pgkiln 0.43.0 → 0.45.0

package/src/runtime/regions.ts

@@ -8,6 +8,7 @@ import type { Button, Region } from '../metadata.ts';
 import { isAuthorized, pageAllowed } from './authz.ts';
 import { bindValues, dbg, publicError, stripSemicolon, substitute, timed, type PageContext } from './context.ts';
 import { renderItems } from './items.ts';
+import { expandShortcuts } from './shortcuts.ts';
 import { fillItems, linkAttrs, linkColumns } from './links.ts';
 import { renderCalendar } from './calendar.ts';
 import { CHART_KINDS, renderChartBody, wallClockIn, type GaugeConfig } from './charts.ts';
@@ -66,7 +67,7 @@ async function renderMenu(ctx: PageContext, b: Button, cls: string, badge: Raw |
   for (const e of b.menu ?? []) {
     if (!(await isAuthorized(ctx, e.authz))) continue;
     const ic = e.icon ? html`${icon(e.icon)} ` : '';
-    const confirm = e.confirm ? raw(` data-confirm="${esc(e.confirm)}"`) : '';
+    const confirm = e.confirm ? raw(` data-confirm="${esc(await expandShortcuts(ctx, e.confirm, 'text'))}"`) : '';
     if (e.page) {
       if (!(await pageAllowed(ctx, e.page))) continue;
       entries.push(html`<a ${linkAttrs(ctx, e.page, e.items ?? {})}${confirm}>${ic}${e.label}</a>`);
@@ -82,7 +83,7 @@ async function renderMenu(ctx: PageContext, b: Button, cls: string, badge: Raw |
 
 export async function renderButton(ctx: PageContext, b: Button) {
   const cls = `btn${b.hot ? ' btn-hot' : ''}${b.name === 'DELETE' ? ' btn-danger' : ''}${templateClasses('button', b.template_options)}`;
-  const confirm = b.confirm ? raw(` data-confirm="${esc(b.confirm)}"`) : '';
+  const confirm = b.confirm ? raw(` data-confirm="${esc(await expandShortcuts(ctx, b.confirm, 'text'))}"`) : '';
   const badge = b.badge || b.badge_query ? await badgeOf(ctx, b) : '';
   if (b.action === 'menu') return renderMenu(ctx, b, cls, badge);
   if (b.action === 'redirect') {
@@ -401,7 +402,7 @@ async function renderBody(ctx: PageContext, r: Region, hidden: Set<string>): Pro
       break;
     case 'static': {
       const itemsHtml = await renderItems(ctx, items, hidden);
-      body = html`${raw(substitute(r.source ?? '', ctx, esc))}${itemsHtml.length ? html`<div class="form-grid">${itemsHtml}</div>` : ''}`;
+      body = html`${raw(substitute(await expandShortcuts(ctx, r.source ?? '', 'html'), ctx, esc))}${itemsHtml.length ? html`<div class="form-grid">${itemsHtml}</div>` : ''}`;
       break;
     }
   }

package/src/runtime/render.ts

@@ -292,9 +292,14 @@ export async function chrome(ctx: PageContext, main: Raw, title: string) {
                 </form>
               </div>
             </details>`
-          : html`<a href="${ctx.base}/login">${t('login.sign_in_link')}</a>`
+          : // (sprint 79, UI-3; APEX: the user menu of a public page) signed out: Appearance and Sign in in the user menu
+            ctx.locale.themeChoice || styleChoice(ctx.app)
+            ? html`<details class="menu t-user"><summary>${icon('user')}<span>${t('login.sign_in_link')}</span></summary>
+                <div class="menu-panel align-right">${themeSwitch(ctx, here(ctx))}${styleSwitch(ctx, here(ctx))}
+                  <div class="menu-section"><a href="${ctx.base}/login">${icon('arrow-right')} ${t('login.sign_in_link')}</a></div></div></details>`
+            : html`<a href="${ctx.base}/login">${t('login.sign_in_link')}</a>`
         : ctx.locale.themeChoice || styleChoice(ctx.app)
-          ? html`<details class="menu t-user"><summary>${icon('settings')}<span class="sr-only">${t('theme.label')}</span></summary>
+          ? html`<details class="menu t-user"><summary title="${t('theme.label')}">${icon('settings')}<span class="sr-only">${t('theme.label')}</span></summary>
               <div class="menu-panel align-right">${themeSwitch(ctx, here(ctx))}${styleSwitch(ctx, here(ctx))}</div></details>`
           : ''}
     </header>
@@ -359,6 +364,7 @@ const timeZoneMeta = (ctx: PageContext) =>
 
