shutro-erp 0.3.5 → 0.3.7

package/dist/server/api/explain.js

@@ -0,0 +1,111 @@
+import { HttpProblem } from '../errors.js';
+/** Which module declares each model and field, from the loaded modules' Shutro definitions. */
+function provenance(registry) {
+    const owner = new Map();
+    const fieldOwner = new Map();
+    const extenders = new Map();
+    for (const m of registry.loaded.modules) {
+        const shutro = m.shutro;
+        for (const model of shutro?.models ?? []) {
+            owner.set(model.name, m.name);
+            for (const key of Object.keys(model.fields ?? {}))
+                fieldOwner.set(`${model.name}.${key}`, m.name);
+        }
+    }
+    for (const m of registry.loaded.modules) {
+        const shutro = m.shutro;
+        for (const ext of shutro?.extensions ?? []) {
+            const set = extenders.get(ext.name) ?? new Set();
+            set.add(m.name);
+            extenders.set(ext.name, set);
+            for (const key of Object.keys(ext.fields ?? {}))
+                fieldOwner.set(`${ext.name}.${key}`, m.name);
+        }
+    }
+    return { owner, fieldOwner, extenders };
+}
+const show = (value) => {
+    if (value === undefined || value === null || typeof value === 'function')
+        return null;
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return null;
+    }
+};
+/** A model explained, from the registry and the API metadata. */
+export function explainModel(registry, models, name) {
+    const model = models.get(name);
+    if (model === undefined)
+        return null;
+    const { owner, fieldOwner, extenders } = provenance(registry);
+    const descriptors = registry.registry.get(name).model.fields;
+    const description = registry.registry.describe(name).fields;
+    const fields = model.fields.map((f) => {
+        const raw = descriptors[f.key] ?? {};
+        const d = description[f.key] ?? {};
+        const depends = Array.isArray(d['depends']) ? d['depends'].map(String) : [];
+        const defaultValue = raw['default'];
+        return {
+            key: f.key,
+            label: f.label,
+            kind: f.kind,
+            help: f.help,
+            target: f.target,
+            inverse: typeof raw['inverseField'] === 'string' ? raw['inverseField'] : null,
+            required: f.required,
+            readonly: f.readonly,
+            stored: f.stored,
+            computed: d['computed'] === true,
+            depends,
+            hasDefault: defaultValue !== undefined,
+            default: typeof defaultValue === 'function' ? '(computed when created)' : show(defaultValue),
+            ondelete: typeof raw['ondelete'] === 'string' ? raw['ondelete'] : null,
+            translate: f.translate,
+            index: raw['index'] !== undefined && raw['index'] !== false,
+            options: f.options,
+            module: fieldOwner.get(`${name}.${f.key}`) ?? owner.get(name) ?? null,
+        };
+    });
+    const incoming = [];
+    for (const other of models.values())
+        for (const f of other.fields)
+            if (f.target === name && f.kind !== 'one2many')
+                incoming.push({ model: other.name, field: f.key, label: f.label, kind: f.kind });
+    return {
+        model: name,
+        label: model.label,
+        module: owner.get(name) ?? null,
+        extendedBy: [...(extenders.get(name) ?? [])].sort(),
+        fields,
+        transitions: model.transitionSpecs.map((t) => ({
+            name: t.name,
+            field: t.field,
+            from: t.from,
+            to: t.to,
+            guarded: t.guard !== null,
+            message: t.message,
+            requires: t.requires,
+        })),
+        incoming: incoming.sort((a, b) => a.model.localeCompare(b.model) || a.field.localeCompare(b.field)),
+    };
+}
+/** The group that may read explanations besides administrators. */
+export const DEVELOPER_GROUP = 'base.developer';
+export function registerExplain(app, options) {
+    app.get('/api/v1/meta/explain/:model', async (request) => request.env(async (raw) => {
+        const env = raw;
+        if (!env.administrator && !env.su && !env.groups.has(DEVELOPER_GROUP))
+            throw new HttpProblem(403, 'not-developer', 'Developers only', 'Explanations are for administrators and developers.', 'Ask an administrator for the Developer role.');
+        const name = String(request.params.model ?? '');
+        const explained = explainModel(options.registry, options.models, name);
+        if (explained === null)
+            throw new HttpProblem(404, 'unknown-model', 'Unknown model', `No installed model is named '${name}'.`);
+        return explained;
+    }));
+}

