@webiny/app-admin 6.6.0-alpha.0 → 6.6.0-alpha.10

package/features/formModel/AccessControlRuleEvaluator.test.js

@@ -0,0 +1,219 @@
+import { describe, expect, it } from "vitest";
+import { Container } from "@webiny/di";
+import { FormModelFeature } from "./feature.js";
+import { FormModelFactory } from "./abstractions.js";
+import { IdentityContext } from "../security/IdentityContext/abstractions.js";
+import { Identity } from "../../domain/Identity.js";
+const createIdentity = (id, teamSlugs = [])=>Identity.createAuthenticated({
+        id,
+        type: "admin",
+        displayName: id,
+        roles: [],
+        teams: teamSlugs.map((slug)=>({
+                id: `${slug}-id`,
+                slug,
+                name: slug
+            })),
+        permissions: [],
+        profile: {
+            external: false
+        },
+        currentTenant: {
+            id: "root",
+            name: "Root"
+        },
+        defaultTenant: {
+            id: "root",
+            name: "Root"
+        }
+    });
+const accessRule = (value, action = "hide")=>({
+        type: "accessControl",
+        target: "identity",
+        operator: "matches",
+        value,
+        action
+    });
+const createContainer = (identity)=>{
+    const container = new Container();
+    FormModelFeature.register(container);
+    container.registerInstance(IdentityContext, {
+        getIdentity: ()=>identity,
+        setIdentity: ()=>{},
+        clear: ()=>{}
+    });
+    return container;
+};
+const createFieldForm = (identity, rules)=>createContainer(identity).resolve(FormModelFactory).create({
+        fields: (fields)=>({
+                secret: fields.text().label("Secret").rules(rules)
+            })
+    });
+describe("AccessControlRuleEvaluator", ()=>{
+    it("hides a field from the admin the rule names", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for other admins", ()=>{
+        const form = createFieldForm(createIdentity("user-2"), [
+            accessRule("admin:user-1")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a field from members of the team the rule names, by team slug", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    it("leaves the field visible for admins outside the team", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "writers"
+        ]), [
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("does not match a team by its id", ()=>{
+        const form = createFieldForm(createIdentity("user-2", [
+            "editors"
+        ]), [
+            accessRule("team:editors-id")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("disables the field for a viewer rule", ()=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule("admin:user-1", "disable")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+        expect(form.field("secret").vm.disabled).toBe(true);
+    });
+    it("applies when any of several rules matches", ()=>{
+        const form = createFieldForm(createIdentity("user-3", [
+            "editors"
+        ]), [
+            accessRule("admin:user-1"),
+            accessRule("team:editors")
+        ]);
+        expect(form.field("secret").visible).toBe(false);
+    });
+    describe("read-only and no-access rules on one field", ()=>{
+        const rules = [
+            accessRule("admin:user-1", "disable"),
+            accessRule("team:team-1", "hide")
+        ];
+        it.each([
+            [
+                "matches only the read-only rule",
+                "user-1",
+                [],
+                true,
+                true
+            ],
+            [
+                "matches only the no-access rule",
+                "user-2",
+                [
+                    "team-1"
+                ],
+                false,
+                false
+            ],
+            [
+                "matches both rules",
+                "user-1",
+                [
+                    "team-1"
+                ],
+                false,
+                true
+            ],
+            [
+                "matches neither rule",
+                "user-2",
+                [
+                    "team-2"
+                ],
