create-astram-app 0.12.2 → 0.12.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-astram-app",
-  "version": "0.12.2",
+  "version": "0.12.4",
   "license": "MIT",
   "description": "Scaffolder for a new Astram app — emits a running, framework-enforced NestJS server (deny-by-default, built-in auth/identity to switch on) and, with --with-frontend, a React admin/auth UI, over the immutable @astram/* framework packages.",
   "type": "module",

package/template/frontend/src/pages/access/RecordPoliciesPage.jsx

@@ -32,26 +32,11 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@/components/ui/select';
+import { operatorLabel, isNullaryOperator, buildCondition } from './recordPolicyBuilder.js';
 
 /** The object types this app lets an admin author policies for. Extend as the app grows. */
 const AUTHORABLE_TYPES = ['note'];
 
-/** Human labels for the closed operator set. */
-const OPERATOR_LABELS = {
-  eq: 'equals',
-  ne: 'does not equal',
-  in: 'is any of',
-  not_in: 'is none of',
-  gt: 'is greater than',
-  lt: 'is less than',
-  gte: 'is at least',
-  lte: 'is at most',
-  contains: 'contains',
-  not_contains: 'does not contain',
-  is_null: 'is empty',
-  is_not_null: 'is not empty',
-};
-
 /** A fresh, empty condition row. */
 const emptyCondition = () => ({ field: '', operator: '', value: '' });
 
@@ -126,19 +111,7 @@ export default function RecordPoliciesPage() {
     for (const c of conditions) {
       if (!c.field || !c.operator) continue;
       const fieldSchema = fieldsByKey.get(c.field);
-      const isNullary = fieldSchema?.nullaryOperators?.includes(c.operator);
-      const isArray = fieldSchema?.arrayOperators?.includes(c.operator);
-      if (isNullary) {
-        built.push({ field: c.field, operator: c.operator });
-      } else if (isArray) {
-        const values = String(c.value ?? '')
-          .split(',')
-          .map((v) => v.trim())
-          .filter(Boolean);
-        built.push({ field: c.field, operator: c.operator, value: values });
-      } else {
-        built.push({ field: c.field, operator: c.operator, value: c.value });
-      }
+      built.push(buildCondition(c, fieldSchema));
     }
 
     setSaving(true);
@@ -170,9 +143,10 @@ export default function RecordPoliciesPage() {
   // Render one policy as a human sentence: "allow read where branch equals north AND …".
   const describe = (policy) => {
     const parts = (policy.conditions ?? []).map((c) => {
-      const label = OPERATOR_LABELS[c.operator] ?? c.operator;
+      const label = operatorLabel(c.operator);
       const val = Array.isArray(c.value) ? c.value.join(', ') : c.value;
-      const isNullary = c.operator === 'is_null' || c.operator === 'is_not_null';
+      const isNullary =
+        c.value === undefined || isNullaryOperator(c.operator, fieldsByKey.get(c.field));
       return `${c.field} ${label}${isNullary ? '' : ` ${val}`}`;
     });
     const where = parts.length ? ` where ${parts.join(' AND ')}` : ' (all records)';
@@ -284,7 +258,7 @@ export default function RecordPoliciesPage() {
               {conditions.map((c, i) => {
                 const fieldSchema = fieldsByKey.get(c.field);
                 const validOps = fieldSchema?.validOperators ?? [];
-                const isNullary = fieldSchema?.nullaryOperators?.includes(c.operator);
+                const isNullary = isNullaryOperator(c.operator, fieldSchema);
                 const isArray = fieldSchema?.arrayOperators?.includes(c.operator);
                 const isContains = c.operator === 'contains' || c.operator === 'not_contains';
                 return (
@@ -318,7 +292,7 @@ export default function RecordPoliciesPage() {
                       <SelectContent>
                         {validOps.map((op) => (
                           <SelectItem key={op} value={op}>
-                            {OPERATOR_LABELS[op] ?? op}
+                            {operatorLabel(op)}
                           </SelectItem>
                         ))}
                       </SelectContent>