package/dist/server/api/metadata.d.ts

@@ -51,6 +51,8 @@ export interface ApiModel {
     readonly onchange: readonly string[];
     /** The stored field names are searched by (`name` by default), or `null`. */
     readonly recName: string | null;
+    /** The field sets of the model's unique constraints (a copy leaves them out, RFC 0023 §3.2). */
+    readonly unique: readonly (readonly string[])[];
 }
 /** `res.partner` → `ResPartner`. */
 export declare function schemaName(model: string): string;

package/dist/server/api/metadata.js

@@ -71,10 +71,19 @@ export function apiModels(registry) {
             transitionSpecs,
             onchange: [...description.onchange],
             recName: recNameOf(registry, name, fields),
+            unique: uniqueOf(registry, name),
         });
     }
     return out;
 }
+function uniqueOf(registry, name) {
+    // Shutro resolves a model's constraints to `{ kind, fields }` (the definition's object form also accepted).
+    const raw = registry.get(name).model.sqlConstraints;
+    const list = Array.isArray(raw)
+        ? raw
+        : [];
+    return list.flatMap((c) => c.kind === 'unique' && Array.isArray(c.fields) ? [c.fields.map(String)] : []);
+}
 function recNameOf(registry, name, fields) {
     const declared = registry.get(name).model.recName;
     const key = typeof declared === 'string' ? declared : 'name';

package/dist/server/api/openapi.js

@@ -186,6 +186,12 @@ function modelPaths(model) {
                         schema: { type: 'boolean' },
                         description: 'Also return the total count.',
                     },
+                    {
+                        name: 'archived',
+                        in: 'query',
+                        schema: { type: 'string', enum: ['include', 'only'] },
+                        description: 'Archived records too (include), or alone (only); hidden otherwise.',
+                    },
                 ],
                 responses: responses({
                     type: 'object',
@@ -263,6 +269,15 @@ function modelPaths(model) {
             },
         },
     };
+    paths[`${base}/{id}/duplicate`] = {
+        post: {
+            operationId: `duplicate${s}`,
+            tags: tag,
+            summary: 'A copy made as the caller, its lines with it (states and numbers start again)',
+            parameters: [ID_PARAM, IDEMPOTENCY],
+            responses: responses(ref, '201'),
+        },
+    };
     for (const t of model.transitions)
         paths[`${base}/{id}/transitions/${t}`] = {
             post: {

package/dist/server/api/rest.d.ts

@@ -11,6 +11,7 @@
  * - `POST   /api/v1/models/:model/aggregate`                grouped totals
  * - `POST   /api/v1/models/:model/onchange`                 form assistance
  * - `POST   /api/v1/models/:model/:id/transitions/:name`    state transition (Idempotency-Key)
+ * - `POST   /api/v1/models/:model/:id/duplicate`            a copy made as the user, its lines with it (RFC 0023 R1)
  * - `POST   /api/v1/models/:model/export`                   export (needs `export`; audited)
  * - `POST   /api/v1/models/:model/import`                   import rows (needs `import` and `create`; audited)
  * - `GET    /api/v1/meta/:model`                            the caller's view of the model (needs `read`)

