rastack 0.0.50 → 0.0.52

package/provider/provider.tsx

@@ -33,6 +33,14 @@ import {
   isAccessRevoked,
   purgeIdentityCache,
 } from "../cache";
+import {
+  RastackAuthProvider,
+  userAuth,
+  type ManifestLike,
+  type RastackAuth,
+} from "../auth";
+import { toManifest } from "../src/define/manifest";
+import { getGlobalManifest } from "../hooks/manifest";
 
 const RastackContext = createContext<RastackClient | null>(null);
 
@@ -57,22 +65,44 @@ export function RAStackProvider({
   const persistRef = useRef<(() => void) & { flush: () => void }>();
   const cacheStorageRef = useRef<CacheStorage | null>(null);
 
+  // The `manifest` prop is optional: when the rastack dev-server plugin is
+  // in the bundler it registers the compiled schema globally before the app
+  // boots, so `<RAStackProvider mode="local">` needs no schema wiring at
+  // all. An explicit prop (schema.rastack.json object/string, or resource()
+  // definitions — array or module namespace) always wins.
+  const manifest = useMemo(
+    () => toManifest(config.manifest) ?? getGlobalManifest(),
+    [config.manifest],
+  );
+
   const setStatusSafe = (next: RadStatus) => {
     setStatus(next);
     config.onStatusChange?.(next);
   };
 
+  // One resolved identity, whichever way it was supplied: the typed `auth`
+  // object, or the raw `identity` / `groups` strings (which win when both are
+  // given). This is what the engine runs as, what namespaces local bytes, and
+  // what the component tree gates its affordances with.
+  const auth: RastackAuth | undefined =
+    config.auth ??
+    (config.identity != null
+      ? userAuth(config.identity, config.groups ?? [])
+      : undefined);
+  const identity = config.identity ?? auth?.sub;
+  const groups = config.groups ?? auth?.groups ?? [];
+
   // Locally persisted state is namespaced per identity, so two accounts on
   // one device never share bytes.
   const warehouseDb = withIdentity(
     config.databaseName || "rastack-warehouse",
-    config.identity,
+    identity,
   );
 
   /** Delete everything this identity persisted locally. */
   const purgeLocal = async () => {
     if (cacheStorageRef.current) {
-      await purgeIdentityCache(cacheStorageRef.current, config.identity);
+      await purgeIdentityCache(cacheStorageRef.current, identity);
     }
     await deleteIndexedDb(warehouseDb);
     // Replicated rows in the sync engine's store are derived from the same
@@ -110,20 +140,22 @@ export function RAStackProvider({
       }
 
       // -- WASM modes (local / s3) --
-      if (!config.manifest) {
-        throw new Error("RAStackProvider: `manifest` is required in local/s3 mode.");
+      if (!manifest) {
+        throw new Error(
+          "RAStackProvider: no manifest found for local/s3 mode — add rastackPlugin() to your bundler (rastack/plugin), or pass the `manifest` prop.",
+        );
       }
 
       setStatusSafe("loading");
       const loader = config.loadEngine ?? defaultEngineLoader;
       const mod = await loader();
       if (cancelled) return;
-      const engine = createEngine(mod, config.manifest, config.openapi);
+      const engine = createEngine(mod, manifest, config.openapi);
 
       // Run the in-browser engine as the signed-in identity so owner stamping
       // and row-level security match the server exactly.
-      if (config.identity) {
-        engine.setAuth?.(config.identity, config.groups ?? []);
+      if (identity) {
+        engine.setAuth?.(identity, groups);
       }
 