+                true,
+                false
+            ]
+        ])("%s", (_, id, teams, visible, disabled)=>{
+            const form = createFieldForm(createIdentity(id, teams), rules);
+            expect(form.field("secret").visible).toBe(visible);
+            expect(form.field("secret").disabled).toBe(disabled);
+        });
+    });
+    it("does not match an anonymous identity", ()=>{
+        const form = createFieldForm(Identity.createAnonymous(), [
+            accessRule("admin:anonymous")
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it.each([
+        [
+            "no scope",
+            "user-1"
+        ],
+        [
+            "unknown scope",
+            "role:user-1"
+        ],
+        [
+            "empty id",
+            "admin:"
+        ],
+        [
+            "null",
+            null
+        ],
+        [
+            "non-string",
+            1
+        ]
+    ])("ignores a malformed value (%s)", (_, value)=>{
+        const form = createFieldForm(createIdentity("user-1"), [
+            accessRule(value)
+        ]);
+        expect(form.field("secret").visible).toBe(true);
+    });
+    it("hides a tab from the admin the rule names, alongside a condition rule", ()=>{
+        const form = createContainer(createIdentity("user-1")).resolve(FormModelFactory).create({
+            fields: (fields)=>({
+                    options: fields.text().label("Options"),
+                    map: fields.text().label("Map")
+                }),
+            layout: (layout)=>[
+                    layout.tabs("tabs").tab("tab1", (tab)=>{
+                        tab.label("Tab 1").layout((layout)=>[
+                                layout.row("options")
+                            ]);
+                    }).tab("tab2", (tab)=>{
+                        tab.label("Tab 2").rules([
+                            {
+                                type: "condition",
+                                target: "options",
+                                operator: "!=",
+                                value: "map",
+                                action: "disable"
+                            },
+                            accessRule("admin:user-1")
+                        ]).layout((layout)=>[
+                                layout.row("map")
+                            ]);
+                    })
+                ]
+        });
+        const tabs = form.vm.layout.find((n)=>"tabs" === n.type);
+        expect(tabs.tabs.map((t)=>t.id)).toEqual([
+            "tab1"
+        ]);
+        expect(form.field("map").visible).toBe(false);
+    });
+});
+
+//# sourceMappingURL=AccessControlRuleEvaluator.test.js.map

package/features/formModel/AccessControlRuleEvaluator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"features/formModel/AccessControlRuleEvaluator.test.js","sources":["../../../src/features/formModel/AccessControlRuleEvaluator.test.ts"],"sourcesContent":["import { describe, it, expect } from \"vitest\";\nimport { Container } from \"@webiny/di\";\nimport { FormModelFeature } from \"./feature.js\";\nimport { FormModelFactory, type IRule, type ITabsNodeVM } from \"./abstractions.js\";\nimport { IdentityContext } from \"~/features/security/IdentityContext/abstractions.js\";\nimport { Identity } from \"~/domain/Identity.js\";\n\nconst createIdentity = (id: string, teamSlugs: string[] = []) =>\n    Identity.createAuthenticated({\n        id,\n        type: \"admin\",\n        displayName: id,\n        roles: [],\n        teams: teamSlugs.map(slug => ({ id: `${slug}-id`, slug, name: slug })),\n        permissions: [],\n        profile: { external: false },\n        currentTenant: { id: \"root\", name: \"Root\" },\n        defaultTenant: { id: \"root\", name: \"Root\" }\n    } as Identity.Data);\n\nconst accessRule = (value: IRule[\"value\"], action: IRule[\"action\"] = \"hide\"): IRule => ({\n    type: \"accessControl\",\n    target: \"identity\",\n    operator: \"matches\",\n    value,\n    action\n});\n\nconst createContainer = (identity: Identity) => {\n    const container = new Container();\n    FormModelFeature.register(container);\n    container.registerInstance(IdentityContext, {\n        