shutro-erp 0.3.4 → 0.3.6

package/dist/website/module.js

@@ -0,0 +1,282 @@
+/**
+ * The data layer of Sites (RFC 0021): websites per company, pages built from blocks (published or draft, in English or
+ * Bangla, translations linked), and forms whose submissions become records of the apps that allow it — a contact
+ * here, a lead with `website_crm`. The public rendering is the Next.js site's; this is the content and its API.
+ */
+import { contactsShutro } from '../contacts/index.js';
+import { messagingShutro } from '../messaging/index.js';
+import { orm } from '../server/orm.js';
+import { check, defineModel, defineModule, f, method, records, } from './.kosh/bindings.js';
+const ALL = ['read', 'write', 'create', 'unlink'];
+const LANGS = { en: 'English', bn: 'Bangla' };
+/** A site's key and a form's key: what URLs name them by. */
+export const KEY = /^[a-z0-9](?:[a-z0-9-]{0,62})$/;
+/** A page's path: `/`, `/about`, `/products/rice`. */
+export const PATH = /^\/(?:[A-Za-z0-9._~-]+(?:\/[A-Za-z0-9._~-]+)*)?$/;
+/** A form field's input name. */
+export const INPUT = /^[a-z][a-z0-9_]{0,39}$/;
+export const WebsiteSite = defineModel('website.site', {
+    label: 'Site',
+    recName: 'name',
+    order: ['name asc'],
+    companyScoped: { required: true },
+    archivable: true,
+    access: {
+        'website.editor': ['read'],
+        'website.manager': [...ALL, 'export'],
+    },
+    fields: {
+        name: f.char({ required: true }),
+        /** The slug the public API names the site by (`padma`): `/api/v1/public/sites/padma/…`. */
+        key: f.char({ required: true, size: 63 }),
+        domain: f.char({
+            label: 'Domain',
+            help: 'Where the public site is served, e.g. www.example.com',
+        }),
+        lang: f.selection(LANGS, { required: true, default: 'en', label: 'Default language' }),
+        pages: f.one2many('website.page', 'site'),
+    },
+    sqlConstraints: {
+        oneKey: { unique: ['key'], message: 'Another site has this key.' },
+    },
+    constraints: {
+        keyShape: {
+            ...check('website.site', ['key'], async (sites) => sites.filter((s) => !KEY.test(s.key)).map((s) => s.id)),
+            message: 'A key is lower-case letters, digits and dashes, e.g. padma-traders.',
+        },
+    },
+});
+export const WebsitePage = defineModel('website.page', {
+    label: 'Page',
+    recName: 'title',
+    order: ['site asc', 'sequence asc', 'path asc'],
+    companyScoped: { required: true },
+    tracking: ['state', 'path', 'title'],
+    access: {
+        'website.editor': ['read', 'write', 'create', 'unlink'],
+        'website.manager': [...ALL, 'export', 'import'],
+    },
+    fields: {
+        site: f.many2one('website.site', { required: true, ondelete: 'cascade' }),
+        path: f.char({ required: true, default: '/', help: '/ for the home page, /about, /contact' }),
+        lang: f.selection(LANGS, { required: true, default: 'en', label: 'Language' }),
+        title: f.char({ required: true }),
+        /** For search engines and link previews. */
+        description: f.text({ label: 'Summary' }),
+        inMenu: f.boolean({ default: true, label: 'In the menu' }),
+        sequence: f.integer({ required: true, default: 10 }),
+        /** The page this one translates (its other languages link to the same original). */
+        translationOf: f.many2one('website.page', { ondelete: 'set null', label: 'Translation of' }),
+        blocks: f.one2many('website.block', 'page', { label: 'Content' }),
+        state: f.state({
+            states: { draft: 'Draft', published: 'Published' },
+            initial: 'draft',
+            transitions: {
+                publish: {
+                    from: ['draft'],
+                    to: 'published',
+                    after: records('website.page', async (pages) => {
+                        await pages.write({ publishedAt: new Date() });
+                    }),
+                },
+                unpublish: { from: ['published'], to: 'draft' },
+            },
+        }),
+        publishedAt: f.datetime({ label: 'Published on' }),
+    },
+    sqlConstraints: {
+        onePath: {
+            unique: ['site', 'path', 'lang'],
+            message: 'The site already has a page at this path in this language.',
+        },
+    },
+    constraints: {
+        pathShape: {
