { AdminRouteRequest, AdminRouteResponse } from './screen-frame';
+import { screenFor } from './screens';
 
 export interface AdminRouteConfig {
   readonly path: string;
   readonly view: AdminRoute['view'];
   readonly entity: string | null;
   readonly permissions: readonly string[];
-  /** The GUARDED component of a custom page; `null` for a generated view. */
-  readonly component: AdminPageComponent | null;
   /**
    * The coarse gate, already composed — the SAME object `config.policy` carries. It is here, and
-   * not read back off `config`, because `RouteConfig.policy` is optional: a host that serves an
-   * admin URL from its own file has to be able to take the gate without proving it exists.
+   * not read back off `config`, because `RouteConfig.policy` is optional.
    */
   readonly policy: RouteGuard;
-  readonly config: ReturnType<typeof defineRoute>;
+  readonly config: RouteConfig;
+  /**
+   * Answer one request to this route — a GET, or the form the screen posted back at itself — as
+   * a status and a framed body, or the redirect a write that worked earns. Never absent: a
+   * generated view renders its rows and a custom page is wrapped, so no route of the table is a
+   * path with nothing behind it. The screen decides before it renders; a host only serialises.
+   */
+  respond(request: AdminRouteRequest): Promise<AdminRouteResponse>;
 }
 
-/**
- * The author never writes this `defineRoute` call, so the author cannot omit its `policy` —
- * which is the whole mechanism. The coarse gate is `permissions[0]` (always `admin:read`, put
- * there by `permissionsForOperation`/`pagePermissions`); the rest of the pair is decided per
- * request by `decideAll`, in `crud.ts` for a generated view and in `page-guard.tsx` for a page.
- * An empty list is refused here too: `render: 'ssr'` with no policy is a public dashboard.
- */
-export function adminRouteConfig(route: AdminRoute): AdminRouteConfig {
-  const permission = route.permissions[0];
-  if (permission === undefined) throw new AdminPageUnguardedError({ path: route.path });
-  const policy: RouteGuard = { permission };
-
+/** One route of the table, with its gate, its served config and its screen. */
+export function adminRouteConfig(app: AdminApp, route: AdminRoute): AdminRouteConfig {
+  const { policy, config } = adminRouteDefinition(route);
   return {
     path: route.path,
     view: route.view,
     entity: route.entity,
     permissions: route.permissions,
-    component: route.component === undefined ? null : guardedPage(route, route.component),
+    respond: screenFor(app, route),
     policy,
-    config: defineRoute({
-      // One mode for every admin route, never an author's choice. A generated view was `spa` — a
-      // shell the browser was supposed to fill — until `spa` was deleted: nothing ever built the
-      // client bundle it preloaded and `renderSpa` never read the route's component, so every
-      // generated view served an empty `<div id="x-root">`. `ssr` renders the same rows behind the
-      // same guard, once per request, and `hydrate: 'never'` means the screen ships no JS at all:
-      // an admin view is a pure function of its props (no `createSignal`, no local state), so
-      // there is nothing to hydrate. `never` is a REFUSAL and not just a default — an `island()`
-      // rendered on this route throws `X_ISLAND_NOT_HYDRATED` (`@ultimat3/render`'s
-      // `island-collector.ts`), and no admin module declares one.
-      render: 'ssr',
-      offline: 'network-only',
-      hydrate: 'never',
-      policy,
-      meta: () => ({ title: t(route.titleKey) }),
-    }),
+    config,
   };
 }
 
-/** Hand these to the router. Auth stays the host app's: see `AdminApp.auth`. */
+/** Every route of the table, each with its screen. Auth stays the host app's: see `AdminApp.auth`. */
 export function adminRoutes(app: AdminApp): readonly AdminRouteConfig[] {
-  return app.routes.map(adminRouteConfig);
+  return app.routes.map((route) => adminRouteConfig(app, route));
 }
 
 /**
- * The one route the admin declares for `path` — the lookup a host performs when it serves an admin
- * URL from its own file rather than from `adminRoutes()`.
- *
- * It exists because the alternative is what the deployed demo shipped: a page file typing
- * `policy: { permission: 'admin:read' }` beside a route table that separately declared
- * `permissionsForOperation(...)` for the same URL. Two declarations of one URL's authz agree until
- * one of them is edited, and nothing was ever going to notice. Reading the gate from here means
- * there is one declaration and one reader.