getIdentity: () => identity,\n        setIdentity: () => {},\n        clear: () => {}\n    });\n    return container;\n};\n\nconst createFieldForm = (identity: Identity, rules: IRule[]) =>\n    createContainer(identity)\n        .resolve(FormModelFactory)\n        .create({\n            fields: fields => ({\n                secret: fields.text().label(\"Secret\").rules(rules)\n            })\n        });\n\ndescribe(\"AccessControlRuleEvaluator\", () => {\n    it(\"hides a field from the admin the rule names\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for other admins\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\"), [accessRule(\"admin:user-1\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a field from members of the team the rule names, by team slug\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    it(\"leaves the field visible for admins outside the team\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"writers\"]), [\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"does not match a team by its id\", () => {\n        const form = createFieldForm(createIdentity(\"user-2\", [\"editors\"]), [\n            accessRule(\"team:editors-id\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"disables the field for a viewer rule\", () => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [\n            accessRule(\"admin:user-1\", \"disable\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n        expect(form.field(\"secret\").vm.disabled).toBe(true);\n    });\n\n    it(\"applies when any of several rules matches\", () => {\n        const form = createFieldForm(createIdentity(\"user-3\", [\"editors\"]), [\n            accessRule(\"admin:user-1\"),\n            accessRule(\"team:editors\")\n        ]);\n\n        expect(form.field(\"secret\").visible).toBe(false);\n    });\n\n    describe(\"read-only and no-access rules on one field\", () => {\n        const rules = [accessRule(\"admin:user-1\", \"disable\"), accessRule(\"team:team-1\", \"hide\")];\n\n        it.each([\n            [\"matches only the read-only rule\", \"user-1\", [], true, true],\n            [\"matches only the no-access rule\", \"user-2\", [\"team-1\"], false, false],\n            [\"matches both rules\", \"user-1\", [\"team-1\"], false, true],\n            [\"matches neither rule\", \"user-2\", [\"team-2\"], true, false]\n        ])(\"%s\", (_, id, teams, visible, disabled) => {\n            const form = createFieldForm(createIdentity(id, teams), rules);\n\n            expect(form.field(\"secret\").visible).toBe(visible);\n            expect(form.field(\"secret\").disabled).toBe(disabled);\n        });\n    });\n\n    it(\"does not match an anonymous identity\", () => {\n        const form = createFieldForm(Identity.createAnonymous(), [accessRule(\"admin:anonymous\")]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it.each([\n        [\"no scope\", \"user-1\"],\n        [\"unknown scope\", \"role:user-1\"],\n        [\"empty id\", \"admin:\"],\n        [\"null\", null],\n        [\"non-string\", 1]\n    ])(\"ignores a malformed value (%s)\", (_, value) => {\n        const form = createFieldForm(createIdentity(\"user-1\"), [accessRule(value)]);\n\n        expect(form.field(\"secret\").visible).toBe(true);\n    });\n\n    it(\"hides a tab from the admin the rule names, alongside a condition rule\", () => {\n        const form = createContainer(createIdentity(\"user-1\"))\n            .resolve(FormModelFactory)\n            .create({\n                fields: fields => ({\n                    options: fields.text().label(\"Options\"),\n                    map: fields.text().label(\"Map\")\n                }),\n                layout: layout => [\n                    layout\n                        .tabs(\"tabs\")\n                        .tab(\"tab1\", tab => {\n                            tab.label(\"Tab 1\").layout(layout => [layout.row(\"options\")]);\n                        })\n                        .tab(\"tab2\", tab => {\n                            tab.label(\"Tab 2\")\n                                .rules([\n                                    {\n                                        type: \"condition\",\n                                        target: \"options\",\n                                        operator: \"!