shutro-erp 0.3.4 → 0.3.6

package/dist/website/routes.js

@@ -0,0 +1,246 @@
+/**
+ * Sites' routes (RFC 0021). The public ones need no sign-in but stay rate limited per address (`auth: false`); they
+ * read in a system scope across companies — published pages only — and keep what they read for a while per server.
+ * A submission is checked value by value and becomes its record in an audited system scope of the site's company.
+ */
+import { HttpProblem } from '../server/index.js';
+import { formTargets, HONEYPOT, submissionValues } from './module.js';
+import { pageHtml, pageOf } from './render.js';
+export const SUBMITTED = 'website.form.submitted';
+/** At most this many inputs, and this long each (a long text: `LONG`). */
+const MAX_INPUTS = 50;
+const SHORT = 200;
+const LONG = 5000;
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const DATE = /^\d{4}-\d{2}-\d{2}$/;
+/** The kinds of field each input kind may fill. */
+const FILLS = {
+    text: ['char', 'text'],
+    email: ['char', 'text'],
+    phone: ['char', 'text'],
+    textarea: ['char', 'text'],
+    number: ['integer', 'float', 'decimal'],
+    date: ['date'],
+};
+const notFound = (what) => new HttpProblem(404, 'not-found', 'Not found', `There is no ${what}.`);
+/** A per-server memory of public reads (misses too), for `ttlMs`; at most `max` entries, the oldest dropped. */
+class Memo {
+    #entries = new Map();
+    ttlMs;
+    max;
+    constructor(ttlMs, max = 500) {
+        this.ttlMs = ttlMs;
+        this.max = max;
+    }
+    async get(key, load) {
+        const hit = this.#entries.get(key);
+        if (hit !== undefined && Date.now() - hit.at < this.ttlMs)
+            return hit.value;
+        const value = await load();
+        if (this.ttlMs > 0) {
+            this.#entries.delete(key);
+            this.#entries.set(key, { at: Date.now(), value });
+            if (this.#entries.size > this.max) {
+                const [oldest] = this.#entries.keys();
+                if (oldest !== undefined)
+                    this.#entries.delete(oldest);
+            }
+        }
+        return value;
+    }
+}
+export function registerSitesRoutes(context, options = {}) {
+    const { app, shutro } = context;
+    const cacheMs = options.cacheMs ?? 30_000;
+    const memo = new Memo(cacheMs);
+    const maxAge = `public, max-age=${Math.floor(cacheMs / 1000)}`;
+    /** A system scope reading across companies (public reads). */
+    const reading = (reason, fn) => shutro.bootstrap({ reason: `sites: ${reason}` }, async (raw) => fn(raw.withFlags({ checkCompany: false })));
+    const siteOf = (key) => memo.get(`site:${key}`, () => reading('site', async (env) => {
+        const [site] = await env.model('website.site').search({ where: { key }, limit: 1 });
+        return site === undefined
+            ? null
+            : {
+                id: site.id,
+                key: site.key,
+                name: site.name,
+                lang: site.lang,
+                domain: site.domain,
+                company: site.company.id,
+            };
+    }));
+    const siteParam = async (params) => {
+        const key = String(params.site ?? '');
+        const site = await siteOf(key);
+        if (site === null)
+            throw notFound(`site ${key}`);
+        return site;
+    };
+    const langOf = (query, site) => {
+        const lang = String(query?.lang ?? '');
+        return lang === 'en' || lang === 'bn' ? lang : site.lang;
+    };
+    app.get('/api/v1/public/sites/:site', { config: { auth: false } }, async (request, reply) => {
+        const site = await siteParam(request.params);
+        const lang = langOf(request.query, site);
+        const menu = await memo.get(`menu:${site.key}:${lang}`, () => reading('menu', async (env) => [
+            ...(await env.model('website.page').search({
+                where: { site: site.id, lang, state: 'published', inMenu: true },
+            })),
+        ].map((p) => ({ path: p.path, title: p.title }))));
+        void reply.header('cache-control', maxAge);
+        return {
+            site: { key: site.key, name: site.name, lang: site.lang, domain: site.domain },
+            lang,
+            menu,
+        };
+    });
+    app.get('/api/v1/public/sites/:site/page', { config: { auth: false } }, async (request, reply) => {
+        const site = await siteParam(request.params);
+        const lang = langOf(request.query, site);
+        const path = String(request.query?.path ?? '/');
+        const page = await memo.get(`page:${site.key}:${lang}:${path}`, () => reading('page', async (env) => {
+            const [found] = await env.model('website.page').search({
+                where: { site: site.id, path, lang, state: 'published' },
+                limit: 1,
+            });
+            return found === undefined ? null : pageOf(env, found.id, true);
+        }));
+        if (page === null)
+            throw notFound(`published page at ${path} in this language`);
+        void reply.header('cache-control', maxAge);
+        return { site: { key: site.key, name: site.name }, page };
+    });
+    app.post('/api/v1/public/sites/:site/forms/:key', { config: { auth: false }, bodyLimit: 64 * 1024 }, async (request, reply) => {
+        const site = await siteParam(request.params);
+        const key = String(request.params.key ?? '');
+        const body = request.body;
+        if (body === null || typeof body !== 'object' || Array.isArray(body))
+            throw new HttpProblem(400, 'invalid-body', 'Invalid form', 'Send the form as an object.');
+        const sent = body;
+        if (Object.keys(sent).length > MAX_INPUTS + 1)
+            throw new HttpProblem(400, 'invalid-body', 'Invalid form', 'Too many inputs.');
+        const describe = context.registry.registry;
