cabloy 5.1.212 → 5.1.214

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/detail.ts

@@ -3,6 +3,7 @@ import 'zova-module-a-form';
 import 'zova-module-a-openapi';
 
 import type { ServiceDetail } from '../service/detail.jsx';
+import type { TypeDetailsCheckPermission } from './details.js';
 
 declare module 'zova-module-a-openapi' {
   export interface IJsxRenderContextDetail<TData extends {} = {}> {
@@ -11,6 +12,7 @@ declare module 'zova-module-a-openapi' {
 
   export interface IDetailScope {
     $$detail?: ServiceDetail;
+    checkPermission?: TypeDetailsCheckPermission;
   }
 }
 

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/details.ts

@@ -1,12 +1,12 @@
 import 'zova-module-a-table';
 import 'zova-module-a-openapi';
-import type { IDetailsScope, IPermissionHintGeneral } from 'zova-module-a-openapi';
+import type { IDetailsScope, IPermissionHintDetailsAction } from 'zova-module-a-openapi';
 
 import { ControllerBlockDetails } from '../component/blockDetails/controller.jsx';
 
 export type TypeDetailsCheckPermission = (
   actionName?: string,
-  permissionHint?: IPermissionHintGeneral,
+  permissionHint?: IPermissionHintDetailsAction,
 ) => boolean;
 
 declare module 'zova-module-a-openapi' {

package/zova/src/suite/cabloy-basic/modules/basic-details/src/types/dialogForm.ts

@@ -3,6 +3,8 @@ import { IIconRecord } from 'zova-module-a-icon';
 import { TypeFormScene, TypeFormSchemaScene } from 'zova-module-a-openapi';
 import { AppModalItem, IModalDialogOptions } from 'zova-module-basic-app';
 
+import type { TypeDetailsCheckPermission } from './details.js';
+
 export interface IDialogFormOptions<TData extends {} = {}> {
   locale: {
     Cancel: () => string;
@@ -15,6 +17,7 @@ export interface IDialogFormOptions<TData extends {} = {}> {
   dialogOptions?: IModalDialogOptions;
   icon?: keyof IIconRecord;
   title: string;
+  checkPermission?: TypeDetailsCheckPermission;
   onSubmitData?: (
     data: TypeFormOnSubmitData<TData>,
     dialogInstance: AppModalItem,

package/zova/src/suite/cabloy-basic/modules/basic-details/test/lib/detailsPermissions.test.ts

@@ -1,4 +1,8 @@
-import type { IPermissionHintGeneral, TypeOpenapiPermissions } from 'zova-module-a-openapi';
+import type {
+  IPermissionHintDetailsAction,
+  IPermissionHintGeneral,
+  TypeOpenapiPermissions,
+} from 'zova-module-a-openapi';
 
