@webiny/app-admin 0.0.0-unstable.eb196ccd2f → 0.0.0-unstable.eb81deee7e

package/features/formModel/AccessControlRuleEvaluator.d.ts

@@ -0,0 +1,12 @@
+import { IdentityContext } from "../../features/security/IdentityContext/abstractions.js";
+import { RuleEvaluator } from "./abstractions.js";
+declare class AccessControlRuleEvaluatorImpl implements RuleEvaluator.Interface {
+    private identityContext;
+    constructor(identityContext: IdentityContext.Interface);
+    canEvaluate(rule: RuleEvaluator.Rule): boolean;
+    evaluate(rule: RuleEvaluator.Rule): boolean;
+}
+export declare const AccessControlRuleEvaluator: typeof AccessControlRuleEvaluatorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IRuleEvaluator>;
+};
+export {};

package/features/formModel/AccessControlRuleEvaluator.js

@@ -0,0 +1,30 @@
+import { IdentityContext } from "../security/IdentityContext/abstractions.js";
+import { RuleEvaluator } from "./abstractions.js";
+class AccessControlRuleEvaluatorImpl {
+    constructor(identityContext){
+        this.identityContext = identityContext;
+    }
+    canEvaluate(rule) {
+        return "accessControl" === rule.type;
+    }
+    evaluate(rule) {
+        const identity = this.identityContext.getIdentity();
+        if (!identity.isAuthenticated || "string" != typeof rule.value) return false;
+        const separator = rule.value.indexOf(":");
+        const scope = rule.value.slice(0, separator);
+        const id = rule.value.slice(separator + 1);
+        if (-1 === separator || !id) return false;
+        if ("admin" === scope) return identity.id === id;
+        if ("team" === scope) return identity.teams.some((team)=>team.slug === id);
+        return false;
+    }
+}
+const AccessControlRuleEvaluator = RuleEvaluator.createImplementation({
+    implementation: AccessControlRuleEvaluatorImpl,
+    dependencies: [
+        IdentityContext
+    ]
+});
+export { AccessControlRuleEvaluator };
+
+//# sourceMappingURL=AccessControlRuleEvaluator.js.map

package/features/formModel/AccessControlRuleEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/AccessControlRuleEvaluator.js","sources":["../../../src/features/formModel/AccessControlRuleEvaluator.ts"],"sourcesContent":["import { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nclass AccessControlRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    constructor(private identityContext: IdentityContext.Interface) {}\n\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"accessControl\";\n    }\n\n    // Rule values follow the folder-permission target format: `admin:<userId>` or `team:<teamSlug>`.\n    evaluate(rule: RuleEvaluator.Rule): boolean {\n        const identity = this.identityContext.getIdentity();\n        if (!identity.isAuthenticated || typeof rule.value !== \"string\") {\n            return false;\n        }\n\n        const separator = rule.value.indexOf(\":\");\n        const scope = rule.value.slice(0, separator);\n        const id = rule.value.slice(separator + 1);\n        if (separator === -1 || !id) {\n            return false;\n        }\n\n        if (scope === \"admin\") {\n            return identity.id === id;\n        }\n        if (scope === \"team\") {\n            return identity.teams.some(team => team.slug === id);\n        }\n        return false;\n    }\n}\n\nexport const AccessControlRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: AccessControlRuleEvaluatorImpl,\n    dependencies: [IdentityContext]\n});\n"],"names":["AccessControlRuleEvaluatorImpl","identityContext","rule","identity","separator","scope","id","team","AccessControlRuleEvaluator","RuleEvaluator","IdentityContext"],"mappings":";;AAGA,MAAMA;IACF,YAAoBC,eAA0C,CAAE;aAA5CA,eAAe,GAAfA;IAA6C;IAEjE,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,oBAAdA,KAAK,IAAI;IACpB;IAGA,SAASA,IAAwB,EAAW;QACxC,MAAMC,WAAW,IAAI,CAAC,eAAe,CAAC,WAAW;QACjD,IAAI,CAACA,SAAS,eAAe,IAAI,AAAsB,YAAtB,OAAOD,KAAK,KAAK,EAC9C,OAAO;QAGX,MAAME,YAAYF,KAAK,KAAK,CAAC,OAAO,CAAC;QACrC,MAAMG,QAAQH,KAAK,KAAK,CAAC,KAAK,CAAC,GAAGE;QAClC,MAAME,KAAKJ,KAAK,KAAK,CAAC,KAAK,CAACE,YAAY;QACxC,IAAIA,AAAc,OAAdA,aAAoB,CAACE,IACrB,OAAO;QAGX,IAAID,AAAU,YAAVA,OACA,OAAOF,SAAS,EAAE,KAAKG;QAE3B,IAAID,AAAU,WAAVA,OACA,OAAOF,SAAS,KAAK,CAAC,IAAI,CAACI,CAAAA,OAAQA,KAAK,IAAI,KAAKD;QAErD,OAAO;IACX;AACJ;AAEO,MAAME,6BAA6BC,cAAc,oBAAoB,CAAC;IACzE,gBAAgBT;IAChB,cAAc;QAACU;KAAgB;AACnC"}

