pgkiln 0.40.0 → 0.42.0

package/src/builder/mail.ts

@@ -207,10 +207,37 @@ export async function mailRoutes(app: FastifyInstance) {
             <td data-label="Status">${x.enabled ? 'enabled' : html`<b>disabled</b>`}</td></tr>`)
             : html`<tr><td colspan="6" class="empty">No mail services yet.</td></tr>`}</tbody></table></div>`,
         html`<a class="btn btn-sm btn-hot" href="${BASE}/mail/new">${icon('plus')} Add service</a>`)}
+      ${await builderMailRegion(s, services)}
       ${region('Recent mail', mailTable(recent, true))}`;
     return send(reply, s, shell(s, 'Mail services', [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Mail services']], main));
   });
 
+  // (096) the builder's own mail ("Find my workspace"): a service and a From address it may send as
+  app.post(`${BASE}/mail/builder`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply, 'Mail services'))) return;
+    const name = String(req.body?.service ?? '');
+    const from = String(req.body?.from ?? '').trim();
+    try {
+      if (!name) await owner.query(`delete from meta.setting where name in ('builder_mail_service', 'builder_mail_from')`);
+      else {
+        const svc = await owner.one<{ senders: string[] }>('select senders from meta.mail_service where name = $1', [name]);
+        if (!svc) throw new Error('Choose one of the mail services.');
+        if (!/^[^@\s<>"]+@[^@\s<>"]+$/.test(from)) throw new Error('The From address is an e-mail address, e.g. pgkiln@example.com.');
+        if (!senderAllowed(svc.senders, from)) throw new Error(`The service ${name} may not send as ${from}: add it to its senders first.`);
+        await owner.tx(async (c) => {
+          for (const [k, v] of [['builder_mail_service', name], ['builder_mail_from', from]])
+            await c.query('insert into meta.setting (name, value) values ($1, $2) on conflict (name) do update set value = excluded.value', [k, v]);
+        });
+      }
+      await logActivity({ appId: null, username: s.username, event: 'mail_service', ip: clientIp(req), detail: name ? `builder mail: ${name} as ${from}` : 'builder mail: none' });
+      flash(s, name ? 'Builder mail saved: "Find my workspace" sends through it.' : 'The builder sends no mail now.');
+    } catch (e) {
+      flash(s, (e as Error).message, 'error');
+    }
+    return back(reply, s, `${BASE}/mail#builder-mail`);
+  });
+
   // a new service: choose the provider, then its settings only
   app.get(`${BASE}/mail/new`, async (req: Req, reply) => {
     const s = await developer(req, reply);
@@ -423,3 +450,15 @@ export async function mailRoutes(app: FastifyInstance) {
   app.post(`${BASE}/apps/:id(^\\d+$)/mail/:mid(^\\d+$)/retry`, change('queued', ['error', 'cancelled']));
   app.post(`${BASE}/apps/:id(^\\d+$)/mail/:mid(^\\d+$)/cancel`, change('cancelled', ['queued']));
 }
+
+/** (096) Mail services → Builder mail: the service and From address of the builder's own mail. */
+async function builderMailRegion(s: Session, services: { name: string; enabled: boolean }[]) {
+  const set = Object.fromEntries((await owner.query<{ name: string; value: string }>(`select name, value from meta.setting where name in ('builder_mail_service', 'builder_mail_from')`)).rows.map((r) => [r.name, r.value]));
+  return region('Builder mail', html`<form method="post" action="${BASE}/mail/builder">${csrf(s)}
+    <p class="muted u-mt0">The service the builder itself sends through: <b>Find my workspace</b> on the sign-in page mails developers their workspaces (to the address on their account). None: the builder sends no mail.</p>
+    <div class="form-grid">
+      ${select('service', 'Service', set.builder_mail_service ?? '', [['', 'None'], ...services.map((x) => [x.name, `${x.name}${x.enabled ? '' : ' (disabled)'}`] as [string, string])])}
+      ${input('from', 'From address', set.builder_mail_from ?? '', { type: 'email', placeholder: 'pgkiln@example.com', help: 'One of the service\'s senders.' })}
+    </div>
+    <div class="buttons"><button class="btn">Save</button></div></form>`, '', 'builder-mail');
+}