package/dist/server/api/rest.js

@@ -1,6 +1,7 @@
 import { audit } from '../audit.js';
 import { HttpProblem } from '../errors.js';
 import { announceChange } from './changes.js';
+import { duplicateValues } from './duplicate.js';
 import { idempotent } from './idempotency.js';
 import { defaultFields } from './metadata.js';
 const ref = (env, model) => env.model(model);
@@ -128,16 +129,47 @@ async function send(reply, outcome) {
 }
 /**
  * JSON has no dates: datetime fields arrive as ISO strings and become `Date`s (Shutro stores them in UTC); other
- * kinds are left to Shutro's own validation. Applied to create, update and import values.
+ * kinds are left to Shutro's own validation. Applied to create, update and import values, and through the lines
+ * of one2many and many2many commands (`create` rows and `update` values) to the lines' own datetimes.
  */
-function coerceValues(model, values) {
+function coerceValues(models, model, values, depth = 0) {
     const out = { ...values };
     for (const [key, value] of Object.entries(values)) {
-        if (model.byKey.get(key)?.kind !== 'datetime' || typeof value !== 'string')
+        const field = model.byKey.get(key);
+        if (field === undefined)
+            continue;
+        if (field.kind === 'datetime' && typeof value === 'string') {
+            const date = new Date(value);
+            if (!Number.isNaN(date.getTime()))
+                out[key] = date;
             continue;
-        const date = new Date(value);
-        if (!Number.isNaN(date.getTime()))
-            out[key] = date;
+        }
+        if ((field.kind === 'one2many' || field.kind === 'many2many') &&
+            field.target !== null &&
+            depth < 4 &&
+            typeof value === 'object' &&
+            value !== null &&
+            !Array.isArray(value)) {
+            const target = models.get(field.target);
+            if (target === undefined)
+                continue;
+            const commands = value;
+            const next = { ...commands };
+            if (Array.isArray(commands.create))
+                next['create'] = commands.create.map((row) => typeof row === 'object' && row !== null
+                    ? coerceValues(models, target, row, depth + 1)
+                    : row);
+            if (Array.isArray(commands.update))
+                next['update'] = commands.update.map((u) => typeof u === 'object' &&
+                    u !== null &&
+                    typeof u.values === 'object'
+                    ? {
+                        ...u,
+                        values: coerceValues(models, target, u.values, depth + 1),
+                    }
+                    : u);
+            out[key] = next;
+        }
     }
     return out;
 }
@@ -173,9 +205,16 @@ export function registerRestApi(app, options) {
             throw problem(400, 'invalid-limit', 'Invalid limit', 'limit must be 1–1000.');
         if (!Number.isInteger(offset) || offset < 0)
             throw problem(400, 'invalid-offset', 'Invalid offset', 'offset must be 0 or more.');
-        const where = parseFilter(q['filter']);
+        const filter = parseFilter(q['filter']);
         const order = parseOrder(model, q['order']);
-        return request.env(async (env) => {
+        // Archived records are hidden unless asked for: `archived=include` lists them with the rest, `archived=only`
+        // lists them alone (RFC 0023: archive, never delete).
+        const archived = q['archived'];
+        if (archived !== undefined && archived !== 'include' && archived !== 'only')
+            throw problem(400, 'invalid-archived', 'Invalid archived', "archived is 'include' or 'only'.");
+        const where = archived === 'only' ? { ...(filter ?? {}), active: false } : filter;
+        return request.env(async (requestEnv) => {
+            const env = archived === undefined ? requestEnv : requestEnv.withFlags({ activeTest: false });
             const fields = fieldsOf(model, env, q['fields']);
             const found = await ref(env, model.name).search({
                 ...(where === undefined ? {} : { where }),
@@ -197,7 +236,7 @@ export function registerRestApi(app, options) {
         const model = modelOf(request.params);
         const values = body(request);
         const outcome = await request.env((env) => idempotent(request, env, driver, async () => {
-            const created = await ref(env, model.name).create([coerceValues(model, values)]);
+            const created = await ref(env, model.name).create([coerceValues(models, model, values)]);
             await env.flush(); // computes and constraints run now: the response shows the stored record
             announceChange(env, driver, {
                 model: model.name,
@@ -232,7 +271,7 @@ export function registerRestApi(app, options) {
         const outcome = await request.env((env) => idempotent(request, env, driver, async () => {
             await ref(env, model.name)
                 .browse([id])
-                .write(coerceValues(model, values), expected === undefined ? {} : { expect: { updatedAt: expected } });
+                .write(coerceValues(models, model, values), expected === undefined ? {} : { expect: { updatedAt: expected } });
             await env.flush();
             announceChange(env, driver, { model: model.name, ids: [id], op: 'update' });
             return record(env, model, id);
@@ -267,7 +306,7 @@ export function registerRestApi(app, options) {
             changed.some((c) => typeof c !== 'string'))
             throw problem(400, 'invalid-body', 'Invalid onchange request', 'The body is { values: { ...the record }, changed: ["field", ...] }.');
         // Datetimes arrive as ISO strings, as for create and update.
-        const values = coerceValues(model, input.values);
+        const values = coerceValues(models, model, input.values);
         return request.env((env) => ref(env, model.name).onchange({ ...input, values }));
     });
     // RFC 0022 §3.4: what comes next for a record — the transitions from its state the user may run, and for
@@ -322,6 +361,31 @@ export function registerRestApi(app, options) {
         await send(reply, outcome);
     });
     // Name search (many2one pickers, display names of ids): the model's record name, within ACL and rules.
+    app.post('/api/v1/models/:model/:id/duplicate', async (request, reply) => {
+        const model = modelOf(request.params);
+        const id = idOf(request.params);
+        const outcome = await request.env((env) => idempotent(request, env, driver, async () => {
+            await ref(env, model.name).browse([id]).load(['id']); // the original, as the user may read it
+            const values = await duplicateValues(env, models, model, id);
+            const created = await ref(env, model.name).create([coerceValues(models, model, values)]);
+            await env.flush();
+            announceChange(env, driver, {
+                model: model.name,
+                ids: [created.ids[0]],
+                op: 'create',
+            });
+            const result = await record(env, model, created.ids[0]);
+            return {
+                ...result,
+                status: 201,
+                headers: {
+                    ...result.headers,
+                    location: `/api/v1/models/${model.name}/${created.ids[0]}`,
+                },
+            };
+        }));
+        await send(reply, outcome);
+    });
     app.get('/api/v1/models/:model/names', async (request) => {
         const model = modelOf(request.params);
         const q = query(request);
@@ -450,7 +514,7 @@ export function registerRestApi(app, options) {
                 throw problem(400, 'invalid-rows', 'Invalid rows', 'Each row is an object of field values.');
         const outcome = await request.env((env) => idempotent(request, env, driver, async () => {
             env.access.check(model.name, 'import'); // and `create`, checked by Shutro
-            const created = await ref(env, model.name).create(input.map((row) => coerceValues(model, row)));
+            const created = await ref(env, model.name).create(input.map((row) => coerceValues(models, model, row)));
             await env.flush(); // all-or-nothing: constraints run before the response
             announceChange(env, driver, { model: model.name, ids: [...created.ids], op: 'create' });
             await audit(env, {