package/features/formModel/AccessControlRuleEvaluator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/features/formModel/AccessControlRuleEvaluator.test.js

@@ -0,0 +1,219 @@
+import { describe, expect, it } from "vitest";
+import { Container } from "@webiny/di";
+import { FormModelFeature } from "./feature.js";
+import { FormModelFactory } from "./abstractions.js";
+import { IdentityContext } from "../security/IdentityContext/abstractions.js";
+import { Identity } from "../../domain/Identity.js";
+const createIdentity = (id, teamSlugs = [])=>Identity.createAuthenticated({
+        id,
+        type: "admin",
+        displayName: id,
+        roles: [],
+        teams: teamSlugs.map((slug)=>({
+                id: `${slug}-id`,
+                slug,
+                name: slug
+            })),
+        permissions: [],
+        profile: {
+            external: false
+        },
+        currentTenant: {
+            id: "root",
+            name: "Root"
+        },
+        defaultTenant: {
+            id: "root",
+            name: "Root"
+        }
+    });
+const accessRule = (value, action = "hide")=>({
+        type: "accessControl",
+        target: "identity",
+        operator: "matches",
+        value,
+        action
+    });
+const createContainer = (identity)=>{
+    const container = new Container();
+    FormModelFeature.register(container);
+    container.registerInstance(IdentityContext, {
+        getIdentity: ()=>identity,
+        setIdentity: ()=>{},
+        clear: ()=>{}
+    });
+    return container;
+};
+const createFieldForm = (identity, rules)=>createContainer(identity).resolve(FormModelFactory).create({
+        fields: (fields)=>({
+                secret: fields.text().label("Secret").rules(rules)
+            })
+    });
+describe("AccessControlRuleEvaluator", ()=>{
+    it("hides a field from the admin the rule names", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for other admins", ()=>{
+        const form = createFieldForm(createIdentity("user-2"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a field from members of the team the rule names, by team slug", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for admins outside the team", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "writers"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("does not match a team by its id", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors-id")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("disables the field for a viewer rule", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1", "disable")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+        expect(form.field("secret").vm.disabled).toBe(true);
+    });
+    it("applies when any of several rules matches", ()=>{
+        const form = createFieldForm(createIdentity("user-3", [
+            "editors"
+        ]), [
+            accessRule("admin:user-1"),
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    describe("read-only and no-access rules on one field", ()=>{
+        const rules = [
+            accessRule("admin:user-1", "disable"),
+            accessRule("team:team-1", "hide")
+        ];
+        it.each([
+            [
+                "matches only the read-only rule",
+                "user-1",
+                [],
+                true,
+                true
+            ],
+            [
+                "matches only the no-access rule",
+                "user-2",
+                [
+                    "team-1"
+                ],
+                false,
+                false
+            ],
+            [
+                "matches both rules",
+                "user-1",
+                [
+                    "team-1"
+                ],
+                false,
+                true
+            ],
+            [
+                "matches neither rule",
+                "user-2",
+                [
+                    "team-2"
+                ],
+                true,
+                false
+            ]
+        ])("%s", (_, id, teams, visible, disabled)=>{
+            const form = createFieldForm(createIdentity(id, teams), rules);
+            expect(form.field("secret").visible).toBe(visible);
+            expect(form.field("secret").disabled).toBe(disabled);
+        });
+    });
+    it("does not match an anonymous identity", ()=>{
+        const form = createFieldForm(Identity.createAnonymous(), [
+            accessRule("admin:anonymous")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it.each([
+        [
+            "no scope",
+            "user-1"
+        ],
+        [
+            "unknown scope",
+            "role:user-1"
+        ],
+        [
+            "empty id",
+            "admin:"
+        ],
+        [
+            "null",
+            null
+        ],
+        [
+            "non-string",
+            1
+        ]
+    ])("ignores a malformed value (%s)", (_, value)=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule(value)
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a tab from the admin the rule names, alongside a condition rule", ()=>{
+        const form = createContainer(createIdentity("user-1")).resolve(FormModelFactory).create({
+            fields: (fields)=>({
+                    options: fields.text().label("Options"),
+                    map: fields.text().label("Map")
+                }),
+            layout: (layout)=>[
+                    layout.tabs("tabs").tab("tab1", (tab)=>{
+                        tab.label("Tab 1").layout((layout)=>[
+                                layout.row("options")
+                            ]);
+                    }).tab("tab2", (tab)=>{
+                        tab.label("Tab 2").rules([
+                            {
+                                type: "condition",
+                                target: "options",
+                                operator: "!=",
+                                value: "map",
+                                action: "disable"
+                            },
+                            accessRule("admin:user-1")
+                        ]).layout((layout)=>[
+                                layout.row("map")
+                            ]);
+                    })
+                ]
+        });
+        const tabs = form.vm.layout.find((n)=>"tabs" === n.type);
+        expect(tabs.tabs.map((t)=>t.id)).toEqual([
+            "tab1"
+        ]);
+        expect(form.field("map").visible).toBe(false);
+    });
+});
+
+//# sourceMappingURL=AccessControlRuleEvaluator.test.js.map

