@vibes.diy/prompts 2.5.13 → 2.5.15

package/llms/fireproof.md

@@ -420,11 +420,22 @@ export function announcements(doc, oldDoc, user, ctx) {
 
   if (doc.type === "roleGrant") {
     if (!user.isOwner) throw { forbidden: "owner only" };
-    return { members: { [doc.role]: [doc.userHandle] } };
+    // A grant doc must ALSO route to a channel — a result with no `channels`
+    // (only `members`/`grant`) is rejected as an "unreadable write". Route it to
+    // an owner-readable admin channel (not a public one) so the grant persists
+    // and the owner can read the roster back; the membership then applies.
+    return {
+      channels: ["admin:grants"],
+      members: { [doc.role]: [doc.userHandle] },
+      grant: { users: { [user.userHandle]: ["admin:grants"] } },
+    };
   }
 
   if (doc.type === "post") {
     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    // On update, the original author must be preserved — never let a writer
+    // overwrite someone else's doc or reassign its author.
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
     ctx.requireAccess(doc.channel);
     return { channels: [doc.channel] };
   }
@@ -510,9 +521,9 @@ export default function App() {
 
 The pattern: `useVibe().can` gates every write surface — including owner-only management, which the access function enforces via `if (!user.isOwner) throw` so `can.create({ type: "roleGrant", … })` is false for non-owners. `access.hasChannel()` reflects display-only membership, and `isOwner` is a display hint only, never the write gate. The access function is the server-side authority — `useVibe().can` is how the UI reflects its decisions for writes.
 
-### Example: Channel board with restricted channels
+### Example: Channel board with open channels (any member posts)
 
-Some channels are open to all members, others are restricted. The access function decides — the UI uses `access.hasChannel()` to filter which channels to display, and `useVibe().can` to gate writes.
+Channels everyone can read, and any signed-in user can post to. The channel doc is `grant.public` (read for everyone) and the post rule checks only the author — **no `ctx.requireAccess`**, because public is read-only and would block every non-owner. (For a members-only board where the owner appoints who can post, grant a poster role and `requireAccess` it, as in the announcements example above.) The UI uses `access.hasChannel()` to filter which channels to display, and `useVibe().can` to gate writes.
 
 access.js
 
@@ -522,18 +533,19 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "channel") {
     if (!user.isOwner) throw { forbidden: "owner only" };
-    return {
-      channels: [doc._id],
-      grant: {
-        users: { [user.userHandle]: [doc._id] },
-        public: [doc._id],
-      },
-    };
+    // Open channel: public READ for everyone. No write-membership grant is
+    // needed — any signed-in user may post (see the post rule below).
+    return { channels: [doc._id], grant: { public: [doc._id] } };
   }
 
   if (doc.type === "post") {
     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
-    ctx.requireAccess(doc.channel);
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    // Any signed-in author may post to this open channel. Do NOT call
+    // ctx.requireAccess(doc.channel) here: the channel is grant.public
+    // (read-only), which never satisfies requireAccess, so gating on it would
+    // block every non-owner from posting. requireAccess is for members-only
+    // channels whose writers were granted membership (see announcements above).
     return { channels: [doc.channel] };
   }
 
@@ -549,7 +561,9 @@ App.jsx — `access.hasChannel()` filters which channels are visible (display);
 =======
   const { database, useLiveQuery, access } = useFireproof("chat");
   const { docs: channels } = useLiveQuery("type", { key: "channel" });
-  const canPost = useVibe("chat").can.create({ type: "post" });
+  // Build the candidate from the doc you'll write — the access fn checks
+  // authorHandle, so a bare { type: "post" } would be denied and hide the form.
+  const canPost = useVibe("chat").can.create({ type: "post", channel, authorHandle: viewer?.userHandle });
 >>>>>>> REPLACE
 ```
 
@@ -585,9 +599,18 @@ Access functions live in `/access.js`, a separate file in the vibe's filesystem
 
 **Helpers (`ctx`):** Opaque closures over the materialized grant state. They throw or pass — you cannot enumerate channels, list members, or iterate grants. Both helpers also throw when `user` is null: `ctx.requireAccess(channelId)` throws if user is not in the channel, `ctx.requireRole(roleName)` throws if user is not in the role.
 
+**`requireAccess` checks _membership_, not public read — don't gate an open channel's writes on it.** `ctx.requireAccess(channelId)` passes only for a channel the user is a member of: granted directly through `grant.users[handle]`, or through a `grant.roles` role they hold. **`grant.public` does NOT satisfy `requireAccess`** — public is read-only ("anyone through the door can _read_"), it never confers write membership. So a channel that is only `grant.public` and gated on `ctx.requireAccess` can be written by **nobody** but the owner-in-admin-mode — every other write returns `not in channel`, silently hiding the form (`useVibe().can` faithfully reflects this). Choose by intent:
+
+- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author — `if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
+- **Restricted channel — only members may post**: gate the write on `ctx.requireAccess(doc.channelId)` **and** grant writers membership explicitly — `grant.users` (direct) or `grant.roles` + a `members`/role-grant doc. `public` alongside is read-only and is fine for letting non-members read, but it is never what lets a member write.
+
 ### AccessDescriptor return type
 
-All fields are optional, but a stored document must be routed to at least one channel (`channels`) to be readable — a result with no channels is refused at write time. To reject a write outright, `throw { forbidden: "reason" }`.
+All fields are optional, but a stored document must be routed to at least one channel (`channels`) to be readable — a result with no channels is refused at write time ("unreadable write"). To reject a write outright, `throw { forbidden: "reason" }`.
+
+**Grant/member/meta docs need a channel too.** A role grant, membership, or config singleton that returns only `members`/`grant` with **no `channels`** is refused exactly like any other channel-less write — so the owner can't even create it. Route these to an owner-readable **admin channel** (e.g. `channels: ["admin:grants"]` with `grant: { users: { [user.userHandle]: ["admin:grants"] } }`), not a public channel. The `members`/`grant` still take effect globally; the channel just makes the doc persist and lets the owner read the roster back.
+
+**Preserve the author on updates.** For an author-owned doc, checking the new author field is not enough — also check `oldDoc` so a writer can't overwrite someone else's doc or reassign its author: `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw { forbidden: "not author" }`, where `<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …). (Write-once docs can simply `if (oldDoc) throw`.)
 
