shutro-erp 0.2.0 → 0.3.0

package/dist/server/auth/service.js

@@ -320,12 +320,18 @@ export class AuthService {
             const [credential] = await fetch(model(env, 'auth.credential').search({ where: { user: session.user } }), ['totpEnabled']);
             const administrator = await this.#holdsAdministrator(env, session.user);
             const twoFactorEnabled = credential?.['totpEnabled'] === true;
+            const companyIds = user?.['companies'] ?? [];
+            const groupings = {};
+            if (companyIds.length > 0)
+                for (const c of await fetch(model(env, 'res.company').search({ where: { id: { in: companyIds } } }), ['numberGrouping']))
+                    groupings[String(c['id'])] = c['numberGrouping'] === 'lakh' ? 'lakh' : 'international';
             return {
                 id: session.user,
                 login: String(user?.['login']),
                 name: String(user?.['name']),
                 company: typeof user?.['company'] === 'number' ? user['company'] : null,
-                companies: user?.['companies'] ?? [],
+                companies: companyIds,
+                groupings,
                 twoFactorEnabled,
                 administrator,
                 administratorNeedsSecondFactor: administrator && !(session.secondFactor && twoFactorEnabled),

package/dist/server/index.d.ts

@@ -5,7 +5,7 @@
  */
 export { announceChange, CHANGES_CHANNEL, parseChange, type RecordChange } from './api/changes.js';
 export { generateClient, typeOf } from './api/client.js';
-export { IDEMPOTENCY_TABLE, idempotencyTableStatements, type Outcome } from './api/idempotency.js';
+export { IDEMPOTENCY_TABLE, idempotencyTableStatements, idempotent, type Outcome, } from './api/idempotency.js';
 export { type ApiField, type ApiModel, apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
 export { type FoundRecord, type MenuNode, moduleVisible, Navigation } from './api/navigation.js';
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';

package/dist/server/index.js

@@ -5,7 +5,7 @@
  */
 export { announceChange, CHANGES_CHANNEL, parseChange } from './api/changes.js';
 export { generateClient, typeOf } from './api/client.js';
-export { IDEMPOTENCY_TABLE, idempotencyTableStatements } from './api/idempotency.js';
+export { IDEMPOTENCY_TABLE, idempotencyTableStatements, idempotent, } from './api/idempotency.js';
 export { apiModels, defaultFields, publicApiModels, schemaName, } from './api/metadata.js';
 export { moduleVisible, Navigation } from './api/navigation.js';
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';

package/dist/server/server.js

@@ -14,7 +14,7 @@ import { registerRestApi } from './api/rest.js';
 import { ViewRegistry } from './api/views.js';
 import { registerAuthRoutes } from './auth/routes.js';
 import { AuthService } from './auth/service.js';
-import { HttpProblem, problemOf } from './errors.js';
+import { HttpProblem, problemOf, ServerConfigError } from './errors.js';
 import { denyAll, runOptionsOf } from './identity.js';
 import { orm, pg } from './orm.js';
 import { buildKoshRegistry, KOSH_VERSION } from './registry.js';
@@ -25,6 +25,22 @@ const REDACT = [
     'req.headers["x-api-key"]',
     'res.headers["set-cookie"]',
 ];
+/** What a portal user reaches: the portal API, and signing in and out (RFC 0015 §5.1). */
+const PORTAL_PATHS = ['/api/portal/', '/api/v1/auth/'];
+/**
+ * The external groups the modules declare (RFC 0015 §5.1). @throws {ServerConfigError} for one implying
+ * `base.user`: its holders would be internal users.
+ */
+function externalGroupsOf(registry) {
+    const groups = new Set(registry.loaded.modules.flatMap((m) => m.externalGroups ?? []));
+    for (const group of groups) {
+        if (!registry.registry.security.groups.has(group))
+            throw new ServerConfigError(`The external group '${group}' is not defined.`, 'Define it in the module that declares it.');
+        if (registry.registry.security.closure([group]).has('base.user'))
+            throw new ServerConfigError(`The external group '${group}' implies base.user: its users would be internal.`, 'Remove base.user from what it implies.');
+    }
+    return groups;
+}
 /** Creates the server (not listening yet). @throws {ServerConfigError} for modules that cannot load together */
 export async function createServer(options) {
     const registry = buildKoshRegistry(options.modules, {
@@ -37,6 +53,7 @@ export async function createServer(options) {
         applicationName: 'kosh',
     });
     const hasBase = registry.registry.models.has('auth.session');
+    const external = externalGroupsOf(registry);
     let shutro;
     const auth = hasBase ? new AuthService(() => shutro, options.auth) : undefined;
     const verify = auth !== undefined && (options.verifyIdentities ?? options.authenticate === undefined);
@@ -101,6 +118,14 @@ export async function createServer(options) {
         if (config.public === true || config.auth === false)
             return;
         request.identity = await authenticate(request);
+        // Customers and vendors of the portal (RFC 0015 §5.1): the portal API and signing in, nothing else.
+        if (request.identity !== null &&
+            external.size > 0 &&
+            request.identity.groups.length > 0 &&
+            request.identity.groups.every((g) => external.has(g)) &&
+            !PORTAL_PATHS.some((p) => request.url.startsWith(p)) &&
+            request.url.startsWith('/api/'))
+            throw new HttpProblem(403, 'internal-only', 'For the company’s users only', 'Portal users reach the portal only.');
     });
     if (options.rateLimit?.max !== 0)
         await app.register(rateLimit, {

