@vibes.diy/prompts 2.5.13 → 2.5.14

package/llms/fireproof.md

@@ -510,9 +510,9 @@ export default function App() {
 
 The pattern: `useVibe().can` gates every write surface — including owner-only management, which the access function enforces via `if (!user.isOwner) throw` so `can.create({ type: "roleGrant", … })` is false for non-owners. `access.hasChannel()` reflects display-only membership, and `isOwner` is a display hint only, never the write gate. The access function is the server-side authority — `useVibe().can` is how the UI reflects its decisions for writes.
 
-### Example: Channel board with restricted channels
+### Example: Channel board with open channels (any member posts)
 
-Some channels are open to all members, others are restricted. The access function decides — the UI uses `access.hasChannel()` to filter which channels to display, and `useVibe().can` to gate writes.
+Channels everyone can read, and any signed-in user can post to. The channel doc is `grant.public` (read for everyone) and the post rule checks only the author — **no `ctx.requireAccess`**, because public is read-only and would block every non-owner. (For a members-only board where the owner appoints who can post, grant a poster role and `requireAccess` it, as in the announcements example above.) The UI uses `access.hasChannel()` to filter which channels to display, and `useVibe().can` to gate writes.
 
 access.js
 
@@ -522,18 +522,18 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "channel") {
     if (!user.isOwner) throw { forbidden: "owner only" };
-    return {
-      channels: [doc._id],
-      grant: {
-        users: { [user.userHandle]: [doc._id] },
-        public: [doc._id],
-      },
-    };
+    // Open channel: public READ for everyone. No write-membership grant is
+    // needed — any signed-in user may post (see the post rule below).
+    return { channels: [doc._id], grant: { public: [doc._id] } };
   }
 
   if (doc.type === "post") {
     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    ctx.requireAccess(doc.channel);
+    // Any signed-in author may post to this open channel. Do NOT call
+    // ctx.requireAccess(doc.channel) here: the channel is grant.public
+    // (read-only), which never satisfies requireAccess, so gating on it would
+    // block every non-owner from posting. requireAccess is for members-only
+    // channels whose writers were granted membership (see announcements above).
     return { channels: [doc.channel] };
   }
 