package/features/formModel/AccessControlRuleEvaluator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/AccessControlRuleEvaluator.test.js","sources":["../../../src/features/formModel/AccessControlRuleEvaluator.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { FormModelFeature } from \"./feature.js\";\nimport { FormModelFactory, type IRule, type ITabsNodeVM } from \"./abstractions.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst createIdentity = (id: string, teamSlugs: string[] = []) =>\n    Identity.createAuthenticated({\n        id,\n        type: \"admin\",\n        displayName: id,\n        roles: [],\n        teams: teamSlugs.map(slug => ({ id: `${slug}-id`, slug, name: slug })),\n        permissions: [],\n        profile: { external: false },\n        currentTenant: { id: \"root\", name: \"Root\" },\n        defaultTenant: { id: \"root\", name: \"Root\" }\n    } as Identity.Data);\n\nconst accessRule = (value: IRule[\"value\"], action: IRule[\"action\"] = \"hide\"): IRule => ({\n    type: \"accessControl\",\n    target: \"identity\",\n    operator: \"matches\",\n    value,\n    action\n});\n\nconst createContainer = (identity: Identity) => {\n    const container = new Container();\n    FormModelFeature.register(container);\n    container.registerInstance(IdentityContext, {\n        getIdentity: () => identity,\n        setIdentity: () => {},\n        clear: () => {}\n    });\n    return container;\n};\n\nconst createFieldForm = (identity: Identity, rules: IRule[]) =>\n    createContainer(identity)\n        .resolve(FormModelFactory)\n        .create({\n            fields: fields => ({\n                secret: fields.text().label(\"Secret\").rules(rules)\n            })\n        });\n\ndescribe(\"AccessControlRuleEvaluator\", () => {\n    it(\"hides a field from the admin the rule names\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for other admins\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a field from members of the team the rule names, by team slug\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for admins outside the team\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"writers\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"does not match a team by its id\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors-id\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"disables the field for a viewer rule\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [\n            accessRule(\"admin:user-1\", \"disable\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n        expect(form.field(\"secret\").vm.disabled).toBe(true);\n    });\n\n    it(\"applies when any of several rules matches\", () => {\n        const form = createFieldForm(createIdentity(\"user-3\", [\"editors\"]), [\n            accessRule(\"admin:user-1\"),\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    describe(\"read-only and no-access rules on one field\", () => {\n        const rules = [accessRule(\"admin:user-1\", \"disable\"), accessRule(\"team:team-1\", \"hide\")];\n\n        it.each([\n            [\"matches only the read-only rule\", \"user-1\", [], true, true],\n            [\"matches