=\",\n                                        value: \"map\",\n                                        action: \"disable\"\n                                    },\n                                    accessRule(\"admin:user-1\")\n                                ])\n                                .layout(layout => [layout.row(\"map\")]);\n                        })\n                ]\n            });\n\n        const tabs = form.vm.layout.find(n => n.type === \"tabs\") as ITabsNodeVM;\n        expect(tabs.tabs.map(t => t.id)).toEqual([\"tab1\"]);\n        expect(form.field(\"map\").visible).toBe(false);\n    });\n});\n"],"names":["createIdentity","id","teamSlugs","Identity","slug","accessRule","value","action","createContainer","identity","container","Container","FormModelFeature","IdentityContext","createFieldForm","rules","FormModelFactory","fields","describe","it","form","expect","_","teams","visible","disabled","layout","tab","tabs","n","t"],"mappings":";;;;;;AAOA,MAAMA,iBAAiB,CAACC,IAAYC,YAAsB,EAAE,GACxDC,SAAS,mBAAmB,CAAC;QACzBF;QACA,MAAM;QACN,aAAaA;QACb,OAAO,EAAE;QACT,OAAOC,UAAU,GAAG,CAACE,CAAAA,OAAS;gBAAE,IAAI,GAAGA,KAAK,GAAG,CAAC;gBAAEA;gBAAM,MAAMA;YAAK;QACnE,aAAa,EAAE;QACf,SAAS;YAAE,UAAU;QAAM;QAC3B,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;QAC1C,eAAe;YAAE,IAAI;YAAQ,MAAM;QAAO;IAC9C;AAEJ,MAAMC,aAAa,CAACC,OAAuBC,SAA0B,MAAM,GAAa;QACpF,MAAM;QACN,QAAQ;QACR,UAAU;QACVD;QACAC;IACJ;AAEA,MAAMC,kBAAkB,CAACC;IACrB,MAAMC,YAAY,IAAIC;IACtBC,iBAAiB,QAAQ,CAACF;IAC1BA,UAAU,gBAAgB,CAACG,iBAAiB;QACxC,aAAa,IAAMJ;QACnB,aAAa,KAAO;QACpB,OAAO,KAAO;IAClB;IACA,OAAOC;AACX;AAEA,MAAMI,kBAAkB,CAACL,UAAoBM,QACzCP,gBAAgBC,UACX,OAAO,CAACO,kBACR,MAAM,CAAC;QACJ,QAAQC,CAAAA,SAAW;gBACf,QAAQA,OAAO,IAAI,GAAG,KAAK,CAAC,UAAU,KAAK,CAACF;YAChD;IACJ;AAERG,SAAS,8BAA8B;IACnCC,GAAG,+CAA+C;QAC9C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAW;SAAgB;QAEnFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,uEAAuE;QACtE,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wDAAwD;QACvD,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,mCAAmC;QAClC,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBd,eAAe,WAAW;YACnDK,WAAW,gBAAgB;SAC9B;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;QAC1CC,OAAOD,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC;IAClD;IAEAD,GAAG,6CAA6C;QAC5C,MAAMC,OAAON,gBAAgBd,eAAe,UAAU;YAAC;SAAU,GAAG;YAChEK,WAAW;YACXA,WAAW;SACd;QAEDgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAF,SAAS,8CAA8C;QACnD,MAAMH,QAAQ;YAACV,WAAW,gBAAgB;YAAYA,WAAW,eAAe;SAAQ;QAExFc,GAAG,IAAI,CAAC;YACJ;gBAAC;gBAAmC;gBAAU,EAAE;gBAAE;gBAAM;aAAK;YAC7D;gBAAC;gBAAmC;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAM;YACvE;gBAAC;gBAAsB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAO;aAAK;YACzD;gBAAC;gBAAwB;gBAAU;oBAAC;iBAAS;gBAAE;gBAAM;aAAM;SAC9D,EAAE,MAAM,CAACG,GAAGrB,IAAIsB,OAAOC,SAASC;YAC7B,MAAML,OAAON,gBAAgBd,eAAeC,IAAIsB,QAAQR;YAExDM,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAACI;YAC1CH,OAAOD,KAAK,KAAK,CAAC,UAAU,QAAQ,EAAE,IAAI,CAACK;QAC/C;IACJ;IAEAN,GAAG,wCAAwC;QACvC,MAAMC,OAAON,gBAAgBX,SAAS,eAAe,IAAI;YAACE,WAAW;SAAmB;QAExFgB,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,IAAI,CAAC;QACJ;YAAC;YAAY;SAAS;QACtB;YAAC;YAAiB;SAAc;QAChC;YAAC;YAAY;SAAS;QACtB;YAAC;YAAQ;SAAK;QACd;YAAC;YAAc;SAAE;KACpB,EAAE,kCAAkC,CAACG,GAAGhB;QACrC,MAAMc,OAAON,gBAAgBd,eAAe,WAAW;YAACK,WAAWC;SAAO;QAE1Ee,OAAOD,KAAK,KAAK,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC;IAC9C;IAEAD,GAAG,yEAAyE;QACxE,MAAMC,OAAOZ,gBAAgBR,eAAe,WACvC,OAAO,CAACgB,kBACR,MAAM,CAAC;YACJ,QAAQC,CAAAA,SAAW;oBACf,SAASA,OAAO,IAAI,GAAG,KAAK,CAAC;oBAC7B,KAAKA,OAAO,IAAI,GAAG,KAAK,CAAC;gBAC7B;YACA,QAAQS,CAAAA,SAAU;oBACdA,OACK,IAAI,CAAC,QACL,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SAAS,MAAM,CAACD,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAW;oBAC/D,GACC,GAAG,CAAC,QAAQC,CAAAA;wBACTA,IAAI,KAAK,CAAC,SACL,KAAK,CAAC;4BACH;gCACI,MAAM;gCACN,QAAQ;gCACR,UAAU;gCACV,OAAO;gCACP,QAAQ;4BACZ;4BACAtB,WAAW;yBACd,EACA,MAAM,CAACqB,CAAAA,SAAU;gCAACA,OAAO,GAAG,CAAC;6BAAO;oBAC7C;iBACP;QACL;QAEJ,MAAME,OAAOR,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,CAACS,CAAAA,IAAKA,AAAW,WAAXA,EAAE,IAAI;QAC5CR,OAAOO,KAAK,IAAI,CAAC,GAAG,CAACE,CAAAA,IAAKA,EAAE,EAAE,GAAG,OAAO,CAAC;YAAC;SAAO;QACjDT,OAAOD,KAAK,KAAK,CAAC,OAAO,OAAO,EAAE,IAAI,CAAC;IAC3C;AACJ"}