 export async function renderPage(ctx: PageContext) {
   const t = ctx.locale.t;
+  ctx.wholePage = true;
   const hidden = initiallyHidden(ctx);
   const defaultButton = [...ctx.vis!.buttons.values()].find((b) => b.hot && b.action === 'submit');
   const pageItems = await renderItems(ctx, ctx.page.items.filter((i) => i.region_id === null), hidden);

package/src/runtime/report.ts

@@ -1,3 +1,4 @@
+import { componentSetting } from './component-settings.ts';
 import { icon } from '../icons.ts';
 import pg from 'pg';
 import { templateClasses } from './template-options.ts';
@@ -237,7 +238,7 @@ export function selectionOf(page: { items: { name: string }[] }, r: Region) {
 
 export function reportState(ctx: PageContext, r: Region): ReportState {
   const p = ctx.params;
-  const size = parseInt(p.get(key(r, 'n')) ?? '', 10) || Number(r.config.page_size) || 15;
+  const size = parseInt(p.get(key(r, 'n')) ?? '', 10) || Number(r.config.page_size) || componentSetting(ctx.app.component_settings, 'report_rows');
   const st: ReportState = {
     search: (p.get(key(r, 'q')) ?? '').trim(),
     searchCol: (p.get(key(r, 'qc')) ?? '').trim() || null,
@@ -567,17 +568,20 @@ export function pagerNav(ctx: PageContext, r: Region, info: PageInfo, linkAttr:
   </nav>`;
 }
 
-/** (sprint 76) Rows per page as a select in the pager (a GET form; app.js sends it on change, else its button). */
+/** (sprint 76) Rows per page as a select in the pager (a detached GET form; app.js sends it on change, else its button). */
 function sizeChooser(ctx: PageContext, r: Region, info: PageInfo): Raw | '' {
   if (r.type !== 'report' || r.config.interactive === false) return '';
   const st = reportState(ctx, r);
   const keep = [...ctx.params.entries()].filter(([k]) => k !== key(r, 'n') && k !== key(r, 'p') && k !== key(r, 'k') && !['clear', 'cs'].includes(k));
   const t = ctx.locale.t;
   if (info.total !== null && info.total <= PAGE_SIZES[0] && st.size === PAGE_SIZES[0]) return '';
-  return html`<form method="get" action="${ctx.base}/${ctx.page.page_no}" class="pager-size">${keep.map(([k, v]) => html`<input type="hidden" name="${k}" value="${v}">`)}${ctx.dialog ? html`<input type="hidden" name="dialog" value="1">` : ''}
+  // the region sits inside the page's form: the GET form is detached, the select and its button join it by its id
+  const form = `rn${r.id}`;
+  ctx.detached.push(html`<form id="${form}" method="get" action="${ctx.base}/${ctx.page.page_no}">${keep.map(([k, v]) => html`<input type="hidden" name="${k}" value="${v}">`)}${ctx.dialog ? html`<input type="hidden" name="dialog" value="1">` : ''}</form>`);
+  return html`<span class="pager-size">
     <label for="r${r.id}_size">${t('report.rows_per_page')}</label>
-    <select id="r${r.id}_size" name="${key(r, 'n')}" data-go>${[...new Set([...PAGE_SIZES, st.size])].sort((a, b) => a - b).map((n) => html`<option value="${n}"${n === st.size ? raw(' selected') : ''}>${n}</option>`)}</select>
-    <button class="btn btn-sm no-js-only">${t('report.go')}</button></form>`;
+    <select id="r${r.id}_size" name="${key(r, 'n')}" form="${form}" data-go>${[...new Set([...PAGE_SIZES, st.size])].sort((a, b) => a - b).map((n) => html`<option value="${n}"${n === st.size ? raw(' selected') : ''}>${n}</option>`)}</select>
+    <button class="btn btn-sm no-js-only" form="${form}">${t('report.go')}</button></span>`;
 }
 
