pgkiln 0.49.0 → 0.51.0

package/src/i18n/ko.ts

@@ -686,6 +686,22 @@ export const ko: Record<MessageKey, string> = {
   'reporter.welcome_text': "데이터를 선택해 보고서를 시작하세요. 열 선택, 필터, 합계가 있는 그룹, 차트를 추가한 뒤 저장하거나 공유할 수 있습니다.",
   'reporter.columns_count': "열 {n}개",
   'reporter.search': "보고서 검색",
+  'reporter.published_reports': "게시된 보고서",
+  'reporter.published_tag': "게시됨",
+  'reporter.publish': "게시",
+  'reporter.unpublish': "게시 취소",
+  'reporter.publish_on_save': "애플리케이션의 모든 사용자에게 게시",
+  'reporter.published': "보고서 \"{name}\"을(를) 게시했습니다.",
+  'reporter.unpublished': "보고서 \"{name}\"의 게시를 취소했습니다.",
+  'reporter.pin': "고정",
+  'reporter.unpin': "고정 해제",
+  'reporter.pinned': "고정됨",
+  'reporter.pinned_msg': "보고서 \"{name}\"을(를) 고정했습니다.",
+  'reporter.unpinned_msg': "보고서 \"{name}\"의 고정을 해제했습니다.",
+  'reporter.link': "이 보고서 링크",
+  'reporter.open_link': "열기",
+  'reporter.no_published': "아직 게시된 보고서가 없습니다.",
+  'reporter.welcome_viewer': "게시된 보고서를 여세요. 데이터는 항상 최신입니다.",
   'reporter.changed': "{date} 변경됨",
   'reporter.no_match': "검색과 일치하는 보고서가 없습니다.",
   'reporter.chart_tag': "차트",

package/src/i18n/nb.ts

@@ -686,6 +686,22 @@ export const nb: Record<MessageKey, string> = {
   'reporter.welcome_text': "Velg data for å starte en rapport: velg kolonner, filtrer, grupper med summer, legg til et diagram, og lagre eller del den.",
   'reporter.columns_count': "{n} kolonner",
   'reporter.search': "Søk i rapporter",
+  'reporter.published_reports': "Publiserte rapporter",
+  'reporter.published_tag': "publisert",
+  'reporter.publish': "Publiser",
+  'reporter.unpublish': "Avpubliser",
+  'reporter.publish_on_save': "Publiser for alle brukere av applikasjonen",
+  'reporter.published': "Rapporten «{name}» publisert.",
+  'reporter.unpublished': "Rapporten «{name}» avpublisert.",
+  'reporter.pin': "Fest",
+  'reporter.unpin': "Løsne",
+  'reporter.pinned': "Festet",
+  'reporter.pinned_msg': "Rapporten «{name}» festet.",
+  'reporter.unpinned_msg': "Rapporten «{name}» løsnet.",
+  'reporter.link': "Lenke til denne rapporten",
+  'reporter.open_link': "Åpne",
+  'reporter.no_published': "Ingen rapporter er publisert ennå.",
+  'reporter.welcome_viewer': "Åpne en publisert rapport: dataene er alltid oppdatert.",
   'reporter.changed': "endret {date}",
   'reporter.no_match': "Ingen rapporter samsvarer med søket.",
   'reporter.chart_tag': "diagram",