+        const result = await shutro.bootstrap({ reason: `sites: form ${key} submitted`, company: site.company }, 
+        // The visitor has no rights of their own: the record is made as the system, audited with the form's key.
+        (raw) => raw.asSuperuser({ reason: `website form ${key}` }, async (env) => {
+            const [form] = await env.model('website.form').search({ where: { key }, limit: 1 });
+            if (form === undefined)
+                throw notFound(`form ${key}`);
+            const spam = String(sent[HONEYPOT] ?? '') !== '';
+            const fields = [
+                ...(await env.model('website.form.field').search({ where: { form: form.id } })),
+            ];
+            const data = {};
+            for (const x of fields) {
+                const value = sent[x.name];
+                if (value !== undefined && value !== null && typeof value !== 'string')
+                    throw invalid(x.label, 'is text');
+                const text = (value ?? '').trim();
+                if (text !== '')
+                    data[x.name] = text;
+            }
+            if (spam) {
+                const [made] = (await env
+                    .model('website.submission')
+                    .create([{ form: form.id, site: site.id, data, state: 'spam' }])).ids;
+                await env.flush();
+                return { message: form.successMessage, submission: made ?? null };
+            }
+            const targets = await formTargets(env);
+            if (!targets.includes(form.target) || !describe.models.has(form.target))
+                throw new HttpProblem(409, 'form-target', 'Form not available', 'This form creates records no installed app allows.');
+            const description = describe.describe(form.target);
+            const values = {
+                ...(await submissionValues(env, form.target)),
+            };
+            for (const x of fields) {
+                const target = description.fields[x.targetField];
+                if (target === undefined ||
+                    !(FILLS[x.kind] ?? []).includes(target.kind) ||
+                    target.readonly ||
+                    target.computed)
+                    throw new HttpProblem(409, 'form-field', 'Form not available', `The input ${x.name} fills ${x.targetField}, which a form cannot fill.`);
+                const text = data[x.name];
+                if (text === undefined) {
+                    if (x.required)
+                        throw invalid(x.label, 'is required');
+                    continue;
+                }
+                values[x.targetField] = inputValue(x, text);
+            }
+            const created = await env.model(form.target).create([values]);
+            const id = created.ids[0];
+            const [named] = (await env
+                .model(form.target)
+                .browse([id])
+                .load([description.recName])).read([description.recName]);
+            const [made] = (await env.model('website.submission').create([
+                {
+                    form: form.id,
+                    site: site.id,
+                    data,
+                    state: 'received',
+                    resModel: form.target,
+                    resId: id,
+                    resName: String(named?.[description.recName] ?? ''),
+                },
+            ])).ids;
+            if (made !== undefined)
+                await env.emit(SUBMITTED, { id: made });
+            // Written while still the superuser: the commit's flush checks constraints as the caller.
+            await env.flush();
+            return { message: form.successMessage, submission: made ?? null };
+        }));
+        return reply.status(201).send({ message: result.message });
+    });
+    // The editors' preview: the page as it will look, draft or published, for those who may read it.
+    app.get('/api/v1/sites/pages/:id/preview', async (request) => {
+        const id = Number(request.params.id);
+        if (!Number.isSafeInteger(id) || id <= 0)
+            throw new HttpProblem(400, 'invalid-id', 'Invalid id', 'The id is a positive integer.');
+        return request.env(async (raw) => {
+            const env = raw;
+            const found = await env
+                .model('website.page')
+                .search({ where: { id: id }, limit: 1 });
+            if (found.length === 0)
+                throw notFound(`page ${id}`);
+            const page = await pageOf(env, id, false);
+            if (page === null)
+                throw notFound(`page ${id}`);
+            return { html: pageHtml(page), page };
+        });
+    });
+}
+function invalid(label, what) {
+    return new HttpProblem(422, 'invalid-input', 'Check the form', `${label} ${what}.`);
+}
+/** An input's text as the value its field takes, checked for its kind. */
+function inputValue(x, text) {
+    const max = x.kind === 'textarea' ? LONG : SHORT;
+    if (text.length > max)
+        throw invalid(x.label, `is at most ${max} characters`);
+    switch (x.kind) {
+        case 'email':
+            if (!EMAIL.test(text))
+                throw invalid(x.label, 'is an email address');
+            return text.toLowerCase();
+        case 'phone':
+            if (!/^[+\d][\d\s().-]{3,30}$/.test(text))
+                throw invalid(x.label, 'is a phone number');
+            return text;
+        case 'number': {
+            const n = Number(text);
+            if (!Number.isFinite(n))
+                throw invalid(x.label, 'is a number');
+            return text;
+        }
+        case 'date':
+            if (!DATE.test(text) || Number.isNaN(Date.parse(text)))
+                throw invalid(x.label, 'is a date');
+            return text;
+        default:
+            return text;
+    }
+}

