hazo_admin 0.7.0 → 0.11.0

package/dist/issues/type_catalog.js

@@ -0,0 +1,185 @@
+import 'server-only';
+import { createLogger } from 'hazo_core';
+const log = createLogger('hazo_admin:issues');
+const TABLE = 'hazo_admin_issue_types';
+export function toIssueTypeCatalogRecord(raw) {
+    return {
+        type_key: raw.type_key,
+        label: raw.label,
+        color: raw.color ?? null,
+        description: raw.description ?? null,
+        scope_id: raw.scope_id ?? null,
+        sort_order: raw.sort_order ?? 0,
+        created_at: raw.created_at,
+        updated_at: raw.updated_at,
+    };
+}
+/** Columns updateType is allowed to write. Guards against attacker-controlled
+ *  identifiers in the dynamic SET clause / CRUD patch (keys arrive from the
+ *  PATCH request body). Unknown keys are dropped, never interpolated into SQL. */
+const UPDATABLE_COLUMNS = ['label', 'color', 'description', 'sort_order'];
+function pickUpdatableFields(patch) {
+    const out = {};
+    for (const k of UPDATABLE_COLUMNS) {
+        if (Object.prototype.hasOwnProperty.call(patch, k)) {
+            out[k] = patch[k];
+        }
+    }
+    return out;
+}
+function sortTypes(rows) {
+    return [...rows].sort((a, b) => {
+        if (a.sort_order !== b.sort_order)
+            return a.sort_order - b.sort_order;
+        return a.label.localeCompare(b.label);
+    });
+}
+export function createIssueTypeCatalogStore(adapter) {
+    function now() {
+        return new Date().toISOString();
+    }
+    async function raw(sql, params = []) {
+        return adapter.raw(sql, params);
+    }
+    async function listTypes(opts) {
+        const { scopeIds, isGlobalAdmin = false } = opts;
+        if (isGlobalAdmin || !scopeIds || scopeIds.length === 0) {
+            const rows = await raw(`SELECT * FROM ${TABLE} ORDER BY sort_order ASC, label ASC`);
+            return (rows ?? []).map(toIssueTypeCatalogRecord);
+        }
+        const placeholders = scopeIds.map((_, i) => `$${i + 1}`).join(', ');
+        const rows = await raw(`SELECT * FROM ${TABLE} WHERE scope_id IN (${placeholders}) OR scope_id IS NULL
+       ORDER BY sort_order ASC, label ASC`, scopeIds);
+        return (rows ?? []).map(toIssueTypeCatalogRecord);
+    }
+    async function getType(type_key) {
+        const rows = await raw(`SELECT * FROM ${TABLE} WHERE type_key = $1 LIMIT 1`, [type_key]);
+        if (!rows || rows.length === 0)
+            return null;
+        return toIssueTypeCatalogRecord(rows[0]);
+    }
+    async function createType(input) {
+        log.debug('createType', { type_key: input.type_key });
+        const ts = now();
+        const inserted = await raw(`INSERT INTO ${TABLE} (
+        type_key, label, color, description, scope_id, sort_order, created_at, updated_at
+      ) VALUES (
+        $1, $2, $3, $4, $5, $6, $7, $8
+      ) RETURNING *`, [
+            input.type_key,
+            input.label,
+            input.color ?? null,
+            input.description ?? null,
+            input.scope_id ?? null,
+            input.sort_order ?? 0,
+            ts,
+            ts,
+        ]);
+        const row = inserted && inserted.length > 0 ? inserted[0] : null;
+        if (!row)
+            throw new Error('hazo_admin:issues — INSERT returned no row for issue type');
+        return toIssueTypeCatalogRecord(row);
+    }
+    async function updateType(type_key, patch) {
+        const ts = now();
+        const fullPatch = { ...pickUpdatableFields(patch), updated_at: ts };
+        const setClauses = Object.keys(fullPatch)
+            .map((k, i) => `${k} = $${i + 2}`)
+            .join(', ');
+        const updated = await raw(`UPDATE ${TABLE} SET ${setClauses} WHERE type_key = $1 RETURNING *`, [type_key, ...Object.values(fullPatch)]);
+        const row = updated && updated.length > 0 ? updated[0] : null;
+        if (!row)
+            throw new Error(`hazo_admin:issues — issue type ${type_key} not found`);
+        return toIssueTypeCatalogRecord(row);
+    }
+    async function deleteType(type_key) {
+        log.debug('deleteType', { type_key });
+        await raw(`DELETE FROM ${TABLE} WHERE type_key = $1`, [type_key]);
+    }
+    return {
+        listTypes,
+        getType,
+        createType,
+        updateType,
+        deleteType,
+    };
+}
+/**
+ * PostgREST-native implementation of IssueTypeCatalogStore.