@@ -549,7 +549,9 @@ App.jsx — `access.hasChannel()` filters which channels are visible (display);
 =======
   const { database, useLiveQuery, access } = useFireproof("chat");
   const { docs: channels } = useLiveQuery("type", { key: "channel" });
-  const canPost = useVibe("chat").can.create({ type: "post" });
+  // Build the candidate from the doc you'll write — the access fn checks
+  // authorHandle, so a bare { type: "post" } would be denied and hide the form.
+  const canPost = useVibe("chat").can.create({ type: "post", channel, authorHandle: viewer?.userHandle });
 >>>>>>> REPLACE
 ```
 
@@ -585,6 +587,11 @@ Access functions live in `/access.js`, a separate file in the vibe's filesystem
 
 **Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. Both helpers also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role.
 
+**`requireAccess` checks _membership_, not public read — don't gate an open channel's writes on it.** `ctx.requireAccess(channelId)` passes only for a channel the user is a member of: granted directly through `grant.users[handle]`, or through a `grant.roles` role they hold. **`grant.public` does NOT satisfy `requireAccess`** — public is read-only ("anyone through the door can _read_"), it never confers write membership. So a channel that is only `grant.public` and gated on `ctx.requireAccess` can be written by **nobody** but the owner-in-admin-mode — every other write returns `not in channel`, silently hiding the form (`useVibe().can` faithfully reflects this). Choose by intent:
+
+- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author — `if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
+- **Restricted channel — only members may post**: gate the write on `ctx.requireAccess(doc.channelId)` **and** grant writers membership explicitly — `grant.users` (direct) or `grant.roles` + a `members`/role-grant doc. `public` alongside is read-only and is fine for letting non-members read, but it is never what lets a member write.
+
 ### AccessDescriptor return type
 
 All fields are optional, but a stored document must be routed to at least one channel (`channels`) to be readable — a result with no channels is refused at write time. To reject a write outright, `throw { forbidden: "reason" }`.
@@ -699,6 +706,25 @@ export function survey(doc, oldDoc, user, ctx) {
 
 Key patterns: `allowAnonymous: true` on survey-response lets unauthenticated visitors submit, `grant.public` on final-results makes them readable by any member without a specific channel grant, and the **singleton grant doc** pattern (survey-config) wires role-to-channel access in one place.
 
+### Example: Public guestbook / contact form (anonymous writes)
+
+When the prompt says **anyone can sign / submit without logging in** (a guestbook, a contact form, an RSVP), do **not** throw on `!user` — return `allowAnonymous: true` so the write is accepted for anonymous visitors. `useVibe().can.create(...)` then returns `ok` for an anonymous viewer, and the form shows instead of a sign-in wall. Stamp `authorHandle` only when there is a user.
+
+access.js
+
+```js
+export function guestbook(doc, oldDoc, user, ctx) {
+  if (doc.type === "entry") {
+    if (oldDoc) throw { forbidden: "entries are write-once" };
+    // No `if (!user) throw` — anyone may sign. allowAnonymous opts the write in.
+    return { channels: ["public"], grant: { public: ["public"] }, allowAnonymous: true };
+  }
+  throw { forbidden: "unknown document type" };
+}
+```
+
+In `App.jsx`, gate the form on `useVibe("guestbook").can.create({ type: "entry" }).ok` (true for anon here) and stamp `authorHandle: me?.userHandle` only when signed in. Without `allowAnonymous: true` the runtime rejects the null-user write even though the function didn't throw — so the guestbook would silently require login, the exact miss to avoid.
+
 ### Multiple databases in one file
 
 Each named export gates its own database. A single `/access.js` can gate all databases the app uses:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "2.5.13",
+  "version": "2.5.14",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -30,9 +30,9 @@
     "@fireproof/core-types-base": "~0.24.19",
     "@fireproof/core-types-protocols-cloud": "~0.24.19",
     "@fireproof/use-fireproof": "~0.24.19",
-    "@vibes.diy/call-ai-v2": "^2.5.13",
-    "@vibes.diy/identity": "^2.5.13",
-    "@vibes.diy/use-vibes-types": "^2.5.13",
+    "@vibes.diy/call-ai-v2": "^2.5.14",
+    "@vibes.diy/identity": "^2.5.14",
+    "@vibes.diy/use-vibes-types": "^2.5.14",
     "arktype": "~2.2.1",
     "json-schema-faker": "~0.6.2"
   },

package/system-prompt-initial.md

@@ -51,29 +51,31 @@ Target ~40–60 lines. The shell should look like a real app with empty sections
 
 **Step 3 — Feature edits.** Wire each feature with SEARCH/REPLACE edits. Each edit gets exactly one prose line (≤25 words) before it. Wire hooks, data, handlers, and `useFireproof` with `access` in these edits. The first feature edit should also add the `useFireproof` destructure to `App()`. Keep edits focused — one feature per edit, fully working after it lands.
 
-> Access function — owner manages channels, authenticated users post to channels they have access to.
+> Access function — owner manages channels; any signed-in member posts to these open channels.
 >
 > access.js
 >
 > ```js
-> // Each channel doc grants public read access to that channel.
-> // Posts require channel access — the server enforces this via ctx.requireAccess.
-> // Only the owner can create channels.
+> // Each channel doc grants public READ; only the owner creates channels.
+> // OPEN board: any signed-in user posts — do NOT gate posts on ctx.requireAccess
+> // (grant.public is read-only and never satisfies it, so it would block everyone
+> // but the owner). Members-only channel instead? grant a role + requireAccess it.
 > export function chat(doc, oldDoc, user, ctx) {
 >   if (!user) throw { forbidden: "sign in" };
 >   if (doc.type === "channel") {
 >     if (!user.isOwner) throw { forbidden: "owner only" };
->     return { channels: [doc.name], grant: { public: [doc.name] } };
+>     return { channels: [doc._id], grant: { public: [doc._id] } };
 >   }
 >   if (doc.type === "message") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
->     ctx.requireAccess(doc.channelId);
 >     return { channels: [doc.channelId] };
 >   }
 >   throw { forbidden: "unknown document type" };
 > }
 > ```
 
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open channel anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`.
+
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 
 After the final edit (and `access.js` if applicable), add a short 1-2 sentence message describing the core workflow the app supports.

package/system-prompt.md

@@ -282,6 +282,8 @@ When the app uses channel-based read isolation or per-document write validation,
 > }
 > ```
 
+`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. See the fireproof access docs.
+
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 
 ## Your starter scaffold
@@ -396,29 +398,29 @@ Example streamed output for a team board app:
 > }
 > ```
 >
-> Access function — owner manages channels, members post to channels they have access to.
+> Access function — owner manages channels; any signed-in member posts to these open channels.
 >
 > access.js
 >
 > ```js
-> // Each channel doc grants public read access to that channel.
-> // Posts require channel access — the server enforces this via ctx.requireAccess.
-> // Only the owner can create channels or grant roles.
+> // Each channel doc grants public READ to that channel; only the owner creates channels.
+> // OPEN board: any signed-in user posts. Do NOT gate posts on ctx.requireAccess —
+> // grant.public is read-only and never satisfies it, so it would block every
+> // non-owner. (Members-only channel instead? grant a role + requireAccess it.)
 > export function crewBoard(doc, oldDoc, user, ctx) {
 >   if (!user) throw { forbidden: "sign in" };
 >
 >   if (doc.type === "channel") {
 >     if (!user.isOwner) throw { forbidden: "owner only" };
->     return { channels: [doc.name], grant: { public: [doc.name] } };
+>     return { channels: [doc._id], grant: { public: [doc._id] } };
 >   }
 >
 >   if (doc.type === "post") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
->     ctx.requireAccess(doc.channelId);
 >     return { channels: [doc.channelId] };
 >   }
 >
->   return {};
+>   throw { forbidden: "unknown document type" };
 > }
 > ```
 >