+            ...check('website.page', ['path'], async (pages) => pages.filter((p) => !PATH.test(p.path)).map((p) => p.id)),
+            message: 'A path starts with / and has letters, digits, dashes, dots or underscores: /about-us.',
+        },
+        sameSite: {
+            ...check('website.page', ['translationOf', 'site'], async (pages) => (await pages.load({ translationOf: true }))
+                .filter((p) => p.translationOf !== null &&
+                (p.translationOf.id === p.id || p.translationOf.site.id !== p.site.id))
+                .map((p) => p.id)),
+            message: 'A page translates another page of the same site.',
+        },
+    },
+});
+/** A piece of a page, in order: what the public site renders, one component per kind. */
+export const WebsiteBlock = defineModel('website.block', {
+    label: 'Block',
+    order: ['sequence asc', 'id asc'],
+    access: {
+        'website.editor': ['read', 'write', 'create', 'unlink'],
+        'website.manager': ALL,
+    },
+    fields: {
+        page: f.many2one('website.page', { required: true, ondelete: 'cascade' }),
+        sequence: f.integer({ required: true, default: 10 }),
+        kind: f.selection({ hero: 'Hero', text: 'Text', image: 'Image', cta: 'Call to action', form: 'Form' }, { required: true, default: 'text' }),
+        title: f.char(),
+        body: f.text({ label: 'Text' }),
+        imageUrl: f.char({ label: 'Image URL', size: 1000 }),
+        buttonLabel: f.char({ label: 'Button' }),
+        buttonUrl: f.char({ label: 'Button link', size: 1000 }),
+        form: f.many2one('website.form', { ondelete: 'restrict' }),
+    },
+    constraints: {
+        formBlock: {
+            ...check('website.block', ['kind', 'form'], async (blocks) => blocks.filter((b) => b.kind === 'form' && b.form === null).map((b) => b.id)),
+            message: 'A form block names its form.',
+        },
+        safeLinks: {
+            ...check('website.block', ['imageUrl', 'buttonUrl'], async (blocks) => blocks
+                .filter((b) => [b.imageUrl, b.buttonUrl].some((u) => u !== null && !safeUrl(u)))
+                .map((b) => b.id)),
+            message: 'A link is a path on the site (/contact) or an http(s) address.',
+        },
+    },
+});
+/** The models website forms may create (`targets()` on `website.form`, as bridges extend it). */
+export async function formTargets(env) {
+    return env.model('website.form').browse([]).targets();
+}
+/** What a record of `target` made from a submission starts with (`submissionValues()`, as bridges extend it). */
+export async function submissionValues(env, target) {
+    return env.model('website.form').browse([]).submissionValues(target);
+}
+/** A link a public page may carry: a path on the site, or http(s) — never `javascript:` or `data:`. */
+export function safeUrl(url) {
+    if (url.startsWith('/') && !url.startsWith('//'))
+        return true;
+    return /^https?:\/\/[^\s]+$/i.test(url);
+}
+export const WebsiteForm = defineModel('website.form', {
+    label: 'Website form',
+    recName: 'name',
+    order: ['name asc'],
+    companyScoped: { required: true },
+    archivable: true,
+    access: {
+        'website.editor': ['read'],
+        'website.manager': [...ALL, 'export'],
+    },
+    fields: {
+        name: f.char({ required: true }),
+        /** What the public API names it by: `POST /api/v1/public/sites/:site/forms/:key`. */
+        key: f.char({ required: true, size: 63 }),
+        /** The model a submission becomes; one of `targets()`. */
+        target: f.char({ required: true, default: 'res.partner', label: 'Creates' }),
+        fields: f.one2many('website.form.field', 'form', { label: 'Fields' }),
+        successMessage: f.text({
+            required: true,
+            default: 'Thank you. We will be in touch soon.',
+            label: 'Message after sending',
+        }),
+        submissions: f.one2many('website.submission', 'form'),
+    },
+    methods: {
+        /** The models a form may create: contacts here; bridges add theirs (`website_crm`: `crm.lead`). */
+        targets: method('website.form', async () => ['res.partner']),
+        /**
+         * What a record made from a submission starts with, before the form's inputs (which win): nothing here; bridges
+         * set their own (`website_crm`: a deal from the website, for no salesperson yet).