package/dist/ui/api.d.ts

@@ -65,6 +65,8 @@ export interface CurrentUser {
     readonly name: string;
     readonly company: number | null;
     readonly companies: readonly number[];
+    /** Number grouping per company (RFC 0016); older servers send none. */
+    readonly groupings?: Readonly<Record<string, 'international' | 'lakh'>>;
     readonly twoFactorEnabled: boolean;
     readonly administrator: boolean;
     readonly administratorNeedsSecondFactor: boolean;

package/dist/ui/app.js

@@ -177,7 +177,7 @@ function Shell() {
     const user = me.data;
     const current = company ?? user.company ?? user.companies[0] ?? 0;
     const app = apps.data?.find((a) => a.code === params.app);
-    return (_jsx(KoshProvider, { api: api, registry: registry, uid: user.id, companyId: current, lang: lang, tz: Intl.DateTimeFormat().resolvedOptions().timeZone, ...(realtime === undefined ? {} : { realtime }), ...(offline === undefined ? {} : { offline }), children: _jsx(ToastProvider, { children: _jsxs(DesignProvider, { children: [_jsx(OfflineAgent, { uid: user.id }), _jsxs(PaletteContext.Provider, { value: openPalette, children: [_jsx("a", { href: "#content", className: "sr-only focus:not-sr-only focus:absolute focus:start-2 focus:top-2 focus:z-50 focus:rounded focus:bg-surface focus:px-3 focus:py-2", children: t('shell.skip') }), _jsx("header", { className: "sticky top-0 z-30 border-b bg-surface", children: _jsxs("div", { className: "flex h-12 items-center gap-2 px-3", children: [_jsxs(Menu, { children: [_jsx(MenuTrigger, { asChild: true, children: _jsx(Button, { variant: "ghost", size: "icon", "aria-label": t('shell.apps'), children: _jsx(Grid3x3, { "aria-hidden": true }) }) }), _jsxs(MenuContent, { align: "start", children: [_jsx(MenuItem, { onSelect: () => void navigate({ to: '/' }), children: t('shell.apps') }), _jsx(MenuSeparator, {}), (apps.data ?? []).map((a) => (_jsx(MenuItem, { onSelect: () => void navigate({ to: '/$app', params: { app: a.code } }), children: a.label }, a.code)))] })] }), _jsx(Link, { to: "/", className: "font-semibold", children: app?.label ?? t('app.name') }), _jsx("nav", { "aria-label": t('shell.menu'), className: "ms-2 flex-1", children: params.app === undefined ? null : (_jsx(MenuLinks, { app: params.app, menus: menus.data ?? [] })) }), _jsxs(Button, { variant: "secondary", size: "sm", className: "hidden h-8 w-56 justify-between text-muted-foreground sm:flex", onClick: () => setPalette(true), "aria-keyshortcuts": "Control+K Meta+K", children: [_jsxs("span", { className: "flex items-center gap-2", children: [_jsx(Search, { className: "size-4", "aria-hidden": true }), t('palette.button')] }), _jsx("kbd", { className: "rounded border bg-surface px-1.5 text-xs", children: "Ctrl K" })] }), _jsx(Button, { variant: "ghost", size: "icon", className: "sm:hidden", "aria-label": t('palette.button'), onClick: () => setPalette(true), children: _jsx(Search, { "aria-hidden": true }) }), _jsx(OfflineMenu, {}), registry.headerItems().map(({ name, component: Item }) => (_jsx(Item, { api: api }, name))), _jsx(CompanySwitcher, { me: user, company: current, onChange: (id) => {