package/dist/server/api/views.js

@@ -174,7 +174,7 @@ export class ViewRegistry {
             case 'form': {
                 if (view.header.statusbar !== undefined)
                     meta(model, view.header.statusbar);
-                const buttons = view.header.buttons.filter((b) => allowed.has(b.transition));
+                const buttons = view.header.buttons.filter((b) => b.open !== undefined || (b.transition !== undefined && allowed.has(b.transition)));
                 served = {
                     ...view,
                     header: { ...view.header, buttons },

package/dist/server/apps.d.ts

@@ -10,6 +10,10 @@ export declare const APPS_LOG_TABLE = "kosh_app_log";
  * installed set (`createAppHost`).
  */
 export declare const APPS_CHANNEL = "kosh_apps";
+/** What an uninstall dropped, kept for {@link SNAPSHOT_DAYS} days (RFC 0008 §5.4). */
+export declare const APPS_SNAPSHOT_TABLE = "kosh_app_snapshot";
+/** How long an uninstall's snapshot is kept. */
+export declare const SNAPSHOT_DAYS = 30;
 /** Tables the framework owns (not a model's): migrations never alter or drop them. */
 export declare const FRAMEWORK_TABLES: readonly string[];
 /** Creates the App manager's tables (idempotent). */
@@ -50,8 +54,16 @@ export interface PreparedApps {
     readonly migration: MigrationPlan;
     /** True when the plan changes nothing. */
     readonly empty: boolean;
-    /** An upgrade may drop columns or tables its new code no longer has (`removeData`). */
+    /** An upgrade may drop columns or tables its new code no longer has (`removeData`); an uninstall drops its own. */
     readonly allowDestructive: boolean;
+    /** The installed and disabled modules before the change (an uninstall's hooks run on it). */
+    readonly before: KoshRegistry;
+    /** What an uninstall drops: each table, or column, with the rows that hold data. */
+    readonly drops: readonly {
+        readonly table: string;
+        readonly column: string | null;
+        readonly rows: number;
+    }[];
 }
 /** Options of {@link prepareApps}. */
 export interface PrepareAppsOptions {
@@ -111,6 +123,9 @@ export interface AppsResult {
     readonly enabled: readonly string[];
     readonly disabled: readonly string[];
     readonly upgraded: readonly string[];
+    readonly uninstalled: readonly string[];
+    /** The snapshot of what the uninstall dropped (`kosh_app_snapshot.id`), or null. */
+    readonly snapshot: number | null;
 }
 /**
  * Runs every served module's `hooks.defaults` (idempotent: approval policies, document templates, activity types,