package/src/builder/newapp.ts

@@ -3,7 +3,146 @@ import { owner, type Client } from '../db.ts';
 import { passwordProblem } from '../accounts.ts';
 import { replaceApp } from '../cli/replace.ts';
 import { placeApp } from './workspaces.ts';
-import { NEW_APP_BASE } from '../runtime/styles.ts';
+import { BASE_STYLES, NEW_APP_BASE } from '../runtime/styles.ts';
+import { LANGUAGE_NAMES } from '../i18n.ts';
+import { isIcon } from '../icons.ts';
+import { secretKeyConfigured } from '../secrets.ts';
+
+/** (097) The icon of a new application's home page when the developer chose none. */
+export const DEFAULT_APP_ICON = 'layers';
+const escapeHtml = (s: string) => s.replace(/[&<>"']/g, (ch) => `&#${ch.charCodeAt(0)};`);
+
+/** (sprint 72) The page number of a generated application's About page. */
+export const ABOUT_PAGE = 9000;
+
+/**
+ * (sprint 72) The About page of a generated application (APEX: the About Page
+ * feature): the application's name, its description or the pages of its menu,
+ * and a Help menu with it in the header's navigation bar (a list NAVBAR, unless
+ * the application has a navigation bar list already). Nothing when the page
+ * number is taken.
+ */
+export async function addAboutPage(c: Client, appId: number, description?: string | null) {
+  const app = (await c.query<{ name: string; navbar_list: string | null; home_page: number }>('select name, navbar_list, home_page from meta.app where id = $1', [appId])).rows[0];
+  if ((await c.query('select 1 from meta.page where app_id = $1 and page_no = $2', [appId, ABOUT_PAGE])).rowCount) return;
+  const pages = (
+    await c.query<{ label: string }>(
+      `select e.label from meta.nav_entry e where e.app_id = $1 and e.parent_id is null and e.target_page is not null and e.target_page <> $2 order by e.seq, e.id`,
+      [appId, app.home_page],
+    )
+  ).rows.map((r) => r.label);
+  const text = description
+    ? `<p>${escapeHtml(description)}</p>`
+    : pages.length
+      ? `<p>${escapeHtml(app.name)} has these pages:</p><ul>${pages.map((l) => `<li>${escapeHtml(l)}</li>`).join('')}</ul>`
+      : `<p>${escapeHtml(app.name)}</p>`;
+  const page = (await c.query(`insert into meta.page (app_id, page_no, name, title, parent_page) values ($1, $2, 'About', $3, $4) returning id`, [appId, ABOUT_PAGE, `About ${app.name}`.slice(0, 200), app.home_page])).rows[0].id;
+  await c.query(`insert into meta.region (page_id, seq, title, type, source) values ($1, 10, $2, 'static', $3)`, [page, app.name, text]);
+  if (app.navbar_list) return;
+  await c.query(`insert into meta.list (app_id, name, description) values ($1, 'NAVBAR', 'The navigation bar: the Help menu') on conflict (app_id, name) do nothing`, [appId]);
+  const help = (await c.query(`insert into meta.list_entry (app_id, list_name, seq, label, icon) values ($1, 'NAVBAR', 10, 'Help', 'help') returning id`, [appId])).rows[0].id;
+  await c.query(`insert into meta.list_entry (app_id, list_name, parent_id, seq, label, icon, target_page) values ($1, 'NAVBAR', $2, 10, 'About', 'info', $3)`, [appId, help, ABOUT_PAGE]);
+  await c.query(`update meta.app set navbar_list = 'NAVBAR' where id = $1`, [appId]);
+}
+
+/**
+ * (sprint 73) The Create Application wizard's features (APEX: Features). Each maps to a setting or to pages:
+ * - about: an About page in a Help menu (addAboutPage)
+ * - access: authorization schemes CONTRIBUTOR and READER next to ADMIN (roles admin, contributor, reader)
+ * - activity: an Activity page for administrators (page 9010: page views per day and the latest activity)
+ * - feedback: users may send feedback (the navigation bar's Feedback entry)
+ * - theme: users may choose light or dark (theme.user_choice)
+ * - pwa, push: installable, with push notifications (push needs PGKILN_SECRET_KEY; its key is made after the commit)
+ */
+export interface Features { about: boolean; access: boolean; activity: boolean; feedback: boolean; theme: boolean; pwa: boolean; push: boolean }
+export const FEATURES: [keyof Features, string, string, boolean][] = [
+  ['about', 'About page', 'An About page in a Help menu of the header.', true],
+  ['access', 'Access control', 'Authorization schemes for the roles admin, contributor and reader, to put on pages, regions and buttons.', false],
+  ['activity', 'Activity reporting', 'A page for administrators with the page views per day and the latest activity.', false],
+  ['feedback', 'Feedback', 'Users send feedback from the header; you read it under Activity → Feedback.', false],
+  ['theme', 'Theme style selection', 'Users may choose the light or the dark theme.', true],
+  ['pwa', 'Install as an app (PWA)', 'Installable on phones and desktops, with offline pages.', false],
+  ['push', 'Push notifications', 'Notifications to the users\' devices (with Install as an app).', false],
+];
+/** The features ticked on a form (a form without them: the defaults). */
+export const featuresFrom = (b: Record<string, unknown>, posted: boolean): Features =>
+  Object.fromEntries(FEATURES.map(([k, , , on]) => [k, posted ? b[`f_${k}`] === 'true' : on])) as unknown as Features;
+
+/** (sprint 73) The Activity page of a generated application. */
+export const ACTIVITY_PAGE = 9010;
+
+async function applyFeatures(c: Client, appId: number, f: Partial<Features>, notes: string[]) {
+  if (f.access) {
+    await c.query(
+      `insert into meta.authz_scheme (app_id, name, type, value, error_message) values
+         ($1, 'CONTRIBUTOR', 'sql', 'meta.has_role(''admin'') or meta.has_role(''contributor'')', 'Only contributors can do this.'),
+         ($1, 'READER', 'sql', 'meta.has_role(''admin'') or meta.has_role(''contributor'') or meta.has_role(''reader'')', 'Only readers can open this page.')
+       on conflict do nothing`,
+      [appId],
+    );
+  }
+  if (f.activity && !(await c.query('select 1 from meta.page where app_id = $1 and page_no = $2', [appId, ACTIVITY_PAGE])).rowCount) {
+    const home = (await c.query('select home_page from meta.app where id = $1', [appId])).rows[0].home_page;
+    const page = (await c.query(`insert into meta.page (app_id, page_no, name, title, parent_page, authz) values ($1, $2, 'Activity', 'Activity', $3, 'ADMIN') returning id`, [appId, ACTIVITY_PAGE, home])).rows[0].id;
+    await c.query(
+      `insert into meta.region (page_id, seq, title, type, source, config) values
+         ($1, 10, 'Page views per day', 'chart', $2, '{"kind": "column"}'),
+         ($1, 20, 'Latest activity', 'report', $3, '{"headings": {"at": "Time", "username": "User", "event": "Event", "page_no": "Page", "elapsed_ms": "Time taken (ms)"}}')`,