package/dist/website/web/PagePreview.d.ts

@@ -0,0 +1,7 @@
+/**
+ * The live preview of a page (a node component of the page form): the page as its visitors will see it, draft or
+ * published, from `GET /api/v1/sites/pages/:id/preview` — in a frame that runs no scripts, refreshed after each save.
+ */
+import type { NodeComponentProps } from '../../ui/index.js';
+import { type ReactElement } from 'react';
+export declare function PagePreview({ api, record, version }: NodeComponentProps): ReactElement | null;

package/dist/website/web/PagePreview.js

@@ -0,0 +1,33 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+export function PagePreview({ api, record, version }) {
+    const { t } = useTranslation('website');
+    const id = typeof record?.['id'] === 'number' ? record['id'] : null;
+    const [html, setHtml] = useState(null);
+    const [error, setError] = useState(null);
+    // biome-ignore lint/correctness/useExhaustiveDependencies: refetched when the record is saved (its version)
+    useEffect(() => {
+        if (id === null)
+            return;
+        let live = true;
+        api
+            .call('GET', `/api/v1/sites/pages/${id}/preview`)
+            .then((answer) => {
+            if (!live)
+                return;
+            setHtml(answer.html);
+            setError(null);
+        })
+            .catch((e) => {
+            if (live)
+                setError(e instanceof Error ? e.message : String(e));
+        });
+        return () => {
+            live = false;
+        };
+    }, [id, version]);
+    if (id === null)
+        return _jsx("p", { className: "text-sm text-muted-foreground", children: t('preview.save') });
+    return (_jsxs("section", { "aria-label": t('preview.title'), className: "grid gap-2", children: [_jsx("h3", { className: "text-sm font-semibold", children: t('preview.title') }), error !== null ? (_jsx("p", { role: "alert", className: "text-sm text-destructive", children: error })) : (_jsx("iframe", { title: t('preview.title'), sandbox: "", srcDoc: html ?? '', className: "h-[480px] w-full rounded-md border bg-white" }))] }));
+}

