pgkiln 0.83.0 → 0.84.0

package/src/runtime/processes.ts

@@ -176,7 +176,7 @@ export function chainProblems(conf: unknown): string[] {
 }
 
 /** Process types a background chain can run (nothing that needs the request: forms, grids, uploads, files). */
-export const BACKGROUND_TYPES = new Set<Process['type']>(['sql', 'invoke_api', 'workflow', 'chain', 'send_push', 'send_email']);
+export const BACKGROUND_TYPES = new Set<Process['type']>(['sql', 'invoke_api', 'workflow', 'chain', 'send_push', 'send_email', 'send_notification']);
 
 // ---------------------------------------------------------------- workflows
 
@@ -248,6 +248,7 @@ export function processProblems(type: string, conf: unknown): string[] {
   if (type === 'chain') return chainProblems(conf);
   if (type === 'workflow') return workflowProblems(conf);
   if (type === 'send_push') return sendPushProblems(conf);
+  if (type === 'send_notification') return sendNotificationProblems(conf);
   if (type === 'send_email') return sendEmailProblems(conf);
   if (DECLARATIVE_PROCESS_TYPES.has(type)) return declarativeProblems(type, conf);
   return [];
@@ -298,6 +299,49 @@ export async function sendPushProcess(ctx: PageContext, p: Process): Promise<str
   return p.success_message ?? null;
 }
 
+// ---------------------------------------------------------------- send_notification (154)
+
+interface SendNotificationConfig {
+  to: string;
+  title: string;
+  body?: string;
+  page?: number;
+  items?: Record<string, string>;
+  icon?: string;
+  push?: boolean;
+}
+
+export function sendNotificationProblems(conf: unknown): string[] {
+  const c = (conf ?? {}) as Record<string, any>;
+  const out: string[] = [];
+  if (typeof c.to !== 'string' || !c.to.trim()) out.push('"to" is the user name, e.g. "&P5_OWNER." or "&APP_USER.".');
+  if (typeof c.title !== 'string' || !c.title.trim()) out.push('"title" is the notification\'s title.');
+  if (c.body !== undefined && typeof c.body !== 'string') out.push('"body" is text.');
+  if (c.page !== undefined && !(Number.isInteger(c.page) && c.page > 0)) out.push('"page" is a page number of this application.');
+  if (c.items !== undefined && (typeof c.items !== 'object' || Array.isArray(c.items) || c.items === null || Object.entries(c.items).some(([k, v]) => !ITEM.test(k.toUpperCase()) || typeof v !== 'string')))
+    out.push('"items" maps item names of the page to values, e.g. {"P5_ID": "&P5_ID."}.');
+  if (c.items !== undefined && c.page === undefined) out.push('"items" needs a "page".');
+  if (c.icon !== undefined && (typeof c.icon !== 'string' || !/^[a-z0-9-]{1,40}$/.test(c.icon))) out.push('"icon" is an icon name, e.g. "bell" or "check".');
+  if (c.push !== undefined && typeof c.push !== 'boolean') out.push('"push" is true or false (also to the user\'s devices when push notifications are on).');
+  return out;
+}
+
+/**
+ * send_notification: adds an in-app notification (the bell) for a user with meta.notify, in the page's
+ * transaction, so it exists only when the submit commits. Values take &ITEM. substitutions.
+ */
+export async function sendNotificationProcess(ctx: PageContext, p: Process): Promise<string | null> {
+  const conf = (p.config ?? {}) as unknown as SendNotificationConfig;
+  const problems = sendNotificationProblems(conf);
+  if (problems.length) throw new Error(`Process "${p.name}": ${problems.join(' ')}`);
+  const value = (s: string | undefined) => (s === undefined ? null : substitute(s, ctx, (x) => x));
+  const items = Object.fromEntries(Object.entries(conf.items ?? {}).map(([k, v]) => [k.toUpperCase(), value(v) ?? '']));
+  await ctx.client!.query('select meta.notify($1, $2, $3, $4, $5::jsonb, $6, $7)', [
+    (value(conf.to) ?? '').trim(), value(conf.title)?.slice(0, 200), value(conf.body)?.slice(0, 1000) || null, conf.page ?? null, JSON.stringify(items), conf.icon ?? null, conf.push === true,
+  ]);
+  return p.success_message ?? null;
+}
+
 // ---------------------------------------------------------------- send_email (081)
 