package/src/i18n/pl.ts

@@ -686,6 +686,22 @@ export const pl: Record<MessageKey, string> = {
   'reporter.welcome_text': "Wybierz dane, aby rozpocząć raport: kolumny, filtry, grupowanie z sumami i wykres, a potem zapisz go lub udostępnij.",
   'reporter.columns_count': "Kolumny: {n}",
   'reporter.search': "Szukaj raportów",
+  'reporter.published_reports': "Opublikowane raporty",
+  'reporter.published_tag': "opublikowany",
+  'reporter.publish': "Opublikuj",
+  'reporter.unpublish': "Cofnij publikację",
+  'reporter.publish_on_save': "Opublikuj dla wszystkich użytkowników aplikacji",
+  'reporter.published': "Raport „{name}” opublikowany.",
+  'reporter.unpublished': "Cofnięto publikację raportu „{name}”.",
+  'reporter.pin': "Przypnij",
+  'reporter.unpin': "Odepnij",
+  'reporter.pinned': "Przypięte",
+  'reporter.pinned_msg': "Raport „{name}” przypięty.",
+  'reporter.unpinned_msg': "Raport „{name}” odpięty.",
+  'reporter.link': "Link do tego raportu",
+  'reporter.open_link': "Otwórz",
+  'reporter.no_published': "Nie opublikowano jeszcze żadnych raportów.",
+  'reporter.welcome_viewer': "Otwórz opublikowany raport: jego dane są zawsze aktualne.",
   'reporter.changed': "zmieniono {date}",
   'reporter.no_match': "Żaden raport nie pasuje do wyszukiwania.",
   'reporter.chart_tag': "wykres",

package/src/i18n/pt.ts

@@ -686,6 +686,22 @@ export const pt: Record<MessageKey, string> = {
   'reporter.welcome_text': "Escolha os dados para começar um relatório: colunas, filtros, agrupamentos com totais e um gráfico; depois guarde-o ou partilhe-o.",
   'reporter.columns_count': "{n} colunas",
   'reporter.search': "Pesquisar relatórios",
+  'reporter.published_reports': "Relatórios publicados",
+  'reporter.published_tag': "publicado",
+  'reporter.publish': "Publicar",
+  'reporter.unpublish': "Despublicar",
+  'reporter.publish_on_save': "Publicar para todos os utilizadores da aplicação",
+  'reporter.published': "Relatório \"{name}\" publicado.",
+  'reporter.unpublished': "Relatório \"{name}\" despublicado.",
+  'reporter.pin': "Fixar",
+  'reporter.unpin': "Desafixar",
+  'reporter.pinned': "Fixados",
+  'reporter.pinned_msg': "Relatório \"{name}\" fixado.",
+  'reporter.unpinned_msg': "Relatório \"{name}\" desafixado.",
+  'reporter.link': "Ligação para este relatório",
+  'reporter.open_link': "Abrir",
+  'reporter.no_published': "Ainda não há relatórios publicados.",
+  'reporter.welcome_viewer': "Abra um relatório publicado: os dados estão sempre atualizados.",
   'reporter.changed': "alterado em {date}",
   'reporter.no_match': "Nenhum relatório corresponde à pesquisa.",
   'reporter.chart_tag': "gráfico",

package/src/i18n/ru.ts

@@ -686,6 +686,22 @@ export const ru: Record<MessageKey, string> = {
   'reporter.welcome_text': "Выберите данные для нового отчёта: столбцы, фильтры, группировку с итогами и диаграмму, затем сохраните его или поделитесь им.",
   'reporter.columns_count': "Столбцов: {n}",
   'reporter.search': "Поиск отчётов",
+  'reporter.published_reports': "Опубликованные отчёты",
+  'reporter.published_tag': "опубликован",
+  'reporter.publish': "Опубликовать",
+  'reporter.unpublish': "Снять с публикации",
+  'reporter.publish_on_save': "Опубликовать для всех пользователей приложения",
+  'reporter.published': "Отчёт «{name}» опубликован.",
+  'reporter.unpublished': "Отчёт «{name}» снят с публикации.",
+  'reporter.pin': "Закрепить",
+  'reporter.unpin': "Открепить",
+  'reporter.pinned': "Закреплённые",
+  'reporter.pinned_msg': "Отчёт «{name}» закреплён.",
+  'reporter.unpinned_msg': "Отчёт «{name}» откреплён.",
+  'reporter.link': "Ссылка на этот отчёт",
+  'reporter.open_link': "Открыть",
+  'reporter.no_published': "Опубликованных отчётов пока нет.",
+  'reporter.welcome_viewer': "Откройте опубликованный отчёт: его данные всегда актуальны.",
   'reporter.changed': "изменён {date}",
   'reporter.no_match': "Нет отчётов, подходящих под поиск.",
   'reporter.chart_tag': "диаграмма",