 ```ts
 type AccessDescriptor = {
@@ -647,12 +670,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    if (oldDoc && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };
   }
 
   if (doc.type === "channel-invite") {
     if (doc.senderHandle !== user.userHandle) throw { forbidden: "not sender" };
+    if (oldDoc && oldDoc.senderHandle !== user.userHandle) throw { forbidden: "not sender" };
     ctx.requireAccess(doc.channelId);
     return {
       channels: [doc.channelId],
@@ -679,11 +704,13 @@ export function survey(doc, oldDoc, user, ctx) {
 
   if (doc.type === "survey-config") {
     if (!user.isOwner) throw { forbidden: "owner only" };
+    // Route this grant/config doc to an owner-readable admin channel — a
+    // grant-only result (no `channels`) is rejected as an "unreadable write".
     return {
+      channels: ["admin:grants"],
       grant: {
-        roles: {
-          "feedback-team": ["inbound-responses"],
-        },
+        users: { [user.userHandle]: ["admin:grants"] },
+        roles: { "feedback-team": ["inbound-responses"] },
       },
     };
   }
@@ -699,6 +726,25 @@ export function survey(doc, oldDoc, user, ctx) {
 
 Key patterns: `allowAnonymous: true` on survey-response lets unauthenticated visitors submit, `grant.public` on final-results makes them readable by any member without a specific channel grant, and the **singleton grant doc** pattern (survey-config) wires role-to-channel access in one place.
 
+### Example: Public guestbook / contact form (anonymous writes)
+
+When the prompt says **anyone can sign / submit without logging in** (a guestbook, a contact form, an RSVP), do **not** throw on `!user` — return `allowAnonymous: true` so the write is accepted for anonymous visitors. `useVibe().can.create(...)` then returns `ok` for an anonymous viewer, and the form shows instead of a sign-in wall. Stamp `authorHandle` only when there is a user.
+
+access.js
+
+```js
+export function guestbook(doc, oldDoc, user, ctx) {
+  if (doc.type === "entry") {
+    if (oldDoc) throw { forbidden: "entries are write-once" };
+    // No `if (!user) throw` — anyone may sign. allowAnonymous opts the write in.
+    return { channels: ["public"], grant: { public: ["public"] }, allowAnonymous: true };
+  }
+  throw { forbidden: "unknown document type" };
+}
+```
+
+In `App.jsx`, gate the form on `useVibe("guestbook").can.create({ type: "entry" }).ok` (true for anon here) and stamp `authorHandle: me?.userHandle` only when signed in. Without `allowAnonymous: true` the runtime rejects the null-user write even though the function didn't throw — so the guestbook would silently require login, the exact miss to avoid.
+
 ### Multiple databases in one file
 
 Each named export gates its own database. A single `/access.js` can gate all databases the app uses:
@@ -775,16 +821,24 @@ export function chat(doc, oldDoc, user, ctx) {
 export function chat(doc, oldDoc, user, ctx) {
   if (!user) throw { forbidden: "authentication required" };
 
+  // Grant/meta docs must also route to a channel — a channel-less result is
+  // rejected as "unreadable write". Route them to an owner-readable admin channel.
   if (doc.type === "team-meta") {
     if (!user.isOwner) throw { forbidden: "owner only" };
     return {
+      channels: ["admin:grants"],
       members: { [doc.teamId]: doc.memberHandles },
-      grant: { roles: { [doc.teamId]: doc.channels } },
+      grant: { users: { [user.userHandle]: ["admin:grants"] }, roles: { [doc.teamId]: doc.channels } },
     };
   }
 
   if (doc.type === "membership") {
-    return { members: { [doc.role]: [doc.userHandle] } };
+    if (!user.isOwner) throw { forbidden: "owner only" };
+    return {
+      channels: ["admin:grants"],
+      members: { [doc.role]: [doc.userHandle] },
+      grant: { users: { [user.userHandle]: ["admin:grants"] } },
+    };
   }
 