+ * The one route the admin declares for `path` — a read of the table, for a caller that wants a
+ * route's gate or its screen without matching a URL.
  *
  * A path the table does not declare is refused rather than answered with a default: a mount with
  * no route is a screen whose permissions nothing composed, which is exactly the shape `pages:`
@@ -95,5 +68,33 @@ export function adminRouteFor(app: AdminApp, path: string): AdminRouteConfig {
         'or declare this one in `pages:` on defineAdmin()',
     });
   }
-  return adminRouteConfig(route);
+  return adminRouteConfig(app, route);
+}
+
+export interface AdminRouteMatch {
+  readonly route: AdminRouteConfig;
+  readonly params: Readonly<Record<string, string>>;
+}
+
+/**
+ * The route a REQUEST's pathname names, with its params — what a host mounting the admin under
+ * one catch-all asks per request. `null` is "no admin screen lives there", which the host answers
+ * 404. The most specific pattern wins, so `/posts/new` is the create form and never the detail
+ * of a row called `new`. Matched against the table as it is NOW, so a page added in a save is
+ * served without the host re-reading anything.
+ */
+export function adminRouteMatch(app: AdminApp, pathname: string): AdminRouteMatch | null {
+  let best: { route: AdminRoute; params: Record<string, string>; specificity: number } | null =
+    null;
+  for (const route of app.routes) {
+    const pattern = compilePattern(route.path);
+    const found = pattern.regex.exec(pathname);
+    if (found === null || (best !== null && best.specificity >= pattern.specificity)) continue;
+    const params: Record<string, string> = {};
+    pattern.keys.forEach((key, index) => {
+      params[key] = decodeURIComponent(found[index + 1] ?? '');
+    });
+    best = { route, params, specificity: pattern.specificity };
+  }
+  return best === null ? null : { route: adminRouteConfig(app, best.route), params: best.params };
 }

package/src/row-scope-write.ts

@@ -0,0 +1,130 @@
+// `rows`, applied to a WRITE: the row a create or an update would leave behind must satisfy the
+// acting actor's row scope, or the write is refused before the repo is asked for it. The one place
+// this package evaluates a predicate itself — a row that does not exist yet cannot be asked of the
+// repo, which is how every READ answers the same question (`list-scope.ts`, `findRow`).
+
+import type { AdminActor, AdminDecision } from './authz';
+import type { AdminFilter, AdminRow } from './registry';
+import type { AdminResource } from './resource';
+
+/** The key a write whose result would sit outside the actor's row scope is refused with. */
+export const ROW_OUT_OF_SCOPE_REASON = 'admin.error.row-out-of-scope';
+
+export interface OutsideRowScope {
+  readonly field: string;
+  readonly op: AdminFilter['op'];
+  /**
+   * `false` when the predicate could not be decided exactly here — an ordering over text is a
+   * collation's to answer — and the write is refused for that reason rather than for a mismatch.
+   */
+  readonly decidable: boolean;
+}
+
+const absent = (value: unknown): boolean => value === null || value === undefined;
+
+/** An instant as milliseconds, whichever of the two shapes it travels in; `undefined` otherwise. */
+const instantOf = (value: unknown): number | undefined => {
+  if (value instanceof Date) return value.getTime();
+  if (typeof value !== 'string' || !/^\d{4}-\d{2}-\d{2}T/.test(value)) return undefined;
+  const at = Date.parse(value);
+  return Number.isNaN(at) ? undefined : at;
+};
+
+/** Equal as the column's value: a `Date` against the ISO text a filter carries is one instant. */
+const equal = (held: unknown, wanted: unknown): boolean => {
+  if (held instanceof Date || wanted instanceof Date) {
+    const a = instantOf(held);
+    return a !== undefined && a === instantOf(wanted);
+  }
+  return typeof held === 'object' ? false : String(held) === String(wanted);
+};
+
+/** `-1 | 0 | 1` for two numbers or two instants; `undefined` for anything a collation orders. */
+const ordered = (held: unknown, wanted: unknown): number | undefined => {
+  const pair =
+    typeof held === 'number' && typeof wanted === 'number'
+      ? ([held, wanted] as const)
+      : held instanceof Date
+        ? ([instantOf(held), instantOf(wanted)] as const)
+        : undefined;
+  const [a, b] = pair ?? [];
+  if (a === undefined || b === undefined || Number.isNaN(a) || Number.isNaN(b)) return undefined;
+  return a < b ? -1 : a > b ? 1 : 0;
+};
+
+/** `true` in scope, `false` out of it, `undefined` when this file cannot say. */
+function satisfies(row: AdminRow, filter: AdminFilter): boolean | undefined {
+  const held = Object.hasOwn(row, filter.field) ? row[filter.field] : undefined;
+  if (filter.op === 'is-null') return absent(held) === (filter.value !== false);
+  // SQL's three-valued logic: a NULL on either side matches nothing, `neq` included.
