cabloy 5.1.212 → 5.1.213

package/.cabloy-version

@@ -1 +1 @@
-5.1.212
+5.1.213

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 5.1.213
+
+### Bug Fixes
+
+- Fix details.
+
 ## 5.1.212
 
 ### Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cabloy",
-  "version": "5.1.212",
+  "version": "5.1.213",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A Node.js fullstack framework",
   "keywords": [

package/repo-docs/frontend/permission-formscene-action-visibility-guide.md

@@ -214,11 +214,11 @@ The current source confirms:
 
 That means the details action family is scene-aware in a different way from `tableActionBulk`.
 
-A practical current example from backend DTO metadata is:
+A practical details example from backend DTO metadata is:
 
 ```tsx
 ZovaRender.detailsActionBulk('basic-details:actionCreate', {
-  permission: { formScene: ['create', 'edit'] },
+  permission: { mode: 'formScene', formScene: ['create', 'edit'] },
 });
 ```
 
@@ -226,15 +226,17 @@ and:
 
 ```tsx
 ZovaRender.detailsActionRow('basic-details:actionDelete', {
-  permission: { formScene: ['create', 'edit'] },
+  permission: { mode: 'formScene', formScene: ['create', 'edit'] },
 });
 ```
 
+For default detail CRUD actions, `permission.mode: 'formScene'` makes the intent explicit: the enclosing form scene controls visibility and no independent action permission check is performed. Custom detail actions should use `permission.mode: 'action'`; an explicit `actionInherit` also takes the action-checking path. If `mode` is omitted, the runtime uses the conservative action-checking path rather than inferring behavior from the action name.
+
 So the correct distinction is:
 
 - `tableActionBulk` does not currently support `formScene`
-- `detailsActionBulk` does support `formScene`
-- `detailsActionRow` also supports `formScene`
+- `detailsActionBulk` supports `formScene` and the detail-specific `mode`
+- `detailsActionRow` supports `formScene` and the detail-specific `mode`
 
 ## 7. Why bulk actions are different today
 

package/vona/packages-cli/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli",
-  "version": "1.1.162",
+  "version": "1.1.163",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli",
   "keywords": [

package/vona/packages-cli/cli-set-api/cli/templates/tools/masterDetail/boilerplate/dto/<%=argv.detailDtoResItemName%>.tsx_

@@ -19,7 +19,7 @@ export interface IDtoOptions<%=cli.helper.firstCharToUpperCase(argv.detailDtoRes
           actions: [
             ZovaRender.detailsActionBulk('<%=argv.detailsModuleName%>:actionCreate', {
               dialogOptions: { title: $locale('Add<%=argv.detailDialogTitleCapitalize%>') },
-              permission: { formScene: ['create', 'edit'] },
+              permission: { mode: 'formScene', formScene: ['create', 'edit'] },
             }),
           ],
         }),
@@ -48,10 +48,10 @@ export class Dto<%=cli.helper.firstCharToUpperCase(argv.detailDtoResItemName)%>
       actions: [
         ZovaRender.detailsActionRow('<%=argv.detailsModuleName%>:actionUpdate', {
           dialogOptions: { title: $locale('Edit<%=argv.detailDialogTitleCapitalize%>') },
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
         ZovaRender.detailsActionRow('<%=argv.detailsModuleName%>:actionDelete', {
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
       ],
     }),

package/vona/packages-cli/cli-set-api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-cli-set-api",
-  "version": "1.1.160",
+  "version": "1.1.161",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "vona cli-set-api",
   "keywords": [

package/vona/src/suite/a-training/modules/training-record/src/dto/detailRecordSubjectResItem.tsx

@@ -19,7 +19,7 @@ export interface IDtoOptionsDetailRecordSubjectResItem extends IDecoratorDtoOpti
           actions: [
             ZovaRender.detailsActionBulk('basic-details:actionCreate', {
               dialogOptions: { title: $locale('AddTrainingRecordSubject') },
-              permission: { formScene: ['create', 'edit'] },
+              permission: { mode: 'formScene', formScene: ['create', 'edit'] },
             }),
           ],
         }),
@@ -53,10 +53,10 @@ export class DtoDetailRecordSubjectResItem extends $Dto.get(() => ModelSubject,
       actions: [
         ZovaRender.detailsActionRow('basic-details:actionUpdate', {
           dialogOptions: { title: $locale('EditTrainingRecordSubject') },
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
         ZovaRender.detailsActionRow('basic-details:actionDelete', {
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
       ],
     }),

package/vona/src/suite/a-training/modules/training-student/src/dto/detailRecordResItem.tsx