   ctx.requireAccess(doc.channelId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "2.5.13",
+  "version": "2.5.15",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -30,9 +30,9 @@
     "@fireproof/core-types-base": "~0.24.19",
     "@fireproof/core-types-protocols-cloud": "~0.24.19",
     "@fireproof/use-fireproof": "~0.24.19",
-    "@vibes.diy/call-ai-v2": "^2.5.13",
-    "@vibes.diy/identity": "^2.5.13",
-    "@vibes.diy/use-vibes-types": "^2.5.13",
+    "@vibes.diy/call-ai-v2": "^2.5.15",
+    "@vibes.diy/identity": "^2.5.15",
+    "@vibes.diy/use-vibes-types": "^2.5.15",
     "arktype": "~2.2.1",
     "json-schema-faker": "~0.6.2"
   },

package/system-prompt-initial.md

@@ -51,29 +51,32 @@ Target ~40–60 lines. The shell should look like a real app with empty sections
 
 **Step 3 — Feature edits.** Wire each feature with SEARCH/REPLACE edits. Each edit gets exactly one prose line (≤25 words) before it. Wire hooks, data, handlers, and `useFireproof` with `access` in these edits. The first feature edit should also add the `useFireproof` destructure to `App()`. Keep edits focused — one feature per edit, fully working after it lands.
 
-> Access function — owner manages channels, authenticated users post to channels they have access to.
+> Access function — owner manages channels; any signed-in member posts to these open channels.
 >
 > access.js
 >
 > ```js
-> // Each channel doc grants public read access to that channel.
-> // Posts require channel access — the server enforces this via ctx.requireAccess.
-> // Only the owner can create channels.
+> // Each channel doc grants public READ; only the owner creates channels.
+> // OPEN board: any signed-in user posts — do NOT gate posts on ctx.requireAccess
+> // (grant.public is read-only and never satisfies it, so it would block everyone
+> // but the owner). Members-only channel instead? grant a role + requireAccess it.
 > export function chat(doc, oldDoc, user, ctx) {
 >   if (!user) throw { forbidden: "sign in" };
 >   if (doc.type === "channel") {
 >     if (!user.isOwner) throw { forbidden: "owner only" };
->     return { channels: [doc.name], grant: { public: [doc.name] } };
+>     return { channels: [doc._id], grant: { public: [doc._id] } };
 >   }
 >   if (doc.type === "message") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
->     ctx.requireAccess(doc.channelId);
+>     if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     return { channels: [doc.channelId] };
 >   }
 >   throw { forbidden: "unknown document type" };
 > }
 > ```
 
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open channel anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member doc must also return `channels` (route it to an owner-readable admin channel) — a channel-less result is rejected. On updates, also check the old author field (`oldDoc.authorHandle`/`userHandle`/`senderHandle`) so a writer can't overwrite or re-author someone else's doc.
+
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 
 After the final edit (and `access.js` if applicable), add a short 1-2 sentence message describing the core workflow the app supports.

package/system-prompt.md

@@ -275,6 +275,7 @@ When the app uses channel-based read isolation or per-document write validation,
 >   if (!user) throw { forbidden: "authentication required" };
 >   if (doc.type === "message") {
 >     if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+>     if (oldDoc && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
 >     ctx.requireAccess(doc.channelId);
 >     return { channels: [doc.channelId] };
 >   }
@@ -282,6 +283,8 @@ When the app uses channel-based read isolation or per-document write validation,
 > }
 > ```
 
+`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates, also check `oldDoc` (`if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) so a writer can't overwrite or re-author someone else's doc. See the fireproof access docs.
+
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 
 ## Your starter scaffold
@@ -396,29 +399,30 @@ Example streamed output for a team board app:
 > }
 > ```
 >
-> Access function — owner manages channels, members post to channels they have access to.
+> Access function — owner manages channels; any signed-in member posts to these open channels.
 >
 > access.js
 >
 > ```js
-> // Each channel doc grants public read access to that channel.
-> // Posts require channel access — the server enforces this via ctx.requireAccess.
-> // Only the owner can create channels or grant roles.
+> // Each channel doc grants public READ to that channel; only the owner creates channels.
+> // OPEN board: any signed-in user posts. Do NOT gate posts on ctx.requireAccess —
+> // grant.public is read-only and never satisfies it, so it would block every
+> // non-owner. (Members-only channel instead? grant a role + requireAccess it.)
 > export function crewBoard(doc, oldDoc, user, ctx) {
 >   if (!user) throw { forbidden: "sign in" };
 >
 >   if (doc.type === "channel") {
 >     if (!user.isOwner) throw { forbidden: "owner only" };
->     return { channels: [doc.name], grant: { public: [doc.name] } };
+>     return { channels: [doc._id], grant: { public: [doc._id] } };
 >   }
 >
 >   if (doc.type === "post") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
->     ctx.requireAccess(doc.channelId);
+>     if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     return { channels: [doc.channelId] };
 >   }
 >
->   return {};
+>   throw { forbidden: "unknown document type" };
 > }
 > ```
 >