       // Warehouse persistence: IndexedDB for `local`, an S3 sink for `s3`.
@@ -140,7 +172,7 @@ export function RAStackProvider({
           await engine.importWarehouse(existing);
         } else {
           const base = config.warehouseBaseUrl ?? "/data/warehouse/";
-          const resources = manifestResources(config.manifest);
+          const resources = manifestResources(manifest);
           if (config.cache === false) {
             await seedFromIceberg(engine, base, resources);
           } else {
@@ -152,7 +184,7 @@ export function RAStackProvider({
             const cache = new IcebergFileCache({
               storage,
               source: config.fileSource ?? httpFileSource(base),
-              identity: config.identity,
+              identity,
               maxOfflineMs: config.maxOfflineMs,
             });
             await cache.seed(engine, resources);
@@ -177,7 +209,10 @@ export function RAStackProvider({
       persistRef.current = persist;
 
       engineRef.current = engine;
-      configureApi({ baseURL: "", adapter: createWasmAdapter(engine, persist) });
+      configureApi({
+        baseURL: "",
+        adapter: createWasmAdapter(engine, persist),
+      });
       setStatusSafe("ready");
     }
 
@@ -195,18 +230,21 @@ export function RAStackProvider({
       engineRef.current = null;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [config.mode, config.baseURL, config.warehouseBaseUrl, config.identity]);
+  }, [config.mode, config.baseURL, config.warehouseBaseUrl, identity]);
 
   const client = useMemo<RastackClient>(
     () => ({
       mode: config.mode,
       status,
+      auth,
       get engine() {
         return engineRef.current;
       },
       async exportWarehouse() {
         if (!engineRef.current) {
-          throw new Error("exportWarehouse is only available in local/s3 mode.");
+          throw new Error(
+            "exportWarehouse is only available in local/s3 mode.",
+          );
         }
         return engineRef.current.exportWarehouse();
       },
@@ -225,13 +263,18 @@ export function RAStackProvider({
       },
     }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [config.mode, status, config.identity],
+    [config.mode, status, identity],
   );
 
   return (
     <RastackContext.Provider value={client}>
-      <RastackManifestProvider manifest={config.manifest}>
-        {children}
+      <RastackManifestProvider manifest={manifest}>
+        <RastackAuthProvider
+          auth={auth}
+          manifest={manifest as ManifestLike | undefined}
+        >
+          {children}
+        </RastackAuthProvider>
       </RastackManifestProvider>
     </RastackContext.Provider>
   );
@@ -265,7 +308,9 @@ function withIdentity(name: string, identity?: string): string {
 export function useRastackClient(): RastackClient {
   const client = useContext(RastackContext);
   if (!client) {
-    throw new Error("useRastackClient must be used within a <RAStackProvider>.");
+    throw new Error(
+      "useRastackClient must be used within a <RAStackProvider>.",
+    );
   }
   return client;
 }

package/provider/types.ts

@@ -68,14 +68,24 @@ export interface RAStackProviderConfig {
   getToken?: () => string | Promise<string>;
 
   // -- identity & local-data security (all modes) --
+  /**
+   * The signed-in identity as a typed {@link import("../auth").RastackAuth} —
+   * the one auth object the whole stack shares. Supplies `identity`/`groups`
+   * when those aren't set, runs the WASM engine as this identity, and is
+   * provided to the component tree (via `rastack/auth`'s context) so
+   * `<AutoForm>` / `<DataTable>` gate their affordances against each
+   * resource's `permission` + `access` policy automatically.
+   */
+  auth?: import("../auth").RastackAuth;
   /**
    * The signed-in identity — the verified Cognito `sub`. It namespaces every
    * locally persisted byte (Iceberg file cache, warehouse snapshot DB), so
    * accounts sharing a device can't read each other's data, and it is the
-   * subject the WASM engine stamps/filters owner rows with.
+   * subject the WASM engine stamps/filters owner rows with. Defaults to
+   * `auth.sub`.
    */
   identity?: string;
-  /** Verified group claims (`cognito:groups`) for the WASM engine's auth. */
+  /** Verified group claims (`cognito:groups`). Defaults to `auth.groups`. */
   groups?: string[];
   /**
    * Fired when the data source reports this identity's access has been
@@ -98,12 +108,19 @@ export interface RAStackProviderConfig {
 
