@vibes.diy/prompts 2.5.14 → 2.5.16

package/llms/fireproof.md

@@ -420,11 +420,22 @@ export function announcements(doc, oldDoc, user, ctx) {
 
   if (doc.type === "roleGrant") {
     if (!user.isOwner) throw { forbidden: "owner only" };
-    return { members: { [doc.role]: [doc.userHandle] } };
+    // A grant doc must ALSO route to a channel — a result with no `channels`
+    // (only `members`/`grant`) is rejected as an "unreadable write". Route it to
+    // an owner-readable admin channel (not a public one) so the grant persists
+    // and the owner can read the roster back; the membership then applies.
+    return {
+      channels: ["admin:grants"],
+      members: { [doc.role]: [doc.userHandle] },
+      grant: { users: { [user.userHandle]: ["admin:grants"] } },
+    };
   }
 
   if (doc.type === "post") {
     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    // On update, the original author must be preserved — never let a writer
+    // overwrite someone else's doc or reassign its author.
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
     ctx.requireAccess(doc.channel);
     return { channels: [doc.channel] };
   }
@@ -510,6 +521,35 @@ export default function App() {
 
 The pattern: `useVibe().can` gates every write surface — including owner-only management, which the access function enforces via `if (!user.isOwner) throw` so `can.create({ type: "roleGrant", … })` is false for non-owners. `access.hasChannel()` reflects display-only membership, and `isOwner` is a display hint only, never the write gate. The access function is the server-side authority — `useVibe().can` is how the UI reflects its decisions for writes.
 
+**Owner-management panels (appoint/revoke moderators, grant/revoke roles) gate on `can.*`, not `isOwner`.** It's tempting to wrap an admin panel in `{isOwner && <ModeratorPanel />}` and have its buttons call `database.put`/`database.del` directly. Don't let `isOwner` be what decides a write — it's the same display hint as everywhere else. Gate each mutating control on the verdict from the doc you'll actually write — appoint on `can.create({ type: "modGrant", role: "moderator", userHandle }).ok`, revoke on `can.delete(grantDoc).ok` — and render `.reason` when denied. `can.*` runs the app's own `access.js` to produce the verdict, so the control's enabled state and message track what the access function decides and stay correct as it grows beyond owner-only (a delegated admin role, say). Gate the panel's *visibility* on those same verdicts too, not `isOwner` alone — otherwise a delegated admin the access function now allows never reaches the controls or their reason.
+
+```jsx
+// Don't: isOwner decides visibility AND the writes are ungated — a non-owner the
+// access function would allow never reaches the controls, and isOwner drifts from access.js
+{isOwner && (
+  <ModeratorPanel>
+    <button onClick={() => database.put({ type: "modGrant", role: "moderator", userHandle })}>Appoint</button>
+    <button onClick={() => database.del(grantDoc._id)}>Revoke</button>
+  </ModeratorPanel>
+)}
+
+// Do: can.* decides visibility AND gates each write, and supplies the denial reason
+const canAppoint = can.create({ type: "modGrant", role: "moderator", userHandle });
+const canRevoke = can.delete(grantDoc);
+{(canAppoint.ok || canRevoke.ok) && (
+  <ModeratorPanel>
+    {canAppoint.ok && (
+      <button onClick={() => database.put({ type: "modGrant", role: "moderator", userHandle })}>Appoint</button>
+    )}
+    {canRevoke.ok ? (
+      <button onClick={() => database.del(grantDoc._id)}>Revoke</button>
+    ) : (
+      <p>{canRevoke.reason}</p>
+    )}
+  </ModeratorPanel>
+)}
+```
+
 ### Example: Channel board with open channels (any member posts)
 
 Channels everyone can read, and any signed-in user can post to. The channel doc is `grant.public` (read for everyone) and the post rule checks only the author — **no `ctx.requireAccess`**, because public is read-only and would block every non-owner. (For a members-only board where the owner appoints who can post, grant a poster role and `requireAccess` it, as in the announcements example above.) The UI uses `access.hasChannel()` to filter which channels to display, and `useVibe().can` to gate writes.
@@ -529,6 +569,7 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "post") {
     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+    if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
     // Any signed-in author may post to this open channel. Do NOT call
     // ctx.requireAccess(doc.channel) here: the channel is grant.public
     // (read-only), which never satisfies requireAccess, so gating on it would
@@ -589,12 +630,16 @@ Access functions live in `/access.js`, a separate file in the vibe's filesystem
 