 /** (sprint 76) The most values a column heading's menu lists. */
@@ -788,6 +792,8 @@ export async function renderReport(ctx: PageContext, r: Region, filterItems: Raw
   const st = reportState(ctx, r);
   const searchable = r.config.searchable !== false;
   const interactive = r.config.interactive !== false && searchable;
+  // (sprint 78; APEX: a faceted search's results have no search bar) one search field: the facets'
+  const searchBox = !ctx.page.regions.some((x) => x.type === 'facets' && x.config.search === true && Number(x.config.report) === r.id && ctx.vis?.regions.has(x.id) !== false);
 
   let res: pg.QueryResult<any[]>;
   let pageNo = st.page;
@@ -1124,14 +1130,14 @@ export async function renderReport(ctx: PageContext, r: Region, filterItems: Raw
       ? html`<div class="report-toolbar">
           ${filterItems}
           ${searchable
-            ? html`<div class="search" role="search">
-                <div class="search-field">${interactive
+            ? html`<div class="search"${searchBox ? raw(' role="search"') : ''}>
+                ${searchBox ? html`<div class="search-field">${interactive
                   ? html`<label class="sr-only" for="r${r.id}_qc">${t('report.search_column')}</label>
-                    <select id="r${r.id}_qc" class="search-scope" name="${key(r, 'qc')}" form="${searchForm}">
-                      <option value="">${t('report.all_columns')}</option>${cols.map(({ f }) => html`<option value="${f.name}"${f.name === st.searchCol ? raw(' selected') : ''}>${headingOf(r, f.name, ctx.locale.tr)}</option>`)}</select>`
+                    <span class="search-scope-wrap" title="${t('report.search_column')}">${icon('search')}<select id="r${r.id}_qc" class="search-scope" name="${key(r, 'qc')}" form="${searchForm}">
+                      <option value="">${t('report.all_columns')}</option>${cols.map(({ f }) => html`<option value="${f.name}"${f.name === st.searchCol ? raw(' selected') : ''}>${headingOf(r, f.name, ctx.locale.tr)}</option>`)}</select></span>`
                   : ''}
                   <input type="search" name="${key(r, 'q')}" value="${st.search}" placeholder="${t('report.search_all')}" form="${searchForm}" aria-label="${t('report.search')} ${r.title ?? ''}"></div>
-                <button class="btn" form="${searchForm}">${t('report.go')}</button>
+                <button class="btn no-js-only" form="${searchForm}">${t('report.go')}</button>` : ''}
                 ${actionsMenu}
               </div>`
             : ''}

package/src/runtime/routes.ts

@@ -44,7 +44,7 @@ import { PassThrough } from 'node:stream';
 import { reportPdf } from './pdf.ts';
 import { renderDocument } from './documents.ts';
 import { pwaHead } from './pwa.ts';
-import { resolveLocale, THEME_COOKIE, translateApp, translatePage, validTimeZone, type Locale } from './locale.ts';
+import { resolveLocale, THEME_COOKIE, themeCookieOptions, translateApp, translatePage, validTimeZone, type Locale } from './locale.ts';
 import { chrome, dialogClosePage, languagePicker, renderPage } from './render.ts';
 import { LOGIN_ERROR, LOGIN_USER, safeNext, signInForm } from './signin.ts';
 import { passwordResetRoutes } from './password-reset.ts';
@@ -122,13 +122,14 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
   // the browser's time zone (sent before signing in) stays with the new session
   if (typeof oldSession.state.__TZ === 'string') s.state.__TZ = oldSession.state.__TZ;
   // the account's preferences: light/dark, language and time zone
-  const pref = await runtime.one<{ theme_pref: string; language: string | null; time_zone: string | null }>(
+  const pref = await runtime.one<{ theme_pref: string | null; language: string | null; time_zone: string | null }>(
     'select theme_pref, language, time_zone from meta.account where lower(username) = lower($1)', [username]);
   if (pref) {
-    s.state.__THEME = pref.theme_pref;
+    // (sprint 79) no choice (null): the application's own mode
+    if (pref.theme_pref) s.state.__THEME = pref.theme_pref;
     if (pref.language) s.state.__LANG = pref.language;
     if (pref.time_zone) s.state.__TZ_PREF = pref.time_zone;
-    if (a.theme?.user_choice !== false) reply.setCookie(THEME_COOKIE, pref.theme_pref, { path: '/', sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 365 * 86400 });
+    if (pref.theme_pref && a.theme?.user_choice !== false) reply.setCookie(THEME_COOKIE, pref.theme_pref, themeCookieOptions(base));
   }
   // the account's style variant for this app (honoured only while the app offers it: styles.ts)
   const style = await runtime.one<{ style: string }>(
@@ -140,7 +141,8 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
   if (shared) s.state.__SHARED = shared;
   await saveState(s);
 