   // -- all modes --
   /**
-   * `schema.rastack.json` — object or JSON string. Required for WASM modes
-   * (it drives the in-browser engine), and recommended in `remote` mode too:
-   * it is what lets the generic `useData(Entity)` / `useForm(Entity)` hooks
-   * resolve a plain TypeScript type to its resource at runtime.
+   * The schema — **usually omitted**: with the `rastack/plugin` dev-server
+   * plugin in the bundler, the manifest compiled from your entities is
+   * registered globally before the app boots and the provider picks it up
+   * automatically. Pass it explicitly to override: the compiled
+   * `schema.rastack.json` (object or JSON string), the
+   * `virtual:rastack-manifest` module, or `resource()` definitions (an array
+   * or a module namespace), from which the provider builds the identical
+   * manifest at runtime. One of the two (plugin or prop) is required for
+   * WASM modes (the manifest drives the in-browser engine); it is also what
+   * lets `useData(Entity)` / `useForm(Entity)` resolve a plain TypeScript
+   * type to its resource at runtime.
    */
-  manifest?: object | string;
+  manifest?: object | readonly object[] | string;
   /** `openapi.json` — object or JSON string. Optional (`/api/schema/`). */
   openapi?: object | string;
   /**
@@ -159,6 +176,8 @@ export type RadStatus =
 export interface RastackClient {
   mode: RadMode;
   status: RadStatus;
+  /** The resolved identity this client runs as (from `auth` or `identity`). */
+  auth?: import("../auth").RastackAuth;
   /** The live WASM engine (null in `remote` mode). */
   engine: RastackEngine | null;
   /** Snapshot the local warehouse to a portable blob (WASM modes only). */

package/provider/warehouse.ts

@@ -26,8 +26,7 @@ export class WarehousePersistence {
   private db: Promise<IDBDatabase> | null;
 
   constructor(private databaseName: string) {
-    this.db =
-      typeof indexedDB !== "undefined" ? openDb(databaseName) : null;
+    this.db = typeof indexedDB !== "undefined" ? openDb(databaseName) : null;
   }
 
   get enabled(): boolean {
@@ -109,7 +108,9 @@ export async function seedFromIceberg(
     if (!metaBytes) continue;
     await engine.seedFile(metaKey, metaBytes);
 
-    const meta = JSON.parse(decoder.decode(metaBytes)) as { data_files?: string[] };
+    const meta = JSON.parse(decoder.decode(metaBytes)) as {
+      data_files?: string[];
+    };
     for (const rel of meta.data_files || []) {
       const key = `${prefix}/${rel}`;
       const bytes = await fetchBytes(base + key);

package/provider/wasm.ts

@@ -13,7 +13,9 @@ const runtimeImport: (specifier: string) => Promise<any> =
   new Function("s", "return import(s)") as any;
 
 export const defaultEngineLoader: RastackEngineLoader = async () => {
-  const mod: RastackWasmModule = await runtimeImport("rastack/wasm/rastack_wasm.js");
+  const mod: RastackWasmModule = await runtimeImport(
+    "rastack/wasm/rastack_wasm.js",
+  );
   const init = mod.default || mod.init;
   if (typeof init === "function") {
     await init();

package/runtime.ts

@@ -2,3 +2,4 @@ export * from "./hooks";
 export * from "./types";
 export * from "./provider";
 export * from "./cache";
+export * from "./auth";

package/src/compile/analyze.ts

@@ -1,18 +1,26 @@
 import * as path from "path";
 import * as ts from "typescript";
 import {
-  AccessModel,
-  AdminModel,
   FieldModel,
   RelationModel,
   ResourceModel,
   ScalarType,
-  SyncModel,
 } from "./model";
 import { resourceSourceFiles } from "./program";
-import { normalizeTransitions } from "../validate/transitions";
+import {
+  applyTransitions,
+  normaliseAccess,
+  normaliseAdmin,
+  normaliseSync,
+} from "../define/manifest";
 import type { EntityTypeExport } from "./entities";
 
+// The option normalisers live beside the runtime manifest builder
+// (`define/manifest.ts`) and are shared with it, so a manifest built from
+// runtime `resource()` values and one compiled from the same source can
+// never disagree. Re-exported here for existing importers.
+export { applyTransitions } from "../define/manifest";
+
 /**
  * Statically analyse resource definitions and produce the canonical model.
  *
@@ -61,7 +69,9 @@ export function analyzeDsl(
 