+  if (absent(held) || absent(filter.value)) return false;
+  switch (filter.op) {
+    case 'eq':
+      return equal(held, filter.value);
+    case 'neq':
+      return !equal(held, filter.value);
+    case 'in':
+      return Array.isArray(filter.value) && filter.value.some((one) => equal(held, one));
+    case 'contains':
+      // `LIKE` is case-sensitive and collation-free for a literal substring.
+      return typeof held === 'string' ? held.includes(String(filter.value)) : undefined;
+    default: {
+      const order = ordered(held, filter.value);
+      if (order === undefined) return undefined;
+      if (filter.op === 'gt') return order > 0;
+      if (filter.op === 'gte') return order >= 0;
+      if (filter.op === 'lt') return order < 0;
+      return order <= 0;
+    }
+  }
+}
+
+/** The first predicate `row` does not satisfy, or `null` when it satisfies every one. */
+export function outsideRowScope(
+  row: AdminRow,
+  where: readonly AdminFilter[],
+): OutsideRowScope | null {
+  for (const filter of where) {
+    const verdict = satisfies(row, filter);
+    if (verdict === true) continue;
+    return { field: filter.field, op: filter.op, decidable: verdict !== undefined };
+  }
+  return null;
+}
+
+/**
+ * What a write would leave, judged against the acting actor's scope. `null` for a resource that
+ * declares no `rows` — and for an actor whose scope is the empty conjunction, who sees every row.
+ *
+ * `touched` narrows an UPDATE to the predicates over the fields it writes: the stored row is
+ * already inside the scope (the repo said so when it was loaded), so only a field the patch
+ * changes can move it out — and a predicate this file cannot decide is then never asked about a
+ * column nobody touched.
+ */
+export function writeOutsideScope(
+  resource: AdminResource,
+  actor: AdminActor,
+  candidate: AdminRow,
+  touched?: readonly string[],
+): OutsideRowScope | null {
+  if (resource.rowScope === undefined) return null;
+  const scope = resource.rowScope(actor);
+  return outsideRowScope(
+    candidate,
+    touched === undefined ? scope : scope.filter((filter) => touched.includes(filter.field)),
+  );
+}
+
+/** The refusal a write outside the scope is answered and audited with. */
+export function outOfScopeDecision(permission: string, outside: OutsideRowScope): AdminDecision {
+  return {
+    allowed: false,
+    permission,
+    reason: ROW_OUT_OF_SCOPE_REASON,
+    trace: [
+      outside.decidable
+        ? `rows: ${outside.field} ${outside.op} is not satisfied by the row this write would leave`
+        : `rows: ${outside.field} ${outside.op} cannot be decided before the write, so it is refused`,
+    ],
+  };
+}

package/src/row-version.ts

@@ -0,0 +1,20 @@
+// The version an edit form is rendered against: a keyed fingerprint of the row as it was READ,
+// posted back in a hidden field, so `adminUpdate` can tell "the row I was shown" from "the row as
+// it is now" and refuse a write that would silently overwrite a concurrent edit.
+
+import { keyedFingerprint } from '@ultimat3/core';
+import type { AdminRow } from './registry';
+
+/** The posted name of the version, beside `_operation`: never a column, never an input field. */
+export const VERSION_FIELD = '_version';
+
+/** The key a write against a stale version is refused and audited with. */
+export const ROW_CHANGED_REASON = 'admin.error.row-changed';
+
+/**
+ * Every value the row enumerates — a sealed one is non-enumerable and is not in it, so a password
+ * change is not a "concurrent edit" and no sealed value is ever folded into page text. Keyed: the
+ * page carries it, and an unkeyed hash of a row is an offline oracle for a short value in a column
+ * the form does not draw.