+    return (_jsx(KoshProvider, { api: api, registry: registry, uid: user.id, companyId: current, lang: lang, tz: Intl.DateTimeFormat().resolvedOptions().timeZone, grouping: user.groupings?.[String(current)] ?? 'international', ...(realtime === undefined ? {} : { realtime }), ...(offline === undefined ? {} : { offline }), children: _jsx(ToastProvider, { children: _jsxs(DesignProvider, { children: [_jsx(OfflineAgent, { uid: user.id }), _jsxs(PaletteContext.Provider, { value: openPalette, children: [_jsx("a", { href: "#content", className: "sr-only focus:not-sr-only focus:absolute focus:start-2 focus:top-2 focus:z-50 focus:rounded focus:bg-surface focus:px-3 focus:py-2", children: t('shell.skip') }), _jsx("header", { className: "sticky top-0 z-30 border-b bg-surface", children: _jsxs("div", { className: "flex h-12 items-center gap-2 px-3", children: [_jsxs(Menu, { children: [_jsx(MenuTrigger, { asChild: true, children: _jsx(Button, { variant: "ghost", size: "icon", "aria-label": t('shell.apps'), children: _jsx(Grid3x3, { "aria-hidden": true }) }) }), _jsxs(MenuContent, { align: "start", children: [_jsx(MenuItem, { onSelect: () => void navigate({ to: '/' }), children: t('shell.apps') }), _jsx(MenuSeparator, {}), (apps.data ?? []).map((a) => (_jsx(MenuItem, { onSelect: () => void navigate({ to: '/$app', params: { app: a.code } }), children: a.label }, a.code)))] })] }), _jsx(Link, { to: "/", className: "font-semibold", children: app?.label ?? t('app.name') }), _jsx("nav", { "aria-label": t('shell.menu'), className: "ms-2 flex-1", children: params.app === undefined ? null : (_jsx(MenuLinks, { app: params.app, menus: menus.data ?? [] })) }), _jsxs(Button, { variant: "secondary", size: "sm", className: "hidden h-8 w-56 justify-between text-muted-foreground sm:flex", onClick: () => setPalette(true), "aria-keyshortcuts": "Control+K Meta+K", children: [_jsxs("span", { className: "flex items-center gap-2", children: [_jsx(Search, { className: "size-4", "aria-hidden": true }), t('palette.button')] }), _jsx("kbd", { className: "rounded border bg-surface px-1.5 text-xs", children: "Ctrl K" })] }), _jsx(Button, { variant: "ghost", size: "icon", className: "sm:hidden", "aria-label": t('palette.button'), onClick: () => setPalette(true), children: _jsx(Search, { "aria-hidden": true }) }), _jsx(OfflineMenu, {}), registry.headerItems().map(({ name, component: Item }) => (_jsx(Item, { api: api }, name))), _jsx(CompanySwitcher, { me: user, company: current, onChange: (id) => {
                                                 api.setCompany(id);
                                                 setCompany(id);
                                                 void queryClient.invalidateQueries();

package/dist/ui/context.d.ts

@@ -26,13 +26,15 @@ export interface KoshContextValue {
 export declare function useKosh(): KoshContextValue;
 /** Applies the theme to `<html>` (the `dark` class) and follows the system when asked to. */
 declare function useTheme(): [ThemeChoice, (t: ThemeChoice) => void];
-export declare function KoshProvider({ api, registry, uid, companyId, lang, tz, realtime, offline, children, }: {
+export declare function KoshProvider({ api, registry, uid, companyId, lang, tz, grouping, realtime, offline, children, }: {
     readonly api: KoshApi;
     readonly registry: Registry;
     readonly uid: number;
     readonly companyId: number;
     readonly lang: string;
     readonly tz: string;
+    /** The company's number grouping (RFC 0016). */
+    readonly grouping?: 'international' | 'lakh';
     readonly realtime?: RealtimeClient;
     readonly offline?: OfflineQueue;
     readonly children: ReactNode;

