@webiny/app-admin 0.0.0-unstable.a4f3e4ea8b → 0.0.0-unstable.a85ef555b2

package/features/featureFlags/FeatureFlagsService.js

@@ -0,0 +1,64 @@
+import { makeAutoObservable, runInAction } from "mobx";
+import { createImplementation } from "@webiny/di";
+import { LocalStorage } from "@webiny/app/features/localStorage";
+import { FeatureFlags } from "@webiny/feature-flags";
+import { FeatureFlagsGateway, FeatureFlagsService } from "./abstractions.js";
+const LOCAL_STORAGE_KEY = "featureFlags";
+class FeatureFlagsServiceImpl {
+    constructor(gateway, localStorage){
+        this.gateway = gateway;
+        this.localStorage = localStorage;
+        this.flags = new FeatureFlags({});
+        this.loaded = false;
+        makeAutoObservable(this, {}, {
+            autoBind: true
+        });
+        this.initializeFromLocalStorage();
+    }
+    initializeFromLocalStorage() {
+        try {
+            const cached = this.localStorage.get(LOCAL_STORAGE_KEY);
+            if (cached) {
+                this.flags = FeatureFlags.fromDto(cached);
+                this.loaded = true;
+            }
+        } catch (error) {
+            console.warn("Failed to load feature flags from localStorage:", error);
+        }
+        this.loadFlags();
+    }
+    getFlags() {
+        return this.flags;
+    }
+    isLoaded() {
+        return this.loaded;
+    }
+    async loadFlags() {
+        try {
+            const data = await this.gateway.fetchFlags();
+            const dto = data ?? {};
+            const flags = FeatureFlags.fromDto(dto);
+            runInAction(()=>{
+                this.flags = flags;
+                this.loaded = true;
+            });
+            this.localStorage.set(LOCAL_STORAGE_KEY, dto);
+        } catch (error) {
+            console.error("Failed to load feature flags:", error);
+            runInAction(()=>{
+                this.loaded = true;
+            });
+        }
+    }
+}
+const FeatureFlagsService_FeatureFlagsService = createImplementation({
+    abstraction: FeatureFlagsService,
+    implementation: FeatureFlagsServiceImpl,
+    dependencies: [
+        FeatureFlagsGateway,
+        LocalStorage
+    ]
+});
+export { FeatureFlagsService_FeatureFlagsService as FeatureFlagsService };
+
+//# sourceMappingURL=FeatureFlagsService.js.map

package/features/featureFlags/FeatureFlagsService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/featureFlags/FeatureFlagsService.js","sources":["../../../src/features/featureFlags/FeatureFlagsService.ts"],"sourcesContent":["import { makeAutoObservable, runInAction } from \"mobx\";\nimport { createImplementation } from \"@webiny/di\";\nimport { LocalStorage } from \"@webiny/app/features/localStorage\";\nimport { FeatureFlags } from \"@webiny/feature-flags\";\nimport type { IFeatureFlagsDto } from \"@webiny/feature-flags\";\nimport { FeatureFlagsService as Abstraction, FeatureFlagsGateway } from \"./abstractions.js\";\n\nconst LOCAL_STORAGE_KEY = \"featureFlags\";\n\nclass FeatureFlagsServiceImpl implements Abstraction.Interface {\n    private flags: FeatureFlags = new FeatureFlags({});\n    private loaded = false;\n\n    constructor(\n        private gateway: FeatureFlagsGateway.Interface,\n        private localStorage: LocalStorage.Interface\n    ) {\n        makeAutoObservable(this, {}, { autoBind: true });\n        this.initializeFromLocalStorage();\n    }\n\n    private initializeFromLocalStorage(): void {\n        try {\n            const cached = this.localStorage.get<IFeatureFlagsDto>(LOCAL_STORAGE_KEY);\n            if (cached) {\n                this.flags = FeatureFlags.fromDto(cached);\n                this.loaded = true;\n            }\n        } catch (error) {\n            console.warn(\"Failed to load feature flags from localStorage:\", error);\n        }\n\n        this.loadFlags();\n    }\n\n    getFlags(): FeatureFlags {\n        return this.flags;\n    }\n\n    isLoaded(): boolean {\n        return this.loaded;\n    }\n\n    async loadFlags(): Promise<void> {\n        try {\n            const data = await this.gateway.fetchFlags();\n            const dto = data ?? {};\n            const flags = FeatureFlags.fromDto(dto);\n\n            runInAction(() => {\n                this.flags = flags;\n                this.loaded = true;\n            });\n\n            this.localStorage.set(LOCAL_STORAGE_KEY, dto);\n        } catch (error) {\n            console.error(\"Failed to load feature flags:\", error);\n            runInAction(() => {\n                this.loaded = true;\n            });\n        }\n    }\n}\n\nexport const FeatureFlagsService = createImplementation({\n    abstraction: Abstraction,\n    implementation: FeatureFlagsServiceImpl,\n    dependencies: [FeatureFlagsGateway, LocalStorage]\n});\n"],"names":["LOCAL_STORAGE_KEY","FeatureFlagsServiceImpl","gateway","localStorage","FeatureFlags","makeAutoObservable","cached","error","console","data","dto","flags","runInAction","FeatureFlagsService","createImplementation","Abstraction","FeatureFlagsGateway","LocalStorage"],"mappings":";;;;;AAOA,MAAMA,oBAAoB;AAE1B,MAAMC;IAIF,YACYC,OAAsC,EACtCC,YAAoC,CAC9C;aAFUD,OAAO,GAAPA;aACAC,YAAY,GAAZA;aALJ,KAAK,GAAiB,IAAIC,aAAa,CAAC;aACxC,MAAM,GAAG;QAMbC,mBAAmB,IAAI,EAAE,CAAC,GAAG;YAAE,UAAU;QAAK;QAC9C,IAAI,CAAC,0BAA0B;IACnC;IAEQ,6BAAmC;QACvC,IAAI;YACA,MAAMC,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAmBN;YACvD,IAAIM,QAAQ;gBACR,IAAI,CAAC,KAAK,GAAGF,aAAa,OAAO,CAACE;gBAClC,IAAI,CAAC,MAAM,GAAG;YAClB;QACJ,EAAE,OAAOC,OAAO;YACZC,QAAQ,IAAI,CAAC,mDAAmDD;QACpE;QAEA,IAAI,CAAC,SAAS;IAClB;IAEA,WAAyB;QACrB,OAAO,IAAI,CAAC,KAAK;IACrB;IAEA,WAAoB;QAChB,OAAO,IAAI,CAAC,MAAM;IACtB;IAEA,MAAM,YAA2B;QAC7B,IAAI;YACA,MAAME,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU;YAC1C,MAAMC,MAAMD,QAAQ,CAAC;YACrB,MAAME,QAAQP,aAAa,OAAO,CAACM;YAEnCE,YAAY;gBACR,IAAI,CAAC,KAAK,GAAGD;gBACb,IAAI,CAAC,MAAM,GAAG;YAClB;YAEA,IAAI,CAAC,YAAY,CAAC,GAAG,CAACX,mBAAmBU;QAC7C,EAAE,OAAOH,OAAO;YACZC,QAAQ,KAAK,CAAC,iCAAiCD;YAC/CK,YAAY;gBACR,IAAI,CAAC,MAAM,GAAG;YAClB;QACJ;IACJ;AACJ;AAEO,MAAMC,0CAAsBC,qBAAqB;IACpD,aAAaC;IACb,gBAAgBd;IAChB,cAAc;QAACe;QAAqBC;KAAa;AACrD"}