+ */
+export const rowVersion = (row: AdminRow): string => keyedFingerprint(row, 'admin.row-version');

package/src/screen-action.tsx

@@ -0,0 +1,333 @@
+// The two writes an action makes from a screen: ONE row, posted at the row's URL (its form, when
+// it takes input, is that URL asked for the action), and a BATCH, posted at the list's URL whose
+// query string is the filter "all matching" means. Both decide through the gate first and render
+// what it answered — a 422 form with the schema's issues, a 409 for a row the action's `when`
+// excludes, a 403 for a refusal, and an honest count of what a batch did.
+
+import { t } from '@ultimat3/i18n';
+import { Button, Card, ErrorState, Link } from '@ultimat3/ui';
+import { AdminActionForm } from './action-form';
+import { actionButtons } from './action-gate';
+import {
+  ACTION_INPUT_PREFIX,
+  actionInputFields,
+  decodeActionInput,
+  postedActionInput,
+} from './action-input';
+import { actionLabelKey } from './action-label';
+import { invokeRowAction } from './action-row';
+import { BATCH_OPERATION, OPERATION_FIELD } from './actions';
+import type { AdminApp } from './admin';
+import styles from './admin.module.scss';
+import { type AdminBatchResult, type BatchSelection, batchPlan, runAdminBatch } from './batch';
+import { BATCH_IDS_FIELD, BATCH_SELECTION_FIELD } from './batch-bar';
+import { batchEnqueue } from './batch-job';
+import { posted } from './form-decode';
+import { listHref, pageRequestOf } from './list-request';
+import { findRow } from './list-scope';
+import { confirmationToken } from './permissions';
+import type { AdminAction } from './registry';
+import type { AdminResource } from './resource';
+import { type AdminRouteRequest, type AdminRouteResponse, framed, refused } from './screen-frame';
+import type { ValidationIssue } from './validate';
+
+/** Posted by a form that already showed its fields: run now, do not ask again. */
+export const STEP_FIELD = '_step';
+const RUN_STEP = 'run';
+/** Where an "all matching" batch continues from: the last row the previous request reached. */
+export const AFTER_FIELD = 'after';
+
+const rowHref = (app: AdminApp, resource: AdminResource, id: string): string =>
+  `${app.basePath}${resource.path}/${id}`;
+
+/** A posted name repeated once per value — the checked rows. */
+const postedList = (form: Readonly<Record<string, unknown>>, name: string): readonly string[] => {
+  if (!Object.hasOwn(form, name)) return [];
+  const value = form[name];
+  const list: readonly unknown[] = Array.isArray(value) ? value : [value];
+  return list.filter((one): one is string => typeof one === 'string' && one !== '');
+};
+
+/** The 409 a row the action does not apply to is answered with: the error, and the way back. */
+function notApplicable(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  error: Error,
+  back: string,
+): AdminRouteResponse {
+  return framed(
+    app,
+    request,
+    resource.titleKey,
+    <>
+      <ErrorState error={error} />
+      <Link href={back}>{t('admin.actions.back')}</Link>
+    </>,
+    409,
+  );
+}
+
+/** One row's action form: `GET <row>?action=<name>`, and its refused post. */
+export async function rowActionForm(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  action: AdminAction,
+  values: Readonly<Record<string, string>>,
+  issues: readonly ValidationIssue[],
+  status = 200,
+): Promise<AdminRouteResponse> {
+  const id = request.params['id'] ?? '';
+  const href = rowHref(app, resource, id);
+  return framed(
+    app,
+    request,
+    resource.titleKey,
+    <AdminActionForm
+      action={action}
+      href={href}
+      operation="action"
+      values={values}
+      issues={issues}
+      confirmation={action.destructive === true ? confirmationToken(resource.name, id) : null}
+      subject={t('admin.actions.subject.row', { id })}
+      cancelHref={href}
+    />,
+    status,
+  );
+}
+
+/**
+ * The form of `?action=<name>` on a row — only for an action the actor may run on THIS row, so a
+ * link to a form is never a way round a hidden button. Anything else is the row's 404.