package/features/formModel/ConditionRuleEvaluator.js

@@ -4,6 +4,10 @@ const isEmpty = (value)=>{
     if (Array.isArray(value) && 0 === value.length) return true;
     return false;
 };
+const isEqual = (value, ruleValue)=>{
+    if ("boolean" == typeof value || "boolean" == typeof ruleValue) return value === ruleValue;
+    return value == ruleValue;
+};
 class ConditionRuleEvaluatorImpl {
     canEvaluate(rule) {
         return "condition" === rule.type;
@@ -12,14 +16,28 @@ class ConditionRuleEvaluatorImpl {
         const field = safeGetField(form, rule.target);
         const value = field?.getValue() ?? null;
         switch(rule.operator){
+            case "==":
+            case "eq":
+                return isEqual(value, rule.value);
+            case "!=":
+            case "neq":
+                return !isEqual(value, rule.value);
+            case ">":
+            case "gt":
+                return Number(value) > Number(rule.value);
+            case "<":
+            case "lt":
+                return Number(value) < Number(rule.value);
+            case ">=":
+            case "gte":
+                return Number(value) >= Number(rule.value);
+            case "<=":
+            case "lte":
+                return Number(value) <= Number(rule.value);
             case "isEmpty":
                 return isEmpty(value);
             case "isNotEmpty":
                 return !isEmpty(value);
-            case "eq":
-                return value === rule.value;
-            case "neq":
-                return value !== rule.value;
             case "isTruthy":
                 return !!value;
             case "isFalsy":
@@ -27,6 +45,18 @@ class ConditionRuleEvaluatorImpl {
             case "matches":
                 if ("string" != typeof value || null === rule.value) return false;
                 return value === rule.value;
+            case "contains":
+                return String(value ?? "").includes(String(rule.value ?? ""));
+            case "notContains":
+                return !String(value ?? "").includes(String(rule.value ?? ""));
+            case "startsWith":
+                return String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "notStartsWith":
+                return !String(value ?? "").startsWith(String(rule.value ?? ""));
+            case "endsWith":
+                return String(value ?? "").endsWith(String(rule.value ?? ""));
+            case "notEndsWith":
+                return !String(value ?? "").endsWith(String(rule.value ?? ""));
             default:
                 if ("development" === process.env.NODE_ENV) console.warn(`[FormModel] Unknown operator "${rule.operator}" in condition rule. Returning false.`);
                 return false;

package/features/formModel/ConditionRuleEvaluator.js.map

@@ -1 +1 @@
-{"version":3,"file":"features/formModel/ConditionRuleEvaluator.js","sources":["../../../src/features/formModel/ConditionRuleEvaluator.ts"],"sourcesContent":["import type { IFormModel } from \"./abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nconst isEmpty = (value: unknown): boolean => {\n    if (value === null || value === undefined || value === \"\") {\n        return true;\n    }\n    if (Array.isArray(value) && value.length === 0) {\n        return true;\n    }\n    return false;\n};\n\nexport class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"condition\";\n    }\n\n    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean {\n        const field = safeGetField(form, rule.target);\n        const value = field?.getValue() ?? null;\n\n        switch (rule.operator) {\n            case \"isEmpty\":\n                return isEmpty(value);\n            case \"isNotEmpty\":\n                return !isEmpty(value);\n            case \"eq\":\n                return value === rule.value;\n            case \"neq\":\n                return value !