+      [page,
+       `select to_char(date_trunc('day', at), 'YYYY-MM-DD') as "Day", count(*) as "Page views"
+  from meta.app_activity(30)
+ where event = 'page_view'
+ group by 1
+ order by 1`,
+       `select at, username, event, page_no, elapsed_ms
+  from meta.app_activity(30)`],
+    );
+    await c.query(`insert into meta.nav_entry (app_id, seq, label, icon, target_page, authz) values ($1, 9010, 'Activity', 'activity', $2, 'ADMIN')`, [appId, ACTIVITY_PAGE]);
+  }
+  if (f.feedback) await c.query('update meta.app set feedback = true where id = $1', [appId]);
+  if (f.theme === false) await c.query(`update meta.app set theme = theme || '{"user_choice": false}' where id = $1`, [appId]);
+  if (f.pwa || f.push) await c.query('update meta.app set pwa = true where id = $1', [appId]);
+  if (f.push) {
+    if (secretKeyConfigured()) await c.query('update meta.app set pwa_push = true where id = $1', [appId]);
+    else notes.push('Push notifications are off: they need PGKILN_SECRET_KEY in the server\'s environment.');
+  }
+}
+
+/** (sprint 72) After a wizard generated the pages: the home page's cards and, unless turned off, the About page; (sprint 73) the chosen features. */
+export async function finishGeneratedApp(c: Client, appId: number, o: { about?: boolean; description?: string | null; features?: Partial<Features>; notes?: string[] } = {}) {
+  const f = { ...(o.features ?? {}) };
+  if (f.about === undefined) f.about = o.about !== false;
+  await applyFeatures(c, appId, f, o.notes ?? []);
+  await addHomeCards(c, appId);
+  if (f.about) await addAboutPage(c, appId, o.description);
+}
+
+/**
+ * (097) A card per page of the navigation menu on the home page (a static list
+ * HOME_PAGES shown by a list region with the cards template), after the pages
+ * of a new application were generated. Does nothing when the application has
+ * no other pages, or the list exists already.
+ */
+export async function addHomeCards(c: Client, appId: number) {
+  const entries = (
+    await c.query<{ label: string; icon: string | null; target_page: number; authz: string | null }>(
+      `select e.label, e.icon, e.target_page, e.authz from meta.nav_entry e join meta.app a on a.id = e.app_id
+        where e.app_id = $1 and e.parent_id is null and e.target_page is not null and e.target_page <> a.home_page
+        order by e.seq, e.id`,
+      [appId],
+    )
+  ).rows;
+  if (!entries.length) return;
+  const made = await c.query(`insert into meta.list (app_id, name, description) values ($1, 'HOME_PAGES', 'The cards of the home page') on conflict (app_id, name) do nothing`, [appId]);
+  if (!made.rowCount) return;
+  for (const [n, e] of entries.entries())
+    await c.query('insert into meta.list_entry (app_id, list_name, seq, label, icon, target_page, authz) values ($1, $2, $3, $4, $5, $6, $7)', [appId, 'HOME_PAGES', (n + 1) * 10, e.label, e.icon, e.target_page, e.authz]);
+  await c.query(
+    `insert into meta.region (page_id, seq, title, type, template, config)
+     select p.id, 20, 'Pages', 'list', 'plain', '{"list": "HOME_PAGES", "template": "cards"}' from meta.page p join meta.app a on a.id = p.app_id and p.page_no = a.home_page where a.id = $1`,
+    [appId],
+  );
+}
 