only the no-access rule\", \"user-2\", [\"team-1\"], false, false],\n            [\"matches both rules\", \"user-1\", [\"team-1\"], false, true],\n            [\"matches neither rule\", \"user-2\", [\"team-2\"], true, false]\n        ])(\"%s\", (_, id, teams, visible, disabled) => {\n            const form = createFieldForm(createIdentity(id, teams), rules);\n\n            expect(form.field(\"secret\").visible).toBe(visible);\n            expect(form.field(\"secret\").disabled).toBe(disabled);\n        });\n    });\n\n    it(\"does not match an anonymous identity\", () => {\n        const form = createFieldForm(Identity.createAnonymous(), [accessRule(\"admin:anonymous\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it.each([\n        [\"no scope\", \"user-1\"],\n        [\"unknown scope\", \"role:user-1\"],\n        [\"empty id\", \"admin:\"],\n        [\"null\", null],\n        [\"non-string\", 1]\n    ])(\"ignores a malformed value (%s)\", (_, value) => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(value)]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a tab from the admin the rule names, alongside a condition rule\", () => {\n        const form = createContainer(createIdentity(\"user-1\"))\n            .resolve(FormModelFactory)\n            .create({\n                fields: fields => ({\n                    options: fields.text().label(\"Options\"),\n                    map: fields.text().label(\"Map\")\n                }),\n                layout: layout => [\n                    layout\n                        .tabs(\"tabs\")\n                        .tab(\"tab1\", tab => {\n                            tab.label(\"Tab 1\").layout(layout => [layout.row(\"options\")]);\n                        })\n                        .tab(\"tab2\", tab => {\n                            tab.label(\"Tab 2\")\n                                .rules([\n                                    {\n                                        type: \"condition\",\n                                        target: \"options\",\n                                        operator: \"!=\",\n                                        value: \"map\",\n                                        action: \"disable\"\n                                    },\n                                    accessRule(\"admin:user-1\")\n                                ])\n                                .layout(layout => [layout.row(\"map\")]);\n                        })\n                ]\n            });\n\n        const tabs = form.vm.layout.find(n => n.type === \"tabs\") as ITabsNodeVM;\n        expect(tabs.tabs.map(t => t.id)).toEqual([\"tab1\"]);\n        expect(form.field(\"map\").visible).toBe(false);\n    });\n});\n"],"names":["createIdentity","id","teamSlugs","Identity","slug","accessRule","value","action","createContainer","identity","container","Container","FormModelFeature","IdentityContext","createFieldForm","rules","FormModelFactory","fields","describe","it","form","expect","_","teams","visible","disabled","layout","tab","tabs","n","t"],"mappings":";;;;;;AAOA,MAAMA,iBAAiB,CAACC,IAAYC,YAAsB,EAAE,GACxDC,SAAS,mBAAmB,CAAC;QACzBF;QACA,MAAM;QACN,aAAaA;QACb,OAAO,EAAE;QACT,OAAOC,UAAU,GAAG,CAACE,CAAAA,OAAS;gBAAE,IAAI,GAAGA,KAAK,GAAG,CAAC;gBAAEA;gBAAM,MAAMA;YAAK;QACnE,aAAa,EAAE;QACf,SAAS;YAAE,UAAU;QAAM;QAC3B,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;QAC1C,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;IAC9C;AAEJ,MAAMC,aAAa,CAACC,OAAuBC,SAA0B,MAAM,GAAa;QACpF,MAAM;QACN,QAAQ;QACR,UAAU;QACVD;QACAC;IACJ;AAEA,MAAMC,kBAAkB,CAACC;IACrB,MAAMC,YAAY,IAAIC;IACtBC,iBAAiB,QAAQ,CAACF;IAC1BA,UAAU,gBAAgB,CAACG,iBAAiB;QACxC,aAAa,IAAMJ;QACnB,aAAa,KAAO;QACpB,OAAO,KAAO;IAClB;IACA,OAAOC;AACX;AAEA,MAAMI,kBAAkB,CAACL,UAAoBM,QACzCP,gBAAgBC,UACX,OAAO,CAACO,kBACR,MAAM,CAAC;QACJ,QAAQC,CAAAA,SAAW;gBACf,QAAQA,OAAO,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,CAACF;YAChD;IACJ;AAERG,SAAS,8BAA8B;IACnCC,GAAG,+CAA+C;QAC9C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,uEAAuE;QACtE,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wDAAwD;QACvD,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,mCAAmC;QAClC,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YACnDK,WAAW,gBAAgB;SAC9B;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;QAC1CC,OAAOD,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;IAClD;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;YACXA,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAF,SAAS,8CAA8C;QACnD,MAAMH,QAAQ;YAACV,WAAW,gBAAgB;YAAYA,WAAW,eAAe;SAAQ;QAExFc,GAAG,IAAI,CAAC;YACJ;gBAAC;gBAAmC;gBAAU,EAAE;gBAAE;gBAAM;aAAK;YAC7D;gBAAC;gBAAmC;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAM;YACvE;gBAAC;gBAAsB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAK;YACzD;gBAAC;gBAAwB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAM;aAAM;SAC9D,EAAE,MAAM,CAACG,GAAGrB,IAAIsB,OAAOC,SAASC;YAC7B,MAAML,OAAON,gBAAgBd,eAAeC,IAAIsB,QAAQR;YAExDM,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAACI;YAC1CH,OAAOD,KAAK,KAAK,CAAC,UAAU,QAAQ,EAAE,IAAI,CAACK;QAC/C;IACJ;IAEAN,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBX,SAAS,eAAe,IAAI;YAACE,WAAW;SAAmB;QAExFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,IAAI,CAAC;QACJ;YAAC;YAAY;SAAS;QACtB;YAAC;YAAiB;SAAc;QAChC;YAAC;YAAY;SAAS;QACtB;YAAC;YAAQ;SAAK;QACd;YAAC;YAAc;SAAE;KACpB,EAAE,kCAAkC,CAACG,GAAGhB;QACrC,MAAMc,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAWC;SAAO;QAE1Ee,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,yEAAyE;QACxE,MAAMC,OAAOZ,gBAAgBR,eAAe,WACvC,OAAO,CAACgB,kBACR,MAAM,CAAC;YACJ,QAAQC,CAAAA,SAAW;oBACf,SAASA,OAAO,IAAI,GAAG,KAAK,CAAC;oBAC7B,KAAKA,OAAO,IAAI,GAAG,KAAK,CAAC;gBAC7B;YACA,QAAQS,CAAAA,SAAU;oBACdA,OACK,IAAI,CAAC,QACL,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SAAS,MAAM,CAACD,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAW;oBAC/D,GACC,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SACL,KAAK,CAAC;4BACH;gCACI,MAAM;gCACN,QAAQ;gCACR,UAAU;gCACV,OAAO;gCACP,QAAQ;4BACZ;4BACAtB,WAAW;yBACd,EACA,MAAM,CAACqB,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAO;oBAC7C;iBACP;QACL;QAEJ,MAAME,OAAOR,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAACS,CAAAA,IAAKA,AAAW,WAAXA,EAAE,IAAI;QAC5CR,OAAOO,KAAK,IAAI,CAAC,GAAG,CAACE,CAAAA,IAAKA,EAAE,EAAE,GAAG,OAAO,CAAC;YAAC;SAAO;QACjDT,OAAOD,KAAK,KAAK,CAAC,OAAO,OAAO,EAAE,IAAI,CAAC;IAC3C;AACJ"}

