@uniweb/api 0.4.1 → 0.5.1

package/README.md

@@ -53,8 +53,9 @@ function Account() {
 
 `viewer` is flat — `viewer.uuid`, `viewer.username`, `viewer.handle`, and `viewer.roles`,
 a list of `{ role, scope_unit_id }`. A member holds no roles (`[]`); the site's operator
-holds `system_admin`. ⚠️ `viewer.actingUnitId` is the same for every member of a site, so
-it cannot tell an operator from a member. To decide whether to show an edit control for
+holds `system_admin`. ⚠️ `viewer.workspace` — the site service's home org,
+`{ handle: 'home', … }` — is the same for every member, so it cannot tell an operator
+from a member. To decide whether to show an edit control for
 a particular record, read that record: `entity.can_edit` is the backend's own answer.
 
 **Signing up** — `useSignUp().signUp({ username, email, password })` answers
@@ -205,7 +206,9 @@ who may create entries, which sections are insert-only, the fields a section tak
 and it is as strict as the backend about requests, so a mistake fails here rather
 than in front of a user. Members read and write their own entities and nothing of each
 other's; the operator reads and writes everything (`memberFloor: 'read'` in the seed
-models a service set up to let members read each other's). A new sign-up must be
+models a service set up to let members read each other's — or per Model,
+`memberFloor: { '@acme/course': 'read' }`, so the operator's content is shared while
+each member's own records stay private). A new sign-up must be
 verified: the link is in `mock.outbox` (the standalone server prints it). State is in
 memory: restart to reset.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/api",
-  "version": "0.4.1",
+  "version": "0.5.1",
   "description": "The client for a Uniweb site's own backend — session, records, entities — imported by a foundation the way it imports @uniweb/kit.",
   "type": "module",
   "exports": {
@@ -34,7 +34,7 @@
     "node": ">=20.19"
   },
   "dependencies": {
-    "@uniweb/core": "^0.29.4"
+    "@uniweb/core": "^0.29.8"
   },
   "peerDependencies": {
     "react": "^19.0.0"

package/src/client.js

@@ -93,6 +93,16 @@ const LOADING = Object.freeze({ status: 'loading', viewer: null, error: null })
  * from `website.config` on each call, so the editor's `Website.rebuild()`
  * needs no hook here.
  */
+
+/**
+ * `/auth/me`'s `workspace` — `{ unit_uuid, handle }`, both null when none — as the
+ * viewer carries it: `{ unitUuid, handle }`, or `null` for none (`VIEWER`).
+ */
+function viewerWorkspace(ws) {
+  if (!ws || typeof ws !== 'object' || (ws.unit_uuid == null && ws.handle == null)) return null
+  return Object.freeze({ unitUuid: ws.unit_uuid ?? null, handle: ws.handle ?? null })
+}
+
 export class ApiClient {
   /**
    * @param {object} uniweb - the page's `Uniweb` singleton
@@ -307,7 +317,7 @@ export class ApiClient {
     const viewer = Object.freeze({
       ...account,
       roles: Array.isArray(me?.roles) ? me.roles : [],
-      actingUnitId: me?.acting_unit_id ?? null,
+      workspace: viewerWorkspace(me?.workspace),
     })
     if (this._session.viewer && this._session.viewer.uuid !== viewer.uuid) this.forgetViewer()
     return this.setSession({ status: 'authenticated', viewer, error: null })

package/src/mock/store.js

@@ -32,9 +32,20 @@ import { checkItemWrite, OUTCOME } from './schema-shape.js'
  * same read), nested sections, second factors, reference fields.
  */
 
-/** The unit every account of a site acts in — `acting_unit_id` on `/auth/me`. */
+/** The unit every account of a site acts in — an entity's `unit_id`. */
 export const SITE_UNIT = 1
 
+/**
+ * The service's home org — `workspace` on `/auth/me`. A site's service is founded with
+ * one, handle `home`, and enrolls every account in it, the owner included, so a request
+ * that names no workspace lands there. Its own value: it is minted in the service's
+ * database, and has nothing to do with the workspace the site was authored in.
+ */
+export const HOME_ORG = Object.freeze({
+  unit_uuid: '01926d5e-0000-7000-8000-0000000000a0',
+  handle: 'home',
+})
+
 /** The gap between neighbouring items' order numbers, as the backend spaces them. */
 const GAP = 1_000_000
 
