@ultimat3/admin 23.0.0 → 25.0.0

package/src/screen-resource.tsx

@@ -34,8 +34,9 @@ import { type ListLocation, listHref, pageRequestOf } from './list-request';
 import { type AdminListRequest, findRow, scopeCounts } from './list-scope';
 import type { AdminRow } from './registry';
 import { relatedLists, relatedOf } from './related';
-import { type RelationNeed, relationNeeds, relationsFor } from './relations';
+import { type RelationNeed, relationDataFor, relationNeeds } from './relations';
 import type { AdminResource } from './resource';
+import { ROW_CHANGED_REASON, rowVersion, VERSION_FIELD } from './row-version';
 import { batchWrite, rowActionFormScreen, rowActionWrite } from './screen-action';
 import {
   type AdminRouteRequest,
@@ -126,7 +127,7 @@ export function listScreen(app: AdminApp, resource: AdminResource): AdminScreen
     // one, and one read per resource the page references — never one per row.
     const [counts, relations] = await Promise.all([
       scopeCounts(resource, request.ctx.actor),
-      relationsFor(
+      relationDataFor(
         app.resources,
         request.ctx,
         relationNeeds(result.page.rows, resource.listFields, resource.filters),
@@ -171,7 +172,7 @@ const relationsOf = (
   row: AdminRow,
   picking: boolean,
 ): Promise<WidgetContext> =>
-  relationsFor(
+  relationDataFor(
     app.resources,
     request.ctx,
     relationNeeds([row], resource.fields, picking ? resource.formFields : []),
@@ -250,12 +251,15 @@ export function detailScreen(app: AdminApp, resource: AdminResource): AdminScree
         entityId: id,
         changes: true,
         limit: HISTORY_PAGE,
+        // The actor's tenant's entries only, as on the audit screen — a row two orgs may open
+        // does not show one org who in the other changed it.
+        ...(request.ctx.actor.orgId === undefined ? {} : { orgId: request.ctx.actor.orgId }),
         ...(before === undefined ? {} : { before }),
       }),
     ]);
     // ONE label read per referenced target for the whole page — this row's references and every
     // related row's together.
-    const relations = await relationsFor(
+    const relations = await relationDataFor(
       app.resources,
       request.ctx,
       mergedNeeds([
@@ -310,6 +314,7 @@ async function form(
   mode: 'create' | 'edit',
   values: Readonly<Record<string, unknown>>,
   issues: readonly ValidationIssue[],
+  version: string | null,
 ): Promise<JSX.Element> {
   const list = listHref(app.basePath, resource);
   return (
@@ -323,10 +328,18 @@ async function form(
       ctx={await relationsOf(app, resource, request, values, true)}
       action={new URL(request.url).pathname}
       cancelHref={mode === 'create' ? list : rowHref(app, resource, idOf(request))}
+      version={version}
     />
   );
 }
 