@@ -19,7 +19,7 @@ export interface IDtoOptionsDetailRecordResItem extends IDecoratorDtoOptions {}
           actions: [
             ZovaRender.detailsActionBulk('basic-details:actionCreate', {
               dialogOptions: { title: $locale('AddTrainingRecord') },
-              permission: { formScene: ['create', 'edit'] },
+              permission: { mode: 'formScene', formScene: ['create', 'edit'] },
             }),
           ],
         }),
@@ -54,10 +54,10 @@ export class DtoDetailRecordResItem extends $Dto.get(() => ModelRecord, {
       actions: [
         ZovaRender.detailsActionRow('basic-details:actionUpdate', {
           dialogOptions: { title: $locale('EditTrainingRecord') },
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
         ZovaRender.detailsActionRow('basic-details:actionDelete', {
-          permission: { formScene: ['create', 'edit'] },
+          permission: { mode: 'formScene', formScene: ['create', 'edit'] },
         }),
       ],
     }),

package/zova/packages-zova/zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova",
-  "version": "5.1.170",
+  "version": "5.1.171",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "A vue3 framework with ioc",
   "keywords": [
@@ -46,7 +46,7 @@
   },
   "dependencies": {
     "zova-core": "^5.1.92",
-    "zova-suite-a-zova": "^5.1.169"
+    "zova-suite-a-zova": "^5.1.170"
   },
   "devDependencies": {
     "clean-package": "^2.2.0",

package/zova/src/suite/cabloy-basic/modules/basic-details/src/bean/tableCell.actionOperationsRow.tsx

@@ -15,7 +15,6 @@ import { BeanBase } from 'zova';
 import { TableCell } from 'zova-module-a-table';
 
 import { filterDetailsRowActions } from '../lib/detailsPermissions.js';
-import { checkFormScene } from '../lib/utils.js';
 
 declare module 'zova-module-a-openapi' {
   export interface IResourceDetailsActionRowRecord {
@@ -39,11 +38,13 @@ export class TableCellActionOperationsRow extends BeanBase implements ITableCell
     const actions = options.actions;
     if (!actions || actions.length === 0) return false;
     const $$details = $celScope.$$details!;
-    const actionsVisible = actions.filter(action => {
-      return checkFormScene($$details.formScene, action.options?.permission);
-    });
+    const actionsAllowed = filterDetailsRowActions(
+      $$details.formScene,
+      $$details.checkPermission.bind($$details),
+      actions,
+    );
     const renders: TypeTableCellRenderComponent[] = [];
-    for (const action of actionsVisible) {
+    for (const action of actionsAllowed) {
       const actionName = action.name;
       const actionRender = action.render;
       if (!actionRender) throw new Error(`should specify action render: ${actionName}`);

package/zova/src/suite/cabloy-basic/modules/basic-details/src/bean/tableCell.actionUpdate.tsx

@@ -53,6 +53,7 @@ export class TableCellActionUpdate extends BeanBase implements ITableCellRender
             icon: options.dialogOptions?.icon,
             title: options.dialogOptions?.title ?? this.scope.locale.EditDetail(),
             dialogOptions: options.dialogOptions,
+            checkPermission: $$details.checkPermission.bind($$details),
             onSubmitData: (
               data: TypeFormOnSubmitData<Record<string, any>>,
               dialog: AppModalItem,

package/zova/src/suite/cabloy-basic/modules/basic-details/src/bean/tableCell.actionView.tsx

@@ -53,6 +53,7 @@ export class TableCellActionView extends BeanBase implements ITableCellRender {
             icon: options.dialogOptions?.icon,
             title: options.dialogOptions?.title ?? this.scope.locale.ViewDetail(),
             dialogOptions: options.dialogOptions,
+            checkPermission: $$details.checkPermission.bind($$details),
           } satisfies IDialogFormOptions);
           serverDetail.openDialogForm();
         }}

package/zova/src/suite/cabloy-basic/modules/basic-details/src/component/actionCreate/controller.tsx