package/dist/server/apps.js

@@ -33,8 +33,17 @@ export const APPS_LOG_TABLE = 'kosh_app_log';
  * installed set (`createAppHost`).
  */
 export const APPS_CHANNEL = 'kosh_apps';
+/** What an uninstall dropped, kept for {@link SNAPSHOT_DAYS} days (RFC 0008 §5.4). */
+export const APPS_SNAPSHOT_TABLE = 'kosh_app_snapshot';
+/** How long an uninstall's snapshot is kept. */
+export const SNAPSHOT_DAYS = 30;
 /** Tables the framework owns (not a model's): migrations never alter or drop them. */
-export const FRAMEWORK_TABLES = [IDEMPOTENCY_TABLE, APPS_TABLE, APPS_LOG_TABLE];
+export const FRAMEWORK_TABLES = [
+    IDEMPOTENCY_TABLE,
+    APPS_TABLE,
+    APPS_LOG_TABLE,
+    APPS_SNAPSHOT_TABLE,
+];
 /** Creates the App manager's tables (idempotent). */
 export function appTableStatements() {
     return [
@@ -62,6 +71,16 @@ export function appTableStatements() {
   digest text NOT NULL,
   migration_file text,
   migration_content text
+)`,
+            params: [],
+        },
+        {
+            text: `CREATE TABLE IF NOT EXISTS ${APPS_SNAPSHOT_TABLE} (
+  id bigserial PRIMARY KEY,
+  at timestamptz NOT NULL DEFAULT now(),
+  actor text NOT NULL,
+  modules text[] NOT NULL,
+  tables jsonb NOT NULL
 )`,
             params: [],
         },
@@ -209,7 +228,7 @@ export async function prepareApps(options) {
         registry: schema.registry,
         ignore: FRAMEWORK_TABLES,
     });
-    const removeData = options.removeData === true && plan.upgrade.length > 0;
+    const removeData = (options.removeData === true && plan.upgrade.length > 0) || plan.uninstall.length > 0;
     if (migration.destructive.length > 0 && !removeData)
         throw new AppPlanError(`The change would drop or alter data: ${migration.destructive.map((op) => migrate.renderOperation(op)).join('; ')}.`, plan.upgrade.length > 0
             ? 'Upgrade with "remove data" (shutro-erp apps upgrade --remove-data) to drop them, or keep the fields in the code.'
@@ -234,6 +253,21 @@ WHERE table_schema = 'public' AND table_name = $1 AND column_name = $2`,
     }
     if (orphaned.length > 0)
         throw new AppPlanError(`Disabling would leave required fields that no enabled module fills: ${orphaned.join(', ')}.`, 'Disable the modules that extend these models too, or make the fields optional.');
+    // What an uninstall drops, with the rows that hold data: the plan shows it before anyone confirms.
+    const drops = [];
+    if (plan.uninstall.length > 0)
+        for (const op of migration.destructive) {
+            if (op.kind !== 'dropTable' && op.kind !== 'dropColumn')
+                continue;
+            const column = op.kind === 'dropColumn' ? op.column : null;
+            const [row] = await driver.query({
+                text: column === null
+                    ? `SELECT count(*)::text AS n FROM "${op.table}"`
+                    : `SELECT count(*)::text AS n FROM "${op.table}" WHERE "${column}" IS NOT NULL`,
+                params: [],
+            });
+            drops.push({ table: op.table, column, rows: Number(row?.n ?? 0) });
+        }
     return {
         plan,
         current,
@@ -244,8 +278,11 @@ WHERE table_schema = 'public' AND table_name = $1 AND column_name = $2`,
             plan.enable.length === 0 &&
             plan.disable.length === 0 &&
             plan.upgrade.length === 0 &&
+            plan.uninstall.length === 0 &&
             migration.statements.length === 0,
         allowDestructive: removeData,
+        before,
+        drops,
     };
 }
 /**
@@ -311,6 +348,7 @@ const defaultLoad = async (context, modules) => {
 export async function applyApps(prepared, options) {
     const { plan } = prepared;
     const step = options.onStep ?? (() => { });
+    let snapshotId = null;
     const file = prepared.migration.statements.length > 0
         ? await migrate.writeMigrationFile({
             dir: options.dir,
@@ -328,6 +366,45 @@ export async function applyApps(prepared, options) {
             // Before the first change the table was just created empty: compare with what was planned from.
             if (now !== null && now.length > 0 && digestOf(now) !== digestOf(prepared.current))
                 throw new AppPlanError('The installed apps changed since this change was planned.', 'Plan it again.');