package/src/i18n/sv.ts

@@ -686,6 +686,22 @@ export const sv: Record<MessageKey, string> = {
   'reporter.welcome_text': "Välj data för att börja en rapport: välj kolumner, filtrera, gruppera med summor, lägg till ett diagram och spara eller dela den.",
   'reporter.columns_count': "{n} kolumner",
   'reporter.search': "Sök rapporter",
+  'reporter.published_reports': "Publicerade rapporter",
+  'reporter.published_tag': "publicerad",
+  'reporter.publish': "Publicera",
+  'reporter.unpublish': "Avpublicera",
+  'reporter.publish_on_save': "Publicera för alla användare av applikationen",
+  'reporter.published': "Rapporten \"{name}\" publicerad.",
+  'reporter.unpublished': "Rapporten \"{name}\" avpublicerad.",
+  'reporter.pin': "Fäst",
+  'reporter.unpin': "Lossa",
+  'reporter.pinned': "Fästa",
+  'reporter.pinned_msg': "Rapporten \"{name}\" fäst.",
+  'reporter.unpinned_msg': "Rapporten \"{name}\" lossad.",
+  'reporter.link': "Länk till den här rapporten",
+  'reporter.open_link': "Öppna",
+  'reporter.no_published': "Inga rapporter är publicerade ännu.",
+  'reporter.welcome_viewer': "Öppna en publicerad rapport: dess data är alltid aktuella.",
   'reporter.changed': "ändrad {date}",
   'reporter.no_match': "Inga rapporter matchar sökningen.",
   'reporter.chart_tag': "diagram",

package/src/i18n/tr.ts

@@ -686,6 +686,22 @@ export const tr: Record<MessageKey, string> = {
   'reporter.welcome_text': "Bir rapora başlamak için verileri seçin: sütunlar, filtreler, toplamlarla gruplama ve bir grafik ekleyin, sonra kaydedin veya paylaşın.",
   'reporter.columns_count': "{n} sütun",
   'reporter.search': "Raporlarda ara",
+  'reporter.published_reports': "Yayımlanan raporlar",
+  'reporter.published_tag': "yayımlandı",
+  'reporter.publish': "Yayımla",
+  'reporter.unpublish': "Yayımdan kaldır",
+  'reporter.publish_on_save': "Uygulamanın tüm kullanıcıları için yayımla",
+  'reporter.published': "\"{name}\" raporu yayımlandı.",
+  'reporter.unpublished': "\"{name}\" raporu yayımdan kaldırıldı.",
+  'reporter.pin': "Sabitle",
+  'reporter.unpin': "Sabitlemeyi kaldır",
+  'reporter.pinned': "Sabitlenenler",
+  'reporter.pinned_msg': "\"{name}\" raporu sabitlendi.",
+  'reporter.unpinned_msg': "\"{name}\" raporunun sabitlemesi kaldırıldı.",
+  'reporter.link': "Bu raporun bağlantısı",
+  'reporter.open_link': "Aç",
+  'reporter.no_published': "Henüz yayımlanmış rapor yok.",
+  'reporter.welcome_viewer': "Yayımlanmış bir raporu açın: verileri her zaman günceldir.",
   'reporter.changed': "{date} tarihinde değişti",
   'reporter.no_match': "Aramayla eşleşen rapor yok.",
   'reporter.chart_tag': "grafik",