 interface SendEmailConfig {

package/src/runtime/regions.ts

@@ -16,7 +16,7 @@ import { CHART_KINDS, renderChartBody, wallClockIn, type GaugeConfig } from './c
 import { databaseTimeZone } from './locale.ts';
 import { renderFacets } from './facets.ts';
 import { renderSmartFilters } from './smart-filters.ts';
-import { renderListRegion } from './lists.ts';
+import { queryBadge, renderListRegion } from './lists.ts';
 import { renderDisplaySelector } from './display-selector.ts';
 import { renderGrid } from './grid.ts';
 import { masterItemOf, mastersOf } from './master-detail.ts';
@@ -44,22 +44,18 @@ import { renderBreadcrumbRegion, renderHelpTextRegion } from './page-regions.ts'
 
 /** A button's badge: the badge query's first value, or the badge text with &ITEM. substitutions. */
 async function badgeOf(ctx: PageContext, b: Button): Promise<Raw | ''> {
-  let value: string | null = null;
-  if (b.badge_query?.trim()) {
-    const c = ctx.client!;
-    const sql = stripSemicolon(applyBinds(b.badge_query, bindValues(ctx)));
-    try {
-      const res = await savepoint(c, () => c.query({ text: sql, rowMode: 'array' }));
-      const v = res.rows[0]?.[0];
-      value = v === null || v === undefined ? null : String(v);
-    } catch (e) {
-      ctx.errors.page.push(await publicError(ctx, e, `badge of button ${b.name}`));
-    }
-  } else if (b.badge) value = substitute(b.badge, ctx, (x) => x);
-  value = value?.trim().slice(0, 100) || null;
-  return value ? html` <span class="btn-badge">${value}</span>` : '';
+  const value = b.badge_query?.trim()
+    ? await queryBadge(ctx, b.badge_query, `badge of button ${b.name}`)
+    : b.badge ? substitute(b.badge, ctx, (x) => x).trim().slice(0, 100) || null : null;
+  // (154) with live badges, a badge from a query keeps a place the refresh can fill
+  const live = ctx.app.live_badges_s && b.badge_query?.trim() ? html` data-badge="${buttonBadgeKey(b)}"` : '';
+  if (!value) return live ? html` <span class="btn-badge"${live} hidden></span>` : '';
+  return html` <span class="btn-badge"${live}>${value}</span>`;
 }
 
+/** (154) The data-badge key of a button's badge (live badges). */
+export const buttonBadgeKey = (b: { id: number }) => `btn:${b.id}`;
+
 /**
  * A menu button: a <details> dropdown (works without JavaScript) with links
  * to pages (signed item values, only pages the user may open), submit

