rastack 0.0.51 → 0.0.52

package/components/data-table/DataTable.tsx

@@ -38,6 +38,8 @@ export interface DataTableProps<
   searchPlaceholder?: string;
   /** Rendered when there are no rows. */
   emptyMessage?: React.ReactNode;
+  /** Rendered when the identity may not list this resource (`canRead` false). */
+  unauthorizedMessage?: React.ReactNode;
   /** Stable React key per row. Defaults to `row.id` then the index. */
   rowKey?: (row: TRow, index: number) => React.Key;
   /** Total-control escape hatch: receives the headless model, you render everything. */
@@ -65,10 +67,14 @@ export function DataTable<TRow extends Record<string, unknown>>(
     query,
     columns: columnsOption,
     sortable,
+    auth,
+    policy,
+    resource,
     onRowClick,
     searchable = true,
     searchPlaceholder = "Search…",
     emptyMessage = "No records.",
+    unauthorizedMessage = "Sign in to view these records.",
     rowKey,
     children,
     style,
@@ -76,12 +82,27 @@ export function DataTable<TRow extends Record<string, unknown>>(
   } = props;
 
   useDataTableCss();
-  const model = useDataTable<TRow>(query, { columns: columnsOption, sortable });
+  const model = useDataTable<TRow>(query, {
+    columns: columnsOption,
+    sortable,
+    auth,
+    policy,
+    resource,
+  });
 
   if (children) return <>{children(model)}</>;
 
-  const { columns, rows, isLoading, isEmpty, error, search, sort, pagination } =
-    model;
+  const {
+    columns,
+    rows,
+    isLoading,
+    isEmpty,
+    error,
+    canRead,
+    search,
+    sort,
+    pagination,
+  } = model;
   const colSpan = Math.max(columns.length, 1);
 
   const keyOf = (row: TRow, index: number): React.Key => {
@@ -115,7 +136,7 @@ export function DataTable<TRow extends Record<string, unknown>>(
         ...style,
       }}
     >
-      {search && searchable ? (
+      {search && searchable && canRead ? (
         <div style={{ maxWidth: 320 }}>
           <Input
             size="sm"
@@ -157,55 +178,61 @@ export function DataTable<TRow extends Record<string, unknown>>(
             </Tr>
           </THead>
           <TBody>
-            {error
-              ? messageRow(
-                  <span style={{ color: tokens.color.danger }}>
-                    {error instanceof Error
-                      ? error.message
-                      : "Something went wrong."}
-                  </span>,
-                )
-              : isLoading && rows.length === 0
+            {!canRead
+              ? // The server would answer 401/403 — say so instead of showing
+                // a misleading empty/error state.
+                messageRow(unauthorizedMessage)
+              : error
                 ? messageRow(
-                    <span
-                      style={{
-                        display: "inline-flex",
-                        alignItems: "center",
-                        gap: tokens.space.sm,
-                      }}
-                    >
-                      <Spinner /> Loading…
+                    <span style={{ color: tokens.color.danger }}>
+                      {error instanceof Error
+                        ? error.message
+                        : "Something went wrong."}
                     </span>,
                   )
-                : isEmpty
-                  ? messageRow(emptyMessage)
-                  : rows.map((row, index) => (
-                      <Tr
-                        key={keyOf(row, index)}
-                        data-clickable={onRowClick ? "true" : undefined}
-                        onClick={
-                          onRowClick ? () => onRowClick(row, index) : undefined
-                        }
+                : isLoading && rows.length === 0
+                  ? messageRow(
+                      <span
+                        style={{
+                          display: "inline-flex",
+                          alignItems: "center",
+                          gap: tokens.space.sm,
+                        }}
                       >
-                        {columns.map((col) => {
-                          const value = (row as Record<string, unknown>)[
-                            col.key
-                          ];
-                          return (
-                            <Td key={col.key} align={col.align}>
-                              {col.render
-                                ? col.render(row, value)
-                                : formatCell(value)}
-                            </Td>
-                          );
-                        })}
-                      </Tr>
-                    ))}
+                        <Spinner /> Loading…
+                      </span>,
+                    )
+                  : isEmpty
+                    ? messageRow(emptyMessage)
+                    : rows.map((row, index) => (
+                        <Tr
+                          key={keyOf(row, index)}
+                          data-clickable={onRowClick ? "true" : undefined}
+                          onClick={
+                            onRowClick
+                              ? () => onRowClick(row, index)
+                              : undefined
+                          }
+                        >
+                          {columns.map((col) => {
+                            const value = (row as Record<string, unknown>)[
+                              col.key
+                            ];
+                            return (
+                              <Td key={col.key} align={col.align}>
+                                {col.render
+                                  ? col.render(row, value)
+                                  : formatCell(value)}
+                              </Td>
+                            );
+                          })}
+                        </Tr>
+                      ))}
           </TBody>
         </Table>
       </div>
 