package/features/featureFlags/abstractions.d.ts

@@ -0,0 +1,19 @@
+import { Abstraction } from "@webiny/di";
+import type { IFeatureFlagsDto } from "@webiny/feature-flags";
+import { FeatureFlags } from "@webiny/feature-flags";
+export interface IFeatureFlagsGateway {
+    fetchFlags(): Promise<IFeatureFlagsDto | null>;
+}
+export declare const FeatureFlagsGateway: Abstraction<IFeatureFlagsGateway>;
+export declare namespace FeatureFlagsGateway {
+    type Interface = IFeatureFlagsGateway;
+}
+export interface IFeatureFlagsService {
+    getFlags(): FeatureFlags;
+    isLoaded(): boolean;
+    loadFlags(): Promise<void>;
+}
+export declare const FeatureFlagsService: Abstraction<IFeatureFlagsService>;
+export declare namespace FeatureFlagsService {
+    type Interface = IFeatureFlagsService;
+}

package/features/featureFlags/abstractions.js

@@ -0,0 +1,6 @@
+import { Abstraction } from "@webiny/di";
+const FeatureFlagsGateway = new Abstraction("FeatureFlagsGateway");
+const FeatureFlagsService = new Abstraction("FeatureFlagsService");
+export { FeatureFlagsGateway, FeatureFlagsService };
+
+//# sourceMappingURL=abstractions.js.map

package/features/featureFlags/abstractions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/featureFlags/abstractions.js","sources":["../../../src/features/featureFlags/abstractions.ts"],"sourcesContent":["import { Abstraction } from \"@webiny/di\";\nimport type { IFeatureFlagsDto } from \"@webiny/feature-flags\";\nimport { FeatureFlags } from \"@webiny/feature-flags\";\n\nexport interface IFeatureFlagsGateway {\n    fetchFlags(): Promise<IFeatureFlagsDto | null>;\n}\n\nexport const FeatureFlagsGateway = new Abstraction<IFeatureFlagsGateway>(\"FeatureFlagsGateway\");\n\nexport namespace FeatureFlagsGateway {\n    export type Interface = IFeatureFlagsGateway;\n}\n\nexport interface IFeatureFlagsService {\n    getFlags(): FeatureFlags;\n    isLoaded(): boolean;\n    loadFlags(): Promise<void>;\n}\n\nexport const FeatureFlagsService = new Abstraction<IFeatureFlagsService>(\"FeatureFlagsService\");\n\nexport namespace FeatureFlagsService {\n    export type Interface = IFeatureFlagsService;\n}\n"],"names":["FeatureFlagsGateway","Abstraction","FeatureFlagsService"],"mappings":";AAQO,MAAMA,sBAAsB,IAAIC,YAAkC;AAYlE,MAAMC,sBAAsB,IAAID,YAAkC"}

package/features/featureFlags/feature.d.ts

@@ -0,0 +1,3 @@
+export declare const FeatureFlagsFeature: import("@webiny/feature/admin").FeatureDefinition<{
+    service: import("./abstractions.js").IFeatureFlagsService;
+}, []>;

package/features/featureFlags/feature.js

@@ -0,0 +1,19 @@
+import { createFeature } from "@webiny/feature/admin";
+import { FeatureFlagsService } from "./abstractions.js";
+import { FeatureFlagsService as external_FeatureFlagsService_js_FeatureFlagsService } from "./FeatureFlagsService.js";
+import { FeatureFlagsGateway } from "./FeatureFlagsGateway.js";
+const FeatureFlagsFeature = createFeature({
+    name: "FeatureFlags",
+    register (container) {
+        container.register(FeatureFlagsGateway).inSingletonScope();
+        container.register(external_FeatureFlagsService_js_FeatureFlagsService).inSingletonScope();
+    },
+    resolve (container) {
+        return {
+            service: container.resolve(FeatureFlagsService)
+        };
+    }
+});
+export { FeatureFlagsFeature };
+
+//# sourceMappingURL=feature.js.map

package/features/featureFlags/feature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/featureFlags/feature.js","sources":["../../../src/features/featureFlags/feature.ts"],"sourcesContent":["import { createFeature } from \"@webiny/feature/admin\";\nimport { Container } from \"@webiny/di\";\nimport { FeatureFlagsService as ServiceAbstraction } from \"./abstractions.js\";\nimport { FeatureFlagsService } from \"./FeatureFlagsService.js\";\nimport { FeatureFlagsGateway } from \"./FeatureFlagsGateway.js\";\n\nexport const FeatureFlagsFeature = createFeature({\n    name: \"FeatureFlags\",\n    register(container: Container) {\n        container.register(FeatureFlagsGateway).inSingletonScope();\n        container.register(FeatureFlagsService).inSingletonScope();\n    },\n    resolve(container: Container) {\n        return {\n            service: container.resolve(ServiceAbstraction)\n        };\n    }\n});\n"],"names":["FeatureFlagsFeature","createFeature","container","FeatureFlagsGateway","FeatureFlagsService","ServiceAbstraction"],"mappings":";;;;AAMO,MAAMA,sBAAsBC,cAAc;IAC7C,MAAM;IACN,UAASC,SAAoB;QACzBA,UAAU,QAAQ,CAACC,qBAAqB,gBAAgB;QACxDD,UAAU,QAAQ,CAACE,qDAAqB,gBAAgB;IAC5D;IACA,SAAQF,SAAoB;QACxB,OAAO;YACH,SAASA,UAAU,OAAO,CAACG;QAC/B;IACJ;AACJ"}

