@uniweb/api 0.5.0 → 0.6.0

package/README.md

@@ -179,7 +179,6 @@ export default createMockBackend({
     ],
     schemas: {
       '@acme/track': {
-        creatable_by: 'unit_members',                    // the operator only; 'any_user' is the default
         sections: {
           track: { kind: 'single', brief: true, fields: { name: { type: 'string', required: true } } },
           sessions: { kind: 'multi', fields: { title: { type: 'string', required: true } } },
@@ -206,7 +205,9 @@ who may create entries, which sections are insert-only, the fields a section tak
 and it is as strict as the backend about requests, so a mistake fails here rather
 than in front of a user. Members read and write their own entities and nothing of each
 other's; the operator reads and writes everything (`memberFloor: 'read'` in the seed
-models a service set up to let members read each other's). A new sign-up must be
+models a service set up to let members read each other's — or per Model,
+`memberFloor: { '@acme/course': 'read' }`, so the operator's content is shared while
+each member's own records stay private). A new sign-up must be
 verified: the link is in `mock.outbox` (the standalone server prints it). State is in
 memory: restart to reset.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@uniweb/api",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "The client for a Uniweb site's own backend — session, records, entities — imported by a foundation the way it imports @uniweb/kit.",
   "type": "module",
   "exports": {

package/src/mock/index.js

@@ -39,7 +39,7 @@ import { DEFAULT_SEED } from './seed.js'
  * One operator (`operator: true` on a seeded account) and members; a member reads
  * and writes their own entities and nothing of another's (unless the seed's
  * `memberFloor` says the service lets them), the operator reads and writes all;
- * `creatable_by: 'unit_members'` Models are created by the operator only; sign-up
+ * anyone signed in may create entries of any Model (Models are open); sign-up
  * leaves an account unverified until the link in `mock.outbox` is followed. It
  * does not model entitlements behind `via`, nested sections, or second factors.
  *
@@ -286,15 +286,9 @@ export function createMockBackend({ seed = DEFAULT_SEED, prefix = '/_api', signe
         }
         const model = store.model(q.get(PARAM.model))
         if (!model) return notFound('model', q.get(PARAM.model))
-        if (!store.mayCreate(model)) {
-          return problem({
-            status: 403,
-            title: 'Forbidden',
-            detail: `use_model on model ${model.uuid} not permitted`,
-            op: 'use_model',
-            target: `model ${model.uuid}`,
-          })
-        }
+        // ⭐ No creation gate: Models are open (2026-09-23) — anyone signed in may create
+        // entries of any Model. Until then `creatable_by: unit_members` answered `403
+        // use_model` here for a member.
         // Any other top-level key is ignored, exactly as the backend ignores it.
         return answer(store.create(model, items.map((i) => ({ ...i, data: i.data ?? {} }))))
       }

package/src/mock/seed.js

@@ -7,24 +7,24 @@
  *
  * - **`accounts`** — `operator: true` marks the account that runs the site's
  *   service. Everyone else is a member. Seeded accounts are verified.
- * - **`schemas`** — per Model: `creatable_by` (`any_user`, the default, or
- *   `unit_members` — the operator only) and `sections`, the Model's sections as
- *   the framework lowers them. With `sections`, writes are shape-checked.
+ * - **`schemas`** — per Model: `sections`, the Model's sections as the framework
+ *   lowers them. With `sections`, writes are shape-checked. Models are open:
+ *   anyone signed in may create entries of any of them.
  * - **`entities`** — `uuid` must be a UUID, as it is on the wire; content is items,
  *   each naming its section. The entity's `brief` is derived from its brief
  *   section's item, as the backend derives it.
  */
 export const DEFAULT_SEED = {
   accounts: [
-    // The organiser runs the site, so the rule on `@/track` lets them author the programme.
+    // The organiser runs the site, and the programme's tracks are theirs.
     { username: 'organiser', password: 'organiser', operator: true },
-    // The attendee is a member — the same rule refuses them, server-side, and that
-    // refusal is the demo. They may record attending, which anyone may.
+    // The attendee is a member. They may make entries of their own — recording
+    // attending is the demo — and may not edit the organiser's programme: the entry
+    // decides, server-side, and that refusal is the other half of the demo.
     { username: 'attendee', password: 'attendee' },
   ],
   schemas: {
     '@/track': {
-      creatable_by: 'unit_members',
       sections: {
         track: { kind: 'single', brief: true, fields: { name: { type: 'string', required: true } } },
         sessions: {
@@ -36,7 +36,6 @@ export const DEFAULT_SEED = {
     // Check-ins are insert-only: an attendee may record attending, and nobody —
     // including them — may edit or remove it afterwards.
     '@/attendance': {
-      creatable_by: 'any_user',
       sections: {
         attendance: { kind: 'single', brief: true, fields: { who: { type: 'string' } } },
         checkins: { kind: 'multi', append_only: true, fields: { session: { type: 'string' }, at: { type: 'string' } } },