package/src/i18n/uk.ts

@@ -686,6 +686,22 @@ export const uk: Record<MessageKey, string> = {
   'reporter.welcome_text': "Виберіть дані для нового звіту: стовпці, фільтри, групування з підсумками та діаграму, потім збережіть його або поділіться ним.",
   'reporter.columns_count': "Стовпців: {n}",
   'reporter.search': "Пошук звітів",
+  'reporter.published_reports': "Опубліковані звіти",
+  'reporter.published_tag': "опубліковано",
+  'reporter.publish': "Опублікувати",
+  'reporter.unpublish': "Зняти з публікації",
+  'reporter.publish_on_save': "Опублікувати для всіх користувачів застосунку",
+  'reporter.published': "Звіт «{name}» опубліковано.",
+  'reporter.unpublished': "Звіт «{name}» знято з публікації.",
+  'reporter.pin': "Закріпити",
+  'reporter.unpin': "Відкріпити",
+  'reporter.pinned': "Закріплені",
+  'reporter.pinned_msg': "Звіт «{name}» закріплено.",
+  'reporter.unpinned_msg': "Звіт «{name}» відкріплено.",
+  'reporter.link': "Посилання на цей звіт",
+  'reporter.open_link': "Відкрити",
+  'reporter.no_published': "Опублікованих звітів ще немає.",
+  'reporter.welcome_viewer': "Відкрийте опублікований звіт: його дані завжди актуальні.",
   'reporter.changed': "змінено {date}",
   'reporter.no_match': "Немає звітів, що відповідають пошуку.",
   'reporter.chart_tag': "діаграма",

package/src/i18n/zh.ts

@@ -686,6 +686,22 @@ export const zh: Record<MessageKey, string> = {
   'reporter.welcome_text': "选择数据开始一个报表：选择列、筛选、按合计分组、添加图表，然后保存或共享。",
   'reporter.columns_count': "{n} 列",
   'reporter.search': "搜索报表",
+  'reporter.published_reports': "已发布的报表",
+  'reporter.published_tag': "已发布",
+  'reporter.publish': "发布",
+  'reporter.unpublish': "取消发布",
+  'reporter.publish_on_save': "向应用的所有用户发布",
+  'reporter.published': "报表“{name}”已发布。",
+  'reporter.unpublished': "报表“{name}”已取消发布。",
+  'reporter.pin': "固定",
+  'reporter.unpin': "取消固定",
+  'reporter.pinned': "已固定",
+  'reporter.pinned_msg': "报表“{name}”已固定。",
+  'reporter.unpinned_msg': "报表“{name}”已取消固定。",
+  'reporter.link': "此报表的链接",
+  'reporter.open_link': "打开",
+  'reporter.no_published': "还没有已发布的报表。",
+  'reporter.welcome_viewer': "打开已发布的报表：其数据始终是最新的。",
   'reporter.changed': "修改于 {date}",
   'reporter.no_match': "没有与搜索匹配的报表。",
   'reporter.chart_tag': "图表",

