okengine 0.13.0 → 0.15.2

package/src/console/ui-next/src/features/store/grid/store-data-grid.tsx

@@ -60,6 +60,7 @@ import { modChord, modShiftChord } from "@/lib/shortcut.ts";
 import { cn } from "@/lib/utils.ts";
 import { useStoreEdit } from "../data/use-store-edit.ts";
 import { JsonValueSheet } from "../detail/json-value-sheet.tsx";
+import { StoreRowDetailSheet } from "../detail/store-row-detail-sheet.tsx";
 import { RevealCell } from "../detail/reveal-cell.tsx";
 import { asInspectableJson, jsonValueEqual } from "../lib/json-value.ts";
 import { parseKvTtlDraft } from "../lib/kv-meta.ts";
@@ -132,12 +133,22 @@ export interface StoreDataGridProps {
   readonly insertOpen?: boolean;
   readonly onInsertOpenChange?: (open: boolean) => void;
   readonly onDeleteRows?: (rows: readonly StoreGridRow[]) => void;
+  /** Gate identity for row DML (`oke.*` stamp). Catalog DDL ignores this. */
+  readonly asGate?: string | null;
+  readonly asUserId?: string | null;
+  /** Two-finger / right-click empty grid (Create policy / insert). */
+  readonly onViewportContextMenu?: () => void;
 }
 
 /** Row height presets (px) for the height menu. */
 const ROW_HEIGHTS = { short: 26, medium: 34, tall: 44, "extra-tall": 56 } as const;
 type RowHeight = keyof typeof ROW_HEIGHTS;
 
+/** Payload columns absorb leftover table width (SQL `comment`, KV `value`). */
+function isFillColumn(key: string): boolean {
+  return key === "comment" || key === "value";
+}
+
 /** Fixed column width (px) by cell variant. */
 function columnWidthPx(type: StoreGridColumn["type"], key: string): number {
   if (key === "id" || key === "key" || key === "name") return 192;
@@ -231,6 +242,9 @@ export function StoreDataGrid({
   insertOpen = false,
   onInsertOpenChange,
   onDeleteRows,
+  asGate = null,
+  asUserId = null,
+  onViewportContextMenu,
 }: StoreDataGridProps): JSX.Element {
   const [findText, setFindText] = useState("");
   const [selected, setSelected] = useState<readonly string[]>([]);
@@ -250,6 +264,8 @@ export function StoreDataGrid({
     readonly rowId: string;
     readonly column: string;
   } | null>(null);
+  const [detailRow, setDetailRow] = useState<StoreGridRow | null>(null);
+  const [detailOpen, setDetailOpen] = useState(false);
   const [addOpen, setAddOpen] = useState(false);
   const [saving, setSaving] = useState(false);
   const [viewportHeight, setViewportHeight] = useState(440);
@@ -533,6 +549,8 @@ export function StoreDataGrid({
             ref: storeRef,
             ...(facet === "sql" ? { child: childName, id: rowId } : { key: rowId }),
             ...(tenant ? { tenant } : {}),
+            ...(asGate ? { asGate } : {}),
+            ...(asUserId ? { asUserId } : {}),
             patch: sanitizeStorePatch(patch),
             commit: true,
           }),
@@ -758,8 +776,8 @@ export function StoreDataGrid({
         header: <StoreColumnHeader col={col} />,
         sortable: true,
         align: isNumericType(col.type) ? "right" : "left",
-        width: col.key === "comment" ? undefined : `${columnWidthPx(col.type, col.key)}px`,
-        fill: col.key === "comment",
+        width: isFillColumn(col.key) ? undefined : `${columnWidthPx(col.type, col.key)}px`,
+        fill: isFillColumn(col.key),
         sortValue: (row) => {
           const raw = overlayValue(row, col.key);
           if (typeof raw === "number") return raw;
@@ -1260,6 +1278,11 @@ export function StoreDataGrid({
                 }
               : undefined
           }
+          onRowContextMenu={(row) => {
+            setDetailRow(row);
+            setDetailOpen(true);
+          }}
+          onViewportContextMenu={onViewportContextMenu}
           cellRange={cellRange}
           onCellRangeChange={
             canInlineEdit
@@ -1324,6 +1347,8 @@ export function StoreDataGrid({
           childName={childName}
           tenant={tenant}
           columns={model.columns}
+          asGate={asGate}
+          asUserId={asUserId}
         />
       ) : null}
 