package/src/mock/store.js

@@ -85,13 +85,17 @@ function canonical(value) {
 const isMulti = (section) => section?.multiple === true || section?.kind === 'multi'
 const shortName = (model) => String(model).split('/').pop() || String(model)
 
+/** A `{ locale: value }` map — a plain object, never an array (a localized list's value). */
+const isLocaleMap = (value) => value != null && typeof value === 'object' && !Array.isArray(value)
+
 export class MockStore {
   /**
    * @param {object} seed
    * @param {object[]} [seed.accounts] - `{ username, password, email?, handle?, operator? }`.
    *   Seeded accounts are verified. (`units: [...]` non-empty, the older spelling,
    *   also marks the operator.)
-   * @param {object} [seed.schemas] - `{ '@scope/name': { creatable_by?, sections?, append_only?, migration_debt? } }`.
+   * @param {object} [seed.schemas] - `{ '@scope/name': { sections?, append_only?, migration_debt? } }`.
+   *   ⛔ No `creatable_by` — retired 2026-09-23, Models are open; a seed carrying it is refused.
    *   `sections` is the LOWERED sections map (`{ [name]: { kind | multiple, brief, append_only, fields } }`)
    *   as the framework's normalizer produces it; with it, writes are shape-checked
    *   (`./schema-shape.js`). Without it the sections are inferred: a one-item brief
@@ -99,8 +103,11 @@ export class MockStore {
    *   seed's items and `append_only` use.
    * @param {object[]} [seed.entities] - `{ uuid?, model, owner?, items?: [{ section, data, parent? }] }`.
    *   `uuid` must be a UUID. (`data`, the older spelling, becomes the brief section's item.)
-   * @param {'read'|'edit'} [seed.memberFloor] - what membership lets one member do to
-   *   ANOTHER member's entities. Absent — the default — nothing: each member's are private.
+   * @param {'read'|'edit'|Object<string,'read'|'edit'>} [seed.memberFloor] - what membership
+   *   lets one member do to ANOTHER member's entities. Absent — the default — nothing: each
+   *   member's are private. A string applies to every Model; a map `{ '@scope/name': 'read' }`
+   *   applies per Model, so a service can open the operator's content (courses, lessons) to
+   *   its members while their own records (progress, submissions) stay theirs alone.
    * @param {object} [options]
    * @param {string} [options.signedInAs] - start with this account already signed in.
    */
@@ -111,10 +118,23 @@ export class MockStore {
     for (const a of seed.accounts || []) this.addAccount(a, { verified: true })
 