+         */
+        submissionValues: method('website.form', async (_target) => ({})),
+    },
+    sqlConstraints: {
+        oneKey: { unique: ['company', 'key'], message: 'Another form has this key.' },
+    },
+    constraints: {
+        keyShape: {
+            ...check('website.form', ['key'], async (forms) => forms.filter((x) => !KEY.test(x.key)).map((x) => x.id)),
+            message: 'A key is lower-case letters, digits and dashes, e.g. contact-us.',
+        },
+        allowedTarget: {
+            ...check('website.form', ['target'], async (forms) => {
+                const allowed = forms.length === 0 ? [] : await formTargets(forms.env);
+                return forms.filter((x) => !allowed.includes(x.target)).map((x) => x.id);
+            }),
+            message: 'A website form creates contacts, or what an installed app allows (a lead with Pipeline).',
+        },
+    },
+});
+export const WebsiteFormField = defineModel('website.form.field', {
+    label: 'Form field',
+    order: ['sequence asc', 'id asc'],
+    access: {
+        'website.editor': ['read'],
+        'website.manager': ALL,
+    },
+    fields: {
+        form: f.many2one('website.form', { required: true, ondelete: 'cascade' }),
+        sequence: f.integer({ required: true, default: 10 }),
+        /** The input's name in what the visitor sends (`email`). */
+        name: f.char({ required: true, size: 40, label: 'Input name' }),
+        label: f.char({ required: true }),
+        kind: f.selection({
+            text: 'Text',
+            email: 'Email',
+            phone: 'Phone',
+            textarea: 'Long text',
+            number: 'Number',
+            date: 'Date',
+        }, { required: true, default: 'text', label: 'Type' }),
+        required: f.boolean({ default: false }),
+        /** The field of the created record it fills (`email`); plain fields only, checked on submission. */
+        targetField: f.char({ required: true, size: 80, label: 'Fills' }),
+    },
+    sqlConstraints: {
+        oneName: { unique: ['form', 'name'], message: 'The form already has an input with this name.' },
+    },
+    constraints: {
+        nameShape: {
+            ...check('website.form.field', ['name'], async (fields) => fields.filter((x) => !INPUT.test(x.name) || x.name === HONEYPOT).map((x) => x.id)),
+            message: 'An input name is lower-case letters, digits and underscores, starting with a letter.',
+        },
+    },
+});
+/** The hidden input a person leaves empty and a bot fills in. */
+export const HONEYPOT = 'website_url';
+/** What a visitor sent through a form, and what it became. */
+export const WebsiteSubmission = defineModel('website.submission', {
+    label: 'Submission',
+    tracking: ['state'],
+    order: ['id desc'],
+    companyScoped: { required: true },
+    access: {
+        'website.editor': ['read'],
+        'website.manager': ['read', 'unlink', 'export'],
+    },
+    fields: {
+        form: f.many2one('website.form', { required: true, ondelete: 'cascade' }),
+        site: f.many2one('website.site', { ondelete: 'set null' }),
+        /** The values as sent (the form's inputs only). */
+        data: f.json({ required: true, default: {} }),
+        state: f.selection({ received: 'Received', spam: 'Spam' }, { required: true, default: 'received' }),
+        resModel: f.char({ label: 'Created (model)' }),
+        resId: f.integer({ label: 'Created (id)' }),
+        /** The created record's name, as it was. */
+        resName: f.char({ label: 'Created' }),
+    },
+});
+export const websiteShutro = defineModule({
+    name: 'website',
+    version: '0.1.0',
+    depends: [contactsShutro, messagingShutro],
+    groups: [
+        orm.defineGroup({ code: 'website.editor', label: 'Sites editor' }),
+        orm.defineGroup({
+            code: 'website.manager',
+            label: 'Sites manager',
+            implies: ['website.editor'],
+        }),
+    ],
+    models: [
+        WebsiteSite,
+        WebsitePage,
+        WebsiteBlock,
+        WebsiteForm,
+        WebsiteFormField,
+        WebsiteSubmission,
+    ],
+});

package/dist/website/render.d.ts

@@ -0,0 +1,45 @@
+/**
+ * What a page is to the outside (RFC 0021, Sites): its blocks in order with the forms they show, as the public API
+ * returns it, and as HTML for the editors' preview — every text escaped, links only to the site or http(s).