   // Deterministic order: app, then model.
   resources.sort((a, b) =>
-    a.app === b.app ? a.model.localeCompare(b.model) : a.app.localeCompare(b.app),
+    a.app === b.app
+      ? a.model.localeCompare(b.model)
+      : a.app.localeCompare(b.app),
   );
   types.sort((a, b) => a.key.localeCompare(b.key));
   return { resources, types };
@@ -106,7 +116,12 @@ function analyzeResourceCall(
   const app = stringLiteralArg(call.arguments[0]);
   const model = stringLiteralArg(call.arguments[1]);
   const fieldsArg = call.arguments[2];
-  if (!app || !model || !fieldsArg || !ts.isObjectLiteralExpression(fieldsArg)) {
+  if (
+    !app ||
+    !model ||
+    !fieldsArg ||
+    !ts.isObjectLiteralExpression(fieldsArg)
+  ) {
     return undefined;
   }
 
@@ -147,26 +162,6 @@ function analyzeResourceCall(
   return resource;
 }
 
-/**
- * Attach a normalised `transitions` block to a resource and derive what the
- * machine implies about its state field: the `states` become the field's
- * allowed-value set (`enum` in OpenAPI, the `member` gate in validation), and
- * `initial` becomes its default when the field doesn't declare one.
- */
-export function applyTransitions(resource: ResourceModel, raw: unknown): void {
-  const transitions = normalizeTransitions(raw);
-  if (!transitions) return;
-  resource.transitions = transitions;
-
-  const stateField = resource.fields.find((f) => f.name === transitions.field);
-  if (stateField && stateField.type !== "fk") {
-    stateField.options = [...transitions.states];
-    if (stateField.default === undefined && transitions.initial !== undefined) {
-      stateField.default = transitions.initial;
-    }
-  }
-}
-
 /**
  * Resolve a single field from its initializer. FK detection is type-driven:
  * the initializer's *type* is inspected, and a `Ref` type yields a foreign key.
@@ -190,7 +185,12 @@ function analyzeField(
   }
 
   // Scalar: the field type carries a `__rastackScalar` string-literal discriminant.
-  const scalar = literalTypeProp(fieldType, "__rastackScalar", checker, initializer);
+  const scalar = literalTypeProp(
+    fieldType,
+    "__rastackScalar",
+    checker,
+    initializer,
+  );
   if (!scalar) return undefined;
 
   const field: FieldModel = { name, type: scalar as ScalarType };
@@ -280,41 +280,3 @@ export function literalToValue(node: ts.Expression | undefined): any {
   }
   return undefined;
 }
-
-function normaliseSync(sync: any): SyncModel | undefined {
-  if (!sync || typeof sync !== "object") return undefined;
-  const mode = sync.mode === "local" ? "local" : "server";
-  if (mode === "server" && !sync.confirmed) {
-    // A bare server resource carries no sync semantics.
-    return undefined;
-  }
-  const model: SyncModel = { mode };
-  if (typeof sync.scope === "string") model.scope = sync.scope;
-  if (Array.isArray(sync.confirmed)) model.confirmed = sync.confirmed;
-  if (sync.load === "lazy") model.load = "lazy";
-  if (sync.clientIds === true) model.clientIds = true;
-  return model;
-}
-
-function normaliseAccess(access: any): AccessModel | undefined {
-  if (!access || typeof access !== "object") return undefined;
-  const model: AccessModel = {};
-  if (typeof access.ownerField === "string") model.ownerField = access.ownerField;
-  if (access.scope === "owner" || access.scope === "shared") {
-    model.scope = access.scope;
-  }
-  if (Array.isArray(access.adminGroups)) {
-    model.adminGroups = access.adminGroups.filter(
-      (g: unknown) => typeof g === "string",
-    );
-  }
-  return Object.keys(model).length ? model : undefined;
-}
-
-function normaliseAdmin(admin: any): AdminModel | false | undefined {
-  if (admin === false) return false;
-  if (!admin || typeof admin !== "object") return undefined;
-  const model: AdminModel = {};
-  if (Array.isArray(admin.listDisplay)) model.listDisplay = admin.listDisplay;
-  return model;
-}