@@ -1338,6 +1363,28 @@ export function StoreDataGrid({
         />
       ) : null}
 
+      <StoreRowDetailSheet
+        open={detailOpen}
+        onOpenChange={setDetailOpen}
+        model={model}
+        row={detailRow ? (model.rows.find((row) => row.id === detailRow.id) ?? detailRow) : null}
+        facet={facet}
+        storeRef={storeRef}
+        childName={childName}
+        tenant={tenant}
+        masked={masked}
+        asGate={asGate}
+        asUserId={asUserId}
+        onDeleteRow={
+          onDeleteRows
+            ? (row) => {
+                setDetailOpen(false);
+                onDeleteRows([row]);
+              }
+            : undefined
+        }
+      />
+
       {inspect && inspectRow && inspectCol ? (
         <JsonValueSheet
           open
@@ -1443,7 +1490,7 @@ export function StoreDataGrid({
           </span>
         ) : (
           <span className="ml-auto opacity-60">
-            Click to select · drag a range · click again or type to edit · Changes to review
+            Click to select · two-finger click opens sheet · drag a range · type to edit
           </span>
         )}
       </div>

package/src/console/ui-next/src/features/store/lib/files-meta.test.ts

@@ -8,6 +8,7 @@ import {
   fileNameFromKey,
   filePreviewMode,
   formatFilePreviewText,
+  previewBlobType,
   inferContentType,
   isAsciiObjectKey,
   safeFileObjectKey,
@@ -66,6 +67,8 @@ describe("fileKind helpers", () => {
     expect(fileKindIsText("code")).toBe(true);
     expect(fileKindIsText("image")).toBe(false);
     expect(fileKindIsImage("image")).toBe(true);
+    expect(previewBlobType("pdf", "application/octet-stream")).toBe("application/pdf");
+    expect(previewBlobType("image", "image/png")).toBe("image/png");
     expect(filePreviewMode("pdf")).toBe("pdf");
     expect(filePreviewMode("video")).toBe("video");
     expect(filePreviewMode("archive")).toBe("none");

package/src/console/ui-next/src/features/store/lib/files-meta.ts

@@ -219,6 +219,18 @@ export function fileKindIsImage(kind: FileKind): boolean {
   return kind === "image";
 }
 
+/**
+ * MIME type for a files-preview blob.
+ * PDF is always `application/pdf` so `nosniff` does not hide the viewer.
+ *
+ * @param mode - Inspector surface
+ * @param contentType - Catalog / inferred type
+ */
+export function previewBlobType(mode: FilePreviewMode, contentType: string): string {
+  if (mode === "pdf") return "application/pdf";
+  return contentType;
+}
+
 /**
  * Inspector surface for a kind (`none` → download fallback).
  *

package/src/console/ui-next/src/features/store/lib/query-defaults.test.ts

@@ -5,7 +5,10 @@ import {
   defaultKvQuery,
   defaultSqlQuery,
   isConsoleAuthStore,
+  pickChildName,
   pickQueryStore,
+  reconcileDefaultKv,
+  reconcileDefaultSql,
 } from "./query-defaults.ts";
 
 const emptyWillNot = { writerFlowIds: [], signals: [], channels: [] };
@@ -53,6 +56,28 @@ describe("default queries", () => {
     expect(defaultKvQuery("holds:")).toContain("list holds:");
     expect(defaultKvQuery()).toContain("list");
   });
+
+  test("picks a random live child", () => {
+    expect(pickChildName(["activity", "tasks"], () => 0)).toBe("activity");
+    expect(pickChildName(["activity", "tasks"], () => 0.99)).toBe("tasks");
+    expect(pickChildName([])).toBeUndefined();
+  });
+
+  test("rewrites a leftover default select when the table is gone", () => {
+    const stale = defaultSqlQuery("issues");
+    expect(reconcileDefaultSql(stale, ["activity", "tasks"], () => 0.99)).toBe(
+      defaultSqlQuery("tasks"),
+    );
+    expect(reconcileDefaultSql(stale, ["issues"])).toBe(stale);
+    expect(reconcileDefaultSql("SELECT 1 FROM issues", ["activity"])).toBe("SELECT 1 FROM issues");
+  });
+
+  test("rewrites a leftover default kv list when the namespace is gone", () => {
+    const stale = defaultKvQuery("sessions:");
+    expect(reconcileDefaultKv(stale, ["holds", "locks"], () => 0)).toBe(defaultKvQuery("holds:"));
+    expect(reconcileDefaultKv(stale, ["sessions"])).toBe(stale);
+    expect(reconcileDefaultKv("get sessions:a", ["holds"])).toBe("get sessions:a");
+  });
 });
 