+ */
+import type { Id } from '../server/orm.js';
+import type { Env } from './.kosh/bindings.js';
+export interface PublicForm {
+    readonly key: string;
+    readonly name: string;
+    readonly fields: readonly {
+        readonly name: string;
+        readonly label: string;
+        readonly kind: string;
+        readonly required: boolean;
+    }[];
+    /** The hidden input to leave empty (a bot fills it in). */
+    readonly honeypot: string;
+    readonly successMessage: string;
+}
+export interface PublicBlock {
+    readonly kind: string;
+    readonly title: string | null;
+    readonly body: string | null;
+    readonly imageUrl: string | null;
+    readonly buttonLabel: string | null;
+    readonly buttonUrl: string | null;
+    readonly form: PublicForm | null;
+}
+export interface PublicPage {
+    readonly path: string;
+    readonly lang: string;
+    readonly title: string;
+    readonly description: string | null;
+    readonly publishedAt: string | null;
+    readonly blocks: readonly PublicBlock[];
+    /** The same page in its other languages (published ones, for the public API). */
+    readonly translations: readonly {
+        readonly lang: string;
+        readonly path: string;
+    }[];
+}
+/** A page with its blocks, forms and translations; `published` keeps translations to published pages. */
+export declare function pageOf(env: Env, id: Id<'website.page'>, published: boolean): Promise<PublicPage | null>;
+/** The page as a stand-alone document (no scripts): the editors' preview. */
+export declare function pageHtml(page: PublicPage): string;

package/dist/website/render.js

@@ -0,0 +1,102 @@
+import { HONEYPOT, safeUrl } from './module.js';
+/** A page with its blocks, forms and translations; `published` keeps translations to published pages. */
+export async function pageOf(env, id, published) {
+    const [page] = await env.model('website.page').browse([id]).load({ translationOf: true });
+    if (page === undefined)
+        return null;
+    const blocks = [
+        ...(await (await env.model('website.block').search({ where: { page: page.id } })).load({
+            form: true,
+        })),
+    ];
+    const formIds = [...new Set(blocks.flatMap((b) => (b.form === null ? [] : [b.form.id])))];
+    const fields = formIds.length === 0
+        ? []
+        : [...(await env.model('website.form.field').search({ where: { form: { in: formIds } } }))];
+    const formOf = (b) => b.form === null
+        ? null
+        : {
+            key: b.form.key,
+            name: b.form.name,
+            fields: fields
+                .filter((x) => x.form.id === b.form?.id)
+                .map((x) => ({ name: x.name, label: x.label, kind: x.kind, required: x.required })),
+            honeypot: HONEYPOT,
+            successMessage: b.form.successMessage,
+        };
+    const original = page.translationOf?.id ?? page.id;
+    const family = await env.model('website.page').search({
+        where: {
+            or: [{ id: original }, { translationOf: original }],
+            ...(published ? { state: 'published' } : {}),
+        },
+    });
+    return {
+        path: page.path,
+        lang: page.lang,
+        title: page.title,
+        description: page.description,
+        publishedAt: page.publishedAt?.toISOString() ?? null,
+        blocks: blocks.map((b) => ({
+            kind: b.kind,
+            title: b.title,
+            body: b.body,
+            imageUrl: b.imageUrl !== null && safeUrl(b.imageUrl) ? b.imageUrl : null,
+            buttonLabel: b.buttonLabel,
+            buttonUrl: b.buttonUrl !== null && safeUrl(b.buttonUrl) ? b.buttonUrl : null,
+            form: formOf(b),
+        })),
+        translations: [...family]
+            .filter((p) => p.id !== page.id)
+            .map((p) => ({ lang: p.lang, path: p.path })),
+    };
+}