+            const removed = plan.uninstall.map((u) => u.name);
+            let snapshot = null;
+            if (removed.length > 0) {
+                // Each module may refuse (Accounting while posted entries exist), on the modules as they are now.
+                const before = orm.createShutro({ driver: tx, registry: prepared.before.registry });
+                for (const name of removed) {
+                    const hook = prepared.before.loaded.byName.get(name)?.hooks?.preUninstall;
+                    if (hook === undefined)
+                        continue;
+                    step('hooks', name);
+                    try {
+                        await before.bootstrap({ reason: `uninstall ${name}` }, (env) => hook(env));
+                    }
+                    catch (error) {
+                        throw new AppPlanError(`${name} cannot be uninstalled: ${error instanceof Error ? error.message : String(error)}`, 'Disable it instead: the app goes away and its data stays.');
+                    }
+                }
+                // The snapshot: every dropped table's rows and every dropped column's values, kept for 30 days.
+                step('state', 'snapshot');
+                const tables = [];
+                for (const d of prepared.drops) {
+                    const [row] = await tx.query({
+                        text: d.column === null
+                            ? `SELECT coalesce(json_agg(t), '[]'::json) AS rows FROM "${d.table}" t`
+                            : `SELECT coalesce(json_agg(json_build_object('id', id, 'value', "${d.column}")), '[]'::json) AS rows FROM "${d.table}" WHERE "${d.column}" IS NOT NULL`,
+                        params: [],
+                    });
+                    tables.push({ table: d.table, column: d.column, rows: row?.rows ?? [] });
+                }
+                await tx.query({
+                    text: `DELETE FROM ${APPS_SNAPSHOT_TABLE} WHERE at < now() - make_interval(days => $1)`,
+                    params: [SNAPSHOT_DAYS],
+                });
+                const [made] = await tx.query({
+                    text: `INSERT INTO ${APPS_SNAPSHOT_TABLE} (actor, modules, tables) VALUES ($1, $2, $3::jsonb) RETURNING id::text AS id`,
+                    params: [options.actor, removed, tables],
+                });
+                snapshot = made === undefined ? null : Number(made.id);
+            }
             // Upgrades run the modules' data migrations even without schema statements (Shutro tracks the versions).
             if (file !== null || plan.upgrade.length > 0) {
                 step('schema', `${prepared.migration.statements.length} statement(s)`);
@@ -373,6 +450,14 @@ export async function applyApps(prepared, options) {
                 step('data', upgraded.join(', '));
                 await (options.load ?? defaultLoad)({ shutro, driver: tx, registry: prepared.runtime, company: companyId }, upgraded);
             }
+            if (removed.length > 0) {
+                step('data', `remove ${removed.join(', ')}`);
+                await removeModuleData(tx, shutro, prepared, removed);
+                await tx.query({
+                    text: `DELETE FROM ${APPS_TABLE} WHERE name = ANY($1)`,
+                    params: [removed],
+                });
+            }
             step('state', `${plan.after.length} module(s)`);
             for (const row of plan.after)
                 await tx.query({
@@ -396,6 +481,8 @@ VALUES ($1, $2::jsonb, $3, $4, $5, $6)`,
                         enable: plan.enable,
                         disable: plan.disable,
                         upgrade: plan.upgrade,
+                        uninstall: plan.uninstall,
+                        snapshot,
                         migration: file === null ? null : `${file.version}_${file.name}.sql`,
                     },
                     sql,
@@ -410,6 +497,7 @@ VALUES ($1, $2::jsonb, $3, $4, $5, $6)`,
                     ...plan.enable.map((n) => `enabled ${n}`),
                     ...plan.disable.map((m) => `disabled ${m.name}`),
                     ...plan.upgrade.map((u) => `upgraded ${u.name} ${u.from} → ${u.to}`),
+                    ...plan.uninstall.map((u) => `uninstalled ${u.name} (data removed)`),
                 ];