+/** The form-level issue a write against a stale version is re-rendered with. */
+const ROW_CHANGED_ISSUE: ValidationIssue = {
+  path: VERSION_FIELD,
+  message: 'the row was changed after this form was opened',
+  messageKey: ROW_CHANGED_REASON,
+};
+
 export function createScreen(
   app: AdminApp,
   route: AdminRoute,
@@ -340,7 +353,7 @@ export function createScreen(
         app,
         request,
         resource.titleKey,
-        await form(app, resource, request, 'create', {}, []),
+        await form(app, resource, request, 'create', {}, [], null),
       );
     }
     const input = decodeForm(resource, request.form ?? {});
@@ -350,13 +363,14 @@ export function createScreen(
       return { kind: 'redirect', location: rowHref(app, resource, id) };
     }
     if (result.kind === 'denied') return refused(app, request, resource.titleKey, result.decision);
-    if (result.kind === 'missing') return notFound(app, resource, request);
+    // A create has no row to have gone missing or stale: neither is an answer it can give.
+    if (result.kind !== 'invalid') return notFound(app, resource, request);
     // 422, with what was typed: a refused form that came back empty is a form filled in twice.
     return framed(
       app,
       request,
       resource.titleKey,
-      await form(app, resource, request, 'create', input, result.issues),
+      await form(app, resource, request, 'create', input, result.issues, null),
       422,
     );
   };
@@ -365,8 +379,8 @@ export function createScreen(
 export function editScreen(app: AdminApp, route: AdminRoute, resource: AdminResource): AdminScreen {
   return async (request) => {
     const id = idOf(request);
+    const row = await findRow(resource, request.ctx.actor, id);
     if (request.method === 'GET') {
-      const row = await findRow(resource, request.ctx.actor, id);
       const decision = decideOperation(resource, 'update', request.ctx, id, row);
       if (!decision.allowed) return refusedPage(app, request, route, decision);
       if (row === null) return notFound(app, resource, request);
@@ -374,19 +388,53 @@ export function editScreen(app: AdminApp, route: AdminRoute, resource: AdminReso
         app,
         request,
         resource.titleKey,
-        await form(app, resource, request, 'edit', row, []),
+        await form(app, resource, request, 'edit', row, [], rowVersion(row)),
       );
     }
-    const input = decodeForm(resource, request.form ?? {});
-    const result = await adminUpdate<AdminRow>(resource, request.ctx, id, input);
+    const submitted = request.form ?? {};
+    // Decoded against the row as it is: an instant posted back as the minute it was drawn at is
+    // left out, not rewritten to that minute. A row that moved on since the form was rendered is
+    // refused below on its version, so "as it is" and "as it was drawn" are the same row here.
+    const input = decodeForm(resource, submitted, row ?? undefined);
+    // A post with no version is not a form this admin rendered: it is refused as stale, never run
+    // as an unversioned write — the version is how the form says which row it was looking at.
+    const version = posted(submitted, VERSION_FIELD) ?? '';
+    const result = await adminUpdate<AdminRow>(resource, request.ctx, id, input, { version });
     if (result.ok) return { kind: 'redirect', location: rowHref(app, resource, id) };
     if (result.kind === 'denied') return refused(app, request, resource.titleKey, result.decision);
     if (result.kind === 'missing') return notFound(app, resource, request);
+    if (result.kind === 'stale') {
+      // What they typed, over the row as it is NOW, under its current version: saving again is a
+      // decision taken with the other edit on screen, not an accident.
+      return framed(
+        app,
+        request,
+        resource.titleKey,
+        await form(
+          app,
+          resource,
+          request,
+          'edit',
+          { ...result.row, ...input },
+          [ROW_CHANGED_ISSUE],
+          result.version,
+        ),
+        409,
+      );
+    }
     return framed(
       app,
       request,
       resource.titleKey,
-      await form(app, resource, request, 'edit', input, result.issues),
+      await form(
+        app,
+        resource,
+        request,
+        'edit',
+        { ...(row ?? {}), ...input },
+        result.issues,
+        version,
+      ),
       422,
     );
   };

package/src/screen-system.tsx

@@ -14,8 +14,14 @@ import { adminSearch } from './search';
 const AUDIT_PAGE = 100;
 
 export function auditScreen(app: AdminApp, route: AdminRoute): AdminScreen {
-  return guardedScreen(app, route, async () => {
-    const entries = await app.audit.entries({ limit: AUDIT_PAGE });
+  return guardedScreen(app, route, async (request) => {
+    // The actor's tenant's trail: `audit:read` held in org A is not a read of org B's operators,
+    // their ids or what they touched. An actor with no org — the platform — reads every tenant's.
+    const orgId = request.ctx.actor.orgId;
+    const entries = await app.audit.entries({
+      limit: AUDIT_PAGE,
+      ...(orgId === undefined ? {} : { orgId }),
+    });
     return (
       <Card>
         {entries.length === 0 ? (

package/src/search.ts

@@ -6,7 +6,7 @@ import { finiteCount } from '@ultimat3/core';
 import { expectedQueryLoop } from '@ultimat3/db';
 import { type AuditEntry, deniedDraft } from './audit';
 import type { AdminActor } from './authz';
-import { denied } from './authz';
+import { adminDenied } from './authz';
 import type { CrudCtx } from './crud';
 import { decideOperation } from './crud';
 import { rowWhere } from './list-scope';
@@ -105,6 +105,7 @@ async function searchResource(
 }
 