 // Creating an application (Create → blank application, and Create → from a
 // file): the parsing schema, a database role app_<alias> that can use only
@@ -18,6 +157,15 @@ export interface NewAppInput {
   authentication?: string;
   admin_user?: string;
   admin_password?: string;
+  /** (097) a line about the application, shown on the home page */
+  description?: string;
+  /** (097) the application's icon (a name from icons.svg) */
+  icon?: string;
+  /** (sprint 73) appearance: base style, menu position, accent colour; the primary language */
+  base?: string;
+  nav?: string;
+  accent?: string;
+  language?: string;
 }
 
 export interface CheckedApp {
@@ -31,6 +179,16 @@ export interface CheckedApp {
   adminPassword: string | null;
   /** the workspace that gets the application (the developer's current one) */
   workspaceId: number;
+  /** (097) shown under the name on the home page */
+  description?: string | null;
+  /** (097) the home page's icon */
+  icon?: string | null;
+  /** (sprint 73) the theme: base style (Iris when not given), menu at the top, own accent colour */
+  base?: 'iris' | 'lavender' | 'standard';
+  topNav?: boolean;
+  accent?: string | null;
+  /** (sprint 73) the primary language (default en) */
+  language?: string;
 }
 
 /** pgkiln's and the system's schemas never become an application's parsing schema. */
@@ -56,7 +214,17 @@ export async function checkNewApp(b: NewAppInput, workspaceId: number): Promise<
     if (problem) throw new Error(problem);
     adminPassword = known ? null : (b.admin_password ?? '');
   }
-  return { name, alias, schema, role: `app_${alias.replace(/-/g, '_')}`, authentication, adminUser, adminPassword, workspaceId };
+  const description = (b.description ?? '').trim().slice(0, 300) || null;
+  const appIcon = (b.icon ?? '').trim();
+  if (appIcon && !isIcon(appIcon)) throw new Error('Choose one of the icons in the list.');
+  const base = b.base === 'lavender' || b.base === 'standard' ? b.base : 'iris';
+  const accent = /^#[0-9a-f]{6}$/i.test(b.accent ?? '') && b.accent!.toLowerCase() !== BASE_STYLES[base].accent ? b.accent!.toLowerCase() : null;
+  const language = (b.language ?? '').trim() || 'en';
+  if (!(language in LANGUAGE_NAMES)) throw new Error('Choose one of the languages in the list.');
+  return {
+    name, alias, schema, role: `app_${alias.replace(/-/g, '_')}`, authentication, adminUser, adminPassword, workspaceId, description, icon: appIcon || null,
+    base, topNav: b.nav === 'top', accent, language,
+  };
 }
 
 /** Create the schema, the role and the application (inside the caller's owner transaction). */
@@ -93,12 +261,21 @@ export async function createApp(c: Client, a: CheckedApp): Promise<{ id: number;
   await c.query(`alter default privileges in schema ${S} grant usage, select on sequences to ${R}`);
   await c.query(`alter default privileges in schema ${S} grant execute on functions to ${R}`);
 
-  // new applications start with the newest base style (Iris); existing ones keep theirs
-  const r = await c.query('insert into meta.app (alias, name, authentication, db_role, theme) values ($1, $2, $3, $4, $5) returning id', [a.alias, a.name, a.authentication, a.role, { base: NEW_APP_BASE }]);
+  // new applications start with the newest base style (Iris), light (users may switch to dark); existing ones keep theirs
+  // (sprint 73) the wizard's appearance: base style, menu at the top, an own accent colour
+  const theme: Record<string, string> = { mode: 'light' };
+  const base = a.base ?? NEW_APP_BASE;
+  if (base !== 'standard') theme.base = base;
+  if (a.topNav) theme.nav = 'top';
+  if (a.accent) theme.accent = a.accent;
+  const r = await c.query('insert into meta.app (alias, name, authentication, db_role, theme, language) values ($1, $2, $3, $4, $5, $6) returning id', [a.alias, a.name, a.authentication, a.role, theme, a.language ?? 'en']);
   const appId = r.rows[0].id as number;
   await placeApp(c, appId, a.workspaceId);
   const p = await c.query(`insert into meta.page (app_id, page_no, name, title) values ($1, 1, 'Home', 'Home') returning id`, [appId]);
-  await c.query(`insert into meta.region (page_id, title, type, source) values ($1, 'Welcome', 'static', '<p>Hello, &APP_USER.! Edit this page in the builder.</p>')`, [p.rows[0].id]);
+  // (097) a hero with the application's icon, name and description (no developer wording for end users)
+  await c.query(`insert into meta.region (page_id, seq, title, type, source, template, config) values ($1, 10, $2, 'static', $3, 'hero', $4)`, [
+    p.rows[0].id, a.name, a.description ? `<p>${escapeHtml(a.description)}</p>` : '', { icon: a.icon ?? DEFAULT_APP_ICON },
+  ]);
   await c.query(`insert into meta.nav_entry (app_id, seq, label, icon, target_page) values ($1, 1, 'Home', 'home', 1)`, [appId]);
   await c.query(`insert into meta.authz_scheme (app_id, name, type, value, error_message) values ($1, 'ADMIN', 'role', 'admin', 'Only administrators can access this page.')`, [appId]);
   let existingAccount = false;