package/src/runtime/render.ts

@@ -19,6 +19,7 @@ import { runtime, savepoint } from '../db.ts';
 import { renderItems } from './items.ts';
 import { buttonsFor, renderRegion } from './regions.ts';
 import { listTree, navbarMarkup, navMarkup } from './lists.ts';
+import { bellMarkup } from './notifications.ts';
 import { aiInputs, aiOutputs, aiProcessOf } from './ai.ts';
 import { frameOrigins } from './url-region.ts';
 import { breadcrumbLinks, hasBreadcrumbRegion } from './page-regions.ts';
@@ -108,7 +109,8 @@ async function navTree(ctx: PageContext, topNav = false) {
   // a list as the navigation menu (falls back to the navigation entries when the list is missing)
   if (ctx.app.nav_list) {
     const nodes = await listTree(ctx, ctx.app.nav_list);
-    if (nodes) return navMarkup(nodes, topNav);
+    // (154) with live badges, every entry's badge has a key the refresh finds it by
+    if (nodes) return navMarkup(nodes, topNav, ctx.app.live_badges_s ? 'n:' : undefined);
   }
   const current = new Set<number>();
   for (let p: number | null | undefined = ctx.page.page_no, guard = 0; p && guard < 10; guard++) {
@@ -267,7 +269,9 @@ export async function chrome(ctx: PageContext, main: Raw, title: string) {
   // (084) the Feedback entry, after the application's own navigation bar list
   const feedback = feedbackNode(ctx);
   const navbarNodes = listNodes || feedback ? [...(listNodes ?? []), ...(feedback ? [feedback] : [])] : null;
-  const navbar = navbarNodes ? navbarMarkup(navbarNodes, t('list.navbar')) : '';
+  const navbar = navbarNodes ? navbarMarkup(navbarNodes, t('list.navbar'), ctx.app.live_badges_s ? 'b:' : undefined) : '';
+  // (154) the notification bell
+  const bell = await bellMarkup(ctx);
   // (sprint 72) the account's display name in the user menu
   const shown = signedIn ? ((await displayName(ctx.user)) ?? ctx.user) : ctx.user;
   // (sprint 88, GEN-4; APEX: the page footer) under the content: the application's version and "Back to top" (to the header, #top)
@@ -280,6 +284,7 @@ export async function chrome(ctx: PageContext, main: Raw, title: string) {
       <span class="t-spacer"></span>
       ${ctx.app.pwa ? html`<button type="button" class="icon-button t-install" data-pwa-install hidden title="${t('pwa.install')}" aria-label="${t('pwa.install')}">${icon('download')}</button>` : ''}
       ${navbar}
+      ${bell}
       ${ctx.app.authentication !== 'none'
         ? signedIn
           ? html`<details class="menu t-user">
@@ -314,7 +319,11 @@ export async function chrome(ctx: PageContext, main: Raw, title: string) {
     </div>
     ${devbarHtml(ctx)}`,
     `t-app${topNav ? ' nav-top' : ''}${appearance ? ` nav-pillar nav-${appearance === 'pillar_dark' ? 'pillar-dark' : 'pillar-light'}` : ''}`,
-    { 'data-base': ctx.base, 'data-page': String(ctx.page.page_no), ...pwaBody(ctx.app, ctx.user), ...(await pushBody(ctx.app, ctx.session.username)) },
+    {
+      'data-base': ctx.base, 'data-page': String(ctx.page.page_no), ...pwaBody(ctx.app, ctx.user), ...(await pushBody(ctx.app, ctx.session.username)),
+      // (154) live badges: the page asks for its badges again every so many seconds
+      ...(ctx.app.live_badges_s ? { 'data-live': String(ctx.app.live_badges_s) } : {}),
+    },
     html`${pageStyle(ctx)}${pwaHead(ctx.app)}${mapHead(ctx)}${staticHead(ctx)}`,
     root,
   );

package/src/runtime/routes.ts

@@ -229,13 +229,21 @@ export const txContext = (ctx: PageContext) => ({
 });
 
 /** Load app, page, session and user; handles 404 and the login redirect. */
-export async function loadContext(req: Req, reply: FastifyReply, { json = false, pageNo: fixedPage }: { json?: boolean; pageNo?: 'home' } = {}): Promise<PageContext | null> {
+export async function loadContext(
+  req: Req,
+  reply: FastifyReply,
+  { json = false, pageNo: fixedPage, touch = true }: { json?: boolean; pageNo?: 'home'; touch?: boolean } = {},
+): Promise<PageContext | null> {
   const app = await loadApp(req.params.alias);
   if (!app) return simplePage(reply, 404, english('error.not_found'), english('error.app_not_found', { app: req.params.alias })), null;
   const base = `/a/${app.alias}`;
-  let session = await getSession(req, reply, app.id, base);
+  // (154) touch false: a request the page makes by itself (live badges) neither keeps an idle session
+  // alive nor starts one (no sign-in from a remembered browser either)
+  const existing = touch ? await getSession(req, reply, app.id, base) : await getSession(req, reply, app.id, base, { touch: false });
+  if (!existing) return reply.code(401).send({ error: english('error.session_ended') }), null;
+  let session = existing;
   // the session ended, but the browser was remembered: sign in again silently (a new token each time)
-  if (app.authentication === 'app_users' && !session.username) {
+  if (touch && app.authentication === 'app_users' && !session.username) {
     const remembered = await useRemember(req, reply, app);
     // (sprint 130) one made before the application asked this user for a second step doesn't stand in for it
     if (remembered && (await carriesSecondStep(app, remembered.username, remembered.roles, remembered.method)))
@@ -245,7 +253,7 @@ export async function loadContext(req: Req, reply: FastifyReply, { json = false,
       });
   }
   // (067) another application of the session sharing group was signed in to: sign in here too
-  if (!session.username && sharingGroup(app)) {
+  if (touch && !session.username && sharingGroup(app)) {
     const shared = await useShared(req, reply, app);
     if (shared && (await carriesSecondStep(app, shared.username, shared.roles, shared.method)))
       session = await signIn(req, reply, app, session, shared.username, {