package/features/formModel/ConditionRuleEvaluator.d.ts

@@ -0,0 +1,9 @@
+import type { IFormModel } from "./abstractions.js";
+import { RuleEvaluator } from "./abstractions.js";
+export declare class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {
+    canEvaluate(rule: RuleEvaluator.Rule): boolean;
+    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean;
+}
+export declare const ConditionRuleEvaluator: typeof ConditionRuleEvaluatorImpl & {
+    __abstraction: import("@webiny/di").Abstraction<import("./abstractions.js").IRuleEvaluator>;
+};

package/features/formModel/ConditionRuleEvaluator.js

@@ -0,0 +1,79 @@
+import { RuleEvaluator } from "./abstractions.js";
+const isEmpty = (value)=>{
+    if (null == value || "" === value) return true;
+    if (Array.isArray(value) && 0 === value.length) return true;
+    return false;
+};
+const isEqual = (value, ruleValue)=>{
+    if ("boolean" == typeof value || "boolean" == typeof ruleValue) return value === ruleValue;
+    return value == ruleValue;
+};
+class ConditionRuleEvaluatorImpl {
+    canEvaluate(rule) {
+        return "condition" === rule.type;
+    }
+    evaluate(rule, form) {
+        const field = safeGetField(form, rule.target);
+        const value = field?.getValue() ?? null;
+        switch(rule.operator){
+            case "==":
+            case "eq":
+                return isEqual(value, rule.value);
+            case "!=":
+            case "neq":
+                return !isEqual(value, rule.value);
+            case ">":
+            case "gt":
+                return Number(value) > Number(rule.value);
+            case "<":
+            case "lt":
+                return Number(value) < Number(rule.value);
+            case ">=":
+            case "gte":
+                return Number(value) >= Number(rule.value);
+            case "<=":
+            case "lte":
+                return Number(value) <= Number(rule.value);
+            case "isEmpty":
+                return isEmpty(value);
+            case "isNotEmpty":
+                return !isEmpty(value);
+            case "isTruthy":
+                return !!value;
+            case "isFalsy":
+                return !value;
+            case "matches":
+                if ("string" != typeof value || null === rule.value) return false;
+                return value === rule.value;
+            case "contains":
+                return String(value ?? "").includes(String(rule.value ?? ""));
+            case "notContains":
+                return !String(value ?? "").includes(String(rule.value ?? ""));
+            case "startsWith":
+                return String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "notStartsWith":
+                return !String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "endsWith":
+                return String(value ?? "").endsWith(String(rule.value ?? ""));
+            case "notEndsWith":
+                return !String(value ?? "").endsWith(String(rule.value ?? ""));
+            default:
+                if ("development" === process.env.NODE_ENV) console.warn(`[FormModel] Unknown operator "${rule.operator}" in condition rule. Returning false.`);
+                return false;
+        }
+    }
+}
+function safeGetField(form, name) {
+    try {
+        return form.field(name);
+    } catch  {
+        return;
+    }
+}
+const ConditionRuleEvaluator = RuleEvaluator.createImplementation({
+    implementation: ConditionRuleEvaluatorImpl,
+    dependencies: []
+});
+export { ConditionRuleEvaluator, ConditionRuleEvaluatorImpl };
+
+//# sourceMappingURL=ConditionRuleEvaluator.js.map