package/src/builder/region-settings.ts

@@ -53,6 +53,9 @@ const CHART_LABELS: Record<string, string> = {
   funnel: 'Funnel (stages in the query order)',
   radar: 'Radar (one axis per row)',
   gantt: 'Gantt (task, start and end columns)',
+  treemap: 'Treemap (label and value; node_id, parent_id for a hierarchy)',
+  sunburst: 'Sunburst (label and value; node_id, parent_id for a hierarchy)',
+  timeline: 'Timeline (label, start, end; a series column for lanes)',
   pyramid: 'Pyramid (one series; two series back to back)',
   polar: 'Polar area (one sector per row)',
   range: 'Range (low and high columns: floating columns)',
@@ -131,6 +134,11 @@ export function mergeChartSettings(config: Config, b: Body, a: Allowed): Config
     if (raw && Number.isFinite(v)) gauge[k] = v;
   }
   set('gauge', Object.keys(gauge).length ? gauge : undefined);
+  // (sprint 69) Gantt drag and drop
+  set('gantt_move', b.gantt_move?.trim() || undefined);
+  const authz = b.gantt_move_authz?.trim().toUpperCase();
+  set('gantt_move_authz', authz && (authz === 'MUST_NOT_BE_PUBLIC_USER' || a.authz?.has(authz)) ? authz : undefined);
+  set('gantt_snap', b.gantt_snap === 'day' || b.gantt_snap === 'hour' ? b.gantt_snap : undefined);
   return out;
 }
 
@@ -728,6 +736,7 @@ export async function regionSettingsForm(pageId: number, appId: number, r: Regio
   const cfg = r.config ?? {};
   const id = (n: string) => `rg_${r.id}_${n}`;
   const pages = async () => (await owner.query('select page_no, name from meta.page where app_id = $1 order by page_no', [appId])).rows;
+  const schemes = async () => (await owner.query('select name from meta.authz_scheme where app_id = $1 order by name', [appId])).rows.map((x) => x.name as string);
   let body: Raw;
   let title = 'Settings';
   switch (r.type as SettingsType) {
@@ -752,7 +761,16 @@ export async function regionSettingsForm(pageId: number, appId: number, r: Regio
         </div>
         <small class="help">Gauge charts only. A warning threshold above the critical one means low values are bad (e.g. warning 50, critical 20).</small></fieldset>
         ${linkFieldset(id, cfg.link, await pages(), 'Each data point')}
-        <small class="help">Drill-down: <code>#column#</code> takes the value from the point's row, <code>#series#</code> the name of its series. Columns only the link refers to are not drawn.</small>`;
+        <small class="help">Drill-down: <code>#column#</code> takes the value from the point's row, <code>#series#</code> the name of its series. Columns only the link refers to are not drawn.</small>
+        <fieldset class="prop-group"><legend>Gantt: drag and drop</legend><div class="form-grid">
+          <div class="field" data-wide><label class="label" for="${id('gantt_move')}">SQL that moves a task</label>
+            <textarea id="${id('gantt_move')}" name="gantt_move" rows="3" data-code="sql" placeholder="update my_schema.task set starts = :NEW_START::date, ends = :NEW_END::date where id = :TASK_ID::int">${cfg.gantt_move ?? ''}</textarea>
+            <small class="help">Gantt charts with a <code>task_id</code> column. Runs as the application's database role (row level security applies) with <code>:TASK_ID</code>, <code>:NEW_START</code> and <code>:NEW_END</code> (<code>YYYY-MM-DD</code>, or <code>YYYY-MM-DDTHH:MM</code> by the hour; a milestone gets the same start and end). Empty: tasks can't be dragged.</small></div>
+          <div class="field"><label class="label" for="${id('gantt_move_authz')}">Who may drag</label>
+            <select id="${id('gantt_move_authz')}" name="gantt_move_authz">${opt('', 'Everyone who sees the chart', cfg.gantt_move_authz)}${opt('MUST_NOT_BE_PUBLIC_USER', 'Signed-in users', cfg.gantt_move_authz)}${(await schemes()).map((n) => opt(n, `Authorization: ${n}`, cfg.gantt_move_authz))}</select></div>
+          <div class="field"><label class="label" for="${id('gantt_snap')}">Steps</label>
+            <select id="${id('gantt_snap')}" name="gantt_snap">${opt('', 'Days, or hours when a task has a time', cfg.gantt_snap)}${opt('day', 'Days', cfg.gantt_snap)}${opt('hour', 'Hours', cfg.gantt_snap)}</select></div>
+        </div><small class="help">Only tasks the user sees in this chart can be moved; the chart is drawn again from its query afterwards.</small></fieldset>`;
       break;
     case 'cards':
       title = 'Cards settings';