logaritmisk/biggus-dickus
1
0
Fork 0
Code Issues 17 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: edit/delete field definitions — audited, blocked when in use (#36)

Browse Source 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Anders Olsson
2026-06-05 19:58:38 +02:00
parent 47240dafcc
commit 3e7c6ad712
5 changed files with 540 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/api/src/admin_objects.rs
+132 -1
View File
@@ -6,7 +6,7 @@ use axum::{
Json, Router,
extract::{Path, Query, State},
http::StatusCode,
response::IntoResponse,
response::{IntoResponse, Response},
routing::{get, put},
};
use domain::{
@@ -510,6 +510,133 @@ pub(crate) async fn create_field_definition(
}
}
/// Fields that may be changed on an existing field definition. `key`, `data_type`, and
/// binding are immutable and intentionally absent from this request.
#[derive(Deserialize, ToSchema)]
pub(crate) struct UpdateFieldDefinitionRequest {
pub required: bool,
pub group: Option<String>,
pub labels: Vec<LabelInput>,
}
/// Update a field definition's mutable attributes (labels, group, required).
/// `key`, `data_type`, and binding are immutable. Requires `EditCatalogue`.
#[utoipa::path(
patch, path = "/api/admin/field-definitions/{key}",
request_body = UpdateFieldDefinitionRequest,
params(("key" = String, Path, description = "Field definition key")),
responses(
(status = 204),
(status = 401),
(status = 403),
(status = 404),
(status = 422, description = "CHECK constraint violated (e.g. empty label)")
)
)]
pub(crate) async fn update_field_definition(
auth: Authorized<EditCatalogue>,
State(state): State<AppState>,
Path(key): Path<String>,
Json(req): Json<UpdateFieldDefinitionRequest>,
) -> Result<StatusCode, StatusCode> {
let labels: Vec<LocalizedLabel> = req
.labels
.into_iter()
.map(|l| LocalizedLabel {
lang: l.lang,
label: l.label,
})
.collect();
let mut tx = state
.db
.pool()
.begin()
.await
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
let result = db::fields::update_field_definition(
&mut tx,
actor(&auth.user),
&key,
req.required,
req.group.as_deref(),
&labels,
)
.await;
match result {
Ok(true) => {
tx.commit()
.await
.map_err(|_| StatusCode::INTERNAL_SERVER_ERROR)?;
Ok(StatusCode::NO_CONTENT)
}
Ok(false) => {
let _ = tx.rollback().await;
Err(StatusCode::NOT_FOUND)
}
Err(err) => {
let _ = tx.rollback().await;
match err.as_database_error().and_then(|e| e.code()).as_deref() {
Some("23514") => Err(StatusCode::UNPROCESSABLE_ENTITY),
_ => Err(StatusCode::INTERNAL_SERVER_ERROR),
}
}
}
}
/// Delete a field definition. Blocked (409) when catalogue objects store a value under
/// this key. Requires `EditCatalogue`.
#[utoipa::path(
delete, path = "/api/admin/field-definitions/{key}",
params(("key" = String, Path, description = "Field definition key")),
responses(
(status = 204),
(status = 401),
(status = 403),
(status = 404),
(status = 409, body = crate::admin_vocab::InUseView,
description = "Field is used by catalogue objects")
)
)]
pub(crate) async fn delete_field_definition(
auth: Authorized<EditCatalogue>,
State(state): State<AppState>,
Path(key): Path<String>,
) -> Response {
use crate::admin_vocab::InUseView;
let Ok(mut tx) = state.db.pool().begin().await else {
return StatusCode::INTERNAL_SERVER_ERROR.into_response();
};
match db::fields::delete_field_definition(&mut tx, actor(&auth.user), &key).await {
Ok(db::DeleteOutcome::Deleted) => match tx.commit().await {
Ok(()) => StatusCode::NO_CONTENT.into_response(),
Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
},
Ok(db::DeleteOutcome::InUse { count }) => {
let _ = tx.rollback().await;
(StatusCode::CONFLICT, Json(InUseView { count })).into_response()
}
Ok(db::DeleteOutcome::NotFound) => {
let _ = tx.rollback().await;
StatusCode::NOT_FOUND.into_response()
}
Err(_) => {
let _ = tx.rollback().await;
StatusCode::INTERNAL_SERVER_ERROR.into_response()
}
}
}
/// Field-level rejection detail for `set_fields`, so the UI can highlight the field.