@@ -47,6 +47,7 @@ export class ControllerActionCreate extends BeanControllerBase {
             icon: this.$props.dialogOptions?.icon,
             title: this.$props.dialogOptions?.title ?? this.scope.locale.AddDetail(),
             dialogOptions: this.$props.dialogOptions,
+            checkPermission: $$details.checkPermission.bind($$details),
             onSubmitData: (
               data: TypeFormOnSubmitData<Record<string, any>>,
               dialog: AppModalItem,

package/zova/src/suite/cabloy-basic/modules/basic-details/src/component/formFieldDetails/controller.tsx

@@ -81,14 +81,26 @@ export class ControllerFormFieldDetails extends BeanControllerBase {
     // blocks
     const blocks = schemaRow?.rest?.blocks;
     if (!blocks || blocks.length === 0) return;
-    const checkPermission: TypeDetailsCheckPermission = createDetailsPermissionChecker(
-      () =>
-        (formFieldRenderContext.celScope as { permissions?: TypeOpenapiPermissions }).permissions,
-      () => $$formField.$$form.formState.values as Record<string, unknown>,
-      (permissions, actionName, permissionHint, currentData) => {
-        return this.$passport.checkPermission(permissions, actionName, permissionHint, currentData);
-      },
-    );
+    const inheritedCheckPermission = (
+      formFieldRenderContext.celScope as {
+        checkPermission?: TypeDetailsCheckPermission;
+      }
+    ).checkPermission;
+    const checkPermission: TypeDetailsCheckPermission =
+      inheritedCheckPermission ??
+      createDetailsPermissionChecker(
+        () =>
+          (formFieldRenderContext.celScope as { permissions?: TypeOpenapiPermissions }).permissions,
+        () => $$formField.$$form.formState.values as Record<string, unknown>,
+        (permissions, actionName, permissionHint, currentData) => {
+          return this.$passport.checkPermission(
+            permissions,
+            actionName,
+            permissionHint,
+            currentData,
+          );
+        },
+      );
     const domBlocks: VNode[] = [];
     blocks.forEach((block, index) => {
       const options = deepExtend(

package/zova/src/suite/cabloy-basic/modules/basic-details/src/lib/detailsPermissions.ts

@@ -1,5 +1,5 @@
 import type {
-  IPermissionHintGeneral,
+  IPermissionHintDetailsAction,
   IResourceRenderDetailsActionBulkOptionsAction,
   IResourceRenderDetailsActionRowOptionsAction,
   TypeFormScene,
@@ -12,7 +12,7 @@ import { checkFormScene } from './utils.js';
 
 export interface IDetailsPermissionAction {
   name?: string;
-  options?: { permission?: IPermissionHintGeneral };
+  options?: { permission?: IPermissionHintDetailsAction };
 }
 
 export function createDetailsPermissionChecker(
@@ -21,7 +21,7 @@ export function createDetailsPermissionChecker(
   checkPermission: (
     permissions: TypeOpenapiPermissions | undefined,
     actionName?: string,
-    permissionHint?: IPermissionHintGeneral,
+    permissionHint?: IPermissionHintDetailsAction,
     currentData?: Record<string, unknown>,
   ) => boolean,
 ): TypeDetailsCheckPermission {
@@ -36,7 +36,9 @@ export function isDetailsActionAllowed(
   action: IDetailsPermissionAction,
 ): boolean {
   const permissionHint = action.options?.permission;
-  return checkFormScene(formScene, permissionHint) && checkPermission(action.name, permissionHint);
+  if (!checkFormScene(formScene, permissionHint)) return false;
+  if (permissionHint?.mode === 'formScene' && !permissionHint.actionInherit) return true;
+  return checkPermission(action.name, permissionHint);
 }
 
 export function filterDetailsActions<TAction extends IDetailsPermissionAction>(

package/zova/src/suite/cabloy-basic/modules/basic-details/src/service/detail.tsx

@@ -91,6 +91,7 @@ export class ServiceDetail<TData extends {} = {}> extends BeanBase {
     return {
       formMeta: this.formMeta,
       $$detail,
+      checkPermission: this.options.checkPermission,
     };
   }
 