package/dist/ui/context.js

@@ -47,9 +47,9 @@ function useTheme() {
     }, [theme]);
     return [theme, setTheme];
 }
-export function KoshProvider({ api, registry, uid, companyId, lang, tz, realtime, offline, children, }) {
+export function KoshProvider({ api, registry, uid, companyId, lang, tz, grouping, realtime, offline, children, }) {
     const [theme, setTheme] = useTheme();
-    const format = useMemo(() => createFormatter(lang, tz), [lang, tz]);
+    const format = useMemo(() => createFormatter(lang, tz, grouping === undefined ? {} : { grouping }), [lang, tz, grouping]);
     const value = useMemo(() => ({
         api,
         registry,

package/dist/ui/index.d.ts

@@ -11,7 +11,7 @@ export { ApiError, type ApiOptions, type AppEntry, type CurrentUser, createKoshA
 export { KoshApp, type KoshAppProps } from './app.js';
 export { AppIcon } from './components/AppIcon.js';
 export * from './components/primitives.js';
-export { type KoshContextValue, KoshProvider, type ThemeChoice, useKosh } from './context.js';
+export { type KoshContextValue, KoshProvider, type ThemeChoice, useKosh, useTheme, } from './context.js';
 export { type DesignContextValue, DesignProvider, type DesignSpot, useDesign, } from './design.js';
 export { addMessages, createI18n, directionOf, NAMESPACE } from './i18n/index.js';
 export { LANGUAGES } from './i18n/messages.js';

package/dist/ui/index.js

@@ -15,7 +15,7 @@ export { ApiError, createKoshApi, NetworkError, } from './api.js';
 export { KoshApp } from './app.js';
 export { AppIcon } from './components/AppIcon.js';
 export * from './components/primitives.js';
-export { KoshProvider, useKosh } from './context.js';
+export { KoshProvider, useKosh, useTheme, } from './context.js';
 export { DesignProvider, useDesign, } from './design.js';
 export { addMessages, createI18n, directionOf, NAMESPACE } from './i18n/index.js';
 export { LANGUAGES } from './i18n/messages.js';

package/dist/ui/lib/format.d.ts

@@ -14,4 +14,6 @@ export interface Formatter {
 }
 export declare function createFormatter(lang: string, tz: string, options?: {
     readonly nativeDigits?: boolean;
+    /** `lakh`: 12,34,567 (RFC 0016). Bangla groups so already; English takes the Indian English pattern. */
+    readonly grouping?: 'international' | 'lakh';
 }): Formatter;

package/dist/ui/lib/format.js

@@ -11,7 +11,9 @@ export function createFormatter(lang, tz, options = {}) {
     // Bangla defaults to Bengali digits in ICU; RFC 0007 makes them a choice (Latin digits unless asked).
     const locale = base.startsWith('bn')
         ? `${base}-u-nu-${options.nativeDigits === true ? 'beng' : 'latn'}`
-        : base;
+        : options.grouping === 'lakh' && base.startsWith('en')
+            ? 'en-IN'
+            : base;
     const integer = new Intl.NumberFormat(locale, { maximumFractionDigits: 0 });
     const digits = new Intl.NumberFormat(locale, { useGrouping: false });
     const separator = new Intl.NumberFormat(locale).formatToParts(1.5).find((p) => p.type === 'decimal')?.value ??