 import assert from 'node:assert/strict';
 import test from 'node:test';
@@ -123,3 +127,194 @@ test('row details actions use the same enclosing Resource checker and form-scene
   );
   assert.deepEqual(calls, ['allowed', 'denied']);
 });
+
+test('form-scene CRUD actions do not invoke the enclosing permission checker', () => {
+  const calls: string[] = [];
+  const actions = ['create', 'update', 'delete'].map(name => ({
+    name,
+    options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+  }));
+  const allowed = filterDetailsRowActions(
+    'edit',
+    actionName => {
+      calls.push(actionName!);
+      return false;
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['create', 'update', 'delete'],
+  );
+  assert.deepEqual(calls, []);
+});
+
+test('form-scene CRUD actions are filtered before permission checks in view', () => {
+  const calls: string[] = [];
+  const action = {
+    name: 'update',
+    options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+  };
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    actionName => {
+      calls.push(actionName!);
+      return true;
+    },
+    [action] as any,
+  );
+
+  assert.deepEqual(allowed, []);
+  assert.deepEqual(calls, []);
+});
+
+test('action mode uses the literal action name and inherited hint', () => {
+  const calls: Array<[string | undefined, IPermissionHintDetailsAction | undefined]> = [];
+  const permissionHint = {
+    mode: 'action',
+    actionInherit: 'approve',
+    formScene: ['create', 'edit'],
+  };
+  const allowed = filterDetailsRowActions(
+    'edit',
+    (actionName, hint) => {
+      calls.push([actionName, hint]);
+      return true;
+    },
+    [{ name: 'approve', options: { permission: permissionHint } }] as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['approve'],
+  );
+  assert.deepEqual(calls, [['approve', permissionHint]]);
+});
+
+test('omitted mode checks custom actions without inferring CRUD permissions', () => {
+  const calls: string[] = [];
+  const actions = ['create', 'update', 'delete'].map(name => ({ name }));
+  const allowed = filterDetailsRowActions(
+    'create',
+    actionName => {
+      calls.push(actionName!);
+      return actionName === 'update';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, ['create', 'update', 'delete']);
+});
+
+test('form-scene mode with action inheritance still invokes the checker', () => {
+  const calls: Array<[string | undefined, IPermissionHintDetailsAction | undefined]> = [];
+  const permissionHint = {
+    mode: 'formScene',
+    actionInherit: 'grant',
+    formScene: ['create', 'edit'],
+  };
+  const allowed = filterDetailsRowActions(
+    'create',
+    (actionName, hint) => {
+      calls.push([actionName, hint]);
+      return actionName === 'update';
+    },
+    [{ name: 'update', options: { permission: permissionHint } }] as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, [['update', permissionHint]]);
+});
+
+test('view scene hides nested write actions before permission checks', () => {
+  const calls: string[] = [];
+  const actions = [
+    {
+      name: 'create',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    {
+      name: 'update',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    {
+      name: 'delete',
+      options: { permission: { mode: 'formScene', formScene: ['create', 'edit'] } },
+    },
+    { name: 'view', options: { permission: { actionInherit: 'view' } } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    actionName => {
+      calls.push(actionName!);
+      return actionName === 'view';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['view'],
+  );
+  assert.deepEqual(calls, ['view']);
+});
+
+test('view scene preserves explicit inherited write actions', () => {
+  const calls: string[] = [];
+  const actions = [
+    { name: 'update', options: { permission: { actionInherit: 'grant', formScene: ['view'] } } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'view',
+    (actionName, permissionHint) => {
+      calls.push(actionName!);
+      return actionName === 'update' && permissionHint?.actionInherit === 'grant';
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update'],
+  );
+  assert.deepEqual(calls, ['update']);
+});
+
+test('explicit action inheritance and custom actions are preserved', () => {
+  const calls: Array<[string | undefined, IPermissionHintGeneral | undefined]> = [];
+  const explicitHint = { actionInherit: 'grant', formScene: ['create', 'edit'] };
+  const customHint = { mode: 'action', formScene: ['create', 'edit'] };
+  const actions = [
+    { name: 'update', options: { permission: explicitHint } },
+    { name: 'archive', options: { permission: customHint } },
+  ];
+
+  const allowed = filterDetailsRowActions(
+    'create',
+    (actionName, permissionHint) => {
+      calls.push([actionName, permissionHint]);
+      return true;
+    },
+    actions as any,
+  );
+
+  assert.deepEqual(
+    allowed.map(action => action.name),
+    ['update', 'archive'],
+  );
+  assert.deepEqual(calls, [
+    ['update', explicitHint],
+    ['archive', customHint],
+  ]);
+});

package/zova/src/suite-vendor/a-zova/modules/a-openapi/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-module-a-openapi",
-  "version": "5.1.56",
+  "version": "5.1.57",
   "gitHead": "09d901d17140a80ee0764211b441cda72fd94663",
   "description": "",
   "keywords": [

package/zova/src/suite-vendor/a-zova/modules/a-openapi/src/types/permissions.ts

@@ -52,6 +52,12 @@ export interface IPermissionHintTableActionBulk {
   public?: boolean;
 }
 
-export interface IPermissionHintDetailsActionRow extends IPermissionHintGeneral {}
+export type TypeDetailsPermissionMode = 'formScene' | 'action';
 
-export interface IPermissionHintDetailsActionBulk extends IPermissionHintGeneral {}
+export interface IPermissionHintDetailsAction extends IPermissionHintGeneral {
+  mode?: TypeDetailsPermissionMode;
+}
+
+export interface IPermissionHintDetailsActionRow extends IPermissionHintDetailsAction {}
+
+export interface IPermissionHintDetailsActionBulk extends IPermissionHintDetailsAction {}

package/zova/src/suite-vendor/a-zova/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zova-suite-a-zova",
-  "version": "5.1.169",
+  "version": "5.1.170",
   "gitHead": "2c5c19284bab738e492856189acb6fad74b8a7b7",
   "description": "zova",
   "license": "MIT",
@@ -21,7 +21,7 @@
     "zova-module-a-logger": "^5.1.28",
     "zova-module-a-meta": "^5.1.22",
     "zova-module-a-model": "^5.1.38",
-    "zova-module-a-openapi": "^5.1.56",
+    "zova-module-a-openapi": "^5.1.57",
     "zova-module-a-router": "^5.1.42",
     "zova-module-a-routerstack": "^5.1.29",
     "zova-module-a-routertabs": "^5.1.35",