== rule.value;\n            case \"isTruthy\":\n                return !!value;\n            case \"isFalsy\":\n                return !value;\n            case \"matches\":\n                if (typeof value !== \"string\" || rule.value === null) {\n                    return false;\n                }\n                return value === rule.value;\n            default:\n                if (process.env.NODE_ENV === \"development\") {\n                    console.warn(\n                        `[FormModel] Unknown operator \"${rule.operator}\" in condition rule. Returning false.`\n                    );\n                }\n                return false;\n        }\n    }\n}\n\nfunction safeGetField(form: IFormModel, name: string) {\n    try {\n        return form.field(name);\n    } catch {\n        return undefined;\n    }\n}\n\nexport const ConditionRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: ConditionRuleEvaluatorImpl,\n    dependencies: []\n});\n"],"names":["isEmpty","value","Array","ConditionRuleEvaluatorImpl","rule","form","field","safeGetField","process","console","name","ConditionRuleEvaluator","RuleEvaluator"],"mappings":";AAGA,MAAMA,UAAU,CAACC;IACb,IAAIA,QAAAA,SAAyCA,AAAU,OAAVA,OACzC,OAAO;IAEX,IAAIC,MAAM,OAAO,CAACD,UAAUA,AAAiB,MAAjBA,MAAM,MAAM,EACpC,OAAO;IAEX,OAAO;AACX;AAEO,MAAME;IACT,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,gBAAdA,KAAK,IAAI;IACpB;IAEA,SAASA,IAAwB,EAAEC,IAAgB,EAAW;QAC1D,MAAMC,QAAQC,aAAaF,MAAMD,KAAK,MAAM;QAC5C,MAAMH,QAAQK,OAAO,cAAc;QAEnC,OAAQF,KAAK,QAAQ;YACjB,KAAK;gBACD,OAAOJ,QAAQC;YACnB,KAAK;gBACD,OAAO,CAACD,QAAQC;YACpB,KAAK;gBACD,OAAOA,UAAUG,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAOH,UAAUG,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAO,CAAC,CAACH;YACb,KAAK;gBACD,OAAO,CAACA;YACZ,KAAK;gBACD,IAAI,AAAiB,YAAjB,OAAOA,SAAsBG,AAAe,SAAfA,KAAK,KAAK,EACvC,OAAO;gBAEX,OAAOH,UAAUG,KAAK,KAAK;YAC/B;gBACI,IAAII,AAAyB,kBAAzBA,QAAQ,GAAG,CAAC,QAAQ,EACpBC,QAAQ,IAAI,CACR,CAAC,8BAA8B,EAAEL,KAAK,QAAQ,CAAC,qCAAqC,CAAC;gBAG7F,OAAO;QACf;IACJ;AACJ;AAEA,SAASG,aAAaF,IAAgB,EAAEK,IAAY;IAChD,IAAI;QACA,OAAOL,KAAK,KAAK,CAACK;IACtB,EAAE,OAAM;QACJ;IACJ;AACJ;AAEO,MAAMC,yBAAyBC,cAAc,oBAAoB,CAAC;IACrE,gBAAgBT;IAChB,cAAc,EAAE;AACpB"}
+{"version":3,"file":"features/formModel/ConditionRuleEvaluator.js","sources":["../../../src/features/formModel/ConditionRuleEvaluator.ts"],"sourcesContent":["import type { IFormModel } from \"./abstractions.js\";\nimport { RuleEvaluator } from \"./abstractions.js\";\n\nconst isEmpty = (value: unknown): boolean => {\n    if (value === null || value === undefined || value === \"\") {\n        return true;\n    }\n    if (Array.isArray(value) && value.length === 0) {\n        return true;\n    }\n    return false;\n};\n\n// Loose equality coerces booleans to numbers (\"\" == false, 0 == false), so compare them strictly.\nconst isEqual = (value: unknown, ruleValue: unknown): boolean => {\n    if (typeof value === \"boolean\" || typeof ruleValue === \"boolean\") {\n        return value === ruleValue;\n    }\n    return value == ruleValue;\n};\n\nexport class ConditionRuleEvaluatorImpl implements RuleEvaluator.Interface {\n    canEvaluate(rule: RuleEvaluator.Rule): boolean {\n        return rule.type === \"condition\";\n    }\n\n    evaluate(rule: RuleEvaluator.Rule, form: IFormModel): boolean {\n        const field = safeGetField(form, rule.target);\n        const value = field?.getValue() ?? null;\n\n        switch (rule.operator) {\n            case \"==\":\n            case \"eq\":\n                return isEqual(value, rule.value);\n            case \"!=\":\n            case \"neq\":\n                return !isEqual(value, rule.value);\n            case \">\":\n            case \"gt\":\n                return Number(value) > Number(rule.value);\n            case \"<\":\n            case \"lt\":\n                return Number(value) < Number(rule.value);\n            case \">=\":\n            case \"gte\":\n                return Number(value) >= Number(rule.value);\n            case \"<=\":\n            case \"lte\":\n                return Number(value) <= Number(rule.value);\n            case \"isEmpty\":\n                return isEmpty(value);\n            case \"isNotEmpty\":\n                return !isEmpty(value);\n            case \"isTruthy\":\n                return !!value;\n            case \"isFalsy\":\n                return !value;\n            case \"matches\":\n                if (typeof value !