package/src/i18n.ts

@@ -713,6 +713,22 @@ const en = {
   'reporter.welcome_text': "Choose the data to start a report: pick columns, filter, group with totals, add a chart, then save it for later or share it.",
   'reporter.columns_count': "{n} columns",
   'reporter.search': "Search reports",
+  'reporter.published_reports': "Published reports",
+  'reporter.published_tag': "published",
+  'reporter.publish': "Publish",
+  'reporter.unpublish': "Unpublish",
+  'reporter.publish_on_save': "Publish for all users of the application",
+  'reporter.published': "Report \"{name}\" published.",
+  'reporter.unpublished': "Report \"{name}\" unpublished.",
+  'reporter.pin': "Pin",
+  'reporter.unpin': "Unpin",
+  'reporter.pinned': "Pinned",
+  'reporter.pinned_msg': "Report \"{name}\" pinned.",
+  'reporter.unpinned_msg': "Report \"{name}\" unpinned.",
+  'reporter.link': "Link to this report",
+  'reporter.open_link': "Open",
+  'reporter.no_published': "No reports are published yet.",
+  'reporter.welcome_viewer': "Open a published report: its data is always up to date.",
   'reporter.changed': "changed {date}",
   'reporter.no_match': "No reports match the search.",
   'reporter.chart_tag': "chart",
@@ -1480,6 +1496,22 @@ const nl: Record<MessageKey, string> = {
   'reporter.welcome_text': "Kies de gegevens om een rapport te beginnen: kies kolommen, filter, groepeer met totalen, voeg een grafiek toe en bewaar of deel het rapport.",
   'reporter.columns_count': "{n} kolommen",
   'reporter.search': "Rapporten zoeken",
+  'reporter.published_reports': "Gepubliceerde rapporten",
+  'reporter.published_tag': "gepubliceerd",
+  'reporter.publish': "Publiceren",
+  'reporter.unpublish': "Publicatie intrekken",
+  'reporter.publish_on_save': "Publiceren voor alle gebruikers van de applicatie",
+  'reporter.published': "Rapport \"{name}\" gepubliceerd.",
+  'reporter.unpublished': "Publicatie van rapport \"{name}\" ingetrokken.",
+  'reporter.pin': "Vastzetten",
+  'reporter.unpin': "Losmaken",
+  'reporter.pinned': "Vastgezet",
+  'reporter.pinned_msg': "Rapport \"{name}\" vastgezet.",
+  'reporter.unpinned_msg': "Rapport \"{name}\" losgemaakt.",
+  'reporter.link': "Link naar dit rapport",
+  'reporter.open_link': "Openen",
+  'reporter.no_published': "Er zijn nog geen rapporten gepubliceerd.",
+  'reporter.welcome_viewer': "Open een gepubliceerd rapport: de gegevens zijn altijd actueel.",
   'reporter.changed': "gewijzigd {date}",
   'reporter.no_match': "Geen rapporten gevonden.",
   'reporter.chart_tag': "grafiek",

package/src/instance.ts

@@ -126,6 +126,7 @@ export const CONFIGURATION: readonly { env: string; secret?: boolean; default: s
   { env: 'OPENAI_API_KEY', secret: true, default: '(none)', help: 'Default key of OpenAI AI services' },
   { env: 'MAP_TILE_URL', default: 'OpenStreetMap', help: 'Tile server of map regions' },
   { env: 'LOG_LEVEL', default: 'info', help: 'Server log level' },
+  { env: 'PGKILN_RELEASE_CHECK', default: 'off', help: 'Ask GitHub once a day for a newer pgkiln release (the Workspace home; administrators can also turn it on there)' },
 ];
 
 /** A configuration value as the page shows it: secrets never, only whether they are set. */