 const SKIPPED_FORBIDDEN = 'admin.search.skipped.forbidden';
+const SKIPPED_FAILED = 'admin.search.skipped.failed';
 
 export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchResult> {
   const { ctx } = input;
@@ -144,7 +145,7 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
             entityId: null,
             // A resource that does not OFFER search was refused by the registry, not by a policy,
             // and the decision object would otherwise read `allow` on a denied entry.
-            decision: offered ? decision : denied(decision.permission, SKIPPED_FORBIDDEN),
+            decision: offered ? decision : adminDenied(decision.permission, SKIPPED_FORBIDDEN),
           }),
         ),
       );
@@ -160,7 +161,6 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
       skipped.push({ entity: resource.name, reason: 'admin.search.skipped.no-repo' });
       continue;
     }
-    searched.push(resource.name);
     // Appended BEFORE the read, so a repo that throws still leaves the record that the rows were
     // asked for — `audit.ts`: if it isn't logged, it didn't happen.
     audit.push(
@@ -176,7 +176,15 @@ export async function adminSearch(input: AdminSearchInput): Promise<AdminSearchR
         reason: decision.reason,
       }),
     );
-    hits.push(...(await searchResource(resource, ctx.actor, term, limit)));
+    try {
+      hits.push(...(await searchResource(resource, ctx.actor, term, limit)));
+      searched.push(resource.name);
+    } catch {
+      // One resource whose repo fails is a resource this search could not read — listed, so the
+      // operator is never silently shown a subset — never a 500 for every other one. Nothing is
+      // read off the thrown value: a reason is a key.
+      skipped.push({ entity: resource.name, reason: SKIPPED_FAILED });
+    }
   }
 
   return { term, hits, searched, skipped, audit };

package/src/widgets.tsx

@@ -17,7 +17,7 @@ import {
 } from '@ultimat3/ui';
 import type { JSX } from 'solid-js';
 import type { AdminField } from './fields';
-import { currencyFieldOf } from './form-decode';
+import { currencyFieldOf, datetimeInputValue } from './form-decode';
 import { type WidgetContext, type WidgetProps, widgetProps } from './widget-value';
 
 export interface WidgetInput {
@@ -70,10 +70,6 @@ export const formatCalendarDate: DateTimeFormatter = (at, options) =>
     dateStyle: 'medium',
   }).format(at);
 
-/** `<input type="date">` wants `YYYY-MM-DD`; `datetime-local` wants `YYYY-MM-DDTHH:mm`. */
-const inputValueFor = (iso: string, precision: 'date' | 'instant'): string =>
-  iso.slice(0, precision === 'date' ? 10 : 16);
-
 /**
  * An enum value's label: its translation when the catalog has one, the value itself when it does
  * not. The value is an identifier the ENTITY declares (`public`, `draft`), so showing it is true;
@@ -238,7 +234,7 @@ function editView(props: WidgetProps, input: WidgetInput): JSX.Element {
           {...shared}
           name={props.field}
           type={props.precision === 'date' ? 'date' : 'datetime-local'}
-          value={props.value === null ? '' : inputValueFor(props.value, props.precision)}
+          value={props.value === null ? '' : datetimeInputValue(props.value, props.precision)}
           suffix={props.precision === 'date' ? undefined : 'UTC'}
           disabled={disabled}
           onInput={(event) => emit(input, event.currentTarget.value)}