+const escapeHtml = (text) => text.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c);
+const paragraphs = (text) => (text ?? '')
+    .split(/\n{2,}/)
+    .filter((p) => p.trim() !== '')
+    .map((p) => `<p>${escapeHtml(p).replace(/\n/g, '<br>')}</p>`)
+    .join('');
+const button = (b) => b.buttonLabel !== null && b.buttonUrl !== null
+    ? `<a class="button" href="${escapeHtml(b.buttonUrl)}">${escapeHtml(b.buttonLabel)}</a>`
+    : '';
+function blockHtml(b) {
+    const title = b.title === null ? '' : escapeHtml(b.title);
+    switch (b.kind) {
+        case 'hero':
+            return `<section class="hero">${title === '' ? '' : `<h1>${title}</h1>`}${paragraphs(b.body)}${button(b)}</section>`;
+        case 'image':
+            return b.imageUrl === null
+                ? ''
+                : `<figure><img src="${escapeHtml(b.imageUrl)}" alt="${title}">${title === '' ? '' : `<figcaption>${title}</figcaption>`}</figure>`;
+        case 'cta':
+            return `<section class="cta">${title === '' ? '' : `<h2>${title}</h2>`}${paragraphs(b.body)}${button(b)}</section>`;
+        case 'form': {
+            const form = b.form;
+            if (form === null)
+                return '';
+            const inputs = form.fields
+                .map((x) => {
+                const tag = x.kind === 'textarea'
+                    ? `<textarea name="${escapeHtml(x.name)}" disabled></textarea>`
+                    : `<input name="${escapeHtml(x.name)}" type="${x.kind === 'phone' ? 'tel' : escapeHtml(x.kind)}" disabled>`;
+                return `<label>${escapeHtml(x.label)}${x.required ? ' *' : ''}${tag}</label>`;
+            })
+                .join('');
+            return `<section class="form">${title === '' ? '' : `<h2>${title}</h2>`}${paragraphs(b.body)}<form>${inputs}<button type="button" disabled>${escapeHtml(b.buttonLabel ?? 'Send')}</button></form></section>`;
+        }
+        default:
+            return `<section>${title === '' ? '' : `<h2>${title}</h2>`}${paragraphs(b.body)}${button(b)}</section>`;
+    }
+}
+const STYLE = `body{font:16px/1.6 system-ui,sans-serif;margin:0;color:#1f2933;background:#fff}
+main{max-width:760px;margin:0 auto;padding:24px 16px}section,figure{margin:0 0 32px}
+.hero{padding:32px 0}.hero h1{font-size:2.2em;line-height:1.2;margin:0 0 12px}
+.cta{padding:24px;border-radius:12px;background:#f1f5f9}img{max-width:100%;border-radius:8px}
+.button{display:inline-block;padding:8px 16px;border-radius:8px;background:#2563eb;color:#fff;text-decoration:none}
+form{display:grid;gap:12px}label{display:grid;gap:4px;font-weight:600}input,textarea{font:inherit;padding:6px 8px}
+@media (prefers-color-scheme: dark){body{background:#111827;color:#e5e7eb}.cta{background:#1f2937}}`;
+/** The page as a stand-alone document (no scripts): the editors' preview. */
+export function pageHtml(page) {
+    return `<!doctype html><html lang="${escapeHtml(page.lang)}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>${escapeHtml(page.title)}</title><style>${STYLE}</style></head><body><main>${page.blocks.map(blockHtml).join('')}</main></body></html>`;
+}

package/dist/website/routes.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Sites' routes (RFC 0021). The public ones need no sign-in but stay rate limited per address (`auth: false`); they
+ * read in a system scope across companies — published pages only — and keep what they read for a while per server.
+ * A submission is checked value by value and becomes its record in an audited system scope of the site's company.
+ */
+import { type ModuleContext } from '../server/index.js';
+export declare const SUBMITTED = "website.form.submitted";
+export interface SitesOptions {
+    /** How long a server keeps a public read (default 30 s; 0: never). */
+    readonly cacheMs?: number | undefined;
+}
+export declare function registerSitesRoutes(context: ModuleContext, options?: SitesOptions): void;