add admin validation

Author: Arlen22

ARCHITECTURE.md

@@ -54,7 +54,7 @@ Depending on server and template configuration, plugin assets and store data may
 
 The admin surface manages wikis, templates, bags, users, and roles. In this model, a wiki is the editable public resource, a template is the reusable shared definition, and a bag is the underlying storage unit.
 
-Saving a wiki or template changes the configuration that future runtime requests use. Template changes affect every wiki that depends on that template. Bag changes affect where titles are stored and resolved.
+Saving a wiki or template changes the configuration that future runtime requests use. Template changes affect every wiki that depends on that template.
 
 Plugin entries are exposed through the admin load path so they can be selected and inspected, but this path does not treat plugins as editable database rows in the same way as wikis, templates, bags, users, and roles.
 
@@ -122,6 +122,5 @@ These are the hooks that run on startup. The listen command starts the server an
 
 ## Todo
 
-- server input validation: all the pieces are there, I just need to wire it up.
-- make commands easier to extend, probably just by making it easier to specify a list of commands via javascript. 
-- clean up my spaghetti code into nice straight rows of pasta.
+- improve the small screen form factor for the admin UI
+- make sure all the descriptions and labels make sense

packages/admin-vanilla/src/app.tsx

@@ -323,6 +323,7 @@ class PerTabStoreImpl implements PerTabStore {
     });
 
     const item = await this.storage.read(tabId, recordId).catch((error) => {
+      console.log(error);
       this.patchState({
         storageError: error instanceof Error ? error.message : "Failed to load record details.",
       });
@@ -426,6 +427,7 @@ class PerTabStoreImpl implements PerTabStore {
       snapshot.tabId,
       snapshot.draft,
     ).catch((error) => {
+      console.log(error);
       this.patchState({
         storageError: error instanceof Error ? error.message : "Failed to save record.",
       });

packages/admin-vanilla/src/definition/store.ts

@@ -283,7 +283,7 @@ function syncWikiRecord(draft: DataStore["wikis"][number], data: DataStore) {
 
   const mergedReadonlyBags = uniqueLines([...wikiReadonlyBags, ...templateReadonlyBags].map(e => e));
   const mergedPlugins = buildEffectivePluginSet({
-    previousEffectivePlugins: (draft as WikiAdminRecord).effectivePluginSet,
+    previousEffectivePlugins: draft.effectivePluginSet,
     templatePlugins,
     wikiPlugins,
     corePluginsEnabled: !!templateRecord?.requiredPluginsEnabled,

packages/admin-vanilla/src/definition/tabs.ts

@@ -55,41 +55,44 @@ export type FieldType =
   | "metadata-table";
 
 
+export class IdString extends String {
+  static cast(val: IdString): string { return val.toString(); }
+  static prefix = "IdString____";
+  name = "IdString" as const;
+  constructor(value: string) { super(value); }
+  toJSON() { return IdString.prefix + this.valueOf(); }
+}
 
-const stringLikeFieldShape = z.union([z.string(), z.instanceof(String)]);
-const stringListFieldShape = z.array(stringLikeFieldShape);
-const writablePrefixRowFieldShape = z.object({
-  prefix: z.string(),
-  bagName: stringLikeFieldShape,
-});
-const permissionRowFieldShape = z.object({
-  role: stringLikeFieldShape,
-  level: z.string(),
-});
-
+const stringLikeFieldShape = z.union([z.string(), z.instanceof(IdString)]);
 