package/src/release-check.ts

@@ -0,0 +1,139 @@
+import { readFileSync } from 'node:fs';
+import { owner } from './db.ts';
+
+// (sprint 109, WS-1) The Workspace home's system message: "pgkiln X is
+// available". Off by default: an administrator turns it on (on the Workspace
+// home, stored as meta.setting 'release_check') or the server's environment
+// does (PGKILN_RELEASE_CHECK=on). Only then does the server ask GitHub's
+// releases API for the latest release, server-side, with a timeout and a
+// size limit, at most once a day per server process (an hour after a
+// failure). Pages never wait for it: they show what is cached and start a
+// refresh in the background. The release's texts are data: the page escapes
+// them, and only a plain version number and an https link are kept.
+
+/** The running version (package.json). */
+export const VERSION = (JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')) as { version: string }).version;
+
+export const RELEASE_API = 'https://api.github.com/repos/pgkiln/pgkiln/releases/latest';
+const TIMEOUT_MS = 5000;
+const MAX_BYTES = 1_000_000;
+const FRESH_MS = 24 * 3600_000;
+const RETRY_MS = 3600_000;
+
+export interface Release {
+  version: string;
+  name: string;
+  url: string;
+  publishedAt: string | null;
+}
+
+let cache: { at: number; release: Release | null; error: string | null } | null = null;
+let inflight: Promise<void> | null = null;
+
+/** The address asked (PGKILN_RELEASE_URL for tests and mirrors; http(s) only). */
+function releaseUrl() {
+  const u = process.env.PGKILN_RELEASE_URL?.trim();
+  return u && /^https?:\/\/[^\s]+$/.test(u) && URL.canParse(u) ? u : RELEASE_API;
+}
+
+/**
+ * Never ask the real GitHub from a test run (node --test sets NODE_TEST_CONTEXT in its test processes; CI has no
+ * outbound network guarantee): there only a PGKILN_RELEASE_URL (a local mock) is asked.
+ */
+function networkAllowed() {
+  return !process.env.NODE_TEST_CONTEXT || !!process.env.PGKILN_RELEASE_URL;
+}
+
+/** Is the check on? The builder's setting, else the environment variable; off by default. */
+export async function releaseCheckEnabled(): Promise<{ on: boolean; from: 'builder' | 'environment' | 'default' }> {
+  const row = await owner.one<{ value: string }>(`select value from meta.setting where name = 'release_check'`).catch(() => null);
+  if (row?.value === 'on' || row?.value === 'off') return { on: row.value === 'on', from: 'builder' };
+  const env = (process.env.PGKILN_RELEASE_CHECK ?? '').trim().toLowerCase();
+  if (env) return { on: ['on', 'true', '1', 'yes'].includes(env), from: 'environment' };
+  return { on: false, from: 'default' };
+}
+
+/** Turn the check on or off ('' = back to the environment variable or the default). */
+export async function setReleaseCheck(value: 'on' | 'off' | '') {
+  if (value === '') await owner.query(`delete from meta.setting where name = 'release_check'`);
+  else await owner.query(`insert into meta.setting (name, value) values ('release_check', $1) on conflict (name) do update set value = excluded.value`, [value]);