-  if (a.app_processes.some((p) => p.point === 'after_login')) {
+  // the application processes "after login", then (102) the application computations "after authentication"
+  if (a.app_processes.some((p) => p.point === 'after_login') || (a.app_computations ?? []).some((c) => c.point === 'after_authentication')) {
     const home = (await loadPage(a.id, a.home_page)) ?? ({ page_no: a.home_page, items: [], regions: [], buttons: [], dynamic_actions: [], validations: [], processes: [], computations: [], branches: [] } as unknown as Page);
     const ctx: PageContext = {
       app: a, page: home, session: s, base, params: new URLSearchParams(), request: '', user: username,
@@ -150,6 +152,7 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
     await appTx(txContext(ctx), async (c) => {
       ctx.client = c;
       await runAppProcesses(ctx, 'after_login');
+      await runComputations(ctx, 'after_authentication');
     });
     await saveState(s);
   }
@@ -1024,7 +1027,7 @@ export async function runtimeRoutes(app: FastifyInstance) {
         if (!item || !vis.editable.has(item.name)) throw new Forbidden(ctx.locale.t('error.unknown_item'));
         if (item.config?.cascade_parents) applyPostedItems(ctx, body, list(item.config.cascade_parents));
         const page = Math.min(Math.max(Math.floor(Number(body.p)) || 0, 0), 10_000);
-        return searchLov(ctx, item, String(body.q ?? '').slice(0, 200), page, popupPageSize(item, body.n));
+        return searchLov(ctx, item, String(body.q ?? '').slice(0, 200), page, popupPageSize(item, body.n, ctx.app.component_settings));
       });
       return reply.send(out);
     } catch (e) {

package/src/runtime/shortcuts.ts

@@ -0,0 +1,43 @@
+import { esc } from '../html.ts';
+import { publicError, type PageContext } from './context.ts';
+import { computeValue } from './logic.ts';
+
+// Shortcuts (migration 103; APEX: Shared Components → Shortcuts). "NAME" (an
+// upper-case name in double quotes) in a static region's content, an item's
+// help text and a button's or menu entry's confirm message is replaced by the
+// application's shortcut of that name, before &ITEM. substitutions. Other
+// quoted words (class="NAV" with no shortcut NAV) stay as they are.
+//
+//   text           the value; escaped where it goes into HTML
+//   html           the value as HTML
+//   function_body  PL/pgSQL returning the text (HTML), run once per request
+//                  as the application's role
+
+const NAME = /"([A-Z][A-Z0-9_]{0,59})"/g;
+
+/** A shortcut's text (html: as it goes into HTML), computed once per request; null: no such shortcut. */
+async function valueOf(ctx: PageContext, name: string, asHtml: boolean): Promise<string | null> {
+  const s = ctx.app.shortcuts?.find((x) => x.name === name);
+  if (!s) return null;
+  if (s.type === 'text') return asHtml ? esc(s.value) : s.value;
+  if (s.type === 'html') return s.value;
+  const cache = (ctx.shortcutValues ??= new Map());
+  if (!cache.has(name)) {
+    try {
+      cache.set(name, (await computeValue(ctx, { type: 'function_body', expression: s.value })) ?? '');
+    } catch (e) {
+      ctx.errors.page.push(await publicError(ctx, e, `shortcut "${name}"`));
+      cache.set(name, '');
+    }
+  }
+  return cache.get(name)!;
+}
+
+/** The text with its "NAME" shortcuts replaced (as HTML or as plain text). */
+export async function expandShortcuts(ctx: PageContext, text: string, as: 'html' | 'text'): Promise<string> {
+  if (!ctx.app.shortcuts?.length || !text.includes('"')) return text;
+  const names = new Set([...text.matchAll(NAME)].map((m) => m[1]));
+  const values = new Map<string, string | null>();
+  for (const n of names) values.set(n, await valueOf(ctx, n, as === 'html'));
+  return text.replace(NAME, (m, n: string) => values.get(n) ?? m);
+}