package/features/formModel/AccessControlRuleEvaluator.d.ts

@@ -0,0 +1,12 @@
+import { IdentityContext } from "../../features/security/IdentityContext/abstractions.js";
+import { RuleEvaluator } from "./abstractions.js";
+declare class AccessControlRuleEvaluatorImpl implements RuleEvaluator.Interface {
+    private identityContext;
+    constructor(identityContext: IdentityContext.Interface);
+    canEvaluate(rule: RuleEvaluator.Rule): boolean;
+    evaluate(rule: RuleEvaluator.Rule): boolean;
+}
+export declare const AccessControlRuleEvaluator: typeof AccessControlRuleEvaluatorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IRuleEvaluator>;
+};
+export {};

package/features/formModel/AccessControlRuleEvaluator.js

@@ -0,0 +1,30 @@
+import { IdentityContext } from "../security/IdentityContext/abstractions.js";
+import { RuleEvaluator } from "./abstractions.js";
+class AccessControlRuleEvaluatorImpl {
+    constructor(identityContext){
+        this.identityContext = identityContext;
+    }
+    canEvaluate(rule) {
+        return "accessControl" === rule.type;
+    }
+    evaluate(rule) {
+        const identity = this.identityContext.getIdentity();
+        if (!identity.isAuthenticated || "string" != typeof rule.value) return false;
+        const separator = rule.value.indexOf(":");
+        const scope = rule.value.slice(0, separator);
+        const id = rule.value.slice(separator + 1);
+        if (-1 === separator || !id) return false;
+        if ("admin" === scope) return identity.id === id;
+        if ("team" === scope) return identity.teams.some((team)=>team.slug === id);
+        return false;
+    }
+}
+const AccessControlRuleEvaluator = RuleEvaluator.createImplementation({
+    implementation: AccessControlRuleEvaluatorImpl,
+    dependencies: [
+        IdentityContext
+    ]
+});
+export { AccessControlRuleEvaluator };
+
+//# sourceMappingURL=AccessControlRuleEvaluator.js.map

package/features/formModel/AccessControlRuleEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/AccessControlRuleEvaluator.js","sources":["../../../src/features/formModel/AccessControlRuleEvaluator.ts"],"sourcesContent":["import { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nclass AccessControlRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    constructor(private identityContext: IdentityContext.Interface) {}\n\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"accessControl\";\n    }\n\n    // Rule values follow the folder-permission target format: `admin:<userId>` or `team:<teamSlug>`.\n    evaluate(rule: RuleEvaluator.Rule): boolean {\n        const identity = this.identityContext.getIdentity();\n        if (!identity.isAuthenticated || typeof rule.value !== \"string\") {\n            return false;\n        }\n\n        const separator = rule.value.indexOf(\":\");\n        const scope = rule.value.slice(0, separator);\n        const id = rule.value.slice(separator + 1);\n        if (separator === -1 || !id) {\n            return false;\n        }\n\n        if (scope === \"admin\") {\n            return identity.id === id;\n        }\n        if (scope === \"team\") {\n            return identity.teams.some(team => team.slug === id);\n        }\n        return false;\n    }\n}\n\nexport const AccessControlRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: AccessControlRuleEvaluatorImpl,\n    dependencies: [IdentityContext]\n});\n"],"names":["AccessControlRuleEvaluatorImpl","identityContext","rule","identity","separator","scope","id","team","AccessControlRuleEvaluator","RuleEvaluator","IdentityContext"],"mappings":";;AAGA,MAAMA;IACF,YAAoBC,eAA0C,CAAE;aAA5CA,eAAe,GAAfA;IAA6C;IAEjE,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,oBAAdA,KAAK,IAAI;IACpB;IAGA,SAASA,IAAwB,EAAW;QACxC,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,IAAI,CAACA,SAAS,eAAe,IAAI,AAAsB,YAAtB,OAAOD,KAAK,KAAK,EAC9C,OAAO;QAGX,MAAME,YAAYF,KAAK,KAAK,CAAC,OAAO,CAAC;QACrC,MAAMG,QAAQH,KAAK,KAAK,CAAC,KAAK,CAAC,GAAGE;QAClC,MAAME,KAAKJ,KAAK,KAAK,CAAC,KAAK,CAACE,YAAY;QACxC,IAAIA,AAAc,OAAdA,aAAoB,CAACE,IACrB,OAAO;QAGX,IAAID,AAAU,YAAVA,OACA,OAAOF,SAAS,EAAE,KAAKG;QAE3B,IAAID,AAAU,WAAVA,OACA,OAAOF,SAAS,KAAK,CAAC,IAAI,CAACI,CAAAA,OAAQA,KAAK,IAAI,KAAKD;QAErD,OAAO;IACX;AACJ;AAEO,MAAME,6BAA6BC,cAAc,oBAAoB,CAAC;IACzE,gBAAgBT;IAChB,cAAc;QAACU;KAAgB;AACnC"}

package/features/formModel/AccessControlRuleEvaluator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/features/formModel/AccessControlRuleEvaluator.test.js