@@ -74,6 +85,9 @@ function canonical(value) {
 const isMulti = (section) => section?.multiple === true || section?.kind === 'multi'
 const shortName = (model) => String(model).split('/').pop() || String(model)
 
+/** A `{ locale: value }` map — a plain object, never an array (a localized list's value). */
+const isLocaleMap = (value) => value != null && typeof value === 'object' && !Array.isArray(value)
+
 export class MockStore {
   /**
    * @param {object} seed
@@ -88,8 +102,11 @@ export class MockStore {
    *   seed's items and `append_only` use.
    * @param {object[]} [seed.entities] - `{ uuid?, model, owner?, items?: [{ section, data, parent? }] }`.
    *   `uuid` must be a UUID. (`data`, the older spelling, becomes the brief section's item.)
-   * @param {'read'|'edit'} [seed.memberFloor] - what membership lets one member do to
-   *   ANOTHER member's entities. Absent — the default — nothing: each member's are private.
+   * @param {'read'|'edit'|Object<string,'read'|'edit'>} [seed.memberFloor] - what membership
+   *   lets one member do to ANOTHER member's entities. Absent — the default — nothing: each
+   *   member's are private. A string applies to every Model; a map `{ '@scope/name': 'read' }`
+   *   applies per Model, so a service can open the operator's content (courses, lessons) to
+   *   its members while their own records (progress, submissions) stay theirs alone.
    * @param {object} [options]
    * @param {string} [options.signedInAs] - start with this account already signed in.
    */
@@ -100,10 +117,16 @@ export class MockStore {
     for (const a of seed.accounts || []) this.addAccount(a, { verified: true })
 
     this.schemas = seed.schemas || {}
-    if (seed.memberFloor != null && !['read', 'edit'].includes(seed.memberFloor)) {
-      throw new Error(`[uniweb/api mock] memberFloor is 'read' or 'edit', or absent — got ${JSON.stringify(seed.memberFloor)}`)
+    const floors = seed.memberFloor != null && typeof seed.memberFloor === 'object' ? Object.values(seed.memberFloor) : [seed.memberFloor]
+    for (const floor of floors) {
+      if (floor != null && !['read', 'edit'].includes(floor)) {
+        throw new Error(`[uniweb/api mock] memberFloor is 'read' or 'edit', or absent — per Model or for all — got ${JSON.stringify(seed.memberFloor)}`)
+      }
     }
-    /** What membership lets one member do to another's entities: `null` (nothing), `read` or `edit`. */
+    /**
+     * What membership lets one member do to another's entities: `null` (nothing), `read`
+     * or `edit` — for every Model, or a map of it per Model.
+     */
     this.memberFloor = seed.memberFloor ?? null
     this.models = new Map()
     const itemSections = new Map()
@@ -169,7 +192,9 @@ export class MockStore {
     return {
       account: this.identity(account),
       roles: account.operator ? [{ role: 'system_admin', scope_unit_id: null }] : [],
-      acting_unit_id: SITE_UNIT,
+      // A request that names no workspace — as this package's never do — lands in the
+      // home org, which every account belongs to. Both null would mean a non-member.
+      workspace: { ...HOME_ORG },
     }
   }
 
@@ -416,15 +441,22 @@ export class MockStore {
     return siblings[siblings.length - 1].order_number + GAP
   }
 
+  /** The floor that applies to this entity's Model: `null`, `'read'` or `'edit'`. */
+  floorFor(entity) {
+    const floor = this.memberFloor
+    if (floor == null || typeof floor === 'string') return floor
+    return floor[entity.model] ?? null
+  }
+
   /** The operator, the owner — or any member, when the service lets members read each other's. */
   mayRead(entity) {
     const me = this.account
-    return !!me && (me.operator || entity.owner_id === me.id || this.memberFloor != null)
+    return !!me && (me.operator || entity.owner_id === me.id || this.floorFor(entity) != null)
   }
 
   mayEdit(entity) {
     const me = this.account
-    return !!me && (me.operator || entity.owner_id === me.id || this.memberFloor === 'edit')
+    return !!me && (me.operator || entity.owner_id === me.id || this.floorFor(entity) === 'edit')
   }
 