package/dist/ui/views/FormView.js

@@ -19,23 +19,36 @@ import { cn } from '../lib/cn.js';
 import { useLiveRecord } from '../live.js';
 import { useToast } from '../shell/toast.js';
 import { PrefetchedNames, useRowNames } from './widgets.js';
-function commandsOf(lines) {
+/** A line's values as the server takes them: many2many as `{ set }` (a line's taxes). */
+function lineValues(values, fields) {
+    const out = {};
+    for (const [key, value] of Object.entries(values))
+        out[key] = fields[key]?.kind === 'many2many' && Array.isArray(value) ? { set: value } : value;
+    return out;
+}
+function commandsOf(lines, fields) {
     return {
         ...(lines.rows.some((r) => r.id === undefined)
-            ? { create: lines.rows.filter((r) => r.id === undefined).map((r) => r.values) }
+            ? {
+                create: lines.rows
+                    .filter((r) => r.id === undefined)
+                    .map((r) => lineValues(r.values, fields)),
+            }
             : {}),
         ...(lines.rows.some((r) => r.id !== undefined && r.dirty)
             ? {
                 update: lines.rows
                     .filter((r) => r.id !== undefined && r.dirty)
-                    .map((r) => ({ id: r.id, values: r.values })),
+                    .map((r) => ({ id: r.id, values: lineValues(r.values, fields) })),
             }
             : {}),
         ...(lines.deleted.length > 0 ? { delete: lines.deleted } : {}),
     };
 }
 /** The payload of a save: changed values, many2many as `{ set }`. */
-function payloadOf(changes, fields, lines) {
+function payloadOf(changes, fields, lines, 
+/** The fields of a one2many's lines. */
+lineFields) {
     const out = {};
     for (const [key, value] of Object.entries(changes)) {
         if (fields[key]?.kind === 'many2many')
@@ -44,7 +57,7 @@ function payloadOf(changes, fields, lines) {
             out[key] = value;
     }
     for (const [key, state] of lines) {
-        const commands = commandsOf(state);
+        const commands = commandsOf(state, lineFields(key));
         if (Object.keys(commands).length > 0)
             out[key] = commands;
     }
@@ -177,7 +190,7 @@ export function FormView({ served, recordId, defaults, onSaved, onBack, crumbs,
     };
     const save = useMutation({
         mutationFn: async () => {
-            const payload = payloadOf(changes, fields, lines);
+            const payload = payloadOf(changes, fields, lines, (key) => served.fields[fields[key]?.target ?? ''] ?? {});
             const etag = loaded.data?.etag ?? null;
             try {
                 return isNew

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shutro-erp",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Shutro ERP (Kosh): a modern ERP framework on TypeScript, PostgreSQL and the Shutro ORM — typed end to end, permissions enforced on the server, metadata-driven views, reporting, documents and a chatter on every record.",
   "keywords": [
     "erp",
@@ -137,6 +137,14 @@
       "types": "./dist/assistant/web/index.d.ts",
       "default": "./dist/assistant/web/index.js"
     },
+    "./import": {
+      "types": "./dist/import/index.d.ts",
+      "default": "./dist/import/index.js"
+    },
+    "./import/web": {
+      "types": "./dist/import/web/index.d.ts",
+      "default": "./dist/import/web/index.js"
+    },
     "./contacts": {
       "types": "./dist/contacts/index.d.ts",
       "default": "./dist/contacts/index.js"
@@ -177,6 +185,46 @@
       "types": "./dist/sale_project/index.d.ts",
       "default": "./dist/sale_project/index.js"
     },
+    "./portal": {
+      "types": "./dist/portal/index.d.ts",
+      "default": "./dist/portal/index.js"
+    },
+    "./portal/web": {
+      "types": "./dist/portal/web/index.d.ts",
+      "default": "./dist/portal/web/index.js"
+    },
+    "./sale_portal": {
+      "types": "./dist/sale_portal/index.d.ts",
+      "default": "./dist/sale_portal/index.js"
+    },
+    "./account_portal": {
+      "types": "./dist/account_portal/index.d.ts",
+      "default": "./dist/account_portal/index.js"
+    },
+    "./purchase_portal": {
+      "types": "./dist/purchase_portal/index.d.ts",
+      "default": "./dist/purchase_portal/index.js"
+    },
+    "./project_portal": {
+      "types": "./dist/project_portal/index.d.ts",
+      "default": "./dist/project_portal/index.js"
+    },
+    "./l10n_bd": {
+      "types": "./dist/l10n_bd/index.d.ts",
+      "default": "./dist/l10n_bd/index.js"
+    },
+    "./l10n_bd/web": {
+      "types": "./dist/l10n_bd/web/index.d.ts",
+      "default": "./dist/l10n_bd/web/index.js"
+    },
+    "./l10n_in": {
+      "types": "./dist/l10n_in/index.d.ts",
+      "default": "./dist/l10n_in/index.js"
+    },
+    "./l10n_in/web": {
+      "types": "./dist/l10n_in/web/index.d.ts",
+      "default": "./dist/l10n_in/web/index.js"
+    },
     "./ui": {
       "types": "./dist/ui/index.d.ts",
       "default": "./dist/ui/index.js"
@@ -229,7 +277,7 @@
     "postal-mime": "^4.1.4",
     "radix-ui": "^1.8.1",
     "sanitize-html": "^2.18.1",
-    "shutro": "^0.3.1",
+    "shutro": "^0.3.2",
     "tailwind-merge": "^3.7.0",
     "web-push": "^3.6.7"
   },