shutro-erp 0.3.4 → 0.3.6

package/dist/server/api/rest.js

@@ -266,7 +266,45 @@ export function registerRestApi(app, options) {
             !Array.isArray(changed) ||
             changed.some((c) => typeof c !== 'string'))
             throw problem(400, 'invalid-body', 'Invalid onchange request', 'The body is { values: { ...the record }, changed: ["field", ...] }.');
-        return request.env((env) => ref(env, model.name).onchange(input));
+        // Datetimes arrive as ISO strings, as for create and update.
+        const values = coerceValues(model, input.values);
+        return request.env((env) => ref(env, model.name).onchange({ ...input, values }));
+    });
+    // RFC 0022 §3.4: what comes next for a record — the transitions from its state the user may run, and for
+    // each whether its guard lets this record go, with the guard's message when not (nothing is changed).
+    app.get('/api/v1/models/:model/:id/next', async (request) => {
+        const model = modelOf(request.params);
+        const id = idOf(request.params);
+        return request.env(async (env) => {
+            const stateFields = [...new Set(model.transitionSpecs.map((t) => t.field))];
+            const set = await ref(env, model.name)
+                .browse([id])
+                .load(['id', ...stateFields]);
+            const [current] = set.read(['id', ...stateFields]);
+            if (current === undefined)
+                throw new HttpProblem(404, 'missing-record', 'Not found', `No ${model.name} has the id ${id}.`);
+            const canWrite = env.access.can(model.name, 'write');
+            const transitions = [];
+            for (const t of model.transitionSpecs) {
+                if (!canWrite || (t.requires !== null && !permitted(env, t.requires)))
+                    continue;
+                if (!t.from.includes(String(current[t.field] ?? '')))
+                    continue;
+                let allowed = true;
+                if (t.guard !== null) {
+                    const refused = idsIn(await t.guard(set));
+                    allowed = !refused.includes(id);
+                }
+                transitions.push({
+                    name: t.name,
+                    field: t.field,
+                    to: t.to,
+                    allowed,
+                    message: allowed ? null : t.message,
+                });
+            }
+            return { transitions };
+        }, { write: true }); // guards that read through asSuperuser audit the scope
     });
     app.post('/api/v1/models/:model/:id/transitions/:name', async (request, reply) => {
         const model = modelOf(request.params);
@@ -458,3 +496,28 @@ export function registerRestApi(app, options) {
         return options.openapi();
     });
 }
+/** Whether `env` holds the feature permission `code` (an unknown code: no). */
+function permitted(env, code) {
+    try {
+        return env.access.has(code);
+    }
+    catch {
+        return false;
+    }
+}
+/** The ids a guard returned: a recordset (`ids`), records (`id`), ids, or lists of those; anything else, none. */
+function idsIn(value) {
+    if (Array.isArray(value))
+        return value.flatMap(idsIn);
+    if (typeof value === 'number')
+        return [value];
+    if (typeof value !== 'object' || value === null)
+        return [];
+    if ('ids' in value && Array.isArray(value.ids))
+        return value.ids.flatMap(idsIn);
+    if ('id' in value)
+        return idsIn(value.id);
+    if (Symbol.iterator in value)
+        return [...value].flatMap(idsIn);
+    return [];
+}

package/dist/server/api/views.js

@@ -296,6 +296,7 @@ function describe(env, model, field) {
         kind: field.kind,
         label: field.label,
         required: field.required,
+        ...(field.help === null ? {} : { help: field.help }),
         // Field-level only: the UI combines it with `operations` (create for new records, write for existing ones).
         readonly: field.readonly || !env.access.canField(model.name, field.key, 'write'),
         ...(field.target === null ? {} : { target: field.target }),

package/dist/server/app-settings.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Installation-wide app settings (RFC 0020 §3.1): read in code by key, the declared default when unset. Company
+ * settings are `res.company` fields, read as the company's fields.
+ */
+import type { Env } from './orm.js';
+/** The value of the installation setting `key` (`app.setting`), or `fallback` when it was never set. */
+export declare function installationSetting<T>(env: Env, key: string, fallback: T): Promise<T>;