package/src/inert-jsx.ts

@@ -1,182 +0,0 @@
-// TEST-ONLY. Calls an admin `.tsx` view as the plain function it is and walks what came back, so
-// a test can assert on the tree a screen produced rather than on a value it also constructed.
-//
-// Which JSX factory a `.tsx` in this package compiled to is NOT ours to choose: `@ultimat3/render`
-// installs a process-global `Bun.plugin` `onLoad` for `/\.tsx$/` at import (`routes.ts` imports it,
-// so any sibling suite can win the race) and `bun test` is one process. Both factories build the
-// same shape — a `type`, a `props`, children under `props.children` — so this walker recognises
-// both and the run's file order stops deciding. Recognising neither is what falls through to
-// `String(value)` and asserts against `"[object Object]"`.
-
-// The subpath, never the barrel: this is a test harness and the design system's `index.ts` is its
-// semver'd contract (`packages/ui/CLAUDE.md`). It is imported for `globalThis.React`'s ONE counter.
-import { probe, unprobe } from '@ultimat3/ui/jsx-probe';
-
-/** `@ultimat3/render`'s node brand, read off the GLOBAL symbol registry rather than imported. */
-const RENDER_NODE: symbol = Symbol.for('ultimate.render.jsx');
-
-export type InertComponent = (props: Record<string, unknown>) => unknown;
-
-export interface InertNode {
-  readonly type: string | InertComponent;
-  readonly props: Record<string, unknown>;
-}
-
-export function isInertNode(value: unknown): value is InertNode {
-  if (typeof value !== 'object' || value === null) return false;
-  return 'inert' in value || RENDER_NODE in value;
-}
-
-/**
- * Build a node by hand, the shape the installed factory builds. NOT the installed factory — that is
- * `@ultimat3/ui`'s, so there is one owner of `globalThis.React` (see `installFactory` below). This
- * is what a test uses to construct a tree it did not render.
- */
-export function h(
-  type: string | InertComponent,
-  props: Record<string, unknown> | null,
-  ...children: readonly unknown[]
-): InertNode {
-  const base = { ...(props ?? {}) };
-  if (children.length > 0) base['children'] = children.length === 1 ? children[0] : children;
-  return { inert: true, type, props: base } as unknown as InertNode;
-}
-
-/**
- * Install the classic-factory global, through `@ultimat3/ui`'s ONE counter over `globalThis.React`.
- *
- * This package kept its own `depth`/`saved` pair until 2026-08-22, and two counters over one
- * property restore in the wrong order: admin installs (saving the real binding), ui installs
- * (saving ADMIN's factory), admin restores (its counter hits 0 → the real binding is back), ui
- * restores (its counter hits 0 → admin's factory goes back over it). `bun test` is one process and
- * `packages/ui` and `packages/admin` are one run, so the interleave is reachable, and the global
- * was left holding a harness the run had already torn down. `admin` is tier 5 and `ui` is tier 4,
- * so importing down is the fix; the two factories build the same `{ inert, type, props }` shape,
- * which is what `isInertNode` recognises.
- */
-export function installFactory(): void {
-  probe();
-}
-
-/** Undo the matching `installFactory()`. Unbalanced calls are inert. */
-export function restoreFactory(): void {
-  unprobe();
-}
-
-/**
- * Every node in the tree, depth first, with nested components CALLED and thunks invoked — a
- * component that reads a prop inside one renders nothing until something asks.
- *
- * Component nodes are KEPT as well as expanded, so a test can assert on the props a view handed
- * `<Money>` — the admin's contract with the design system — and not only on the markup ui chose
- * to emit for them, which is ui's business and changes without this package changing.
- */
-export function nodesOf(value: unknown): InertNode[] {
-  if (value === null || value === undefined || typeof value === 'boolean') return [];
-  if (typeof value === 'string' || typeof value === 'number') return [];
-  if (Array.isArray(value)) return value.flatMap(nodesOf);
-  if (isInertNode(value)) {
-    if (typeof value.type === 'function') return [value, ...nodesOf(value.type(value.props))];
-    return [value, ...nodesOf(value.props['children'])];
-  }
-  if (typeof value === 'function') return nodesOf((value as () => unknown)());
-  return [];
-}
-
-/**
- * The tree this package itself built: component nodes are kept but NOT called, so the walk stops