package/template/frontend/src/pages/access/recordPolicyBuilder.js

@@ -0,0 +1,45 @@
+// recordPolicyBuilder.js — pure logic for the guided record-policy builder
+// (RecordPoliciesPage.jsx). Plain ESM, no JSX, no `@/` aliases, so `node --test` can load it.
+
+/** Human labels for the closed operator set. */
+export const OPERATOR_LABELS = {
+  eq: 'equals',
+  ne: 'does not equal',
+  in: 'is any of',
+  not_in: 'is none of',
+  gt: 'is greater than',
+  lt: 'is less than',
+  gte: 'is at least',
+  lte: 'is at most',
+  contains: 'contains',
+  not_contains: 'does not contain',
+  is_null: 'is empty',
+  is_not_null: 'is not empty',
+  is_owner: 'is me',
+  is_not_owner: 'is not me',
+};
+
+/** The label for an operator; falls back to the operator key. */
+export function operatorLabel(op) {
+  return OPERATOR_LABELS[op] ?? op;
+}
+
+/** True when the field's schema lists the operator as taking no value. */
+export function isNullaryOperator(op, fieldSchema) {
+  return Boolean(fieldSchema?.nullaryOperators?.includes(op));
+}
+
+/** Build the structured condition submitted to the server from one builder row. */
+export function buildCondition(row, fieldSchema) {
+  if (isNullaryOperator(row.operator, fieldSchema)) {
+    return { field: row.field, operator: row.operator };
+  }
+  if (fieldSchema?.arrayOperators?.includes(row.operator)) {
+    const values = String(row.value ?? '')
+      .split(',')
+      .map((v) => v.trim())
+      .filter(Boolean);
+    return { field: row.field, operator: row.operator, value: values };
+  }
+  return { field: row.field, operator: row.operator, value: row.value };
+}

package/template/frontend/src/pages/access/recordPolicyBuilder.test.mjs

@@ -0,0 +1,55 @@
+// recordPolicyBuilder.test.mjs — separation-of-duties R10 / AC-15: the guided policy builder's
+// pure logic for the owner operators. The page (RecordPoliciesPage.jsx) cannot be rendered
+// under Node's runner, so its operator logic lives in ./recordPolicyBuilder.js:
+//   operatorLabel(op), isNullaryOperator(op, fieldSchema), buildCondition(row, fieldSchema)
+//
+//   node --test src/pages/access/recordPolicyBuilder.test.mjs
+import { test, describe } from 'node:test';
+import assert from 'node:assert/strict';
+import { operatorLabel, isNullaryOperator, buildCondition } from './recordPolicyBuilder.js';
+
+const ownerField = {
+  key: 'created_by',
+  validOperators: ['eq', 'is_null', 'is_owner', 'is_not_owner'],
+  nullaryOperators: ['is_null', 'is_owner', 'is_not_owner'],
+  arrayOperators: [],
+};
+
+describe('owner operators in the guided policy builder (AC-15)', () => {
+  test('is_owner is labelled "is me"', () => {
+    assert.equal(operatorLabel('is_owner'), 'is me');
+  });
+  test('is_not_owner is labelled "is not me"', () => {
+    assert.equal(operatorLabel('is_not_owner'), 'is not me');
+  });
+  test('existing labels are unchanged', () => {
+    assert.equal(operatorLabel('is_null'), 'is empty');
+    assert.equal(operatorLabel('eq'), 'equals');
+  });
+  test('both owner operators are nullary when the schema lists them', () => {
+    assert.equal(isNullaryOperator('is_owner', ownerField), true);
+    assert.equal(isNullaryOperator('is_not_owner', ownerField), true);
+    assert.equal(isNullaryOperator('eq', ownerField), false);
+  });
+  test('submitted condition for is_owner has no value, even if a stale value was typed', () => {
+    const c = buildCondition(
+      { field: 'created_by', operator: 'is_owner', value: 'stale' },
+      ownerField,
+    );
+    assert.deepEqual(c, { field: 'created_by', operator: 'is_owner' });
+    assert.equal('value' in c, false);
+  });
+  test('submitted condition for is_not_owner has no value', () => {
+    const c = buildCondition(
+      { field: 'created_by', operator: 'is_not_owner', value: '' },
+      ownerField,
+    );
+    assert.deepEqual(c, { field: 'created_by', operator: 'is_not_owner' });
+  });
+  test('non-nullary operators still carry their value', () => {
+    assert.deepEqual(
+      buildCondition({ field: 'created_by', operator: 'eq', value: 'x' }, ownerField),
+      { field: 'created_by', operator: 'eq', value: 'x' },
+    );
+  });
+});

package/template/server/package.json

@@ -21,13 +21,13 @@
     "postinstall": "node scripts/sync-astram-guide.mjs"
   },
   "dependencies": {
-    "@astram/core": "1.11.0",
-    "@astram/engine": "0.12.0",
-    "@astram/guard": "0.20.1",
+    "@astram/core": "1.12.0",
+    "@astram/engine": "0.14.0",
+    "@astram/guard": "0.21.0",
     "@astram/guide": "^0.2.8",
-    "@astram/identity": "0.17.1",
-    "@astram/messaging": "0.1.4",
-    "@astram/migrate": "0.7.1",
+    "@astram/identity": "0.18.0",
+    "@astram/messaging": "0.1.6",
+    "@astram/migrate": "0.7.2",
     "@astram/sdk": "^0.2.0",
     "@nestjs/common": "^11.2.7",
     "@nestjs/core": "^11.2.7",