@@ -0,0 +1,219 @@
+import { describe, expect, it } from "vitest";
+import { Container } from "@webiny/di";
+import { FormModelFeature } from "./feature.js";
+import { FormModelFactory } from "./abstractions.js";
+import { IdentityContext } from "../security/IdentityContext/abstractions.js";
+import { Identity } from "../../domain/Identity.js";
+const createIdentity = (id, teamSlugs = [])=>Identity.createAuthenticated({
+        id,
+        type: "admin",
+        displayName: id,
+        roles: [],
+        teams: teamSlugs.map((slug)=>({
+                id: `${slug}-id`,
+                slug,
+                name: slug
+            })),
+        permissions: [],
+        profile: {
+            external: false
+        },
+        currentTenant: {
+            id: "root",
+            name: "Root"
+        },
+        defaultTenant: {
+            id: "root",
+            name: "Root"
+        }
+    });
+const accessRule = (value, action = "hide")=>({
+        type: "accessControl",
+        target: "identity",
+        operator: "matches",
+        value,
+        action
+    });
+const createContainer = (identity)=>{
+    const container = new Container();
+    FormModelFeature.register(container);
+    container.registerInstance(IdentityContext, {
+        getIdentity: ()=>identity,
+        setIdentity: ()=>{},
+        clear: ()=>{}
+    });
+    return container;
+};
+const createFieldForm = (identity, rules)=>createContainer(identity).resolve(FormModelFactory).create({
+        fields: (fields)=>({
+                secret: fields.text().label("Secret").rules(rules)
+            })
+    });
+describe("AccessControlRuleEvaluator", ()=>{
+    it("hides a field from the admin the rule names", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for other admins", ()=>{
+        const form = createFieldForm(createIdentity("user-2"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a field from members of the team the rule names, by team slug", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for admins outside the team", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "writers"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("does not match a team by its id", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors-id")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("disables the field for a viewer rule", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1", "disable")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+        expect(form.field("secret").vm.disabled).toBe(true);
+    });
+    it("applies when any of several rules matches", ()=>{
+        const form = createFieldForm(createIdentity("user-3", [
+            "editors"
+        ]), [
+            accessRule("admin:user-1"),
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    describe("read-only and no-access rules on one field", ()=>{
+        const rules = [
+            accessRule("admin:user-1", "disable"),
+            accessRule("team:team-1", "hide")
+        ];
+        it.each([
+            [
+                "matches only the read-only rule",
+                "user-1",
+                [],
+                true,
+                true
+            ],
+            [
+                "matches only the no-access rule",
+                "user-2",
+                [
+                    "team-1"
+                ],
+                false,
+                false
+            ],
+            [
+                "matches both rules",
+                "user-1",
+                [
+                    "team-1"
+                ],
+                false,
+                true
+            ],
+            [
+                "matches neither rule",
+                "user-2",
+                [
+                    "team-2"
+                ],
+                true,
+                false
+            ]
+        ])("%s", (_, id, teams, visible, disabled)=>{
+            const form = createFieldForm(createIdentity(id, teams), rules);
+            expect(form.field("secret").visible).toBe(visible);
+            expect(form.field("secret").disabled).toBe(disabled);
+        });
+    });
+    it("does not match an anonymous identity", ()=>{
+        const form = createFieldForm(Identity.createAnonymous(), [
+            accessRule("admin:anonymous")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it.each([
+        [
+            "no scope",
+            "user-1"
+        ],
+        [
+            "unknown scope",
+            "role:user-1"
+        ],
+        [
+            "empty id",
+            "admin:"
+        ],
+        [
+            "null",
+            null
+        ],
+        [
+            "non-string",
+            1
+        ]
+    ])("ignores a malformed value (%s)", (_, value)=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule(value)
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a tab from the admin the rule names, alongside a condition rule", ()=>{
+        const form = createContainer(createIdentity("user-1")).resolve(FormModelFactory).create({
+            fields: (fields)=>({
+                    options: fields.text().label("Options"),
+                    map: fields.text().label("Map")
+                }),
+            layout: (layout)=>[
+                    layout.tabs("tabs").tab("tab1", (tab)=>{
+                        tab.label("Tab 1").layout((layout)=>[
+                                layout.row("options")
+                            ]);
+                    }).tab("tab2", (tab)=>{
+                        tab.label("Tab 2").rules([
+                            {
+                                type: "condition",
+                                target: "options",
+                                operator: "!=",
+                                value: "map",
+                                action: "disable"
+                            },
+                            accessRule("admin:user-1")
+                        ]).layout((layout)=>[
+                                layout.row("map")
+                            ]);
+                    })
+                ]
+        });
+        const tabs = form.vm.layout.find((n)=>"tabs" === n.type);
+        expect(tabs.tabs.map((t)=>t.id)).toEqual([
+            "tab1"
+        ]);
+        expect(form.field("map").visible).toBe(false);
+    });
+});
+
+//# sourceMappingURL=AccessControlRuleEvaluator.test.js.map