+  if (value !== 'on') cache = null;
+}
+
+const SEMVER = /^v?(\d{1,6})\.(\d{1,6})\.(\d{1,6})$/;
+
+/** Is version a newer than b (plain x.y.z; anything else is not newer)? */
+export function newerVersion(a: string, b: string) {
+  const x = SEMVER.exec(a);
+  const y = SEMVER.exec(b.replace(/[-+].*$/, ''));
+  if (!x || !y) return false;
+  for (let i = 1; i <= 3; i++) if (Number(x[i]) !== Number(y[i])) return Number(x[i]) > Number(y[i]);
+  return false;
+}
+
+/** The parts of a GitHub release the page uses, checked; null when it doesn't look like a release. */
+export function parseRelease(doc: unknown): Release | null {
+  if (!doc || typeof doc !== 'object') return null;
+  const d = doc as Record<string, unknown>;
+  const m = typeof d.tag_name === 'string' ? SEMVER.exec(d.tag_name.trim()) : null;
+  if (!m) return null;
+  const version = `${Number(m[1])}.${Number(m[2])}.${Number(m[3])}`;
+  const name = typeof d.name === 'string' && d.name.trim() ? d.name.trim().slice(0, 200) : `pgkiln ${version}`;
+  const url = typeof d.html_url === 'string' && /^https:\/\/[^\s"'<>]{1,500}$/.test(d.html_url) && URL.canParse(d.html_url)
+    ? d.html_url : `https://github.com/pgkiln/pgkiln/releases/tag/v${version}`;
+  const publishedAt = typeof d.published_at === 'string' && !Number.isNaN(Date.parse(d.published_at)) ? new Date(d.published_at).toISOString() : null;
+  return { version, name, url, publishedAt };
+}
+
+async function fetchLatest(): Promise<Release | null> {
+  const res = await fetch(releaseUrl(), {
+    headers: { accept: 'application/vnd.github+json', 'user-agent': `pgkiln/${VERSION}` },
+    redirect: 'error',
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+  });
+  if (!res.ok || !res.body) throw new Error(`HTTP ${res.status}`);
+  const reader = res.body.getReader();
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > MAX_BYTES) {
+      await reader.cancel();
+      throw new Error('response too large');
+    }
+    chunks.push(value);
+  }
+  return parseRelease(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+}
+
+/**
+ * Ask for the latest release when the check is on and the cache is stale (force: now). Never throws;
+ * concurrent calls share one request.
+ */
+export async function refreshRelease(force = false): Promise<void> {
+  if (!networkAllowed() || !(await releaseCheckEnabled()).on) return;
+  if (!force && cache && Date.now() - cache.at < (cache.error ? RETRY_MS : FRESH_MS)) return;
+  inflight ??= fetchLatest()
+    .then((release) => {
+      cache = { at: Date.now(), release, error: release ? null : 'not a release' };
+    })
+    .catch((e: Error) => {
+      cache = { at: Date.now(), release: cache?.release ?? null, error: e.name === 'TimeoutError' ? 'timed out' : e.message.slice(0, 200) };
+    })
+    .finally(() => {
+      inflight = null;
+    });
+  await inflight;
+}
+
+/** What is cached (the page shows it; it never waits for a request). */
+export function cachedRelease() {
+  return cache;
+}
+
+/** Forget the cache (tests). */
+export function resetReleaseCache() {
+  cache = null;
+}