                 await shutro.bootstrap({ reason: 'apps change audit' }, (env) => audit(env, {
                     kind: 'apps.change',
@@ -419,6 +507,7 @@ VALUES ($1, $2::jsonb, $3, $4, $5, $6)`,
                     details: {
                         by: options.actor,
                         migration: file === null ? null : `${file.version}_${file.name}.sql`,
+                        ...(removed.length === 0 ? {} : { snapshot, drops: prepared.drops }),
                     },
                     ...(options.audit?.ip === undefined ? {} : { ip: options.audit.ip }),
                 }));
@@ -428,6 +517,7 @@ VALUES ($1, $2::jsonb, $3, $4, $5, $6)`,
                 text: 'SELECT pg_notify($1, $2)',
                 params: [APPS_CHANNEL, digestOf(plan.after)],
             });
+            snapshotId = snapshot;
         });
     }
     catch (error) {
@@ -441,5 +531,77 @@ VALUES ($1, $2::jsonb, $3, $4, $5, $6)`,
         enabled: plan.enable,
         disabled: plan.disable.map((m) => m.name),
         upgraded: plan.upgrade.map((u) => u.name),
+        uninstalled: plan.uninstall.map((u) => u.name),
+        snapshot: snapshotId,
     };
 }
+/** Whether a table exists (a failed query would abort the transaction). */
+async function hasTable(tx, table) {
+    const [row] = await tx.query({
+        text: 'SELECT to_regclass($1)::text AS found',
+        params: [`public.${table}`],
+    });
+    return row?.found !== null && row?.found !== undefined;
+}
+/**
+ * After an uninstall's schema change (RFC 0008 §5.4): the modules' records in the models that stay (by external
+ * id; one that others still use is kept and logged), their external ids, their groups and role grants, the runtime
+ * roles' rights on models that went, and Shutro's record of the modules.
+ */
+async function removeModuleData(tx, shutro, prepared, removed) {
+    const models = new Set([...prepared.runtime.registry.models.keys()].map(String));
+    const ids = await tx.query({
+        text: 'SELECT model, res_id::text AS res_id, name FROM shutro_external_id WHERE module = ANY($1)',
+        params: [removed],
+    });
+    for (const row of ids) {
+        if (!models.has(row.model))
+            continue;
+        try {
+            await shutro.bootstrap({ reason: `uninstall: ${row.name}` }, async (env) => {
+                const records = env.model(row.model);
+                await records.browse([Number(row.res_id)]).unlink();
+            });
+        }
+        catch {
+            // Still used by records that stay (a sequence, a category): kept, without its module.
+        }
+    }
+    await tx.query({
+        text: 'DELETE FROM shutro_external_id WHERE module = ANY($1)',
+        params: [removed],
+    });
+    const byName = prepared.before.loaded.byName;
+    const groups = removed.flatMap((n) => (byName.get(n)?.shutro.groups ?? []).map((g) => g.code));
+    const permissions = removed.flatMap((n) => (byName.get(n)?.shutro.permissions ?? []).map((p) => p.code));
+    if (groups.length > 0 && (await hasTable(tx, 'auth_user_group')))
+        await tx.query({
+            text: 'DELETE FROM auth_user_group WHERE "group" = ANY($1)',
+            params: [groups],
+        });
+    const kept = [...models];
+    if (await hasTable(tx, 'shutro_role')) {
+        await tx.query({
+            text: 'UPDATE shutro_role SET implies = array(SELECT g FROM unnest(implies) AS g WHERE NOT (g = ANY($1))) WHERE implies && $1',
+            params: [groups],
+        });
+        await tx.query({
+            text: 'DELETE FROM shutro_role_access WHERE role = ANY($1) OR NOT (model = ANY($2))',
+            params: [groups, kept],
+        });
+        await tx.query({
+            text: 'DELETE FROM shutro_role_rule WHERE role = ANY($1) OR NOT (model = ANY($2))',
+            params: [groups, kept],
+        });
+        await tx.query({
+            text: 'DELETE FROM shutro_role_permission WHERE role = ANY($1) OR permission = ANY($2)',
+            params: [groups, permissions],
+        });
+        await tx.query({
+            text: 'DELETE FROM shutro_role_field WHERE NOT (model = ANY($1))',
+            params: [kept],
+        });
+    }
+    if (await hasTable(tx, 'shutro_module'))
+        await tx.query({ text: 'DELETE FROM shutro_module WHERE name = ANY($1)', params: [removed] });
+}

