tempest-express-sdk 0.27.0 → 0.28.0

package/dist/index.cjs

@@ -9461,6 +9461,23 @@ function partitionTotal(partition) {
   return partition.segments.reduce((total, segment) => total + segment.value, 0);
 }
 
+// src/admin/inlines.ts
+function adminInline(options) {
+  const slug = options.model.tablename;
+  if (typeof slug !== "string" || slug === "") {
+    throw new Error("adminInline requires a concrete model with a tablename");
+  }
+  return {
+    model: options.model,
+    slug,
+    fkField: options.fkField,
+    listDisplay: options.listDisplay === void 0 ? null : [...options.listDisplay],
+    label: options.label ?? null,
+    editable: options.editable ?? false,
+    canDelete: options.canDelete ?? false
+  };
+}
+
 // src/admin/lenses.ts
 function slugify(name) {
   return name.normalize("NFD").replace(/\p{M}/gu, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "lens";
@@ -9716,6 +9733,8 @@ var AdminModel = class {
   canImport;
   /** Foreign-key columns rendered as a typed search box. */
   autocompleteFields;
+  /** Related child models listed on the detail view. */
+  inlines;
   actions = /* @__PURE__ */ new Map();
   slugOverride;
   listDisplayOverride;
@@ -9747,6 +9766,7 @@ var AdminModel = class {
     this.uploadStorage = options.uploadStorage ?? null;
     this.canImport = options.canImport ?? false;
     this.autocompleteFields = [...options.autocompleteFields ?? []];
+    this.inlines = [...options.inlines ?? []];
     if (this.uploadFields.length > 0 && this.uploadStorage === null) {
       throw new Error(
         `AdminModel(${this.model.tablename}).uploadFields requires an uploadStorage (e.g. LocalUploadStorage / S3UploadStorage) \u2014 without one there is nowhere to write the file.`
@@ -10025,7 +10045,9 @@ function parseFormBody(admin, body, options = {}) {
   const data = {};
   const errors = {};
   const uploads = options.uploadsAsText === true ? /* @__PURE__ */ new Set() : new Set(admin.uploadFields);
+  const only = options.only === void 0 ? null : new Set(options.only);
   for (const name of admin.editableFieldNames()) {
+    if (only !== null && !only.has(name)) continue;
     const column6 = columns[name];
     if (column6 === void 0) continue;
     if (uploads.has(name)) continue;
@@ -12359,10 +12381,97 @@ function renderDetailPage(context, view) {
     </div>
   </header>
   <dl class="tempest-admin-detail__fields">${fields}</dl>
+  ${view.inlines.map((inline) => renderInline(inline, context.session?.csrfToken ?? "", view.inlineError)).join("")}
   ${auditPanel}
 </section>`;
   return renderLayout(context, `${view.title} \xB7 ${view.identity}`, body);
 }
+function renderInlineCell(field) {
+  const required = field.required ? " required" : "";
+  const name = escapeHtml(field.name);
+  const value = escapeHtml(field.value);
+  let control;
+  switch (field.widget) {
+    case "checkbox":
+      control = `<input type="checkbox" name="${name}" value="true"${field.checked ? " checked" : ""}>`;
+      break;
+    case "textarea":
+    case "json":
+      control = `<textarea name="${name}" rows="2"${required}>${value}</textarea>`;
+      break;
+    case "select": {
+      const blank = field.required ? "" : '<option value="">\u2014 none \u2014</option>';
+      const options = field.options.map(
+        (option) => `<option value="${escapeHtml(option.value)}"${option.value === field.value ? " selected" : ""}>${escapeHtml(option.label)}</option>`
+      ).join("");
+      control = `<select name="${name}"${required}>${blank}${options}</select>`;
+      break;
+    }
+    case "number":
+      control = `<input type="number" name="${name}" value="${value}"${field.step !== null ? ` step="${escapeHtml(field.step)}"` : ""}${required}>`;
+      break;
+    case "datetime":
+      control = `<input type="datetime-local" name="${name}" value="${value}"${required}>`;
+      break;
+    case "date":
+      control = `<input type="date" name="${name}" value="${value}"${required}>`;
+      break;
+    case "time":
+      control = `<input type="time" name="${name}" value="${value}"${required}>`;
+      break;
+    default:
+      control = `<input type="text" name="${name}" value="${value}"${required}>`;
+  }
+  const error = field.error !== null ? `<small class="tempest-admin-form__field-error">${escapeHtml(field.error)}</small>` : "";
+  return `${control}${error}`;
+}
+function renderInline(inline, csrfToken, error) {
+  const heading = `<header class="tempest-admin-inline__header">
+      <h2>${escapeHtml(inline.label)}${inline.total > 0 ? ` <span class="tempest-admin-inline__count">(${escapeHtml(inline.total)})</span>` : ""}</h2>