- * at the design-system boundary. Use this when a design-system component's own internals would
- * otherwise answer a query about the admin's markup — `<Dialog>` renders a close `<button>`, and a
- * test asking "which buttons did the action bar render" must not be handed ui's.
- */
-export function shallowNodesOf(value: unknown): InertNode[] {
-  if (value === null || value === undefined || typeof value === 'boolean') return [];
-  if (typeof value === 'string' || typeof value === 'number') return [];
-  if (Array.isArray(value)) return value.flatMap(shallowNodesOf);
-  if (isInertNode(value)) return [value, ...shallowNodesOf(value.props['children'])];
-  if (typeof value === 'function') return shallowNodesOf((value as () => unknown)());
-  return [];
-}
-
-/** Nodes rendered by the named component — `byComponent(nodes, 'Money')`. */
-export function byComponent(nodes: readonly InertNode[], name: string): InertNode[] {
-  return nodes.filter((node) => typeof node.type === 'function' && node.type.name === name);
-}
-
-const SKIPPED_PROPS = new Set(['children', 'ref', 'innerHTML']);
-
-function attributes(props: Record<string, unknown>): string {
-  return Object.entries(props)
-    .filter(([name, value]) => {
-      if (SKIPPED_PROPS.has(name) || name.startsWith('on')) return false;
-      return value !== undefined && value !== null && value !== false;
-    })
-    .map(([name, value]) => (value === true ? ` ${name}` : ` ${name}="${String(value)}"`))
-    .join('');
-}
-
-/** The tree as markup. Unknown values are `String()`d, which the premise test refuses to allow. */
-export function renderHtml(value: unknown): string {
-  if (value === null || value === undefined || typeof value === 'boolean') return '';
-  if (typeof value === 'string' || typeof value === 'number') return String(value);
-  if (Array.isArray(value)) return value.map(renderHtml).join('');
-  if (isInertNode(value)) {
-    if (typeof value.type === 'function') return renderHtml(value.type(value.props));
-    const inner = renderHtml(value.props['children']);
-    return `<${value.type}${attributes(value.props)}>${inner}</${value.type}>`;
-  }
-  if (typeof value === 'function') return renderHtml((value as () => unknown)());
-  return String(value);
-}
-
-/** Render a component to its host nodes. `props` is the component's own, untyped on purpose. */
-export function renderNodes(component: unknown, props: Record<string, unknown> = {}): InertNode[] {
-  return nodesOf((component as InertComponent)(props));
-}
-
-/**
- * `renderNodes`, stopping at the design-system boundary — the `shallowNodesOf` sibling. The
- * `unknown` parameter is what makes it usable: a screen's props are typed and generic, so a test
- * calling one through `as (props: Record<string, unknown>) => unknown` is a conversion TypeScript
- * refuses outright. One widening here beats one per call site.
- */
-export function renderShallowNodes(
-  component: unknown,
-  props: Record<string, unknown> = {},
-): InertNode[] {
-  return shallowNodesOf((component as InertComponent)(props));
-}
-
-/** Render a component to markup. */
-export function renderComponent(component: unknown, props: Record<string, unknown> = {}): string {
-  return renderHtml((component as InertComponent)(props));
-}
-
-export function byTag(nodes: readonly InertNode[], tag: string): InertNode[] {
-  return nodes.filter((node) => node.type === tag);
-}
-
-/** Nodes whose attribute equals `value`; `undefined` matches "carries the attribute at all". */
-export function withAttr(nodes: readonly InertNode[], name: string, value?: unknown): InertNode[] {
-  return nodes.filter((node) =>
-    value === undefined ? node.props[name] !== undefined : node.props[name] === value,
-  );
-}
-
-/** The one node a test means, or a throw naming what it looked for — never a silent `undefined`. */
-export function one(nodes: readonly InertNode[], what: string): InertNode {
-  const node = nodes[0];
-  if (node === undefined || nodes.length !== 1) {
-    throw new Error(`expected exactly one ${what}, found ${nodes.length}`);
-  }
-  return node;
-}
-
-/** Call an element's event handler prop, e.g. `fire(button, 'onClick', {})`. */
-export function fire(node: InertNode, handler: string, event: unknown): void {
-  const fn = node.props[handler];
-  if (typeof fn !== 'function') {
-    throw new Error(`node <${String(node.type)}> carries no ${handler}`);
-  }
-  (fn as (e: unknown) => void)(event);
-}