 export const fieldTypeZodShapes = {
   "template-type": z.enum(["simpleV1"]),
   "string": z.string(),
   "text": z.string(),
   "enter-password": z.string(),
   "confirm-password": z.string(),
-  "search": z.union([stringLikeFieldShape, z.null()]),
+  "search": z.string(),
   "structured-preview": z.string(),
-  "table": stringListFieldShape,
-  "permission-table": z.array(permissionRowFieldShape),
+  "table": z.string().array(),
+  "permission-table": z.array(z.object({
+    role: z.string(),
+    level: z.string(),
+  })),
   "validation-report": z.string(),
   "resolver-preview": z.string(),
-  "search-multiselect": stringListFieldShape,
-  "prefix-table": z.array(writablePrefixRowFieldShape),
-  "parameter-list": stringListFieldShape,
-  "relationship-table": stringListFieldShape,
-  "summary-list": stringListFieldShape,
+  "search-multiselect": z.string().array(),
+  "prefix-table": z.array(z.object({
+    prefix: z.string(),
+    bagName: z.string(),
+  })),
+  "parameter-list": z.string().array(),
+  "relationship-table": z.string().array(),
+  "summary-list": z.string().array(),
   "number": z.string(),
-  "activity-feed": stringListFieldShape,
+  "activity-feed": z.string().array(),
   "version": z.string(),
   "select": z.boolean(),
-  "metadata-table": stringListFieldShape,
+  "metadata-table": z.string().array(),
 } satisfies Record<FieldType, any>;
 
 export type FieldTypeCreateValue<T extends FieldType = FieldType> = z.infer<(typeof fieldTypeZodShapes)[T]>;
@@ -100,7 +103,7 @@ export const fieldTypeCreateFactories = {
   "text": () => "",
   "enter-password": () => "",
   "confirm-password": () => "",
-  "search": () => null,
+  "search": () => "",
   "structured-preview": () => "",
   "table": () => [],
   "permission-table": () => [],
@@ -773,13 +776,6 @@ export interface KeyValueRow {
 }
 
 
-export class IdString extends String {
-  static cast(val: IdString): string { return val.toString(); }
-  static prefix = "IdString____";
-  name = "IdString" as const;
-  constructor(value: string) { super(value); }
-  toJSON() { return IdString.prefix + this.valueOf(); }
-}
 // export class string extends String {
 //   static cast(val: string): string { return val; }
 //   static prefix = "KeyString____";
@@ -806,12 +802,7 @@ export function buildTabZodObject<T extends TabId>(tabId: T, filter?: TabZodObje
   const tab = tabs[tabId];
   const fieldEntries = tab.fields
     .filter((field) => shouldIncludeFieldInTabZodObject(field.mode, filter))
-    .map((field) => [
-      field.key,
-      // KeyFields[tabId] === field.key
-      //   ? z.instanceof(KeyString)
-      fieldTypeZodShapes[field.type]
-    ] as const);
+    .map((field) => [field.key, fieldTypeZodShapes[field.type]] as const);
 
   return z.object({
     id: stringLikeFieldShape,

packages/mws/src/new-managers/TabDataAdapter.ts

@@ -14,6 +14,7 @@ import {
   SendError,
   ServerRequest,
   Z2,
+  zod,
   zodRoute
 } from "@tiddlywiki/server";
 import {
@@ -77,11 +78,6 @@ export type {
   UpsertUserInput,
 } from "./wiki-contract";
 export {
-  importBags,
-  importRecipes,
-  importRoles,
-  importTemplates,
-  importUsers,
   type ImportedBagRows,
   type ImportedRecipeRows,
   type ImportedRoleRows,
@@ -541,14 +537,14 @@ export const AdminSave = zodRoute({
     state.data = JSON.parse(JSON.stringify(state.data), (key: any, val: any) => {
       if (typeof val === "string" && val.startsWith(IdString.prefix))
         return new IdString(val.slice(IdString.prefix.length));
-      if (typeof val === "string" && val.startsWith("KeyString____"))
-        return val.slice("KeyString____".length);
+      // if (typeof val === "string" && val.startsWith("KeyString____"))
+      //   return val.slice("KeyString____".length);
       return val;
     });
 
     checkData(state, () => buildTabZodObject(state.pathParams.tab, "DataSave"), new Error());
 