package/features/formModel/AccessControlRuleEvaluator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/AccessControlRuleEvaluator.test.js","sources":["../../../src/features/formModel/AccessControlRuleEvaluator.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { FormModelFeature } from \"./feature.js\";\nimport { FormModelFactory, type IRule, type ITabsNodeVM } from \"./abstractions.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst createIdentity = (id: string, teamSlugs: string[] = []) =>\n    Identity.createAuthenticated({\n        id,\n        type: \"admin\",\n        displayName: id,\n        roles: [],\n        teams: teamSlugs.map(slug => ({ id: `${slug}-id`, slug, name: slug })),\n        permissions: [],\n        profile: { external: false },\n        currentTenant: { id: \"root\", name: \"Root\" },\n        defaultTenant: { id: \"root\", name: \"Root\" }\n    } as Identity.Data);\n\nconst accessRule = (value: IRule[\"value\"], action: IRule[\"action\"] = \"hide\"): IRule => ({\n    type: \"accessControl\",\n    target: \"identity\",\n    operator: \"matches\",\n    value,\n    action\n});\n\nconst createContainer = (identity: Identity) => {\n    const container = new Container();\n    FormModelFeature.register(container);\n    container.registerInstance(IdentityContext, {\n        getIdentity: () => identity,\n        setIdentity: () => {},\n        clear: () => {}\n    });\n    return container;\n};\n\nconst createFieldForm = (identity: Identity, rules: IRule[]) =>\n    createContainer(identity)\n        .resolve(FormModelFactory)\n        .create({\n            fields: fields => ({\n                secret: fields.text().label(\"Secret\").rules(rules)\n            })\n        });\n\ndescribe(\"AccessControlRuleEvaluator\", () => {\n    it(\"hides a field from the admin the rule names\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for other admins\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a field from members of the team the rule names, by team slug\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for admins outside the team\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"writers\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"does not match a team by its id\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors-id\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"disables the field for a viewer rule\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [\n            accessRule(\"admin:user-1\", \"disable\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n        expect(form.field(\"secret\").vm.disabled).toBe(true);\n    });\n\n    it(\"applies when any of several rules matches\", () => {\n        const form = createFieldForm(createIdentity(\"user-3\", [\"editors\"]), [\n            accessRule(\"admin:user-1\"),\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    describe(\"read-only and no-access rules on one field\", () => {\n        const rules = [accessRule(\"admin:user-1\", \"disable\"), accessRule(\"team:team-1\", \"hide\")];\n\n        it.each([\n            [\"matches only the read-only rule\", \"user-1\", [], true, true],\n            [\"matches only the no-access rule\", \"user-2\", [\"team-1\"], false, false],\n            [\"matches both rules\", \"user-1\", [\"team-1\"], false, true],\n            [\"matches neither rule\", \"user-2\", [\"team-2\"], true, false]\n        ])(\"%s\", (_, id, teams, visible, disabled) => {\n            const form = createFieldForm(createIdentity(id, teams), rules);\n\n            expect(form.field(\"secret\").visible).toBe(visible);\n            expect(form.field(\"secret\").disabled).toBe(disabled);\n        });\n    });\n\n    it(\"does not match an anonymous identity\", () => {\n        const form = createFieldForm(Identity.createAnonymous(), [accessRule(\"admin:anonymous\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it.each([\n        [\"no scope\", \"user-1\"],\n        [\"unknown scope\", \"role:user-1\"],\n        [\"empty id\", \"admin:\"],\n        [\"null\", null],\n        [\"non-string\", 1]\n    ])(\"ignores a malformed value (%s)\", (_, value) => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(value)]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a tab from the admin the rule names, alongside a condition rule\", () => {\n        const form = createContainer(createIdentity(\"user-1\"))\n            .resolve(FormModelFactory)\n            .create({\n                fields: fields => ({\n                    options: fields.text().label(\"Options\"),\n                    map: fields.text().label(\"Map\")\n                }),\n                layout: layout => [\n                    layout\n                        .tabs(\"tabs\")\n                        .tab(\"tab1\", tab => {\n                            tab.label(\"Tab 1\").layout(layout => [layout.row(\"options\")]);\n                        })\n                        .tab(\"tab2\", tab => {\n                            tab.label(\"Tab 2\")\n                                .rules([\n                                    {\n                                        type: \"condition\",\n                                        target: \"options\",\n                                        operator: \"!=\",\n                                        value: \"map\",\n                                        action: \"disable\"\n                                    },\n                                    accessRule(\"admin:user-1\")\n                                ])\n                                .layout(layout => [layout.row(\"map\")]);\n                        })\n                ]\n            });\n\n        const tabs = form.vm.layout.find(n => n.type === \"tabs\") as ITabsNodeVM;\n        expect(tabs.tabs.map(t => t.id)).toEqual([\"tab1\"]);\n        expect(form.field(\"map\").visible).toBe(false);\n    });\n});\n"],"names":["createIdentity","id","teamSlugs","Identity","slug","accessRule","value","action","createContainer","identity","container","Container","FormModelFeature","IdentityContext","createFieldForm","rules","FormModelFactory","fields","describe","it","form","expect","_","teams","visible","disabled","layout","tab","tabs","n","t"],"mappings":";;;;;;AAOA,MAAMA,iBAAiB,CAACC,IAAYC,YAAsB,EAAE,GACxDC,SAAS,mBAAmB,CAAC;QACzBF;QACA,MAAM;QACN,aAAaA;QACb,OAAO,EAAE;QACT,OAAOC,UAAU,GAAG,CAACE,CAAAA,OAAS;gBAAE,IAAI,GAAGA,KAAK,GAAG,CAAC;gBAAEA;gBAAM,MAAMA;YAAK;QACnE,aAAa,EAAE;QACf,SAAS;YAAE,UAAU;QAAM;QAC3B,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;QAC1C,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;IAC9C;AAEJ,MAAMC,aAAa,CAACC,OAAuBC,SAA0B,MAAM,GAAa;QACpF,MAAM;QACN,QAAQ;QACR,UAAU;QACVD;QACAC;IACJ;AAEA,MAAMC,kBAAkB,CAACC;IACrB,MAAMC,YAAY,IAAIC;IACtBC,iBAAiB,QAAQ,CAACF;IAC1BA,UAAU,gBAAgB,CAACG,iBAAiB;QACxC,aAAa,IAAMJ;QACnB,aAAa,KAAO;QACpB,OAAO,KAAO;IAClB;IACA,OAAOC;AACX;AAEA,MAAMI,kBAAkB,CAACL,UAAoBM,QACzCP,gBAAgBC,UACX,OAAO,CAACO,kBACR,MAAM,CAAC;QACJ,QAAQC,CAAAA,SAAW;gBACf,QAAQA,OAAO,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,CAACF;YAChD;IACJ;AAERG,SAAS,8BAA8B;IACnCC,GAAG,+CAA+C;QAC9C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,uEAAuE;QACtE,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wDAAwD;QACvD,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,mCAAmC;QAClC,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YACnDK,WAAW,gBAAgB;SAC9B;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;QAC1CC,OAAOD,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;IAClD;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;YACXA,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAF,SAAS,8CAA8C;QACnD,MAAMH,QAAQ;YAACV,WAAW,gBAAgB;YAAYA,WAAW,eAAe;SAAQ;QAExFc,GAAG,IAAI,CAAC;YACJ;gBAAC;gBAAmC;gBAAU,EAAE;gBAAE;gBAAM;aAAK;YAC7D;gBAAC;gBAAmC;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAM;YACvE;gBAAC;gBAAsB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAK;YACzD;gBAAC;gBAAwB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAM;aAAM;SAC9D,EAAE,MAAM,CAACG,GAAGrB,IAAIsB,OAAOC,SAASC;YAC7B,MAAML,OAAON,gBAAgBd,eAAeC,IAAIsB,QAAQR;YAExDM,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAACI;YAC1CH,OAAOD,KAAK,KAAK,CAAC,UAAU,QAAQ,EAAE,IAAI,CAACK;QAC/C;IACJ;IAEAN,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBX,SAAS,eAAe,IAAI;YAACE,WAAW;SAAmB;QAExFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,IAAI,CAAC;QACJ;YAAC;YAAY;SAAS;QACtB;YAAC;YAAiB;SAAc;QAChC;YAAC;YAAY;SAAS;QACtB;YAAC;YAAQ;SAAK;QACd;YAAC;YAAc;SAAE;KACpB,EAAE,kCAAkC,CAACG,GAAGhB;QACrC,MAAMc,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAWC;SAAO;QAE1Ee,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,yEAAyE;QACxE,MAAMC,OAAOZ,gBAAgBR,eAAe,WACvC,OAAO,CAACgB,kBACR,MAAM,CAAC;YACJ,QAAQC,CAAAA,SAAW;oBACf,SAASA,OAAO,IAAI,GAAG,KAAK,CAAC;oBAC7B,KAAKA,OAAO,IAAI,GAAG,KAAK,CAAC;gBAC7B;YACA,QAAQS,CAAAA,SAAU;oBACdA,OACK,IAAI,CAAC,QACL,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SAAS,MAAM,CAACD,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAW;oBAC/D,GACC,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SACL,KAAK,CAAC;4BACH;gCACI,MAAM;gCACN,QAAQ;gCACR,UAAU;gCACV,OAAO;gCACP,QAAQ;4BACZ;4BACAtB,WAAW;yBACd,EACA,MAAM,CAACqB,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAO;oBAC7C;iBACP;QACL;QAEJ,MAAME,OAAOR,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAACS,CAAAA,IAAKA,AAAW,WAAXA,EAAE,IAAI;QAC5CR,OAAOO,KAAK,IAAI,CAAC,GAAG,CAACE,CAAAA,IAAKA,EAAE,EAAE,GAAG,OAAO,CAAC;YAAC;SAAO;QACjDT,OAAOD,KAAK,KAAK,CAAC,OAAO,OAAO,EAAE,IAAI,CAAC;IAC3C;AACJ"}