+ */
+export async function rowActionFormScreen(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  name: string,
+  missing: () => AdminRouteResponse,
+): Promise<AdminRouteResponse> {
+  const action = resource.actions.find((declared) => declared.name === name);
+  if (action === undefined) return missing();
+  const id = request.params['id'] ?? '';
+  const row = await findRow(resource, request.ctx.actor, id);
+  if (row === null) return missing();
+  // The button's own decision: a form for an action this row would not show is no form at all.
+  const offered = actionButtons({
+    actions: [action],
+    actor: request.ctx.actor,
+    authz: request.ctx.authz,
+    subject: { entity: resource.name, id, row },
+    sealed: resource.secretFields.map((field) => field.name),
+  });
+  if (offered.length === 0) return missing();
+  return rowActionForm(app, request, resource, action, {}, []);
+}
+
+/** A posted action on one row: decided by the same gate that decided whether its button rendered. */
+export async function rowActionWrite(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  form: Readonly<Record<string, unknown>>,
+  missing: () => AdminRouteResponse,
+): Promise<AdminRouteResponse> {
+  const id = request.params['id'] ?? '';
+  // The posted name, resolved against the actions `defineAdmin()` attached to THIS resource —
+  // "which operation is this?" is answered before "may this actor run it?".
+  const action = resource.actions.find((declared) => declared.name === posted(form, 'name'));
+  if (action === undefined) return missing();
+  const result = await invokeRowAction({
+    resource,
+    action,
+    id,
+    ctx: request.ctx,
+    input: decodeActionInput(action, form),
+    confirmation: posted(form, 'confirmation'),
+  });
+  const href = rowHref(app, resource, id);
+  if (result.ok) return { kind: 'redirect', location: href };
+  if (result.kind === 'not-applicable') {
+    return notApplicable(app, request, resource, result.error, href);
+  }
+  if (result.kind === 'invalid') {
+    return rowActionForm(
+      app,
+      request,
+      resource,
+      action,
+      postedActionInput(action, form),
+      result.issues,
+      422,
+    );
+  }
+  // A destructive action with a form, posted with the wrong token: the form again, not a 403 —
+  // the operator holds the grant and mistyped.
+  if (result.confirmationRequired && actionInputFields(action).length > 0) {
+    return rowActionForm(app, request, resource, action, postedActionInput(action, form), [], 422);
+  }
+  return refused(app, request, resource.titleKey, result.decision);
+}
+
+/** What a batch result page says, outcome by outcome. */
+function batchResult(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  action: AdminAction,
+  result: AdminBatchResult,
+  again: readonly (readonly [string, string])[],
+): AdminRouteResponse {
+  const list = listHref(app.basePath, resource);
+  const terms: readonly (readonly [string, number])[] = [
+    ['admin.batch.done', result.done],
+    ['admin.batch.refused', result.refused],
+    ['admin.batch.failed', result.failed],
+    ['admin.batch.queued', result.queued],
+    ['admin.batch.remaining', result.remaining],
+  ];
+  return framed(
+    app,
+    request,
+    resource.titleKey,
+    <Card header={<h2>{t(actionLabelKey(action))}</h2>}>
+      <dl class={styles['counts']}>
+        {terms.map(([key, count]) => (
+          <>
+            <dt>{t(key)}</dt>
+            <dd>{String(count)}</dd>
+          </>
+        ))}
+      </dl>
+      {result.rows.length === 0 ? null : (
+        <ul class={styles['list']}>
+          {result.rows.map((row) => (
+            <li>
+              <a href={rowHref(app, resource, row.id)}>{row.id}</a>{' '}
+              <span data-outcome={row.outcome}>{t(row.reason)}</span>
+            </li>
+          ))}
+        </ul>
+      )}
+      {result.remaining === 0 || (result.after === null && action.matching === undefined) ? null : (
+        // The rest of an "all matching" batch: the same post, from where this one stopped — or,
+        // for a set-based one, the same post again: the set it reads has already shrunk.