== \"string\" || rule.value === null) {\n                    return false;\n                }\n                return value === rule.value;\n            case \"contains\":\n                return String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"notContains\":\n                return !String(value ?? \"\").includes(String(rule.value ?? \"\"));\n            case \"startsWith\":\n                return String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"notStartsWith\":\n                return !String(value ?? \"\").startsWith(String(rule.value ?? \"\"));\n            case \"endsWith\":\n                return String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            case \"notEndsWith\":\n                return !String(value ?? \"\").endsWith(String(rule.value ?? \"\"));\n            default:\n                if (process.env.NODE_ENV === \"development\") {\n                    console.warn(\n                        `[FormModel] Unknown operator \"${rule.operator}\" in condition rule. Returning false.`\n                    );\n                }\n                return false;\n        }\n    }\n}\n\nfunction safeGetField(form: IFormModel, name: string) {\n    try {\n        return form.field(name);\n    } catch {\n        return undefined;\n    }\n}\n\nexport const ConditionRuleEvaluator = RuleEvaluator.createImplementation({\n    implementation: ConditionRuleEvaluatorImpl,\n    dependencies: []\n});\n"],"names":["isEmpty","value","Array","isEqual","ruleValue","ConditionRuleEvaluatorImpl","rule","form","field","safeGetField","Number","String","process","console","name","ConditionRuleEvaluator","RuleEvaluator"],"mappings":";AAGA,MAAMA,UAAU,CAACC;IACb,IAAIA,QAAAA,SAAyCA,AAAU,OAAVA,OACzC,OAAO;IAEX,IAAIC,MAAM,OAAO,CAACD,UAAUA,AAAiB,MAAjBA,MAAM,MAAM,EACpC,OAAO;IAEX,OAAO;AACX;AAGA,MAAME,UAAU,CAACF,OAAgBG;IAC7B,IAAI,AAAiB,aAAjB,OAAOH,SAAuB,AAAqB,aAArB,OAAOG,WACrC,OAAOH,UAAUG;IAErB,OAAOH,SAASG;AACpB;AAEO,MAAMC;IACT,YAAYC,IAAwB,EAAW;QAC3C,OAAOA,AAAc,gBAAdA,KAAK,IAAI;IACpB;IAEA,SAASA,IAAwB,EAAEC,IAAgB,EAAW;QAC1D,MAAMC,QAAQC,aAAaF,MAAMD,KAAK,MAAM;QAC5C,MAAML,QAAQO,OAAO,cAAc;QAEnC,OAAQF,KAAK,QAAQ;YACjB,KAAK;YACL,KAAK;gBACD,OAAOH,QAAQF,OAAOK,KAAK,KAAK;YACpC,KAAK;YACL,KAAK;gBACD,OAAO,CAACH,QAAQF,OAAOK,KAAK,KAAK;YACrC,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,SAASS,OAAOJ,KAAK,KAAK;YAC5C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;YACL,KAAK;gBACD,OAAOI,OAAOT,UAAUS,OAAOJ,KAAK,KAAK;YAC7C,KAAK;gBACD,OAAON,QAAQC;YACnB,KAAK;gBACD,OAAO,CAACD,QAAQC;YACpB,KAAK;gBACD,OAAO,CAAC,CAACA;YACb,KAAK;gBACD,OAAO,CAACA;YACZ,KAAK;gBACD,IAAI,AAAiB,YAAjB,OAAOA,SAAsBK,AAAe,SAAfA,KAAK,KAAK,EACvC,OAAO;gBAEX,OAAOL,UAAUK,KAAK,KAAK;YAC/B,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC/D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,UAAU,CAACU,OAAOL,KAAK,KAAK,IAAI;YAChE,KAAK;gBACD,OAAOK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC7D,KAAK;gBACD,OAAO,CAACK,OAAOV,SAAS,IAAI,QAAQ,CAACU,OAAOL,KAAK,KAAK,IAAI;YAC9D;gBACI,IAAIM,AAAyB,kBAAzBA,QAAQ,GAAG,CAAC,QAAQ,EACpBC,QAAQ,IAAI,CACR,CAAC,8BAA8B,EAAEP,KAAK,QAAQ,CAAC,qCAAqC,CAAC;gBAG7F,OAAO;QACf;IACJ;AACJ;AAEA,SAASG,aAAaF,IAAgB,EAAEO,IAAY;IAChD,IAAI;QACA,OAAOP,KAAK,KAAK,CAACO;IACtB,EAAE,OAAM;QACJ;IACJ;AACJ;AAEO,MAAMC,yBAAyBC,cAAc,oBAAoB,CAAC;IACrE,gBAAgBX;IAChB,cAAc,EAAE;AACpB"}

package/features/formModel/Field.d.ts

@@ -22,6 +22,7 @@ export declare class Field implements IField {
     private _focusRequested;
     private _qualifiedName;
     private _parentPath;
+    private _scopePath;
     private _form;
     private _ancestorRules;
     readonly config: IFieldConfig;
@@ -40,12 +41,19 @@ export declare class Field implements IField {
      */
     setValueSilent(value: unknown): void;
     setDisabled(value: boolean): void;
+    /**
+     * `form.field()` throws for a path it can't resolve, which happens while a form is
+     * still being assembled. Ancestor lookups treat that as "no parent" rather than
+     * failing the render.