 **`requireAccess` checks _membership_, not public read — don't gate an open channel's writes on it.** `ctx.requireAccess(channelId)` passes only for a channel the user is a member of: granted directly through `grant.users[handle]`, or through a `grant.roles` role they hold. **`grant.public` does NOT satisfy `requireAccess`** — public is read-only ("anyone through the door can _read_"), it never confers write membership. So a channel that is only `grant.public` and gated on `ctx.requireAccess` can be written by **nobody** but the owner-in-admin-mode — every other write returns `not in channel`, silently hiding the form (`useVibe().can` faithfully reflects this). Choose by intent:
 
-- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author — `if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
+- **Open channel — any signed-in user may post** (public board, guestbook, comment wall): do **not** call `ctx.requireAccess`. Route the doc to the channel and check the author — `if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" }; return { channels: [doc.channelId] }`. `grant.public` on the channel doc gives everyone read; the write is open to any author.
 - **Restricted channel — only members may post**: gate the write on `ctx.requireAccess(doc.channelId)` **and** grant writers membership explicitly — `grant.users` (direct) or `grant.roles` + a `members`/role-grant doc. `public` alongside is read-only and is fine for letting non-members read, but it is never what lets a member write.
 
 ### AccessDescriptor return type
 
-All fields are optional, but a stored document must be routed to at least one channel (`channels`) to be readable — a result with no channels is refused at write time. To reject a write outright, `throw { forbidden: "reason" }`.
+All fields are optional, but a stored document must be routed to at least one channel (`channels`) to be readable — a result with no channels is refused at write time ("unreadable write"). To reject a write outright, `throw { forbidden: "reason" }`.
+
+**Grant/member/meta docs need a channel too.** A role grant, membership, or config singleton that returns only `members`/`grant` with **no `channels`** is refused exactly like any other channel-less write — so the owner can't even create it. Route these to an owner-readable **admin channel** (e.g. `channels: ["admin:grants"]` with `grant: { users: { [user.userHandle]: ["admin:grants"] } }`), not a public channel. The `members`/`grant` still take effect globally; the channel just makes the doc persist and lets the owner read the roster back.
+
+**Preserve the author on updates.** For an author-owned doc, checking the new author field is not enough — also check `oldDoc` so a writer can't overwrite someone else's doc or reassign its author: `if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw { forbidden: "not author" }`, where `<authorField>` is whatever your doc uses (`authorHandle`, `userHandle`, `senderHandle`, …). (Write-once docs can simply `if (oldDoc) throw`.)
 
 ```ts
 type AccessDescriptor = {
@@ -654,12 +699,14 @@ export function chat(doc, oldDoc, user, ctx) {
 
   if (doc.type === "message") {
     if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+    if (oldDoc && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
     ctx.requireAccess(doc.channelId);
     return { channels: [doc.channelId] };
   }
 
   if (doc.type === "channel-invite") {
     if (doc.senderHandle !== user.userHandle) throw { forbidden: "not sender" };
+    if (oldDoc && oldDoc.senderHandle !== user.userHandle) throw { forbidden: "not sender" };
     ctx.requireAccess(doc.channelId);
     return {
       channels: [doc.channelId],
@@ -686,11 +733,13 @@ export function survey(doc, oldDoc, user, ctx) {
 
   if (doc.type === "survey-config") {
     if (!user.isOwner) throw { forbidden: "owner only" };
+    // Route this grant/config doc to an owner-readable admin channel — a
+    // grant-only result (no `channels`) is rejected as an "unreadable write".
     return {
+      channels: ["admin:grants"],
       grant: {
-        roles: {
-          "feedback-team": ["inbound-responses"],
-        },
+        users: { [user.userHandle]: ["admin:grants"] },
+        roles: { "feedback-team": ["inbound-responses"] },
       },
     };
   }
@@ -801,16 +850,24 @@ export function chat(doc, oldDoc, user, ctx) {
 export function chat(doc, oldDoc, user, ctx) {
   if (!user) throw { forbidden: "authentication required" };
 
+  // Grant/meta docs must also route to a channel — a channel-less result is
+  // rejected as "unreadable write". Route them to an owner-readable admin channel.
   if (doc.type === "team-meta") {
     if (!user.isOwner) throw { forbidden: "owner only" };