+        <form
+          class={styles['actionForm']}
+          method="post"
+          action={new URL(request.url).pathname + new URL(request.url).search}
+        >
+          <input type="hidden" name={OPERATION_FIELD} value={BATCH_OPERATION} />
+          <input type="hidden" name="name" value={action.name} />
+          <input type="hidden" name={BATCH_SELECTION_FIELD} value="all" />
+          {result.after === null ? null : (
+            <input type="hidden" name={AFTER_FIELD} value={result.after} />
+          )}
+          {again.map(([name, value]) => (
+            <input type="hidden" name={name} value={value} />
+          ))}
+          <Button type="submit" size="sm" variant="secondary">
+            {t('admin.batch.continue', { count: result.remaining })}
+          </Button>
+        </form>
+      )}
+      <Link href={list}>{t('admin.batch.back')}</Link>
+    </Card>,
+  );
+}
+
+/**
+ * A batch posted from the list's bar. The first post of an action that takes input, or that is
+ * destructive, answers with its form — the confirmation is a server round trip — and the second,
+ * `_step=run`, runs it.
+ */
+export async function batchWrite(
+  app: AdminApp,
+  request: AdminRouteRequest,
+  resource: AdminResource,
+  form: Readonly<Record<string, unknown>>,
+  missing: () => AdminRouteResponse,
+): Promise<AdminRouteResponse> {
+  const action = resource.actions.find(
+    (declared) => declared.name === posted(form, 'name') && declared.batch !== undefined,
+  );
+  if (action === undefined) return missing();
+  const url = new URL(request.url);
+  const all = posted(form, BATCH_SELECTION_FIELD) === 'all';
+  const after = posted(form, AFTER_FIELD);
+  const ids = postedList(form, BATCH_IDS_FIELD);
+  const selection: BatchSelection = all
+    ? {
+        kind: 'all',
+        // The list's own URL grammar: a parameter it does not derive is refused there, by name.
+        request: pageRequestOf(resource, url),
+        ...(after === undefined ? {} : { after }),
+      }
+    : { kind: 'ids', ids };
+  // What the form posts back: the selection, as it was.
+  const hidden: readonly (readonly [string, string])[] = [
+    [BATCH_SELECTION_FIELD, all ? 'all' : 'checked'],
+    ...(all ? [] : ids.map((id) => [BATCH_IDS_FIELD, id] as const)),
+    ...(after === undefined ? [] : [[AFTER_FIELD, after] as const]),
+    [STEP_FIELD, RUN_STEP],
+  ];
+  const href = url.pathname + url.search;
+  const values = postedActionInput(action, form);
+  const formOf = (
+    token: string | null,
+    count: number | null,
+    issues: readonly ValidationIssue[],
+    status: number,
+  ): AdminRouteResponse =>
+    framed(
+      app,
+      request,
+      resource.titleKey,
+      <AdminActionForm
+        action={action}
+        href={href}
+        operation={BATCH_OPERATION}
+        values={values}
+        issues={issues}
+        confirmation={token}
+        subject={
+          count === null
+            ? t(all ? 'admin.batch.subject.all' : 'admin.batch.subject.checked', {
+                count: ids.length,
+              })
+            : t('admin.batch.subject.count', { count })
+        }
+        hidden={hidden}
+        cancelHref={href}
+      />,
+      status,
+    );
+
+  const run = posted(form, STEP_FIELD) === RUN_STEP;
+  const asks = actionInputFields(action).length > 0;
+  if (!run && asks && action.destructive !== true) return formOf(null, null, [], 200);
+
+  const result = await runAdminBatch({
+    resource,
+    action,
+    ctx: request.ctx,
+    selection,
+    input: decodeActionInput(action, form),
+    confirmation: posted(form, 'confirmation'),
+    ...(batchPlan(action) === null ? {} : { enqueue: batchEnqueue(app.basePath) }),
+  });
+  if (result.ok) {
+    return batchResult(app, request, resource, action, result, [
+      ...Object.entries(values).map(
+        ([name, value]) => [`${ACTION_INPUT_PREFIX}${name}`, value] as const,
+      ),
+    ]);
+  }
+  if (result.kind === 'denied') return refused(app, request, resource.titleKey, result.decision);
+  if (result.kind === 'confirm') {
+    return formOf(result.token, result.count, [], run ? 422 : 200);
+  }
+  return formOf(null, null, result.issues, 422);
+}