+      ${inline.addUrl !== null ? `<a class="tempest-admin-btn" href="${escapeHtml(inline.addUrl)}">Add</a>` : ""}
+    </header>`;
+  const more = inline.truncated ? `<p class="tempest-admin-inline__more"><em>Showing the first ${escapeHtml(inline.rows.length)} of ${escapeHtml(inline.total)}.</em></p>` : "";
+  if (!inline.editable) {
+    if (inline.rows.length === 0) {
+      return `<section class="tempest-admin-inline">${heading}<p><em>No related records.</em></p></section>`;
+    }
+    const head2 = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}<th></th></tr>`;
+    const body = inline.rows.map(
+      (row) => `<tr>${row.cells.map((cell) => `<td>${escapeHtml(cell)}</td>`).join("")}<td>${row.url === null ? "" : `<a href="${escapeHtml(row.url)}">View</a>`}</td></tr>`
+    ).join("");
+    return `<section class="tempest-admin-inline">
+      ${heading}
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head2}</thead>
+          <tbody>${body}</tbody>
+        </table>
+      </div>
+      ${more}
+    </section>`;
+  }
+  const head = `<tr>${inline.columns.map((column6) => `<th>${escapeHtml(column6)}</th>`).join("")}${inline.canDelete ? "<th>Delete</th>" : ""}</tr>`;
+  const renderRow = (row, isNew) => `<tr${isNew ? ' class="tempest-admin-inline__new"' : ""}>${row.fields.map((field) => `<td>${renderInlineCell(field)}</td>`).join("")}${inline.canDelete ? `<td class="tempest-admin-inline__del">${isNew ? "" : `<input type="checkbox" name="row.${escapeHtml(row.key)}.__delete" value="true">`}</td>` : ""}</tr>`;
+  const rows = inline.rows.map((row) => renderRow(row, false)).join("");
+  const blank = inline.newRow === null ? "" : renderRow(inline.newRow, true);
+  return `<section class="tempest-admin-inline">
+    ${heading}
+    ${error !== null ? `<p class="tempest-admin-form__error">${escapeHtml(error)}</p>` : ""}
+    <form method="post" action="${escapeHtml(inline.formAction)}" class="tempest-admin-inline__form">
+      <input type="hidden" name="csrf_token" value="${escapeHtml(csrfToken)}">
+      <div class="tempest-admin-inline__scroll">
+        <table class="tempest-admin-inline__table">
+          <thead>${head}</thead>
+          <tbody>${rows}${blank}</tbody>
+        </table>
+      </div>
+      <div class="tempest-admin-form__actions">
+        <button type="submit">Save ${escapeHtml(inline.label)}</button>
+      </div>
+    </form>
+    ${more}
+  </section>`;
+}
 function renderAuditPanel(audit) {
   const rows = audit.fields.map(
     (field) => `<dt>${escapeHtml(field.label)}</dt><dd>${field.value === "" ? "<em>\u2014</em>" : escapeHtml(field.value)}</dd>`
@@ -12551,6 +12660,7 @@ var AUTOCOMPLETE_SCRIPT = `<script>
 })();
 </script>`;
 var logger2 = new JSONLogger("tempest_express_sdk.admin.router");
+var INLINE_ROW_LIMIT = 50;
 var AUTOCOMPLETE_LIMIT = 20;
 var AUDIT_HISTORY_LIMIT = 50;
 var FK_OPTION_CAP = 1e3;
@@ -13167,6 +13277,8 @@ function makeAdminRouter(site, options) {
           title: admin.verboseName(),
           identity,
           audit: await buildAuditView(admin, row, state.dbSession),
+          inlines: await buildInlines(admin, row, state, identity),
+          inlineError: null,
           fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(row[name]) })),
           backUrl: `${prefix}/m/${admin.slug()}`,
           editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
@@ -13287,6 +13399,103 @@ function makeAdminRouter(site, options) {
       res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
     })
   );
+  router.post(
+    `${prefix}/m/:slug/:identity/inlines/:child`,
+    guarded(async (req, res) => {
+      const state = await authenticate(req, res);
+      if (state === null) return;
+      const admin = await resolveAdmin(req, res, state);
+      if (admin === null) return;
+      if (!checkCsrf(req, res, state)) return;
+      const childSlug = String(req.params.child);
+      const inline = admin.inlines.find(
+        (entry) => entry.slug === childSlug && entry.editable
+      );
+      const childAdmin = inline === void 0 ? null : site.get(childSlug);
+      if (inline === void 0 || childAdmin === null || !await allows(state.principal, childAdmin, AdminPermission.EDIT)) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const identity = String(req.params.identity);
+      const parent = await findRow(admin, state.dbSession, identity);
+      if (parent === null) {
+        html(res, renderNotFound(context(req, state.session, state.visible)), 404);
+        return;