package/features/formModel/ConditionRuleEvaluator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/ConditionRuleEvaluator.js","sources":["../../../src/features/formModel/ConditionRuleEvaluator.ts"],"sourcesContent":["import type { IFormModel } from \"./abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nconst isEmpty = (value: unknown): boolean => {\n    if (value === null || value === undefined || value === \"\") {\n        return true;\n    }\n    if (Array.isArray(value) && value.length === 0) {\n        return true;\n    }\n    return false;\n};\n\n// Loose equality coerces booleans to numbers (\"\" == false, 0 == false), so compare them strictly.\nconst isEqual = (value: unknown, ruleValue: unknown): boolean => {\n    if (typeof value === \"boolean\" || typeof ruleValue === \"boolean\") {\n        return value === ruleValue;\n    }\n    return value == ruleValue;\n};\n\nexport class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"condition\";\n    }\n\n    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean {\n        const field = safeGetField(form, rule.target);\n        const value = field?.getValue() ?? null;\n\n        switch (rule.operator) {\n            case \"==\":\n            case \"eq\":\n                return isEqual(value, rule.value);\n            case \"!=\":\n            case \"neq\":\n                return !isEqual(value, rule.value);\n            case \">\":\n            case \"gt\":\n                return Number(value) > Number(rule.value);\n            case \"<\":\n            case \"lt\":\n                return Number(value) < Number(rule.value);\n            case \">=\":\n            case \"gte\":\n                return Number(value) >= Number(rule.value);\n            case \"<=\":\n            case \"lte\":\n                return Number(value) <= Number(rule.value);\n            case \"isEmpty\":\n                return isEmpty(value);\n            case \"isNotEmpty\":\n                return !isEmpty(value);\n            case \"isTruthy\":\n                return !!value;\n            case \"isFalsy\":\n                return !value;\n            case \"matches\":\n                if (typeof value !== \"string\" || rule.value === null) {\n                    return false;\n                }\n                return value === rule.value;\n            case \"contains\":\n                return String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"notContains\":\n                return !String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"startsWith\":\n                return String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"notStartsWith\":\n                return !String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"endsWith\":\n                return String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            case \"notEndsWith\":\n                return !String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            default:\n                if (process.env.NODE_ENV === \"development\") {\n                    console.warn(\n                        `[FormModel] Unknown operator \"${rule.operator}\" in condition rule. Returning false.`\n                    );\n                }\n                return false;\n        }\n    }\n}\n\nfunction safeGetField(form: IFormModel, name: string) {\n    try {\n        return form.field(name);\n    } catch {\n        return undefined;\n    }\n}\n\nexport const ConditionRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: ConditionRuleEvaluatorImpl,\n    dependencies: []\n});\n"],"names":["isEmpty","value","Array","isEqual","ruleValue","ConditionRuleEvaluatorImpl","rule","form","field","safeGetField","Number","String","process","console","name","ConditionRuleEvaluator","RuleEvaluator"],"mappings":";AAGA,MAAMA,UAAU,CAACC;IACb,IAAIA,QAAAA,SAAyCA,AAAU,OAAVA,OACzC,OAAO;IAEX,IAAIC,MAAM,OAAO,CAACD,UAAUA,AAAiB,MAAjBA,MAAM,MAAM,EACpC,OAAO;IAEX,OAAO;AACX;AAGA,MAAME,UAAU,CAACF,OAAgBG;IAC7B,IAAI,AAAiB,aAAjB,OAAOH,SAAuB,AAAqB,aAArB,OAAOG,WACrC,OAAOH,UAAUG;IAErB,OAAOH,SAASG;AACpB;AAEO,MAAMC;IACT,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,gBAAdA,KAAK,IAAI;IACpB;IAEA,SAASA,IAAwB,EAAEC,IAAgB,EAAW;QAC1D,MAAMC,QAAQC,aAAaF,MAAMD,KAAK,MAAM;QAC5C,MAAML,QAAQO,OAAO,cAAc;QAEnC,OAAQF,KAAK,QAAQ;YACjB,KAAK;YACL,KAAK;gBACD,OAAOH,QAAQF,OAAOK,KAAK,KAAK;YACpC,KAAK;YACL,KAAK;gBACD,OAAO,CAACH,QAAQF,OAAOK,KAAK,KAAK;YACrC,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;gBACD,OAAON,QAAQC;YACnB,KAAK;gBACD,OAAO,CAACD,QAAQC;YACpB,KAAK;gBACD,OAAO,CAAC,CAACA;YACb,KAAK;gBACD,OAAO,CAACA;YACZ,KAAK;gBACD,IAAI,AAAiB,YAAjB,OAAOA,SAAsBK,AAAe,SAAfA,KAAK,KAAK,EACvC,OAAO;gBAEX,OAAOL,UAAUK,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC/D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAChE,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D;gBACI,IAAIM,AAAyB,kBAAzBA,QAAQ,GAAG,CAAC,QAAQ,EACpBC,QAAQ,IAAI,CACR,CAAC,8BAA8B,EAAEP,KAAK,QAAQ,CAAC,qCAAqC,CAAC;gBAG7F,OAAO;QACf;IACJ;AACJ;AAEA,SAASG,aAAaF,IAAgB,EAAEO,IAAY;IAChD,IAAI;QACA,OAAOP,KAAK,KAAK,CAACO;IACtB,EAAE,OAAM;QACJ;IACJ;AACJ;AAEO,MAAMC,yBAAyBC,cAAc,oBAAoB,CAAC;IACrE,gBAAgBX;IAChB,cAAc,EAAE;AACpB"}