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/detail.ts

@@ -3,6 +3,7 @@ import 'zova-module-a-form';
 import 'zova-module-a-openapi';
 
 import type { ServiceDetail } from '../service/detail.jsx';
+import type { TypeDetailsCheckPermission } from './details.js';
 
 declare module 'zova-module-a-openapi' {
   export interface IJsxRenderContextDetail<TData extends {} = {}> {
@@ -11,6 +12,7 @@ declare module 'zova-module-a-openapi' {
 
   export interface IDetailScope {
     $$detail?: ServiceDetail;
+    checkPermission?: TypeDetailsCheckPermission;
   }
 }
 

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/details.ts

@@ -1,12 +1,12 @@
 import 'zova-module-a-table';
 import 'zova-module-a-openapi';
-import type { IDetailsScope, IPermissionHintGeneral } from 'zova-module-a-openapi';
+import type { IDetailsScope, IPermissionHintDetailsAction } from 'zova-module-a-openapi';
 
 import { ControllerBlockDetails } from '../component/blockDetails/controller.jsx';
 
 export type TypeDetailsCheckPermission = (
   actionName?: string,
-  permissionHint?: IPermissionHintGeneral,
+  permissionHint?: IPermissionHintDetailsAction,
 ) => boolean;
 
 declare module 'zova-module-a-openapi' {

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/dialogForm.ts

@@ -3,6 +3,8 @@ import { IIconRecord } from 'zova-module-a-icon';
 import { TypeFormScene, TypeFormSchemaScene } from 'zova-module-a-openapi';
 import { AppModalItem, IModalDialogOptions } from 'zova-module-basic-app';
 
+import type { TypeDetailsCheckPermission } from './details.js';
+
 export interface IDialogFormOptions<TData extends {} = {}> {
   locale: {
     Cancel: () => string;
@@ -15,6 +17,7 @@ export interface IDialogFormOptions<TData extends {} = {}> {
   dialogOptions?: IModalDialogOptions;
   icon?: keyof IIconRecord;
   title: string;
+  checkPermission?: TypeDetailsCheckPermission;
   onSubmitData?: (
     data: TypeFormOnSubmitData<TData>,
     dialogInstance: AppModalItem,

package/zova/src/suite/cabloy-basic/modules/basic-details/test/lib/detailsPermissions.test.ts

@@ -1,4 +1,8 @@
-import type { IPermissionHintGeneral, TypeOpenapiPermissions } from 'zova-module-a-openapi';
+import type {
+  IPermissionHintDetailsAction,
+  IPermissionHintGeneral,
+  TypeOpenapiPermissions,
+} from 'zova-module-a-openapi';
 