+      }
+      const parentId = parent[admin.identityField];
+      const { rows: grouped, deletions } = groupInlineSubmission(
+        req.body
+      );
+      const names = inlineFieldNames(childAdmin, inline);
+      const childRepo = childAdmin.repository(state.dbSession);
+      const actorId = backend.principalId(state.principal);
+      const canDelete = inline.canDelete && await allows(state.principal, childAdmin, AdminPermission.DELETE);
+      const failed = [];
+      let formError = null;
+      const owned = async (key) => await childRepo.first({
+        [childAdmin.identityField]: key,
+        [inline.fkField]: parentId
+      });
+      for (const [key, values] of Object.entries(grouped)) {
+        const isNew = key.startsWith("new");
+        if (!isNew && canDelete && deletions.has(key)) {
+          if (await owned(key) !== null) {
+            await childRepo.delete({ [childAdmin.identityField]: key });
+          }
+          continue;
+        }
+        if (isNew && Object.values(values).every((value) => value.trim() === "")) {
+          continue;
+        }
+        const parsed = parseFormBody(childAdmin, values, { only: names });
+        if (Object.keys(parsed.errors).length > 0) {
+          failed.push({ key, values, errors: parsed.errors });
+          continue;
+        }
+        try {
+          if (isNew) {
+            stampActor(childAdmin, parsed.data, actorId, true);
+            await childRepo.create({
+              ...parsed.data,
+              [inline.fkField]: parentId
+            });
+          } else {
+            if (await owned(key) === null) continue;
+            stampActor(childAdmin, parsed.data, actorId, false);
+            await childRepo.update(
+              { [childAdmin.identityField]: key },
+              parsed.data
+            );
+          }
+        } catch (error) {
+          formError = describeWriteFailure(childAdmin, error);
+          failed.push({ key, values, errors: {} });
+        }
+      }
+      if (failed.length > 0) {
+        const fresh = await findRow(admin, state.dbSession, identity) ?? parent;
+        html(
+          res,
+          renderDetailPage(context(req, state.session, state.visible), {
+            title: admin.verboseName(),
+            identity,
+            audit: await buildAuditView(admin, fresh, state.dbSession),
+            inlines: await buildInlines(admin, fresh, state, identity, {
+              [childSlug]: failed
+            }),
+            inlineError: formError ?? "Some inline rows could not be saved.",
+            fields: admin.detailFieldNames().map((name) => ({ label: name, value: formatCellValue(fresh[name]) })),
+            backUrl: `${prefix}/m/${admin.slug()}`,
+            editUrl: await allows(state.principal, admin, AdminPermission.EDIT) ? `${prefix}/m/${admin.slug()}/${identity}/edit` : null,
+            deleteUrl: await allows(state.principal, admin, AdminPermission.DELETE) ? `${prefix}/m/${admin.slug()}/${identity}/delete` : null
+          }),
+          400
+        );
+        return;
+      }
+      res.redirect(`${prefix}/m/${admin.slug()}/${identity}?ok=updated`);
+    })
+  );
   router.post(
     `${prefix}/m/:slug/:identity/delete`,
     guarded(async (req, res) => {
@@ -13308,6 +13517,89 @@ function makeAdminRouter(site, options) {
     const principal = await backend.loadPrincipal(dbSession, String(actor));
     return principal === null ? String(actor) : backend.displayName(principal);
   }
+  async function buildInlines(admin, parent, state, identity, overrides = {}) {
+    const parentId = parent[admin.identityField];
+    const blocks = [];
+    for (const inline of admin.inlines) {
+      const childAdmin = site.get(inline.slug);
+      const repository = childAdmin === null ? new tempestDbJs.BaseRepository(inline.model, state.dbSession) : childAdmin.repository(state.dbSession);
+      const children = await repository.list({
+        [inline.fkField]: parentId
+      });
+      const columns = inline.listDisplay ?? childAdmin?.listDisplayNames() ?? Object.keys(adminColumns(inline.model));
+      const label = inline.label ?? childAdmin?.verboseNamePlural() ?? humanizeField(inline.slug);
+      const visible = children.slice(0, INLINE_ROW_LIMIT);
+      const editable = inline.editable && childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.EDIT);
+      const addUrl = childAdmin !== null && await allows(state.principal, childAdmin, AdminPermission.CREATE) ? `${prefix}/m/${inline.slug}/new` : null;
+      if (!editable || childAdmin === null) {