 describe("pickQueryStore", () => {

package/src/console/ui-next/src/features/store/lib/query-defaults.ts

@@ -17,6 +17,66 @@ export function defaultSqlQuery(table?: string): string {
   return `SELECT *\nFROM "${table}"\nLIMIT 50;`;
 }
 
+const DEFAULT_SQL = /^SELECT \*\nFROM "([^"]+)"\nLIMIT 50;$/;
+const DEFAULT_KV = /^\/\/ list  ·  get  ·  set  ·  delete  ·  ttl\nlist(?: (.+))?$/;
+
+/**
+ * Replace a leftover default `SELECT` when that table is gone.
+ * Custom SQL is left alone.
+ *
+ * @param text - Editor buffer
+ * @param tables - Live table names
+ * @param random - Unit interval used to pick a replacement table
+ */
+export function reconcileDefaultSql(
+  text: string,
+  tables: readonly string[],
+  random: () => number = Math.random,
+): string {
+  const match = DEFAULT_SQL.exec(text);
+  if (!match) return text;
+  const table = match[1];
+  if (table && tables.includes(table)) return text;
+  return defaultSqlQuery(pickChildName(tables, random));
+}
+
+/**
+ * Replace a leftover default `list ns:` when that namespace is gone.
+ *
+ * @param text - Editor buffer
+ * @param namespaces - Live namespace names
+ * @param random - Unit interval used to pick a replacement namespace
+ */
+export function reconcileDefaultKv(
+  text: string,
+  namespaces: readonly string[],
+  random: () => number = Math.random,
+): string {
+  const match = DEFAULT_KV.exec(text);
+  if (!match) return text;
+  const prefix = match[1];
+  if (!prefix) return text;
+  const name = prefix.endsWith(":") ? prefix.slice(0, -1) : prefix;
+  if (namespaces.includes(name)) return text;
+  const next = pickChildName(namespaces, random);
+  return defaultKvQuery(next ? `${next}:` : undefined);
+}
+
+/**
+ * Re-seed a default buffer against the live store children.
+ *
+ * @param text - Editor buffer
+ * @param names - Table or namespace names
+ * @param facet - SQL or KV
+ */
+export function reconcileDefaultQuery(
+  text: string,
+  names: readonly string[],
+  facet: Extract<StoreFacet, "sql" | "kv">,
+): string {
+  return facet === "sql" ? reconcileDefaultSql(text, names) : reconcileDefaultKv(text, names);
+}
+
 /**
  * Seed KV command for a namespace prefix.
  *
@@ -59,12 +119,34 @@ export function pickQueryStore(
 }
 
 /**
- * Default child name under a store (first table / namespace).
+ * One live child name, picked at random.
+ *
+ * @param names - Table or namespace names
+ * @param random - Unit interval in `[0, 1)`
+ */
+export function pickChildName(
+  names: readonly string[],
+  random: () => number = Math.random,
+): string | undefined {
+  if (names.length === 0) return undefined;
+  const index = Math.min(names.length - 1, Math.floor(random() * names.length));
+  return names[index];
+}
+
+/**
+ * Default child name under a store (random table / namespace).
  *
  * @param store - Store row
+ * @param random - Unit interval used to pick
  */
-export function firstChildName(store: StoreListStore): string | undefined {
-  return store.children[0]?.name;
+export function randomChildName(
+  store: StoreListStore,
+  random: () => number = Math.random,
+): string | undefined {
+  return pickChildName(
+    store.children.map((child) => child.name),
+    random,
+  );
 }
 