package/dist/server/app-settings.js

@@ -0,0 +1,10 @@
+/** The value of the installation setting `key` (`app.setting`), or `fallback` when it was never set. */
+export async function installationSetting(env, key, fallback) {
+    return env.asSuperuser({ reason: `setting ${key}` }, async (su) => {
+        const found = await su.model('kosh.setting').search({ where: { key }, limit: 1 });
+        if (found.length === 0)
+            return fallback;
+        const [row] = (await found.load(['value'])).read(['value']);
+        return (row?.['value'] ?? fallback);
+    });
+}

package/dist/server/auth/base.js

@@ -202,6 +202,13 @@ const OAuthToken = defineModel('oauth.token', {
         rotated: f.boolean({ default: false }),
     },
 });
+/** Installation-wide app settings (RFC 0020): one value per key (`sales.something`), JSON. Private: Settings edits it. */
+const KoshSetting = defineModel('kosh.setting', {
+    fields: {
+        key: f.char({ required: true, index: 'unique' }),
+        value: f.json(),
+    },
+});
 /** Profile photos and company logos (`images.ts`): small images, their bytes in base64. Private: served by routes. */
 const KoshImage = defineModel('kosh.image', {
     fields: {
@@ -288,6 +295,7 @@ export const baseShutro = defineModule({
         OAuthCode,
         OAuthToken,
         KoshImage,
+        KoshSetting,
         AuditEvent,
         SavedView,
     ],
@@ -312,6 +320,7 @@ export const base = defineKoshModule({
         'oauth.code',
         'oauth.token',
         'kosh.image',
+        'kosh.setting',
         'audit.event',
     ],
 });

package/dist/server/index.d.ts

@@ -11,6 +11,7 @@ export { type FoundRecord, type MenuNode, moduleVisible, Navigation } from './ap
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
 export { readApiRecord, registerRestApi } from './api/rest.js';
 export { type ServedView, type ViewField, ViewRegistry } from './api/views.js';
+export { installationSetting } from './app-settings.js';
 export { APPS_CHANNEL, APPS_LOG_TABLE, APPS_TABLE, type AppLoadContext, type ApplyAppsOptions, type AppsResult, applyApps, appsDigest, appTableStatements, FRAMEWORK_TABLES, installDefaults, installedApps, installedModules, type PrepareAppsOptions, type PreparedApps, prepareApps, readInstalledApps, recordInstalledApps, restoreAppMigrations, } from './apps.js';
 export { type AuditInput, audit } from './audit.js';
 export { administrators, isAdministratorUser, keepingAdministrator, LAST_ADMINISTRATOR, } from './auth/admins.js';

package/dist/server/index.js

@@ -11,6 +11,7 @@ export { moduleVisible, Navigation } from './api/navigation.js';
 export { fieldSchema, openApiDocument, openApiOf } from './api/openapi.js';
 export { readApiRecord, registerRestApi } from './api/rest.js';
 export { ViewRegistry } from './api/views.js';
+export { installationSetting } from './app-settings.js';
 export { APPS_CHANNEL, APPS_LOG_TABLE, APPS_TABLE, applyApps, appsDigest, appTableStatements, FRAMEWORK_TABLES, installDefaults, installedApps, installedModules, prepareApps, readInstalledApps, recordInstalledApps, restoreAppMigrations, } from './apps.js';
 export { audit } from './audit.js';
 export { administrators, isAdministratorUser, keepingAdministrator, LAST_ADMINISTRATOR, } from './auth/admins.js';

package/dist/settings/app-settings.d.ts

@@ -0,0 +1,2 @@
+import { type ModuleContext } from '../server/index.js';
+export declare function registerAppSettingsRoutes(context: ModuleContext): void;