package/dist/website/web/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * @packageDocumentation
+ * The web contribution of `shutro-erp/website`: the live preview on the page form.
+ */
+import { type Registry } from '../../ui/index.js';
+import type { i18n } from 'i18next';
+import { messages } from './messages.js';
+export { PagePreview } from './PagePreview.js';
+/** Registers the component (and the messages in `i18n`, when given). */
+export declare function registerWebsiteWeb(registry: Registry, i18n?: i18n): Registry;
+export { messages as websiteMessages };

package/dist/website/web/index.js

@@ -0,0 +1,16 @@
+/**
+ * @packageDocumentation
+ * The web contribution of `shutro-erp/website`: the live preview on the page form.
+ */
+import { addMessages } from '../../ui/index.js';
+import { messages } from './messages.js';
+import { PagePreview } from './PagePreview.js';
+export { PagePreview } from './PagePreview.js';
+/** Registers the component (and the messages in `i18n`, when given). */
+export function registerWebsiteWeb(registry, i18n) {
+    registry.registerComponent('sites.Preview', PagePreview);
+    if (i18n !== undefined)
+        addMessages(i18n, 'website', messages);
+    return registry;
+}
+export { messages as websiteMessages };

package/dist/website/web/messages.d.ts

@@ -0,0 +1,2 @@
+/** Messages of the Sites screens (namespace `website`), in English and Bangla. */
+export declare const messages: Readonly<Record<string, object>>;

package/dist/website/web/messages.js

@@ -0,0 +1,15 @@
+/** Messages of the Sites screens (namespace `website`), in English and Bangla. */
+export const messages = {
+    en: {
+        preview: {
+            title: 'Preview',
+            save: 'Save the page to see its preview.',
+        },
+    },
+    bn: {
+        preview: {
+            title: 'প্রিভিউ',
+            save: 'প্রিভিউ দেখতে পাতাটি সংরক্ষণ করুন।',
+        },
+    },
+};

package/dist/website_crm/.kosh/bindings.d.ts

@@ -0,0 +1,22 @@
+export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
+import { type DefinitionHelpers } from '../../server/orm.js';
+import type { DefaultLoaded, Env as CoreEnv, RecordSet as CoreRecordSet, Shutro as CoreShutro } from '../../server/orm.js';
+import type { SchemaView } from './schema.js';
+export type { SchemaView };
+/** Every model visible in this view. */
+export type ModelName = keyof SchemaView & string;
+/** `Env` typed to this view. */
+export type Env = CoreEnv<SchemaView>;
+/** `Shutro` typed to this view. */
+export type Shutro = CoreShutro<SchemaView>;
+/** A recordset of `M`, with the default loaded shape unless `L` is given. */
+export type Records<M extends ModelName, L = DefaultLoaded<SchemaView, M>> = CoreRecordSet<SchemaView, M, L>;
+export declare const compute: DefinitionHelpers<SchemaView>['compute'];
+export declare const check: DefinitionHelpers<SchemaView>['check'];
+export declare const onchange: DefinitionHelpers<SchemaView>['onchange'];
+export declare const records: DefinitionHelpers<SchemaView>['records'];
+export declare const method: DefinitionHelpers<SchemaView>['method'];
+/** Module data (RFC 0017): records, overrides of dependencies' records, and references, typed like creates. */
+export declare const record: DefinitionHelpers<SchemaView>['record'];
+export declare const override: DefinitionHelpers<SchemaView>['override'];
+export declare const ref: DefinitionHelpers<SchemaView>['ref'];

package/dist/website_crm/.kosh/bindings.js

@@ -0,0 +1,15 @@
+// GENERATED by `pnpm generate:models` (Shutro’s generator). Do not edit. definitions-hash: fe2c56640a3ed761
+// Bindings of module `website_crm`: import the definition API from here to get types scoped to what it can see.
+export { defineModel, defineModule, extendModel, f, replace } from '../../server/orm.js';
+import { definitions } from '../../server/orm.js';
+/** Definition callbacks typed against this module's view: no casts in computes, checks, onchange, methods. */
+const helpers = definitions();
+export const compute = helpers.compute;
+export const check = helpers.check;
+export const onchange = helpers.onchange;
+export const records = helpers.records;
+export const method = helpers.method;
+/** Module data (RFC 0017): records, overrides of dependencies' records, and references, typed like creates. */
+export const record = helpers.record;
+export const override = helpers.override;
+export const ref = helpers.ref;