 import assert from 'node:assert/strict';
 import test from 'node:test';
@@ -123,3 +127,194 @@ test('row details actions use the same enclosing Resource checker and form-scene
   );
   assert.deepEqual(calls, ['allowed', 'denied']);
 });
+
+test('form-scene CRUD actions do not invoke the enclosing permission checker', () => {
+  const calls: string[] = [];
+  const actions = ['create', 'update', 'delete'].map(name => ({
+    name,
+    options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+  }));
+  const allowed = filterDetailsRowActions(
+    'edit',
+    actionName => {
+      calls.push(actionName!);
+      return false;
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['create', 'update', 'delete'],
+  );
+  assert.deepEqual(calls, []);
+});
+
+test('form-scene CRUD actions are filtered before permission checks in view', () => {
+  const calls: string[] = [];
+  const action = {
+    name: 'update',
+    options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+  };
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    actionName => {
+      calls.push(actionName!);
+      return true;
+    },
+    [action] as any,
+  );
+
+  assert.deepEqual(allowed, []);
+  assert.deepEqual(calls, []);
+});
+
+test('action mode uses the literal action name and inherited hint', () => {
+  const calls: Array<[string | undefined, IPermissionHintDetailsAction | undefined]> = [];
+  const permissionHint = {
+    mode: 'action',
+    actionInherit: 'approve',
+    formScene: ['create', 'edit'],
+  };
+  const allowed = filterDetailsRowActions(
+    'edit',
+    (actionName, hint) => {
+      calls.push([actionName, hint]);
+      return true;
+    },
+    [{ name: 'approve', options: { permission: permissionHint } }] as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['approve'],
+  );
+  assert.deepEqual(calls, [['approve', permissionHint]]);
+});
+
+test('omitted mode checks custom actions without inferring CRUD permissions', () => {
+  const calls: string[] = [];
+  const actions = ['create', 'update', 'delete'].map(name => ({ name }));
+  const allowed = filterDetailsRowActions(
+    'create',
+    actionName => {
+      calls.push(actionName!);
+      return actionName === 'update';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, ['create', 'update', 'delete']);
+});
+
+test('form-scene mode with action inheritance still invokes the checker', () => {
+  const calls: Array<[string | undefined, IPermissionHintDetailsAction | undefined]> = [];
+  const permissionHint = {
+    mode: 'formScene',
+    actionInherit: 'grant',
+    formScene: ['create', 'edit'],
+  };
+  const allowed = filterDetailsRowActions(
+    'create',
+    (actionName, hint) => {
+      calls.push([actionName, hint]);
+      return actionName === 'update';
+    },
+    [{ name: 'update', options: { permission: permissionHint } }] as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, [['update', permissionHint]]);
+});
+
+test('view scene hides nested write actions before permission checks', () => {
+  const calls: string[] = [];
+  const actions = [
+    {
+      name: 'create',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    {
+      name: 'update',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    {
+      name: 'delete',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    { name: 'view', options: { permission: { actionInherit: 'view' } } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    actionName => {
+      calls.push(actionName!);
+      return actionName === 'view';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['view'],
+  );
+  assert.deepEqual(calls, ['view']);
+});
+
+test('view scene preserves explicit inherited write actions', () => {
+  const calls: string[] = [];
+  const actions = [
+    { name: 'update', options: { permission: { actionInherit: 'grant', formScene: ['view'] } } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    (actionName, permissionHint) => {
+      calls.push(actionName!);
+      return actionName === 'update' && permissionHint?.actionInherit === 'grant';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, ['update']);
+});
+
+test('explicit action inheritance and custom actions are preserved', () => {
+  const calls: Array<[string | undefined, IPermissionHintGeneral | undefined]> = [];
+  const explicitHint = { actionInherit: 'grant', formScene: ['create', 'edit'] };
+  const customHint = { mode: 'action', formScene: ['create', 'edit'] };
+  const actions = [
+    { name: 'update', options: { permission: explicitHint } },
+    { name: 'archive', options: { permission: customHint } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'create',
+    (actionName, permissionHint) => {
+      calls.push([actionName, permissionHint]);
+      return true;
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update', 'archive'],
+  );
+  assert.deepEqual(calls, [
+    ['update', explicitHint],
+    ['archive', customHint],
+  ]);
+});

package/zova/src/suite-vendor/a-zova/modules/a-openapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-module-a-openapi",
-  "version": "5.1.56",
+  "version": "5.1.57",
   "gitHead": "09d901d17140a80ee0764211b441cda72fd94663",
   "description": "",
   "keywords": [

package/zova/src/suite-vendor/a-zova/modules/a-openapi/src/types/permissions.ts

@@ -52,6 +52,12 @@ export interface IPermissionHintTableActionBulk {
   public?: boolean;
 }
 
-export interface IPermissionHintDetailsActionRow extends IPermissionHintGeneral {}
+export type TypeDetailsPermissionMode = 'formScene' | 'action';
 
-export interface IPermissionHintDetailsActionBulk extends IPermissionHintGeneral {}
+export interface IPermissionHintDetailsAction extends IPermissionHintGeneral {
+  mode?: TypeDetailsPermissionMode;
+}
+
+export interface IPermissionHintDetailsActionRow extends IPermissionHintDetailsAction {}
+
+export interface IPermissionHintDetailsActionBulk extends IPermissionHintDetailsAction {}

package/zova/src/suite-vendor/a-zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-suite-a-zova",
-  "version": "5.1.169",
+  "version": "5.1.170",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "zova",
   "license": "MIT",
@@ -21,7 +21,7 @@
     "zova-module-a-logger": "^5.1.28",
     "zova-module-a-meta": "^5.1.22",
     "zova-module-a-model": "^5.1.38",
-    "zova-module-a-openapi": "^5.1.56",
+    "zova-module-a-openapi": "^5.1.57",
     "zova-module-a-router": "^5.1.42",
     "zova-module-a-routerstack": "^5.1.29",
     "zova-module-a-routertabs": "^5.1.35",