package/features/formModel/ConditionRuleEvaluator.js

@@ -4,6 +4,10 @@ const isEmpty = (value)=>{
     if (Array.isArray(value) && 0 === value.length) return true;
     return false;
 };
+const isEqual = (value, ruleValue)=>{
+    if ("boolean" == typeof value || "boolean" == typeof ruleValue) return value === ruleValue;
+    return value == ruleValue;
+};
 class ConditionRuleEvaluatorImpl {
     canEvaluate(rule) {
         return "condition" === rule.type;
@@ -12,14 +16,28 @@ class ConditionRuleEvaluatorImpl {
         const field = safeGetField(form, rule.target);
         const value = field?.getValue() ?? null;
         switch(rule.operator){
+            case "==":
+            case "eq":
+                return isEqual(value, rule.value);
+            case "!=":
+            case "neq":
+                return !isEqual(value, rule.value);
+            case ">":
+            case "gt":
+                return Number(value) > Number(rule.value);
+            case "<":
+            case "lt":
+                return Number(value) < Number(rule.value);
+            case ">=":
+            case "gte":
+                return Number(value) >= Number(rule.value);
+            case "<=":
+            case "lte":
+                return Number(value) <= Number(rule.value);
             case "isEmpty":
                 return isEmpty(value);
             case "isNotEmpty":
                 return !isEmpty(value);
-            case "eq":
-                return value === rule.value;
-            case "neq":
-                return value !== rule.value;
             case "isTruthy":
                 return !!value;
             case "isFalsy":
@@ -27,6 +45,18 @@ class ConditionRuleEvaluatorImpl {
             case "matches":
                 if ("string" != typeof value || null === rule.value) return false;
                 return value === rule.value;
+            case "contains":
+                return String(value ?? "").includes(String(rule.value ?? ""));
+            case "notContains":
+                return !String(value ?? "").includes(String(rule.value ?? ""));
+            case "startsWith":
+                return String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "notStartsWith":
+                return !String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "endsWith":
+                return String(value ?? "").endsWith(String(rule.value ?? ""));
+            case "notEndsWith":
+                return !String(value ?? "").endsWith(String(rule.value ?? ""));
             default:
                 if ("development" === process.env.NODE_ENV) console.warn(`[FormModel] Unknown operator "${rule.operator}" in condition rule. Returning false.`);
                 return false;