     return {
+      channels: ["admin:grants"],
       members: { [doc.teamId]: doc.memberHandles },
-      grant: { roles: { [doc.teamId]: doc.channels } },
+      grant: { users: { [user.userHandle]: ["admin:grants"] }, roles: { [doc.teamId]: doc.channels } },
     };
   }
 
   if (doc.type === "membership") {
-    return { members: { [doc.role]: [doc.userHandle] } };
+    if (!user.isOwner) throw { forbidden: "owner only" };
+    return {
+      channels: ["admin:grants"],
+      members: { [doc.role]: [doc.userHandle] },
+      grant: { users: { [user.userHandle]: ["admin:grants"] } },
+    };
   }
 
   ctx.requireAccess(doc.channelId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibes.diy/prompts",
-  "version": "2.5.14",
+  "version": "2.5.16",
   "type": "module",
   "main": "./index.js",
   "description": "",
@@ -30,9 +30,9 @@
     "@fireproof/core-types-base": "~0.24.19",
     "@fireproof/core-types-protocols-cloud": "~0.24.19",
     "@fireproof/use-fireproof": "~0.24.19",
-    "@vibes.diy/call-ai-v2": "^2.5.14",
-    "@vibes.diy/identity": "^2.5.14",
-    "@vibes.diy/use-vibes-types": "^2.5.14",
+    "@vibes.diy/call-ai-v2": "^2.5.16",
+    "@vibes.diy/identity": "^2.5.16",
+    "@vibes.diy/use-vibes-types": "^2.5.16",
     "arktype": "~2.2.1",
     "json-schema-faker": "~0.6.2"
   },

package/system-prompt-initial.md

@@ -68,13 +68,14 @@ Target ~40–60 lines. The shell should look like a real app with empty sections
 >   }
 >   if (doc.type === "message") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+>     if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     return { channels: [doc.channelId] };
 >   }
 >   throw { forbidden: "unknown document type" };
 > }
 > ```
 
-`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open channel anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`.
+`ctx.requireAccess(channel)` gates on **membership** (a `grant.users`/`grant.roles` grant), not `grant.public` (read-only) — so an open channel anyone signed-in may post to must not gate writes on it; check the author and route the doc. For writes needing no sign-in ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member doc must also return `channels` (route it to an owner-readable admin channel) — a channel-less result is rejected. On updates, also check the old author field (`oldDoc.authorHandle`/`userHandle`/`senderHandle`) so a writer can't overwrite or re-author someone else's doc.
 
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 

package/system-prompt.md

@@ -275,6 +275,7 @@ When the app uses channel-based read isolation or per-document write validation,
 >   if (!user) throw { forbidden: "authentication required" };
 >   if (doc.type === "message") {
 >     if (doc.userHandle !== user.userHandle) throw { forbidden: "not author" };
+>     if (oldDoc && oldDoc.userHandle !== user.userHandle) throw { forbidden: "not author" };
 >     ctx.requireAccess(doc.channelId);
 >     return { channels: [doc.channelId] };
 >   }
@@ -282,7 +283,7 @@ When the app uses channel-based read isolation or per-document write validation,
 > }
 > ```
 
-`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. See the fireproof access docs.
+`ctx.requireAccess(channel)` gates on channel **membership** (a `grant.users`/`grant.roles` grant), NOT on `grant.public`, which is read-only — so a channel anyone signed-in should post to must **not** gate writes on `requireAccess` (it would block every non-owner); just check the author and route the doc. Reserve `requireAccess` for members-only channels whose writers you granted membership. For writes that need no sign-in at all ("anyone can sign/submit"), return `allowAnonymous: true` instead of throwing on `!user`. A grant/member/role doc must also return `channels` (route it to an owner-readable admin channel like `["admin:grants"]`) — a channel-less result is rejected as "unreadable write". On updates, also check `oldDoc` (`if (oldDoc && oldDoc.<authorField> !== user.userHandle) throw`, where `<authorField>` is your doc's author field — `authorHandle`/`userHandle`/`senderHandle`) so a writer can't overwrite or re-author someone else's doc. See the fireproof access docs.
 
 **Never put access function code inside an `App.jsx` block** — it will overwrite the React component. The filename line (`access.js` vs `App.jsx`) is how the system knows which file to write.
 
@@ -417,6 +418,7 @@ Example streamed output for a team board app:
 >
 >   if (doc.type === "post") {
 >     if (doc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
+>     if (oldDoc && oldDoc.authorHandle !== user.userHandle) throw { forbidden: "not author" };
 >     return { channels: [doc.channelId] };
 >   }
 >