-      {pagination ? (
+      {pagination && canRead ? (
         <div
           style={{
             display: "flex",

package/components/data-table/use-data-table.ts

@@ -13,6 +13,16 @@
 
 import { useMemo } from "react";
 import type { TableQuery } from "../types";
+import {
+  can,
+  canActOnRow,
+  useRastackAuth,
+  useResourcePolicy,
+  type AuthAction,
+  type RastackAuth,
+  type ResourcePolicy,
+  type ResourceRef,
+} from "../../auth";
 import {
   resolveColumns,
   type DataTableColumn,
@@ -49,6 +59,21 @@ export interface DataTableModel<TRow = Record<string, unknown>> {
   isLoading: boolean;
   isEmpty: boolean;
   error: unknown;
+  /**
+   * Whether the identity may list this resource at all — `false` means the
+   * server would answer 401/403, so `<DataTable>` renders a sign-in notice
+   * instead of firing doomed affordances. Always `true` when no auth/policy
+   * is wired up.
+   */
+  canRead: boolean;
+  /**
+   * The permission gate for any action on this resource — build your actions
+   * column with it (`model.can("delete")` hides a delete button the server
+   * would reject).
+   */
+  can: (action: AuthAction) => boolean;
+  /** Row-level check: {@link can} *and* ownership of the specific row. */
+  canActOnRow: (action: AuthAction, row: TRow) => boolean;
   /** Present only when the hook exposes searching. */
   search?: DataTableSearch;
   /** Present only when the hook exposes sorting. */
@@ -62,6 +87,19 @@ export interface DataTableOptions<TRow = Record<string, unknown>> {
   columns?: DataTableColumnInput<TRow>[];
   /** Force sortable headers on/off. Defaults to on whenever the hook supports sorting. */
   sortable?: boolean;
+  /**
+   * The identity to gate against. Defaults to the ambient identity from
+   * `<RAStackProvider auth={…}>` / `<RastackAuthProvider>`; pass `null` to
+   * opt out of gating for this table.
+   */
+  auth?: RastackAuth | null;
+  /** The resource's compiled `permission` + `access` policy. */
+  policy?: ResourcePolicy;
+  /**
+   * `"app.model"` — looks `policy` up from the provider's manifest when one
+   * is available (always the case in `local`/`s3` mode).
+   */
+  resource?: ResourceRef;
 }
 
 /** Pure model assembly — see {@link useDataTable}. */
@@ -85,12 +123,18 @@ export function buildDataTableModel<TRow extends Record<string, unknown>>(
   const error =
     query.error ?? (query.isError ? new Error("Request failed") : undefined);
 
+  const auth = options.auth ?? undefined;
+  const policy = options.policy;
+
   const model: DataTableModel<TRow> = {
     columns,
     rows,
     isLoading,
     isEmpty,
     error,
+    canRead: can(auth, policy, "list"),
+    can: (action) => can(auth, policy, action),
+    canActOnRow: (action, row) => canActOnRow(auth, policy, action, row),
   };
 
   if (query.searching) {
@@ -128,14 +172,24 @@ export function buildDataTableModel<TRow extends Record<string, unknown>>(
   return model;
 }
 
-/** React hook wrapper around {@link buildDataTableModel} (memoized on the query + options). */
+/**
+ * React hook wrapper around {@link buildDataTableModel} (memoized on the query
+ * + options). Auth handling is built in: the identity defaults to the ambient
+ * one from `<RAStackProvider auth={…}>`, and `resource: "app.model"` resolves
+ * the policy from the provider's manifest.
+ */
 export function useDataTable<TRow extends Record<string, unknown>>(
   query: TableQuery<TRow>,
   options: DataTableOptions<TRow> = {},
 ): DataTableModel<TRow> {
+  const ambientAuth = useRastackAuth();
+  const ambientPolicy = useResourcePolicy(options.resource);
+  const auth = options.auth !== undefined ? options.auth : ambientAuth;
+  const policy = options.policy ?? ambientPolicy;
   return useMemo(
-    () => buildDataTableModel(query, options),
+    () => buildDataTableModel(query, { ...options, auth, policy }),
     // The query object identity changes as react-query state advances.
-    [query, options.columns, options.sortable],
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [query, options.columns, options.sortable, auth, policy],
   );
 }

package/components/index.ts

@@ -66,6 +66,8 @@ export {
   buildAutoFormModel,
   type AutoFormModel,
   type AutoFormFieldModel,
+  type AutoFormAuthOptions,
+  type AutoFormModelOptions,
 } from "./auto-form/use-auto-form";
 export {
   inputKindForFieldType,

package/db.ts

@@ -0,0 +1,9 @@
+/**
+ * `rastack/db` — type-level column configuration for class/interface
+ * entities: the `DbConfig` brands (`Unique`, `MaxLength<N>`, `PrimaryKey`,
+ * `Default<V>`, `Int`, `UUID`, `DateTimeString`) plus the access-control
+ * field brands (`Owner`, `Group`), which are also exported from
+ * `rastack/auth` alongside the entity-level markers.
+ */
+
+export * from "./src/define/db";