package/features/formModel/Field.d.ts

@@ -0,0 +1,113 @@
+import type { IFieldConfig, IFieldVM, IFieldValidation, IFormModel, IField, IRule, FieldTypeMap, BeforeChangeCallback, AfterChangeCallback, AfterSetValueCallback, OnBlurCallback, ComputedFieldCallback, IFieldCallbackParams } from "./abstractions.js";
+export declare class Field implements IField {
+    private _value;
+    private _validation;
+    private _disabled;
+    private _hidden;
+    private _beforeChangeCallbacks;
+    private _afterChangeCallbacks;
+    private _afterSetValueCallbacks;
+    private _onBlurCallbacks;
+    private _requiredWhenCallbacks;
+    private _hiddenWhenCallbacks;
+    private _disabledWhenCallbacks;
+    private _computed;
+    private _computedUntilDirty;
+    /** Set once a computedUntilDirty field receives its first user edit. */
+    private _computedOverridden;
+    private _validating;
+    private _validationCacheKey;
+    private _validationCache;
+    private _isUIChange;
+    private _focusRequested;
+    private _qualifiedName;
+    private _parentPath;
+    private _scopePath;
+    private _form;
+    private _ancestorRules;
+    readonly config: IFieldConfig;
+    constructor(config: IFieldConfig);
+    get name(): string;
+    get type(): string;
+    getValue<T = unknown>(): T;
+    /**
+     * Set value with beforeChange/afterChange pipeline.
+     * beforeChange always runs (pure transform).
+     * afterChange only fires when value actually changed.
+     */
+    setValue(raw: unknown): void;
+    /**
+     * Set value directly without running pipelines. Used by setData() and reset().
+     */
+    setValueSilent(value: unknown): void;
+    setDisabled(value: boolean): void;
+    /**
+     * `form.field()` throws for a path it can't resolve, which happens while a form is
+     * still being assembled. Ancestor lookups treat that as "no parent" rather than
+     * failing the render.
+     */
+    private _safeGetField;
+    private _evaluateRules;
+    get visible(): boolean;
+    get disabled(): boolean;
+    setVisible(value: boolean): void;
+    setAncestorRules(rules: IRule[]): void;
+    setValidation(validation: IFieldValidation): void;
+    setValidationWithCache(validation: IFieldValidation, value: unknown, result: boolean): void;
+    resetValidation(): void;
+    addBeforeChange(cb: BeforeChangeCallback): void;
+    addAfterChange(cb: AfterChangeCallback): void;
+    addAfterSetValue(cb: AfterSetValueCallback): void;
+    addOnBlur(cb: OnBlurCallback): void;
+    addRequiredWhen(fn: (params: IFieldCallbackParams) => boolean, message?: string): void;
+    setComputed(fn: ComputedFieldCallback): void;
+    setComputedUntilDirty(fn: ComputedFieldCallback): void;
+    /**
+     * Effective `required` state — true if the built-in `.required()` flag is
+     * set, or if any `requiredWhen()` callback returns `true` for the current
+     * form state. The first truthy callback wins; its message is used.
+     */
+    resolveRequired(): {
+        required: boolean;
+        message?: string;
+    };
+    private _resolveRequired;
+    blur(): void;
+    setForm(form: IFormModel, parentPath?: string, scopePath?: () => string): void;
+    /**
+     * A path `form.field()` resolves to exactly this field. Same as `qualifiedName`,
+     * except inside list items, where it carries the item index (`blocks.2.title`).
+     */
+    get scopedName(): string;
+    private _callbackParams;
+    get qualifiedName(): string;
+    focus(): void;
+    requestFocus(): void;
+    clearFocusRequest(): void;
+    as<T extends keyof FieldTypeMap>(type: T): FieldTypeMap[T];
+    remove(): void;
+    get vm(): IFieldVM;
+    private _setValueFromUI;
+    private _applyNormalizeValue;
+    private _addItem;
+    private _removeItem;
+    private _resolveOptions;
+    private _resolveContext;
+    /**
+     * Validate this field. Returns true if valid.
+     * Validation order: required check → zod schema.
+     * Hidden fields are excluded from validation.
+     *
+     * Pass `{ force: true }` to bypass the memoization cache (used by
+     * `form.validate()` / `form.submit()`). Blur-triggered validation
+     * omits the flag so unchanged values return the cached result.
+     */
+    validate(options?: {
+        force?: boolean;
+    }): Promise<boolean>;
+    private _serializeValue;
+    /** True if this field has any computed callback configured. */
+    get isComputed(): boolean;
+    /** True if a computedUntilDirty field has been overridden by user edit. */
+    get isComputedOverridden(): boolean;
+}