+ * Uses createCrudService so no raw SQL is issued.
+ * Falls back to createIssueTypeCatalogStore when the adapter exposes a raw()
+ * method (i.e. it is a direct-DB adapter that already handles SQL).
+ *
+ * Returns a Promise because it lazily imports hazo_connect/server on the
+ * CRUD path (avoiding loading the full hazo_connect stack for raw adapters).
+ */
+export async function createIssueTypeCatalogStoreFromConnect(adapter) {
+    // Capability sniff: direct-DB adapters have a raw() method — use the raw store.
+    if (typeof adapter.raw === 'function') {
+        return createIssueTypeCatalogStore(adapter);
+    }
+    // Lazy import to avoid pulling hazo_connect into server-only environments
+    // that don't have it installed (e.g., direct-SQL test adapters).
+    const { createCrudService } = await import('hazo_connect/server');
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const crud = createCrudService(adapter, TABLE);
+    function now() {
+        return new Date().toISOString();
+    }
+    async function listTypes(opts) {
+        const { scopeIds, isGlobalAdmin = false } = opts;
+        // The query builder cannot express `scope_id IN (...) OR scope_id IS NULL`,
+        // so fetch broadly and filter/merge in-memory when scoped.
+        const qb = crud.query();
+        const rows = await qb.execute('GET');
+        const all = (Array.isArray(rows) ? rows : []).map((r) => toIssueTypeCatalogRecord(r));
+        if (isGlobalAdmin || !scopeIds || scopeIds.length === 0) {
+            return sortTypes(all);
+        }
+        const filtered = all.filter((t) => t.scope_id === null || scopeIds.includes(t.scope_id));
+        return sortTypes(filtered);
+    }
+    async function getType(type_key) {
+        const row = await crud.findById(type_key);
+        if (!row)
+            return null;
+        return toIssueTypeCatalogRecord(row);
+    }
+    async function createType(input) {
+        log.debug('createIssueTypeCatalogStoreFromConnect:createType', { type_key: input.type_key });
+        const ts = now();
+        const inserted = await crud.insert({
+            type_key: input.type_key,
+            label: input.label,
+            color: input.color ?? null,
+            description: input.description ?? null,
+            scope_id: input.scope_id ?? null,
+            sort_order: input.sort_order ?? 0,
+            created_at: ts,
+            updated_at: ts,
+        });
+        const row = Array.isArray(inserted) ? inserted[0] : inserted;
+        if (!row)
+            throw new Error('hazo_admin:issues — INSERT returned no row for issue type');
+        return toIssueTypeCatalogRecord(row);
+    }
+    async function updateType(type_key, patch) {
+        const ts = now();
+        const updated = await crud.updateById(type_key, { ...pickUpdatableFields(patch), updated_at: ts });
+        const row = Array.isArray(updated) ? updated[0] : updated;
+        if (!row)
+            throw new Error(`hazo_admin:issues — issue type ${type_key} not found`);
+        return toIssueTypeCatalogRecord(row);
+    }
+    async function deleteType(type_key) {
+        log.debug('createIssueTypeCatalogStoreFromConnect:deleteType', { type_key });
+        await crud.deleteById(type_key);
+    }
+    return {
+        listTypes,
+        getType,
+        createType,
+        updateType,
+        deleteType,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hazo_admin",
-  "version": "0.7.0",
+  "version": "0.11.0",
   "description": "Standard site-admin package — auth-gated admin shell + panel kit + drop-in /admin preset",
   "type": "module",
   "module": "./dist/index.js",
@@ -56,7 +56,7 @@
     "react": "^18.0.0 || ^19.0.0",
     "react-dom": "^18.0.0 || ^19.0.0",
     "next": "^14.0.0 || ^16.0.0",
-    "hazo_auth": "^10.4.2",
+    "hazo_auth": "^10.5.0",
     "hazo_logs": "^2.0.2",
     "hazo_debug": "^3.1.1",
     "hazo_connect": "^3.7.0",
@@ -64,7 +64,7 @@
     "hazo_api": "^2.3.1",
     "hazo_files": "^3.0.0",
     "hazo_jobs": "^0.12.0",
-    "hazo_env": "^0.2.0",
+    "hazo_env": "^0.6.0",
     "hazo_audit": "^2.1.1",
     "hazo_feedback": "^2.2.0",
     "hazo_secure": "^1.2.0",
@@ -131,8 +131,8 @@
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "hazo_core": "^1.2.1",
-    "hazo_ui": "^4.6.2",
-    "hazo_auth": "^10.4.2",
+    "hazo_ui": "^4.7.0",
+    "hazo_auth": "^10.5.0",
     "hazo_testing": "^0.3.1",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",