package/src/reporting-app.ts

@@ -0,0 +1,101 @@
+import pg from 'pg';
+import type { Client } from './db.ts';
+import { owner } from './db.ts';
+import type { DatasetRow } from './datasets.ts';
+import { createApp, type CheckedApp } from './builder/newapp.ts';
+
+// (sprint 110, migration 120) Reporting applications (APEX 26.1: Data Reporter → Create Reporting
+// Application): a pgkiln application of type 'reporting' on one or more datasets of the workspace, with the
+// Data Reporter region as its engine. Users sign in with accounts of the user directory (the workspace's
+// sign-in); their roles decide what they may do:
+//
+//   viewer         runs published reports (every user with access, also without a role)
+//   editor         builds, saves, publishes and unpublishes reports of their own
+//   administrator  also unpublishes and deletes anyone's reports
+//
+// The application's database role reads only the datasets' tables and views (SELECT, nothing else), so every
+// report runs through its grants and row level security.
+
+export const REPORTING_ROLES = ['viewer', 'editor', 'administrator'] as const;
+export const MAX_REPORTING_DATASETS = 10;
+
+/** The Data Reporter region's settings of a reporting application on these datasets. */
+export function reportingConfig(name: string, datasets: { name: string }[]) {
+  return {
+    sources: datasets.map((d) => ({ id: d.name, dataset: d.name })),
+    publishing: true,
+    edit_authz: 'EDITOR',
+    share_authz: 'EDITOR',
+    admin_authz: 'ADMIN',
+    welcome_title: name,
+    page_size: 25,
+  };
+}
+
+/**
+ * Create a reporting application in the caller's owner transaction: createApp() (schema = the first dataset's,
+ * the first user an administrator), then the type, the roles' authorization schemes, page 1 with the Data
+ * Reporter, and the role's grants narrowed to SELECT on the datasets' tables and views.
+ */
+export async function createReportingApp(c: Client, a: CheckedApp, datasets: DatasetRow[]): Promise<{ id: number; existingAccount: boolean }> {
+  if (!datasets.length) throw new Error('Choose at least one dataset.');
+  if (datasets.length > MAX_REPORTING_DATASETS) throw new Error(`A reporting application has at most ${MAX_REPORTING_DATASETS} datasets.`);
+  const app = await createApp(c, a);
+  const R = pg.escapeIdentifier(a.role);
+  // read only: nothing but SELECT on the datasets' objects (createApp granted the whole parsing schema)
+  const S = pg.escapeIdentifier(a.schema);
+  await c.query(`revoke all on all tables in schema ${S} from ${R}`);
+  await c.query(`revoke all on all sequences in schema ${S} from ${R}`);
+  await c.query(`revoke all on all functions in schema ${S} from ${R}`);
+  await c.query(`alter default privileges in schema ${S} revoke all on tables from ${R}`);
+  await c.query(`alter default privileges in schema ${S} revoke all on sequences from ${R}`);
+  await c.query(`alter default privileges in schema ${S} revoke all on functions from ${R}`);
+  for (const d of datasets) {
+    await c.query(`grant usage on schema ${pg.escapeIdentifier(d.schema_name)} to ${R}`);
+    for (const t of d.tables) {
+      const exists = (await c.query('select 1 from pg_class c join pg_namespace n on n.oid = c.relnamespace where n.nspname = $1 and c.relname = $2', [d.schema_name, t.table])).rowCount;
+      if (exists) await c.query(`grant select on ${pg.escapeIdentifier(d.schema_name)}.${pg.escapeIdentifier(t.table)} to ${R}`);
+    }
+  }
+
+  await c.query(`update meta.app set app_type = 'reporting', access_control = 'assigned', updated_at = now() where id = $1`, [app.id]);
+  await c.query(`update meta.authz_scheme set value = 'administrator', error_message = 'Only administrators of the reports can do this.' where app_id = $1 and name = 'ADMIN'`, [app.id]);
+  await c.query(
+    `insert into meta.authz_scheme (app_id, name, type, value, error_message)
+     values ($1, 'EDITOR', 'sql', 'meta.has_role(''editor'') or meta.has_role(''administrator'')', 'Only editors can change reports.')`,
+    [app.id],
+  );
+  await c.query(`update meta.app_access set roles = '{administrator}' where app_id = $1`, [app.id]);
+
+  // page 1: the Data Reporter instead of the hero
+  const page = (await c.query<{ id: number }>(`update meta.page set name = 'Reports', title = 'Reports' where app_id = $1 and page_no = 1 returning id`, [app.id])).rows[0];
+  await c.query('delete from meta.region where page_id = $1', [page.id]);
+  await c.query(`insert into meta.region (page_id, seq, title, type, columns, template, config) values ($1, 10, 'Reports', 'data_reporter', 12, 'standard', $2)`, [
+    page.id, JSON.stringify(reportingConfig(a.name, datasets)),
+  ]);
+  await c.query(`update meta.nav_entry set label = 'Reports', icon = 'chart' where app_id = $1 and target_page = 1`, [app.id]);
+  return app;
+}
+
+/** (sprint 110) The number of reporting applications of a workspace (the workspace home's summary; meta.reporting_app_count). */
+export async function reportingAppCount(workspaceId: number): Promise<number> {
+  return (await owner.one<{ n: number }>('select meta.reporting_app_count($1) as n', [workspaceId]))?.n ?? 0;
+}
+
+/** The reporting applications of a workspace, with the datasets they use (from the region's settings). */
+export async function reportingApps(workspaceId: number) {
+  return (
+    await owner.query<{ id: number; alias: string; name: string; datasets: string[]; users: number; reports: number }>(
+      `select a.id, a.alias, a.name,
+              coalesce((select array_agg(distinct s ->> 'dataset' order by s ->> 'dataset')
+                          from meta.page p join meta.region r on r.page_id = p.id, jsonb_array_elements(case when jsonb_typeof(r.config -> 'sources') = 'array' then r.config -> 'sources' else '[]' end) s
+                         where p.app_id = a.id and r.type = 'data_reporter' and s ? 'dataset'), '{}') as datasets,
+              (select count(*)::int from meta.app_access x where x.app_id = a.id) as users,
+              (select count(*)::int from meta.data_report d where d.app_id = a.id and d.shared) as reports
+         from meta.app a
+        where a.app_type = 'reporting' and meta.app_workspace(a.id) = $1
+        order by lower(a.name), a.id`,
+      [workspaceId],
+    )
+  ).rows;
+}