shutro-erp 0.3.3 → 0.3.5

package/dist/server/api/rest.js

@@ -266,7 +266,45 @@ export function registerRestApi(app, options) {
             !Array.isArray(changed) ||
             changed.some((c) => typeof c !== 'string'))
             throw problem(400, 'invalid-body', 'Invalid onchange request', 'The body is { values: { ...the record }, changed: ["field", ...] }.');
-        return request.env((env) => ref(env, model.name).onchange(input));
+        // Datetimes arrive as ISO strings, as for create and update.
+        const values = coerceValues(model, input.values);
+        return request.env((env) => ref(env, model.name).onchange({ ...input, values }));
+    });
+    // RFC 0022 §3.4: what comes next for a record — the transitions from its state the user may run, and for
+    // each whether its guard lets this record go, with the guard's message when not (nothing is changed).
+    app.get('/api/v1/models/:model/:id/next', async (request) => {
+        const model = modelOf(request.params);
+        const id = idOf(request.params);
+        return request.env(async (env) => {
+            const stateFields = [...new Set(model.transitionSpecs.map((t) => t.field))];
+            const set = await ref(env, model.name)
+                .browse([id])
+                .load(['id', ...stateFields]);
+            const [current] = set.read(['id', ...stateFields]);
+            if (current === undefined)
+                throw new HttpProblem(404, 'missing-record', 'Not found', `No ${model.name} has the id ${id}.`);
+            const canWrite = env.access.can(model.name, 'write');
+            const transitions = [];
+            for (const t of model.transitionSpecs) {
+                if (!canWrite || (t.requires !== null && !permitted(env, t.requires)))
+                    continue;
+                if (!t.from.includes(String(current[t.field] ?? '')))
+                    continue;
+                let allowed = true;
+                if (t.guard !== null) {
+                    const refused = idsIn(await t.guard(set));
+                    allowed = !refused.includes(id);
+                }
+                transitions.push({
+                    name: t.name,
+                    field: t.field,
+                    to: t.to,
+                    allowed,
+                    message: allowed ? null : t.message,
+                });
+            }
+            return { transitions };
+        }, { write: true }); // guards that read through asSuperuser audit the scope
     });
     app.post('/api/v1/models/:model/:id/transitions/:name', async (request, reply) => {
         const model = modelOf(request.params);
@@ -458,3 +496,28 @@ export function registerRestApi(app, options) {
         return options.openapi();
     });
 }
+/** Whether `env` holds the feature permission `code` (an unknown code: no). */
+function permitted(env, code) {
+    try {
+        return env.access.has(code);
+    }
+    catch {
+        return false;
+    }
+}
+/** The ids a guard returned: a recordset (`ids`), records (`id`), ids, or lists of those; anything else, none. */
+function idsIn(value) {
+    if (Array.isArray(value))
+        return value.flatMap(idsIn);
+    if (typeof value === 'number')
+        return [value];
+    if (typeof value !== 'object' || value === null)
+        return [];
+    if ('ids' in value && Array.isArray(value.ids))
+        return value.ids.flatMap(idsIn);
+    if ('id' in value)
+        return idsIn(value.id);
+    if (Symbol.iterator in value)
+        return [...value].flatMap(idsIn);
+    return [];
+}

package/dist/server/api/views.js

@@ -296,6 +296,7 @@ function describe(env, model, field) {
         kind: field.kind,
         label: field.label,
         required: field.required,
+        ...(field.help === null ? {} : { help: field.help }),
         // Field-level only: the UI combines it with `operations` (create for new records, write for existing ones).
         readonly: field.readonly || !env.access.canField(model.name, field.key, 'write'),
         ...(field.target === null ? {} : { target: field.target }),

package/dist/server/app-settings.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Installation-wide app settings (RFC 0020 §3.1): read in code by key, the declared default when unset. Company
+ * settings are `res.company` fields, read as the company's fields.
+ */
+import type { Env } from './orm.js';
+/** The value of the installation setting `key` (`app.setting`), or `fallback` when it was never set. */
+export declare function installationSetting<T>(env: Env, key: string, fallback: T): Promise<T>;

package/dist/server/app-settings.js

@@ -0,0 +1,10 @@
+/** The value of the installation setting `key` (`app.setting`), or `fallback` when it was never set. */
+export async function installationSetting(env, key, fallback) {
+    return env.asSuperuser({ reason: `setting ${key}` }, async (su) => {
+        const found = await su.model('kosh.setting').search({ where: { key }, limit: 1 });
+        if (found.length === 0)
+            return fallback;
+        const [row] = (await found.load(['value'])).read(['value']);
+        return (row?.['value'] ?? fallback);
+    });
+}