 /**

package/src/console/ui-next/src/features/store/lib/query-gate.ts

@@ -1,9 +1,8 @@
 /**
  * Query-console "view as Gate" choices — Operator, public, user, or policy.
  *
- * Gates are OKE authorization, not Postgres `TO` roles. Selecting one sets
- * `oke.gate` on postgres / pglite so RLS policies can read
- * `current_setting('oke.gate', true)`.
+ * Gates are OKE authorization, not Postgres `TO` roles. Selecting one stamps
+ * `oke.gate()` / `oke.user()` / `oke.has_scope()` on postgres / pglite.
  */
 
 import type { RlsCatalogGate, RlsGateCatalog } from "./rls-gate-catalog.ts";
@@ -36,6 +35,12 @@ export type QueryGateUserChoice = {
   readonly gate: string;
 };
 
+/** Picker value shared by SQL console, browse, and grid edit. */
+export type RlsPickerValue = {
+  readonly asGate: string | null;
+  readonly asUserId: string | null;
+};
+
 /** Identity slice used to build As-card user rows. */
 export type QueryGateIdentity = {
   readonly id: string;
@@ -175,10 +180,31 @@ export function filterQueryGateAsChoices<
  *
  * @param asGate - Selected gate name, or null for Operator
  */
-export function queryGateToolbarLabel(asGate: string | null): string {
+export function queryGateToolbarLabel(
+  asGate: string | null,
+  asUserId?: string | null,
+  userLabel?: string | null,
+): string {
+  if (asUserId && userLabel) return `User · ${userLabel}`;
+  if (asUserId) return `User · ${asUserId}`;
   return asGate && asGate.length > 0 ? `Gate · ${asGate}` : "Gate";
 }
 
+/**
+ * Request fields for store query / edit / SQL.
+ *
+ * @param value - Picker bag
+ */
+export function rlsPickerPayload(value: RlsPickerValue): {
+  readonly asGate?: string;
+  readonly asUserId?: string;
+} {
+  return {
+    ...(value.asGate ? { asGate: value.asGate } : {}),
+    ...(value.asUserId ? { asUserId: value.asUserId } : {}),
+  };
+}
+
 function gateChoiceDetail(gate: RlsCatalogGate): string {
   if (gate.description) return gate.description;
   if (gate.roles.length > 0) return `Roles ${gate.roles.join(", ")}`;

package/src/console/ui-next/src/features/store/lib/rls-policy.test.ts

@@ -9,7 +9,17 @@ import {
   rlsGateModeFromCommand,
   rlsPolicyPredicates,
   rlsPolicyPreviewSql,
+  rlsPolicyCodeSource,
+  rlsGatePredicateSql,
   rlsStoreGateActions,
+  rlsBindOwnerExpr,
+  rlsExprNeedsOwnerColumn,
+  rlsExprUsesUserIdentity,
+  rlsOwnerColumn,
+  rlsRewriteIdentityColumn,
+  rlsTableColumns,
+  rlsTableSqlColumns,
+  rlsTemplateUsesOwner,
 } from "./rls-policy.ts";
 
 describe("rlsPolicyPreviewSql", () => {
@@ -62,6 +72,35 @@ describe("RLS_POLICY_TEMPLATES", () => {
     expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "oke.gate").length).toBeGreaterThan(0);
     expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "owner").length).toBeGreaterThan(0);
     expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "missing")).toEqual([]);
+    expect(
+      RLS_POLICY_TEMPLATES.some((tpl) => /\bcurrent_user\b/.test(`${tpl.using} ${tpl.withCheck}`)),
+    ).toBe(false);
+    expect(
+      RLS_POLICY_TEMPLATES.some((tpl) => /oke\.user\(\)/.test(`${tpl.using} ${tpl.withCheck}`)),
+    ).toBe(true);
+  });
+});
+
+describe("rlsGatePredicateSql", () => {
+  test("fills oke.gate / oke.has_scope — not Postgres TO", () => {
+    expect(rlsGatePredicateSql([])).toBe("true");
+    expect(rlsGatePredicateSql(["member"])).toBe("oke.gate() = 'member'");
+    expect(rlsGatePredicateSql(["booking:create"])).toBe("oke.has_scope('booking:create')");
+  });
+});
+
+describe("rlsPolicyCodeSource", () => {
+  test("emits store.schema.policy and pgPolicy", () => {
+    const spec = parseSqlPolicySpec({
+      name: "gate_member_select",
+      table: "bookings",
+      command: "SELECT",
+      using: "oke.gate() = 'member'",
+    });
+    const code = rlsPolicyCodeSource(spec);
+    expect(code).toContain("store.schema.policy");
+    expect(code).toContain("pgPolicy");
+    expect(code).toContain("oke.gate()");
   });
 });
 