package/src/security.ts

@@ -96,7 +96,8 @@ export function securityHeaders(app: FastifyInstance) {
     // the app's own pages may use the camera (photos, scanning) and the position (location items); nothing else may
     reply.header('Permissions-Policy', 'camera=(self), microphone=(), geolocation=(self)');
     const type = String(reply.getHeader('content-type') ?? '');
-    if (type.startsWith('text/html')) {
+    // a file's own stricter policy (downloads, uploaded files: default-src 'none'; sandbox) is kept
+    if (type.startsWith('text/html') && !reply.hasHeader('content-security-policy')) {
       // No inline scripts and no inline styles: behaviour lives in /static/app.js,
       // styling in /static/app.css. The only <style> a page has (theme colours,
       // chart geometry) carries this response's nonce; style="" attributes are refused.

package/src/subscriptions.ts

@@ -219,3 +219,70 @@ export async function publish(masterId: number, kind: string, name: string, user
 
 export const unsubscribe = async (appId: number, kind: string, name: string) =>
   ((await owner.query('delete from meta.subscription where app_id = $1 and kind = $2 and name = $3', [appId, kind, name])).rowCount ?? 0) > 0;
+
+// ------------------------------------------------------------------ (105) component groups
+// A component group names some of an application's subscribable components
+// ("kind:name"); another application subscribes to all of them at once.
+
+/** The kinds a component group can hold: every subscribable kind but the theme. */
+export const GROUP_KINDS = (Object.keys(KINDS) as Kind[]).filter((k) => k !== 'theme');
+
+/** Members as the application has them ("lov:JOBS"), and a message for each that it doesn't have. */
+export async function checkGroupMembers(appId: number, members: string[]) {
+  const ok: string[] = [];
+  const problems: string[] = [];
+  for (const m of members.map((x) => x.trim()).filter(Boolean)) {
+    const at = m.indexOf(':');
+    const kind = m.slice(0, at).trim();
+    const name = m.slice(at + 1).trim();
+    if (at < 1 || !isKind(kind) || kind === 'theme') {
+      problems.push(`${m}: write kind:name, the kind one of ${GROUP_KINDS.join(', ')}.`);
+      continue;
+    }
+    const k = KINDS[kind];
+    const row = await owner.one<{ n: string }>(`select ${k.key} as n from ${k.table} where app_id = $1 and lower(${k.key}) = lower($2)`, [appId, name]);
+    if (!row) problems.push(`${m}: the application has no ${k.label.toLowerCase()} ${name}.`);
+    else if (!ok.includes(`${kind}:${row.n}`)) ok.push(`${kind}:${row.n}`);
+  }
+  return { members: ok, problems };
+}
+
+/** Component groups of the theme and library applications appId can subscribe to. */
+export async function groupsOffered(appId: number) {
+  return (
+    await owner.query<{ master_id: number; master_name: string; name: string; description: string | null; members: string[] }>(
+      `select m.id as master_id, m.name as master_name, g.name, g.description, g.members
+         from meta.component_group g join meta.app m on m.id = g.app_id
+        where m.app_type in ('theme', 'library') and m.id <> $1 and meta.app_workspace(m.id) = meta.app_workspace($1)
+        order by lower(m.name), m.id, lower(g.name)`,
+      [appId],
+    )
+  ).rows;
+}
+
+/** Subscribe appId to every member of a master's component group; members the master no longer has are skipped. */
+export async function subscribeGroup(appId: number, masterId: number, group: string, username: string) {
+  const g = await owner.one<{ members: string[] }>('select members from meta.component_group where app_id = $1 and name = $2', [masterId, group]);
+  if (!g) throw new SubscriptionError('Choose a component group.');
+  const done: string[] = [];
+  const skipped: string[] = [];
+  for (const m of g.members) {
+    const at = m.indexOf(':');
+    const kind = m.slice(0, at);
+    const name = m.slice(at + 1);
+    if (!isKind(kind) || kind === 'theme') continue;
+    const k = KINDS[kind];
+    if (!(await owner.one(`select 1 as ok from ${k.table} where app_id = $1 and ${k.key} = $2`, [masterId, name]))) {
+      skipped.push(m);
+      continue;
+    }
+    try {
+      await subscribe(appId, masterId, kind, name, username);
+      done.push(m);
+    } catch (e) {
+      if (!(e instanceof SubscriptionError)) throw e;
+      skipped.push(m);
+    }
+  }
+  return { done, skipped };
+}