golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(10-02): relation field options and relation saves with labels

Browse Source 
- FieldRelationContract/FieldRelationProvider bind every type: relation
  field to a belongsTo foreign key or a belongsToMany pivot; activation
  fails naming plugin, controller and field on a missing or broken contract
- GET /{vendor}/{plugin}/{controller}/fields/{field}/options serves
  {value, label} pages scoped by pact.RelationExtendOptionsQuery, behind
  the controller permission; read-only and non-relation fields are 404
- Saves apply present relation keys after the Before hook: ids are
  revalidated through the same scoped query (422 and full rollback
  otherwise), belongsTo sets the foreign key, belongsToMany replaces pivot
  rows in submitted order with the order column set to the index
- Show, create and update return relation values in data and meta.labels
- A belongsTo on a protected fill key is read-only (D-26)
- One six-segment GET pattern dispatches relation lists and field options,
  which ServeMux cannot register side by side
- Admin OpenAPI documents the options route and RecordEnvelope
This commit is contained in:
Jakub Zych
2026-09-27 16:00:52 +02:00
parent e9b48d4720
commit fe04dbc89e
14 changed files with 1969 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
cabana/security_coverage_test.go
View File

@@ -12,46 +12,61 @@ import (
"git.golem15.com/golem15/summercms/pact"
)
// phase09Routes is the admin surface mounted by service.mount. API keys are
// method plus the path relative to {backend.uri}/api/v1 (D-03); spa entries
// are the public SPA shell routes relative to {backend.uri} and are not part
// of the OpenAPI inventory. A handler added outside this set, or a protected
// handler missing the backend guard, fails TestPhase09PermissionMatrix.
var phase09Routes = []struct {
key string
public bool
spa bool
}{
{"POST /auth/login", true, false},
{"POST /auth/refresh", true, false},
{"POST /auth/logout", false, false},
{"GET /auth/me", false, false},
{"GET /navigation", false, false},
{"GET /settings", false, false},
{"GET /settings/{code}/schema", false, false},
{"GET /settings/{code}", false, false},
{"PUT /settings/{code}", false, false},
{"GET /{vendor}/{plugin}/{controller}/schema/list", false, false},
{"GET /{vendor}/{plugin}/{controller}/schema/form", false, false},
{"GET /{vendor}/{plugin}/{controller}/schema/relation/{name}", false, false},
{"GET /{vendor}/{plugin}/{controller}", false, false},
{"POST /{vendor}/{plugin}/{controller}", false, false},
{"POST /{vendor}/{plugin}/{controller}/bulk-delete", false, false},
{"GET /{vendor}/{plugin}/{controller}/{id}", false, false},
{"PUT /{vendor}/{plugin}/{controller}/{id}", false, false},
{"DELETE /{vendor}/{plugin}/{controller}/{id}", false, false},
{"GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}", false, false},
{"GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}/candidates", false, false},
{"POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/link", false, false},
{"POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/unlink", false, false},
{"GET ", true, true},
{"GET /{path...}", true, true},
// adminRoute is one logical admin route. key is method plus the path relative
// to {backend.uri}/api/v1 (D-03); spa entries are the public SPA shell routes
// relative to {backend.uri} and are not part of the OpenAPI inventory.
// mounted, when set, is the relative ServeMux key that serves the route:
// logical routes ServeMux cannot hold side by side share one dispatching
// pattern (service.nestedGet).
type adminRoute struct {
key string
public bool
spa bool
mounted string
}
// nestedGetRoute is the shared six-segment GET pattern.
const nestedGetRoute = "GET /{vendor}/{plugin}/{controller}/{id}/{segment}/{name}"
// phase09Routes is the admin surface mounted by service.mount. A handler added
// outside this set, or a protected handler missing the backend guard, fails
// TestPhase09PermissionMatrix.
var phase09Routes = []adminRoute{
{key: "POST /auth/login", public: true},
{key: "POST /auth/refresh", public: true},
{key: "POST /auth/logout"},
{key: "GET /auth/me"},
{key: "GET /navigation"},
{key: "GET /settings"},
{key: "GET /settings/{code}/schema"},
{key: "GET /settings/{code}"},
{key: "PUT /settings/{code}"},
{key: "GET /{vendor}/{plugin}/{controller}/schema/list"},
{key: "GET /{vendor}/{plugin}/{controller}/schema/form"},
{key: "GET /{vendor}/{plugin}/{controller}/schema/relation/{name}"},
{key: "GET /{vendor}/{plugin}/{controller}/fields/{field}/options", mounted: nestedGetRoute},
{key: "GET /{vendor}/{plugin}/{controller}"},
{key: "POST /{vendor}/{plugin}/{controller}"},
{key: "POST /{vendor}/{plugin}/{controller}/bulk-delete"},
{key: "GET /{vendor}/{plugin}/{controller}/{id}"},
{key: "PUT /{vendor}/{plugin}/{controller}/{id}"},
{key: "DELETE /{vendor}/{plugin}/{controller}/{id}"},
{key: "GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}", mounted: nestedGetRoute},
{key: "GET /{vendor}/{plugin}/{controller}/{id}/relations/{name}/candidates"},
{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/link"},
{key: "POST /{vendor}/{plugin}/{controller}/{id}/relations/{name}/unlink"},
{key: "GET ", public: true, spa: true},
{key: "GET /{path...}", public: true, spa: true},
}
// mountedKey is the full mounted route key for an inventory entry.
func mountedKey(key string, spa bool) string {
func mountedKey(route adminRoute) string {
key := route.key
if route.mounted != "" {
key = route.mounted
}
method, rel, _ := strings.Cut(key, " ")
if spa {
if route.spa {
return method + " " + DefaultAdminPrefix + rel
}
return method + " " + adminAPI(rel)
@@ -67,11 +82,15 @@ func TestPhase09PermissionMatrix(t *testing.T) {
}
got[key] = router.middleware[key]
}
if len(got) != len(phase09Routes) {
t.Fatalf("mounted %d admin routes, want %d: %#v", len(got), len(phase09Routes), router.routes)
want := map[string]bool{}
for _, route := range phase09Routes {
want[mountedKey(route)] = true
}
if len(got) != len(want) {
t.Fatalf("mounted %d admin routes, want %d: %#v", len(got), len(want), router.routes)
}
for _, route := range phase09Routes {
key := mountedKey(route.key, route.spa)
key := mountedKey(route)
mw, ok := got[key]
if !ok {
t.Fatalf("missing mounted route %s in %v", key, router.routes)
@@ -250,6 +269,8 @@ func phase09ProtectedCalls() []phase09Call {
{"form-schema", (*service).formSchema},
{"relation-schema", (*service).relationSchema},
{"relation-linked", (*service).relationLinked},
{"field-options", (*service).fieldOptions},
{"nested-get", (*service).nestedGet},
{"relation-candidates", (*service).relationCandidates},
{"relation-link", (*service).relationLink},
{"relation-unlink", (*service).relationUnlink},
@@ -278,6 +299,7 @@ func phase09Request(principal *bouncer.Principal) *http.Request {
req.SetPathValue("controller", "widgets")
req.SetPathValue("id", "1")
req.SetPathValue("name", "editors")
req.SetPathValue("segment", "relations")
req.SetPathValue("code", "demo")
if principal != nil {
req = req.WithContext(bouncer.WithUser(req.Context(), principal))