-    return await state.$transaction(async prisma => {
+    const res = await state.$transaction(async prisma => {
       const { pathParams: { op, tab }, data } = state;
       if (op !== "save") throw new Error(`Unsupported admin operation: ${op}`);
       switch (tab) {
@@ -574,6 +570,10 @@ export const AdminSave = zodRoute({
         }
       }
     });
+
+    const { success, data: res2, error } = buildTabZodObject(state.pathParams.tab, "DataStore").safeParse(res);
+    if (!success) console.log("Response validation: ", error);
+    return res2;
   }
 });
 
@@ -586,7 +586,7 @@ export const AdminLoad = zodRoute({
   inner: async (state) => {
     // access is checked in each list
     state.asserted = state.user.isLoggedIn;
-    return await state.$transaction(async prisma => {
+    const res = await state.$transaction(async prisma => {
       const roles = await new RoleImportWriter(prisma, false).getIdMapper();
       return {
         wikis: await new RecipeDataAdapter(state.user).getList(prisma, roles),
@@ -602,5 +602,15 @@ export const AdminLoad = zodRoute({
         users: await new UserDataAdapter(state.user).getList(prisma, roles),
       };
     });
+    const { success, data, error } = zod.object({
+      wikis: buildTabZodObject("wikis", "DataStore").array(),
+      templates: buildTabZodObject("templates", "DataStore").array(),
+      bags: buildTabZodObject("bags", "DataStore").array(),
+      plugins: buildTabZodObject("plugins", "DataStore").array(),
+      roles: buildTabZodObject("roles", "DataStore").array(),
+      users: buildTabZodObject("users", "DataStore").array(),
+    }).safeParse(res);
+    if (!success) throw error;
+    return data;
   }
 });

packages/mws/src/new-managers/TabImportWriter.ts

@@ -398,7 +398,6 @@ export class RecipeImportWriter extends PerClassImportWriter<"recipe"> {
     this.assertPermissions();
     const upserter = async (recipe: UpsertRecipeInput, compiledAt: Date) => {
       recipe.compiledBags.sort((a, b) => a.priority - b.priority);
-      console.log(recipe.compiledBags);
       return await this.tx.recipe.upsert({
         where: { slug: recipe.slug },
         update: {
@@ -511,41 +510,6 @@ export class RecipeImportWriter extends PerClassImportWriter<"recipe"> {
 }
 // #region OTHER
 
-export function importRoles(prisma: PrismaEngineClient, roles: UpsertRoleInput[], initStore = false) {
-  return prisma.$transaction(async (tx) => {
-    const importer = new RoleImportWriter(tx, initStore);
-    return importer.upsert(roles);
-  });
-}
-
-export function importUsers(prisma: PrismaEngineClient, users: UpsertUserInput[], initStore = false) {
-  return prisma.$transaction(async (tx) => {
-    const importer = new UserImportWriter(tx, initStore);
-    return importer.upsert(users);
-  });
-}
-
-export function importBags(prisma: PrismaEngineClient, bags: UpsertBagInput[], initStore = false) {
-  return prisma.$transaction(async (tx) => {
-    const importer = new BagImportWriter(tx, initStore);
-    return importer.upsert(bags);
-  });
-}
-
-export function importTemplates(prisma: PrismaEngineClient, templates: UpsertTemplateInput[], initStore = false) {
-  return prisma.$transaction(async (tx) => {
-    const importer = new TemplateImportWriter(tx, initStore);
-    return importer.upsert(templates);
-  });
-}
-
-export function importRecipes(prisma: PrismaEngineClient, recipes: UpsertRecipeInput[], initStore = false) {
-  return prisma.$transaction(async (tx) => {
-    const importer = new RecipeImportWriter(tx, initStore);
-    return importer.upsert(recipes);
-  });
-}
-
 export function toMappingRows(obj: Record<string, string>) {
   return Object.entries(obj).map(([prefix, bagName]) => ({ prefix, bagName }));
 }