     this.schemas = seed.schemas || {}
-    if (seed.memberFloor != null && !['read', 'edit'].includes(seed.memberFloor)) {
-      throw new Error(`[uniweb/api mock] memberFloor is 'read' or 'edit', or absent — got ${JSON.stringify(seed.memberFloor)}`)
+    for (const [name, decl] of Object.entries(this.schemas)) {
+      if (decl && (decl.creatable_by !== undefined || decl.creatableBy !== undefined)) {
+        throw new Error(
+          `[uniweb/api mock] ${name}: creatable_by is retired — Models are open: anyone signed in may create entries of any Model, and who may see or edit an entry is decided by the entry. Remove it.`
+        )
+      }
+    }
+    const floors = seed.memberFloor != null && typeof seed.memberFloor === 'object' ? Object.values(seed.memberFloor) : [seed.memberFloor]
+    for (const floor of floors) {
+      if (floor != null && !['read', 'edit'].includes(floor)) {
+        throw new Error(`[uniweb/api mock] memberFloor is 'read' or 'edit', or absent — per Model or for all — got ${JSON.stringify(seed.memberFloor)}`)
+      }
     }
-    /** What membership lets one member do to another's entities: `null` (nothing), `read` or `edit`. */
+    /**
+     * What membership lets one member do to another's entities: `null` (nothing), `read`
+     * or `edit` — for every Model, or a map of it per Model.
+     */
     this.memberFloor = seed.memberFloor ?? null
     this.models = new Map()
     const itemSections = new Map()
@@ -257,7 +277,6 @@ export class MockStore {
       id: (this.ids.model += 1),
       uuid: newUuid(),
       name,
-      creatable_by: decl?.creatable_by || 'any_user',
       decl: decl || {},
       sections: [],
     }
@@ -302,14 +321,14 @@ export class MockStore {
     return null
   }
 
-  mayCreate(model) {
-    if (!this.account) return false
-    return model.creatable_by === 'any_user' || this.account.operator
-  }
-
-  /** The definition is readable for the Models the viewer may create, and by the operator. */
-  maySeeSchema(model) {
-    return !!this.account && (this.account.operator || model.creatable_by === 'any_user')
+  /**
+   * The definition is readable by anyone signed in. ⭐ Models are open (2026-09-23):
+   * anyone signed in may create entries of any Model, and what protects content is the
+   * entry — `mayEdit`, `mayRead` — never who may create. *(Until then a Model declaring
+   * `creatable_by: unit_members` was the operator's alone, and so was its definition.)*
+   */
+  maySeeSchema() {
+    return !!this.account
   }
 
   /** `GET /models/@scope/name`, in the backend's shape. */
@@ -429,15 +448,22 @@ export class MockStore {
     return siblings[siblings.length - 1].order_number + GAP
   }
 
+  /** The floor that applies to this entity's Model: `null`, `'read'` or `'edit'`. */
+  floorFor(entity) {
+    const floor = this.memberFloor
+    if (floor == null || typeof floor === 'string') return floor
+    return floor[entity.model] ?? null
+  }
+
   /** The operator, the owner — or any member, when the service lets members read each other's. */
   mayRead(entity) {
     const me = this.account
-    return !!me && (me.operator || entity.owner_id === me.id || this.memberFloor != null)
+    return !!me && (me.operator || entity.owner_id === me.id || this.floorFor(entity) != null)
   }
 
   mayEdit(entity) {
     const me = this.account
-    return !!me && (me.operator || entity.owner_id === me.id || this.memberFloor === 'edit')
+    return !!me && (me.operator || entity.owner_id === me.id || this.floorFor(entity) === 'edit')
   }
 
   /**
@@ -466,12 +492,18 @@ export class MockStore {
    * A localized field — declared `localized: true` — answered in the first listed
    * locale it has, and omitted when it has none: the backend has no fallback of
    * its own. Without a locale, the whole `{ locale: value }` map.
+   *
+   * ⛔ Only a plain object is a locale map. A localized LIST (`multiple: true`) holds
+   * an array, and an array is a value, not a map of them: read as a map it has no
+   * `en`, and the field was DELETED from every read that carried `?locale=` — which
+   * the client sends on every browser read. Measured 2026-09-22 on a course brief
+   * whose `outcomes` vanished, and on quiz questions whose `options` did.
    */
   project(data, section, locales) {
     if (!locales?.length || !section?.fields || !data || typeof data !== 'object') return data
     const out = { ...data }
     for (const [key, field] of Object.entries(section.fields)) {
-      if (!field?.localized || !out[key] || typeof out[key] !== 'object') continue
+      if (!field?.localized || !isLocaleMap(out[key])) continue
       const hit = locales.find((l) => out[key][l] != null)
       if (hit) out[key] = out[key][hit]
       else delete out[key]