package/dist/server/auth/base.js

@@ -147,6 +147,79 @@ const AuthPolicy = defineModel('auth.policy', {
         sessionDays: f.integer({ label: 'Session lifetime (days)' }),
     },
 });
+/**
+ * OAuth 2.0 apps (RFC 0017 §5.2): third-party applications that act for a user who consented, within scopes. The
+ * client secret (confidential apps) is stored as a digest; public apps rely on PKCE. Private: managed by the
+ * Integrations routes and the OAuth flow.
+ */
+const OAuthApp = defineModel('oauth.app', {
+    fields: {
+        name: f.char({ required: true }),
+        clientId: f.char({ required: true, index: 'unique' }),
+        secretHash: f.char(),
+        confidential: f.boolean({ default: true }),
+        /** One per line; the redirect must match one exactly. */
+        redirectUris: f.text({ required: true }),
+        /** The scopes it may ask for, space separated (`*`, `read:<app>`, `write:<app>`). */
+        scopes: f.char({ required: true }),
+        homepage: f.char(),
+        active: f.boolean({ default: true }),
+        owner: f.many2one('res.users', { ondelete: 'set null' }),
+    },
+});
+/** A user's consent to an app, with the scopes granted; revoking it ends every token of it. */
+const OAuthGrant = defineModel('oauth.grant', {
+    fields: {
+        user: f.many2one('res.users', { required: true, ondelete: 'cascade' }),
+        app: f.many2one('oauth.app', { required: true, ondelete: 'cascade' }),
+        scopes: f.char({ required: true }),
+        revoked: f.boolean({ default: false }),
+        lastUsedAt: f.datetime(),
+    },
+});
+/** An authorization code: once, for 10 minutes, bound to its redirect and its PKCE challenge. */
+const OAuthCode = defineModel('oauth.code', {
+    fields: {
+        codeHash: f.char({ required: true, index: 'unique' }),
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        redirectUri: f.char({ required: true }),
+        challenge: f.char(),
+        expiresAt: f.datetime({ required: true }),
+        used: f.boolean({ default: false }),
+    },
+});
+/** An access token (1 hour) and its refresh token (rotated at each use), both stored as digests. */
+const OAuthToken = defineModel('oauth.token', {
+    fields: {
+        grant: f.many2one('oauth.grant', { required: true, ondelete: 'cascade' }),
+        accessHash: f.char({ required: true, index: 'unique' }),
+        refreshHash: f.char({ required: true, index: 'unique' }),
+        accessExpiresAt: f.datetime({ required: true }),
+        refreshExpiresAt: f.datetime({ required: true }),
+        /** No longer valid: replaced by a newer pair, or revoked. */
+        revoked: f.boolean({ default: false }),
+        /** Replaced by a newer pair: its refresh token coming back means someone else holds it. */
+        rotated: f.boolean({ default: false }),
+    },
+});
+/** Installation-wide app settings (RFC 0020): one value per key (`sales.something`), JSON. Private: Settings edits it. */
+const KoshSetting = defineModel('kosh.setting', {
+    fields: {
+        key: f.char({ required: true, index: 'unique' }),
+        value: f.json(),
+    },
+});
+/** Profile photos and company logos (`images.ts`): small images, their bytes in base64. Private: served by routes. */
+const KoshImage = defineModel('kosh.image', {
+    fields: {
+        ownerModel: f.char({ required: true, index: true }),
+        ownerId: f.integer({ required: true, index: true }),
+        mime: f.char({ required: true }),
+        data: f.text({ required: true }),
+        /** The bytes' digest (16 hex): the version in the image's URL. */
+        hash: f.char({ required: true }),
+    },
+});
 /**
  * The security audit log (CLAUDE.md: logins, permission changes, exports, sensitive actions). Append-only: no one
  * may change or delete events (administrators included: the REST API never serves it, and the admin API only reads).
@@ -217,6 +290,12 @@ export const baseShutro = defineModule({
         AuthUserGroup,
         AuthUserGrant,
         AuthPolicy,
+        OAuthApp,
+        OAuthGrant,
+        OAuthCode,
+        OAuthToken,
+        KoshImage,
+        KoshSetting,
         AuditEvent,
         SavedView,
     ],
@@ -236,6 +315,12 @@ export const base = defineKoshModule({
         'auth.user_group',
         'auth.user_grant',
         'auth.policy',
+        'oauth.app',
+        'oauth.grant',
+        'oauth.code',
+        'oauth.token',
+        'kosh.image',
+        'kosh.setting',
         'audit.event',
     ],
 });

package/dist/server/auth/oauth.d.ts

@@ -0,0 +1,21 @@
+import type { FastifyInstance } from 'fastify';
+import type { Env, Shutro } from '../orm.js';
+import type { KoshRegistry } from '../registry.js';
+import type { AuthService } from './service.js';
+export declare const ACCESS_SECONDS = 3600;
+/** Access tokens start with it: the server tells them from sessions and API keys at a glance. */
+export declare const ACCESS_PREFIX = "oat_";
+export interface OAuthOptions {
+    /** The back-office's address: the consent page is `<baseUrl>/oauth/authorize`. */
+    readonly baseUrl: string;
+}
+/** A resolved access token: who it acts as, within which scopes. */
+export interface OAuthAccess {
+    readonly token: number;
+    readonly user: number;
+    readonly app: number;
+    readonly scopes: string[];
+}
+/** Finds the access token `token` (`oat_…`), live, of an active app and a grant not revoked. */
+export declare function resolveAccessToken(env: Env, token: string): Promise<OAuthAccess | null>;
+export declare function registerOAuthRoutes(app: FastifyInstance, auth: AuthService, shutro: () => Shutro, registry: KoshRegistry, options: OAuthOptions): void;