   /**
@@ -453,12 +485,18 @@ export class MockStore {
    * A localized field — declared `localized: true` — answered in the first listed
    * locale it has, and omitted when it has none: the backend has no fallback of
    * its own. Without a locale, the whole `{ locale: value }` map.
+   *
+   * ⛔ Only a plain object is a locale map. A localized LIST (`multiple: true`) holds
+   * an array, and an array is a value, not a map of them: read as a map it has no
+   * `en`, and the field was DELETED from every read that carried `?locale=` — which
+   * the client sends on every browser read. Measured 2026-09-22 on a course brief
+   * whose `outcomes` vanished, and on quiz questions whose `options` did.
    */
   project(data, section, locales) {
     if (!locales?.length || !section?.fields || !data || typeof data !== 'object') return data
     const out = { ...data }
     for (const [key, field] of Object.entries(section.fields)) {
-      if (!field?.localized || !out[key] || typeof out[key] !== 'object') continue
+      if (!field?.localized || !isLocaleMap(out[key])) continue
       const hit = locales.find((l) => out[key][l] != null)
       if (hit) out[key] = out[key][hit]
       else delete out[key]

package/src/wire.js

@@ -38,6 +38,7 @@
  * | a `409` was rebased onto "the first op with an item id" | only the item the stale `409` names (`item_id`, since 2026-09-18); an older backend names none, and a batch is then not rebased — never by guesswork |
  * | a sign-up answered with the account | it answers `202 { status: 'verification_required', email }`; the account cannot sign in until verified (`403 Email Not Verified`) |
  * | `acting_unit_id` was a membership signal | every signed-in member of a site acts in the same unit — it cannot tell an operator from a member; `roles` can |
+ * | the viewer carried `actingUnitId` | it carries `workspace` — where the request landed: on a site's service, its home org (2026-09-23; `acting_unit_id` leaves the wire) |
  *
  * @module @uniweb/api/wire
  */
@@ -113,7 +114,7 @@ export const AUTH = {
  * | reset request | `{ email }` | `202 { status: 'reset_requested' }` whether or not the address is known |
  * | reset confirm | `{ token, new_password, code? }` | `200 { reset: true }`; a bad token is `400 Validation`; `code` is required when a second factor is enrolled |
  * | logout | none | `204`; with no session to end, `401` |
- * | me | none | `200 { account: { uuid, username, handle }, roles, acting_unit_id }` · `401` |
+ * | me | none | `200 { account: { uuid, username, handle }, roles, workspace: { unit_uuid, handle } }` · `401` |
  */
 export const AUTH_BODY = {
   login: ['username', 'password'],
@@ -136,16 +137,24 @@ export const TOTP = {
  * `roles` is a list of `{ role, scope_unit_id }` — `role` one of `system_admin`,
  * `unit_admin`, `content_editor`, `user`. An ordinary member holds none: `[]`.
  *
- * ⛔ **`acting_unit_id` is NOT a membership or operator signal.** Every signed-in
- * member of a site acts in the same unit, so it reads the same for the operator
- * and for someone who signed up a minute ago. The operator of a site's `api`
- * service holds `system_admin`. Better than either: ask about the thing — a
- * single-entity read carries `can_edit`, the write gate's own answer.
+ * `workspace` is `{ unit_uuid, handle }` — **the workspace the request works in**. This
+ * package's requests name none, and on a site's `api` service such a request lands in
+ * the service's **home org**, `handle: 'home'`, in which every account is enrolled.
+ * Both `null` there means an account that is not a member — a service account, a
+ * revoked membership. (On a backend with no home org, naming none is personal: both
+ * `null`.) The viewer carries it as `{ unitUuid, handle }`, or `null` when both are
+ * null. *(It replaced `acting_unit_id` on 2026-09-23. MEASURED by backend at the
+ * function the route serializes, 2026-09-23.)*
+ *
+ * ⛔ **Neither is an operator signal.** Every member of a site's service works in the
+ * same home org, so it reads the same for the operator and for someone who signed up a
+ * minute ago. The operator holds `system_admin`. Better than either: ask about the
+ * thing — a single-entity read carries `can_edit`, the write gate's own answer.
  */
 export const VIEWER = {
   account: 'account',
   roles: 'roles',
-  actingUnit: 'acting_unit_id',
+  workspace: 'workspace',
 }
 
 /**