package/features/formModel/ConditionRuleEvaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/formModel/ConditionRuleEvaluator.js","sources":["../../../src/features/formModel/ConditionRuleEvaluator.ts"],"sourcesContent":["import type { IFormModel } from \"./abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nconst isEmpty = (value: unknown): boolean => {\n    if (value === null || value === undefined || value === \"\") {\n        return true;\n    }\n    if (Array.isArray(value) && value.length === 0) {\n        return true;\n    }\n    return false;\n};\n\nexport class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"condition\";\n    }\n\n    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean {\n        const field = safeGetField(form, rule.target);\n        const value = field?.getValue() ?? null;\n\n        switch (rule.operator) {\n            case \"isEmpty\":\n                return isEmpty(value);\n            case \"isNotEmpty\":\n                return !isEmpty(value);\n            case \"eq\":\n                return value === rule.value;\n            case \"neq\":\n                return value !== rule.value;\n            case \"isTruthy\":\n                return !!value;\n            case \"isFalsy\":\n                return !value;\n            case \"matches\":\n                if (typeof value !== \"string\" || rule.value === null) {\n                    return false;\n                }\n                return value === rule.value;\n            default:\n                if (process.env.NODE_ENV === \"development\") {\n                    console.warn(\n                        `[FormModel] Unknown operator \"${rule.operator}\" in condition rule. Returning false.`\n                    );\n                }\n                return false;\n        }\n    }\n}\n\nfunction safeGetField(form: IFormModel, name: string) {\n    try {\n        return form.field(name);\n    } catch {\n        return undefined;\n    }\n}\n\nexport const ConditionRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: ConditionRuleEvaluatorImpl,\n    dependencies: []\n});\n"],"names":["isEmpty","value","Array","ConditionRuleEvaluatorImpl","rule","form","field","safeGetField","process","console","name","ConditionRuleEvaluator","RuleEvaluator"],"mappings":";AAGA,MAAMA,UAAU,CAACC;IACb,IAAIA,QAAAA,SAAyCA,AAAU,OAAVA,OACzC,OAAO;IAEX,IAAIC,MAAM,OAAO,CAACD,UAAUA,AAAiB,MAAjBA,MAAM,MAAM,EACpC,OAAO;IAEX,OAAO;AACX;AAEO,MAAME;IACT,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,gBAAdA,KAAK,IAAI;IACpB;IAEA,SAASA,IAAwB,EAAEC,IAAgB,EAAW;QAC1D,MAAMC,QAAQC,aAAaF,MAAMD,KAAK,MAAM;QAC5C,MAAMH,QAAQK,OAAO,cAAc;QAEnC,OAAQF,KAAK,QAAQ;YACjB,KAAK;gBACD,OAAOJ,QAAQC;YACnB,KAAK;gBACD,OAAO,CAACD,QAAQC;YACpB,KAAK;gBACD,OAAOA,UAAUG,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAOH,UAAUG,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAO,CAAC,CAACH;YACb,KAAK;gBACD,OAAO,CAACA;YACZ,KAAK;gBACD,IAAI,AAAiB,YAAjB,OAAOA,SAAsBG,AAAe,SAAfA,KAAK,KAAK,EACvC,OAAO;gBAEX,OAAOH,UAAUG,KAAK,KAAK;YAC/B;gBACI,IAAII,AAAyB,kBAAzBA,QAAQ,GAAG,CAAC,QAAQ,EACpBC,QAAQ,IAAI,CACR,CAAC,8BAA8B,EAAEL,KAAK,QAAQ,CAAC,qCAAqC,CAAC;gBAG7F,OAAO;QACf;IACJ;AACJ;AAEA,SAASG,aAAaF,IAAgB,EAAEK,IAAY;IAChD,IAAI;QACA,OAAOL,KAAK,KAAK,CAACK;IACtB,EAAE,OAAM;QACJ;IACJ;AACJ;AAEO,MAAMC,yBAAyBC,cAAc,oBAAoB,CAAC;IACrE,gBAAgBT;IAChB,cAAc,EAAE;AACpB"}
+{"version":3,"file":"features/formModel/ConditionRuleEvaluator.js","sources":["../../../src/features/formModel/ConditionRuleEvaluator.ts"],"sourcesContent":["import type { IFormModel } from \"./abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nconst isEmpty = (value: unknown): boolean => {\n    if (value === null || value === undefined || value === \"\") {\n        return true;\n    }\n    if (Array.isArray(value) && value.length === 0) {\n        return true;\n    }\n    return false;\n};\n\n// Loose equality coerces booleans to numbers (\"\" == false, 0 == false), so compare them strictly.\nconst isEqual = (value: unknown, ruleValue: unknown): boolean => {\n    if (typeof value === \"boolean\" || typeof ruleValue === \"boolean\") {\n        return value === ruleValue;\n    }\n    return value == ruleValue;\n};\n\nexport class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"condition\";\n    }\n\n    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean {\n        const field = safeGetField(form, rule.target);\n        const value = field?.getValue() ?? null;\n\n        switch (rule.operator) {\n            case \"==\":\n            case \"eq\":\n                return isEqual(value, rule.value);\n            case \"!=\":\n            case \"neq\":\n                return !isEqual(value, rule.value);\n            case \">\":\n            case \"gt\":\n                return Number(value) > Number(rule.value);\n            case \"<\":\n            case \"lt\":\n                return Number(value) < Number(rule.value);\n            case \">=\":\n            case \"gte\":\n                return Number(value) >= Number(rule.value);\n            case \"<=\":\n            case \"lte\":\n                return Number(value) <= Number(rule.value);\n            case \"isEmpty\":\n                return isEmpty(value);\n            case \"isNotEmpty\":\n                return !isEmpty(value);\n            case \"isTruthy\":\n                return !!value;\n            case \"isFalsy\":\n                return !value;\n            case \"matches\":\n                if (typeof value !== \"string\" || rule.value === null) {\n                    return false;\n                }\n                return value === rule.value;\n            case \"contains\":\n                return String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"notContains\":\n                return !String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"startsWith\":\n                return String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"notStartsWith\":\n                return !String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"endsWith\":\n                return String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            case \"notEndsWith\":\n                return !String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            default:\n                if (process.env.NODE_ENV === \"development\") {\n                    console.warn(\n                        `[FormModel] Unknown operator \"${rule.operator}\" in condition rule. Returning false.`\n                    );\n                }\n                return false;\n        }\n    }\n}\n\nfunction safeGetField(form: IFormModel, name: string) {\n    try {\n        return form.field(name);\n    } catch {\n        return undefined;\n    }\n}\n\nexport const ConditionRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: ConditionRuleEvaluatorImpl,\n    dependencies: []\n});\n"],"names":["isEmpty","value","Array","isEqual","ruleValue","ConditionRuleEvaluatorImpl","rule","form","field","safeGetField","Number","String","process","console","name","ConditionRuleEvaluator","RuleEvaluator"],"mappings":";AAGA,MAAMA,UAAU,CAACC;IACb,IAAIA,QAAAA,SAAyCA,AAAU,OAAVA,OACzC,OAAO;IAEX,IAAIC,MAAM,OAAO,CAACD,UAAUA,AAAiB,MAAjBA,MAAM,MAAM,EACpC,OAAO;IAEX,OAAO;AACX;AAGA,MAAME,UAAU,CAACF,OAAgBG;IAC7B,IAAI,AAAiB,aAAjB,OAAOH,SAAuB,AAAqB,aAArB,OAAOG,WACrC,OAAOH,UAAUG;IAErB,OAAOH,SAASG;AACpB;AAEO,MAAMC;IACT,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,gBAAdA,KAAK,IAAI;IACpB;IAEA,SAASA,IAAwB,EAAEC,IAAgB,EAAW;QAC1D,MAAMC,QAAQC,aAAaF,MAAMD,KAAK,MAAM;QAC5C,MAAML,QAAQO,OAAO,cAAc;QAEnC,OAAQF,KAAK,QAAQ;YACjB,KAAK;YACL,KAAK;gBACD,OAAOH,QAAQF,OAAOK,KAAK,KAAK;YACpC,KAAK;YACL,KAAK;gBACD,OAAO,CAACH,QAAQF,OAAOK,KAAK,KAAK;YACrC,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;gBACD,OAAON,QAAQC;YACnB,KAAK;gBACD,OAAO,CAACD,QAAQC;YACpB,KAAK;gBACD,OAAO,CAAC,CAACA;YACb,KAAK;gBACD,OAAO,CAACA;YACZ,KAAK;gBACD,IAAI,AAAiB,YAAjB,OAAOA,SAAsBK,AAAe,SAAfA,KAAK,KAAK,EACvC,OAAO;gBAEX,OAAOL,UAAUK,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC/D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAChE,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D;gBACI,IAAIM,AAAyB,kBAAzBA,QAAQ,GAAG,CAAC,QAAQ,EACpBC,QAAQ,IAAI,CACR,CAAC,8BAA8B,EAAEP,KAAK,QAAQ,CAAC,qCAAqC,CAAC;gBAG7F,OAAO;QACf;IACJ;AACJ;AAEA,SAASG,aAAaF,IAAgB,EAAEO,IAAY;IAChD,IAAI;QACA,OAAOP,KAAK,KAAK,CAACO;IACtB,EAAE,OAAM;QACJ;IACJ;AACJ;AAEO,MAAMC,yBAAyBC,cAAc,oBAAoB,CAAC;IACrE,gBAAgBX;IAChB,cAAc,EAAE;AACpB"}