#[derive(Serialize, ToSchema)]
pub(crate) struct FieldErrorView {
@@ -609,4 +736,8 @@ pub(crate) fn routes() -> Router<AppState> {
"/api/admin/field-definitions",
get(list_field_definitions).post(create_field_definition),
)
.route(
"/api/admin/field-definitions/{key}",
axum::routing::patch(update_field_definition).delete(delete_field_definition),
)
}
crates/api/src/openapi.rs
+3
View File
@@ -26,6 +26,8 @@ use crate::{
admin_objects::delete_object,
admin_objects::list_field_definitions,
admin_objects::create_field_definition,
admin_objects::update_field_definition,
admin_objects::delete_field_definition,
admin_objects::set_fields,
admin_vocab::list_vocabularies,
admin_vocab::create_vocabulary,
@@ -58,6 +60,7 @@ use crate::{
admin_objects::CreatedObject,
admin_objects::FieldDefinitionView,
admin_objects::NewFieldDefinitionRequest,
admin_objects::UpdateFieldDefinitionRequest,
admin_objects::CreatedField,
admin_objects::FieldErrorView,
admin_vocab::VocabularyView,
crates/api/tests/admin_catalog.rs
+164
View File
@@ -714,3 +714,167 @@ async fn edit_and_delete_authority(pool: PgPool) {
.await;
assert_eq!(deleted.status(), StatusCode::NO_CONTENT);
}
#[sqlx::test(migrations = "../db/migrations")]
async fn edit_and_delete_field_definition(pool: PgPool) {
migrate_sessions(&db::Db::from_pool(pool.clone()))
.await
.unwrap();
seed_user(&pool, "ed@example.com", "pw-editor-123", Role::Editor).await;
let app = build_app(state(pool));
let cookie = login(&app, "ed@example.com", "pw-editor-123").await;
// create a field definition
send(
&app,
&cookie,
"POST",
"/api/admin/field-definitions",
Some(r#"{"key":"weight","data_type":"integer","vocabulary_id":null,"authority_kind":null,"required":false,"group":null,"labels":[{"lang":"sv","label":"Vikt"}]}"#),
)
.await;
// PATCH: update required + group + labels
let patched = send(
&app,
&cookie,
"PATCH",
"/api/admin/field-definitions/weight",
Some(r#"{"required":true,"group":"Mått","labels":[{"lang":"sv","label":"Vikt (g)"}]}"#),
)
.await;
assert_eq!(patched.status(), StatusCode::NO_CONTENT);
// PATCH unknown key → 404
let missing = send(
&app,
&cookie,
"PATCH",
"/api/admin/field-definitions/nope",
Some(r#"{"required":false,"group":null,"labels":[]}"#),
)
.await;
assert_eq!(missing.status(), StatusCode::NOT_FOUND);
// DELETE the (unreferenced) field definition
let deleted = send(
&app,
&cookie,
"DELETE",
"/api/admin/field-definitions/weight",
None,
)
.await;
assert_eq!(deleted.status(), StatusCode::NO_CONTENT);
// DELETE again → 404
let again = send(
&app,
&cookie,
"DELETE",
"/api/admin/field-definitions/weight",
None,
)
.await;
assert_eq!(again.status(), StatusCode::NOT_FOUND);
}
#[sqlx::test(migrations = "../db/migrations")]
async fn delete_field_definition_referenced_is_409(pool: PgPool) {
migrate_sessions(&db::Db::from_pool(pool.clone()))
.await
.unwrap();
seed_user(&pool, "ed@example.com", "pw-editor-123", Role::Editor).await;
let app = build_app(state(pool));
let cookie = login(&app, "ed@example.com", "pw-editor-123").await;
// create a field definition
send(
&app,
&cookie,
"POST",
"/api/admin/field-definitions",
Some(r#"{"key":"weight","data_type":"integer","vocabulary_id":null,"authority_kind":null,"required":false,"group":null,"labels":[{"lang":"sv","label":"Vikt"}]}"#),
)
.await;
// create an object and set the field
let obj = send(
&app,
&cookie,
"POST",
"/api/admin/objects",
Some(r#"{"object_number":"T-2","object_name":"test","number_of_objects":1,"visibility":"draft"}"#),
)
.await;
assert_eq!(obj.status(), StatusCode::CREATED);
let obj_json: serde_json::Value =
serde_json::from_slice(&obj.into_body().collect().await.unwrap().to_bytes()).unwrap();
let obj_id = obj_json["id"].as_str().unwrap().to_owned();
let set = send(
&app,
&cookie,
"PUT",
&format!("/api/admin/objects/{obj_id}/fields"),
Some(r#"{"weight":42}"#),
)
.await;
assert_eq!(set.status(), StatusCode::NO_CONTENT);
// delete the field definition — must be blocked
let blocked = send(
&app,
&cookie,
"DELETE",
"/api/admin/field-definitions/weight",
None,
)
.await;
assert_eq!(blocked.status(), StatusCode::CONFLICT);
let body: serde_json::Value =
serde_json::from_slice(&blocked.into_body().collect().await.unwrap().to_bytes()).unwrap();
assert_eq!(body["count"], 1);
}
#[sqlx::test(migrations = "../db/migrations")]
async fn field_definition_edit_delete_requires_auth(pool: PgPool) {
migrate_sessions(&db::Db::from_pool(pool.clone()))
.await
.unwrap();
let app = build_app(state(pool));
let patch_resp = app
.clone()
.oneshot(
Request::builder()
.method("PATCH")
.uri("/api/admin/field-definitions/weight")
.header(header::CONTENT_TYPE, "application/json")
.body(Body::from(r#"{"required":false,"group":null,"labels":[]}"#))
.unwrap(),
)
.await
.unwrap();
assert_eq!(patch_resp.status(), StatusCode::UNAUTHORIZED);
let delete_resp = app
.clone()
.oneshot(
Request::builder()
.method("DELETE")
.uri("/api/admin/field-definitions/weight")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(delete_resp.status(), StatusCode::UNAUTHORIZED);
}