package/src/runtime/signin.ts

@@ -19,7 +19,8 @@ import { languagePicker } from './render.ts';
 
 /** Where to go after signing in: a path of this application, else its home page. */
 export const safeNext = (app: App, next: string | undefined) =>
-  next && next.startsWith(`/a/${app.alias}/`) && !/[\\\r\n]/.test(next) && !next.includes('//') ? next : `/a/${app.alias}/${app.home_page}`;
+  // (sprint 165) no dot segments either: /a/<alias>/../../builder stays inside the application
+  next && next.startsWith(`/a/${app.alias}/`) && !/[\\\r\n]/.test(next) && !next.includes('//') && !/\/(\.|%2e){1,2}(\/|$|\?|#)/i.test(next) ? next : `/a/${app.alias}/${app.home_page}`;
 
 /** "Forgot password?" is offered: turned on, app users with passwords, an enabled mail service. */
 export async function passwordResetAvailable(app: App) {

package/src/session.ts

@@ -53,10 +53,11 @@ export const cookieName = (appId: number | null) => (appId === null ? 'pgkiln_de
 /** The idle and maximum session length (minutes, hours), for lookups outside this file. */
 export const sessionLimits = () => ({ idleMinutes: IDLE_MINUTES(), maxHours: MAX_HOURS() });
 
-async function find(token: string | undefined, appId: number | null) {
+/** A live session of the token; touch (the default): the request counts as activity (last_seen). */
+async function find(token: string | undefined, appId: number | null, touch = true) {
   if (!token || token.length > 100) return undefined;
   return runtime.one<Session>(
-    `update meta.session set last_seen = now()
+    `update meta.session set last_seen = ${touch ? 'now()' : 'last_seen'}
       where token_hash = $1 and app_id is not distinct from $2
         and last_seen > now() - make_interval(mins => $3)
         and created_at > now() - make_interval(hours => $4)
@@ -84,8 +85,16 @@ export async function createSession(reply: FastifyReply, appId: number | null, p
   return { ...s, isNew: true };
 }
 
-export async function getSession(req: FastifyRequest, reply: FastifyReply, appId: number | null, path: string) {
-  return (await find(req.cookies[cookieName(appId)], appId)) ?? createSession(reply, appId, path);
+/**
+ * The request's session, or a new one. (154) touch false: a request the browser makes by itself (live
+ * badges) doesn't keep an idle session alive, and makes no new session when there is none (null).
+ */
+export async function getSession(req: FastifyRequest, reply: FastifyReply, appId: number | null, path: string): Promise<Session>;
+export async function getSession(req: FastifyRequest, reply: FastifyReply, appId: number | null, path: string, opts: { touch: false }): Promise<Session | null>;
+export async function getSession(req: FastifyRequest, reply: FastifyReply, appId: number | null, path: string, opts?: { touch: false }) {
+  const found = await find(req.cookies[cookieName(appId)], appId, !opts);
+  if (found || opts) return found ?? null;
+  return createSession(reply, appId, path);
 }
 
 export async function saveState(s: Session) {