package/features/formModel/Field.d.ts

@@ -22,6 +22,7 @@ export declare class Field implements IField {
     private _focusRequested;
     private _qualifiedName;
     private _parentPath;
+    private _scopePath;
     private _form;
     private _ancestorRules;
     readonly config: IFieldConfig;
@@ -40,6 +41,12 @@ export declare class Field implements IField {
      */
     setValueSilent(value: unknown): void;
     setDisabled(value: boolean): void;
+    /**
+     * `form.field()` throws for a path it can't resolve, which happens while a form is
+     * still being assembled. Ancestor lookups treat that as "no parent" rather than
+     * failing the render.
+     */
+    private _safeGetField;
     private _evaluateRules;
     get visible(): boolean;
     get disabled(): boolean;
@@ -66,7 +73,12 @@ export declare class Field implements IField {
     };
     private _resolveRequired;
     blur(): void;
-    setForm(form: IFormModel, parentPath?: string): void;
+    setForm(form: IFormModel, parentPath?: string, scopePath?: () => string): void;
+    /**
+     * A path `form.field()` resolves to exactly this field. Same as `qualifiedName`,
+     * except inside list items, where it carries the item index (`blocks.2.title`).
+     */
+    get scopedName(): string;
     private _callbackParams;
     get qualifiedName(): string;
     focus(): void;

package/features/formModel/Field.js

@@ -48,6 +48,7 @@ class Field {
         this._focusRequested = false;
         this._qualifiedName = "";
         this._parentPath = "";
+        this._scopePath = ()=>this._parentPath;
         this._form = null;
         this._ancestorRules = [];
         this.config = config;
@@ -81,7 +82,8 @@ class Field {
         else if (config.computedUntilDirty) this._computedUntilDirty = config.computedUntilDirty;
         makeAutoObservable(this, {
             config: false,
-            vm: computed
+            vm: computed,
+            _scopePath: false
         });
     }
     get name() {
@@ -120,6 +122,13 @@ class Field {
     setDisabled(value) {
         this._disabled = value;
     }
+    _safeGetField(name) {
+        try {
+            return this._form?.field(name);
+        } catch  {
+            return;
+        }
+    }
     _evaluateRules() {
         if (!this._form) return {
             visible: true,
@@ -134,11 +143,12 @@ class Field {
             visible: true,
             disabled: false
         };
-        if (this._parentPath) {
+        const scopePath = this._scopePath();
+        if (scopePath) {
             const resolved = all.map((rule)=>{
                 if (rule.target.startsWith("$.")) return {
                     ...rule,
-                    target: `${this._parentPath}.${rule.target.slice(2)}`
+                    target: `${scopePath}.${rule.target.slice(2)}`
                 };
                 return rule;
             });
@@ -156,6 +166,10 @@ class Field {
     }
     get disabled() {
         if (this._disabled) return true;
+        if (this._parentPath && this._form) {
+            const parent = this._safeGetField(this._parentPath);
+            if (parent?.disabled) return true;
+        }
         if (this._form && this._disabledWhenCallbacks.length > 0) {
             const scoped = this._callbackParams();
             for (const cb of this._disabledWhenCallbacks)if (cb(scoped)) return true;
@@ -235,15 +249,20 @@ class Field {
     blur() {
         for (const cb of this._onBlurCallbacks)cb(this._value, this._callbackParams());
     }
-    setForm(form, parentPath) {
+    setForm(form, parentPath, scopePath) {
         this._form = form;
         this._parentPath = parentPath || "";
+        this._scopePath = scopePath ?? (()=>this._parentPath);
         this._qualifiedName = parentPath ? `${parentPath}.${this.config.name}` : this.config.name;
     }
+    get scopedName() {
+        const scopePath = this._scopePath();
+        return scopePath ? `${scopePath}.${this.config.name}` : this.config.name;
+    }
     _callbackParams() {
         if (!this._form) throw new Error("Field not attached to a form.");
         return {
-            field: new FieldNavigator(this._form, this._qualifiedName),
+            field: new FieldNavigator(this._form, this.scopedName),
             form: this._form
         };
     }
@@ -280,6 +299,7 @@ class Field {
             description: this.config.description,
             note: this.config.note,
             placeholder: this.config.placeholder,
+            autoFocus: this.config.autoFocus,
             value: this.getValue(),
             validation: this.visible ? this._validation : {
                 isValid: null