+     */
+    private _safeGetField;
     private _evaluateRules;
     get visible(): boolean;
     get disabled(): boolean;
     setVisible(value: boolean): void;
     setAncestorRules(rules: IRule[]): void;
     setValidation(validation: IFieldValidation): void;
+    setValidationWithCache(validation: IFieldValidation, value: unknown, result: boolean): void;
     resetValidation(): void;
     addBeforeChange(cb: BeforeChangeCallback): void;
     addAfterChange(cb: AfterChangeCallback): void;
@@ -65,7 +73,12 @@ export declare class Field implements IField {
     };
     private _resolveRequired;
     blur(): void;
-    setForm(form: IFormModel, parentPath?: string): void;
+    setForm(form: IFormModel, parentPath?: string, scopePath?: () => string): void;
+    /**
+     * A path `form.field()` resolves to exactly this field. Same as `qualifiedName`,
+     * except inside list items, where it carries the item index (`blocks.2.title`).
+     */
+    get scopedName(): string;
     private _callbackParams;
     get qualifiedName(): string;
     focus(): void;

package/features/formModel/Field.js

@@ -48,6 +48,7 @@ class Field {
         this._focusRequested = false;
         this._qualifiedName = "";
         this._parentPath = "";
+        this._scopePath = ()=>this._parentPath;
         this._form = null;
         this._ancestorRules = [];
         this.config = config;
@@ -81,7 +82,8 @@ class Field {
         else if (config.computedUntilDirty) this._computedUntilDirty = config.computedUntilDirty;
         makeAutoObservable(this, {
             config: false,
-            vm: computed
+            vm: computed,
+            _scopePath: false
         });
     }
     get name() {
@@ -120,6 +122,13 @@ class Field {
     setDisabled(value) {
         this._disabled = value;
     }
+    _safeGetField(name) {
+        try {
+            return this._form?.field(name);
+        } catch  {
+            return;
+        }
+    }
     _evaluateRules() {
         if (!this._form) return {
             visible: true,
@@ -134,6 +143,17 @@ class Field {
             visible: true,
             disabled: false
         };
+        const scopePath = this._scopePath();
+        if (scopePath) {
+            const resolved = all.map((rule)=>{
+                if (rule.target.startsWith("$.")) return {
+                    ...rule,
+                    target: `${scopePath}.${rule.target.slice(2)}`
+                };
+                return rule;
+            });
+            return this._form.evaluateRules(resolved);
+        }
         return this._form.evaluateRules(all);
     }
     get visible() {
@@ -146,6 +166,10 @@ class Field {
     }
     get disabled() {
         if (this._disabled) return true;
+        if (this._parentPath && this._form) {
+            const parent = this._safeGetField(this._parentPath);
+            if (parent?.disabled) return true;
+        }
         if (this._form && this._disabledWhenCallbacks.length > 0) {
             const scoped = this._callbackParams();
             for (const cb of this._disabledWhenCallbacks)if (cb(scoped)) return true;
@@ -163,6 +187,11 @@ class Field {
     setValidation(validation) {
         this._validation = validation;
     }
+    setValidationWithCache(validation, value, result) {
+        this._validation = validation;
+        this._validationCacheKey = this._serializeValue(value);
+        this._validationCache = result;
+    }
     resetValidation() {
         this._validation = {
             isValid: null
@@ -220,15 +249,20 @@ class Field {
     blur() {
         for (const cb of this._onBlurCallbacks)cb(this._value, this._callbackParams());
     }
-    setForm(form, parentPath) {
+    setForm(form, parentPath, scopePath) {
         this._form = form;
         this._parentPath = parentPath || "";
+        this._scopePath = scopePath ?? (()=>this._parentPath);
         this._qualifiedName = parentPath ? `${parentPath}.${this.config.name}` : this.config.name;
     }
+    get scopedName() {
+        const scopePath = this._scopePath();
+        return scopePath ? `${scopePath}.${this.config.name}` : this.config.name;
+    }
     _callbackParams() {
         if (!this._form) throw new Error("Field not attached to a form.");
         return {
-            field: new FieldNavigator(this._form, this._qualifiedName),
+            field: new FieldNavigator(this._form, this.scopedName),
             form: this._form
         };
     }
@@ -258,6 +292,7 @@ class Field {
         const required = this._resolveRequired().required;
         return {
             name: this.config.name,
+            qualifiedName: this._qualifiedName,
             type: this.config.type,
             label: this.config.label,
             help: this.config.help,
@@ -355,6 +390,17 @@ class Field {
                     return false;
                 }
             }
+            if (!requiredState.required && null == effectiveValue) {
+                const cacheKey = this._serializeValue(effectiveValue);
+                runInAction(()=>{
+                    this._validation = {
+                        isValid: null
+                    };
+                    this._validationCacheKey = cacheKey;
+                    this._validationCache = true;
+                });
+                return true;
+            }
             if (this.config.schema) {
                 const result = await this.config.schema.safeParseAsync(effectiveValue);
                 if (!result.success) {