@@ -75,6 +114,106 @@ describe("rlsPolicyPredicates", () => {
   });
 });
 
+describe("rls owner column bind", () => {
+  test("picks creator_email when owner is missing", () => {
+    expect(rlsOwnerColumn(["id", "title", "creator_email"])).toBe("creator_email");
+    expect(rlsOwnerColumn(["id", "owner_email"])).toBe("owner_email");
+    expect(rlsOwnerColumn(["id", "title"])).toBeNull();
+    expect(rlsBindOwnerExpr("owner = oke.user()", "creator_email")).toBe(
+      "creator_email = oke.user()",
+    );
+    expect(rlsExprNeedsOwnerColumn("owner = oke.user()")).toBe(true);
+    expect(rlsExprNeedsOwnerColumn("creator_email = oke.user()")).toBe(false);
+  });
+
+  test("reads Manifest sqlName / snake_case keys", () => {
+    const cols = rlsTableSqlColumns(
+      {
+        oke: "1.0",
+        app: "keel",
+        stores: {
+          db: {
+            facet: "sql",
+            tables: {
+              tasks: {
+                columns: {
+                  creatorEmail: { type: "text", sqlName: "creator_email" },
+                  title: { type: "text" },
+                },
+              },
+            },
+          },
+        },
+      },
+      "sql:db",
+      "tasks",
+    );
+    expect(cols).toEqual(["creator_email", "title"]);
+    expect(rlsOwnerColumn(cols)).toBe("creator_email");
+  });
+
+  test("marks PK / declared FK / inferred *_id", () => {
+    const cols = rlsTableColumns(
+      {
+        oke: "1.0",
+        app: "keel",
+        stores: {
+          db: {
+            facet: "sql",
+            tables: {
+              tasks: {
+                columns: {
+                  id: { type: "text", primaryKey: true, sqlName: "id" },
+                  identifier: { type: "text", unique: true, sqlName: "identifier" },
+                  spaceId: {
+                    type: "text",
+                    sqlName: "space_id",
+                    references: { table: "spaces", column: "id" },
+                  },
+                  parentId: { type: "text", sqlName: "parent_id" },
+                  title: { type: "text", sqlName: "title" },
+                },
+              },
+            },
+          },
+        },
+      },
+      "sql:db",
+      "tasks",
+    );
+    expect(cols.find((c) => c.sqlName === "id")).toMatchObject({
+      primaryKey: true,
+      foreignKey: false,
+    });
+    expect(cols.find((c) => c.sqlName === "identifier")).toMatchObject({ unique: true });
+    expect(cols.find((c) => c.sqlName === "space_id")).toMatchObject({
+      foreignKey: true,
+      inferred: false,
+    });
+    expect(cols.find((c) => c.sqlName === "parent_id")).toMatchObject({
+      foreignKey: true,
+      inferred: true,
+    });
+    expect(cols.find((c) => c.sqlName === "title")).toMatchObject({
+      foreignKey: false,
+      primaryKey: false,
+    });
+  });
+
+  test("rewrites owner or a previous identity column", () => {
+    expect(rlsRewriteIdentityColumn("owner = oke.user()", "owner", "creator_email")).toBe(
+      "creator_email = oke.user()",
+    );
+    expect(
+      rlsRewriteIdentityColumn("creator_email = oke.user()", "creator_email", "owner_email"),
+    ).toBe("owner_email = oke.user()");
+    expect(rlsExprUsesUserIdentity("creator_email = oke.user()")).toBe(true);
+    expect(rlsExprUsesUserIdentity("true")).toBe(false);
+    expect(rlsTemplateUsesOwner({ using: "owner = oke.user()" })).toBe(true);
+    expect(rlsTemplateUsesOwner({ withCheck: "true" })).toBe(false);
+  });
+});
+
 describe("rls gate posture", () => {
   test("maps commands to Module:Action pairs", () => {
     expect(rlsStoreGateActions("SELECT")).toEqual(["store.sql:read"]);