+        blocks.push({
+          label,
+          total: children.length,
+          columns,
+          editable: false,
+          canDelete: false,
+          addUrl,
+          formAction: "",
+          rows: visible.map((child) => ({
+            key: String(child[childAdmin?.identityField ?? "id"]),
+            cells: columns.map((column6) => formatCellValue(child[column6])),
+            fields: [],
+            url: childAdmin === null ? null : `${prefix}/m/${inline.slug}/${String(child[childAdmin.identityField])}`
+          })),
+          newRow: null,
+          truncated: children.length > visible.length
+        });
+        continue;
+      }
+      const names = inlineFieldNames(childAdmin, inline);
+      const submitted = overrides[inline.slug];
+      const rows = [];
+      if (submitted !== void 0) {
+        for (const entry of submitted) {
+          rows.push({
+            key: entry.key,
+            cells: [],
+            fields: inlineFields(
+              childAdmin,
+              names,
+              entry.key,
+              entry.values,
+              entry.errors
+            ),
+            url: null
+          });
+        }
+      } else {
+        for (const child of visible) {
+          const key = String(child[childAdmin.identityField]);
+          rows.push({
+            key,
+            cells: [],
+            fields: inlineFields(childAdmin, names, key, child, {}),
+            url: `${prefix}/m/${inline.slug}/${key}`
+          });
+        }
+      }
+      blocks.push({
+        label,
+        total: children.length,
+        columns: names.map(humanizeField),
+        editable: true,
+        canDelete: inline.canDelete && childAdmin.canDelete,
+        addUrl,
+        formAction: `${prefix}/m/${admin.slug()}/${identity}/inlines/${inline.slug}`,
+        rows,
+        newRow: {
+          key: "new1",
+          cells: [],
+          fields: inlineFields(childAdmin, names, "new1", {}, {}),
+          url: null
+        },
+        truncated: children.length > visible.length
+      });
+    }
+    return blocks;
+  }
   async function buildAuditView(admin, row, dbSession) {
     const fields = [];
     for (const name of admin.auditFieldNames()) {
@@ -13606,6 +13898,35 @@ function makeAdminRouter(site, options) {
   }
   return router;
 }
+function groupInlineSubmission(body) {
+  const rows = {};
+  const deletions = /* @__PURE__ */ new Set();
+  for (const [key, raw] of Object.entries(body)) {
+    if (!key.startsWith("row.")) continue;
+    const parts = key.split(".");
+    if (parts.length !== 3) continue;
+    const [, rowKey, field] = parts;
+    const value = typeof raw === "string" ? raw : "";
+    if (field === "__delete") {
+      if (!["", "false", "off", "0", "no"].includes(value.trim().toLowerCase())) {
+        deletions.add(rowKey);
+      }
+      continue;
+    }
+    const row = rows[rowKey] ?? {};
+    row[field] = value;
+    rows[rowKey] = row;
+  }
+  return { rows, deletions };
+}
+function inlineFieldNames(childAdmin, inline) {
+  return childAdmin.editableFieldNames().filter(
+    (name) => name !== inline.fkField && !childAdmin.uploadFields.includes(name) && !childAdmin.autocompleteFields.includes(name)
+  );
+}
+function inlineFields(childAdmin, names, key, values, errors) {
+  return buildFormFields(childAdmin, { values, errors }).filter((field) => names.includes(field.name)).map((field) => ({ ...field, name: `row.${key}.${field.name}` }));
+}
 function flagAllows(admin, action) {
   if (action === AdminPermission.CREATE) return admin.canCreate;
   if (action === AdminPermission.EDIT) return admin.canEdit;
@@ -15777,7 +16098,7 @@ async function withTestDatabase(models, fn) {
 }
 
 // src/version.ts
-var VERSION = "0.27.0";
+var VERSION = "0.28.0";
 
 Object.defineProperty(exports, "OpenAPIRegistry", {
   enumerable: true,
@@ -16037,6 +16358,7 @@ exports.activationSchema = activationSchema;
 exports.addLogSink = addLogSink;
 exports.adminAction = adminAction;
 exports.adminColumns = adminColumns;
+exports.adminInline = adminInline;
 exports.adminLens = adminLens;
 exports.adminThemeCss = adminThemeCss;
 exports.attachWebSocketHub = attachWebSocketHub;
@@ -16098,6 +16420,7 @@ exports.getConditions = getConditions;
 exports.getPaginationConditions = getPaginationConditions;
 exports.getRequestId = getRequestId;
 exports.getState = getState;
+exports.groupInlineSubmission = groupInlineSubmission;
 exports.hashOpaqueToken = hashOpaqueToken;
 exports.hexColorField = hexColorField;
 exports.humanizeField = humanizeField;