package/dist/server/auth/base.js

@@ -273,6 +273,8 @@ export const baseShutro = defineModule({
     version: '0.1.0',
     groups: [
         defineGroup({ code: 'base.user', label: 'Internal user' }),
+        // Developer mode (RFC 0031 §3.1): the explain popovers of fields, buttons and models.
+        defineGroup({ code: 'base.developer', label: 'Developer', implies: ['base.user'] }),
         defineGroup({
             code: 'base.admin',
             label: 'Administrator',

package/dist/server/auth/service.d.ts

@@ -50,6 +50,8 @@ export interface UserInfo {
     readonly administrator: boolean;
     /** Administrator rights are withheld until this session has a second factor (enable or verify 2FA). */
     readonly administratorNeedsSecondFactor: boolean;
+    /** May turn on Developer mode (RFC 0031 §3.1): administrators and the `base.developer` group. */
+    readonly developer: boolean;
     /** The policy requires two-factor sign-in of everyone and it is not on: nothing but setting it up is allowed. */
     readonly twoFactorSetupRequired: boolean;
 }
@@ -174,6 +176,12 @@ export declare class AuthService {
     /** Completes a pending sign-in with a TOTP or recovery code (a recovery code works once). */
     verifyTwoFactor(session: SessionInfo, code: string): Promise<void>;
     /** Turns 2FA off (password and a current code required). */
+    /**
+     * A step-up check (RFC 0008 §5.4): the user's current authenticator code, asked again for a dangerous action
+     * (removing an app with its data). Recovery codes do not count. @throws {HttpProblem} 409 when two-factor is off,
+     * 422 when the code does not match
+     */
+    confirmSecondFactor(user: number, code: string): Promise<void>;
     disableTwoFactor(session: SessionInfo, password: string, code: string): Promise<void>;
     /** Changes the password; every other session of the user is revoked. */
     changePassword(session: SessionInfo, current: string, next: string): Promise<void>;