fix(ui): make mirrored-artefact edit form read-only except local access#6
Merged
Conversation
Editing a mirrored artefact (one with `origin`) could not save a privateAccess/public change: the form always PATCHed the full body, and the API rejects any non-access field on a mirror with 403. The metadata form was also fully editable even though the remote registry owns it. - artefact schema: add mirror-aware VJSF `layout.if` expressions keyed on context.mirrored / context.accessOnly so remote-owned fields show read-only and hide from the access-only form (and vice-versa); regenerate the vjsf-patch-req components. - artefact-admin.vue: render remote-owned metadata read-only for mirrors with an explanatory notice; restrict the editable form + PATCH body to public/privateAccess on a mirror. - adopt @data-fair/lib-vue helpers (edit-fetch pattern): unify the diff and PATCH body through a normalized buildPayload, compute hasDiff with fast-deep-equal, keep the payload reference stable via computedDeepDiff, and add useLeaveGuard for an unsaved-changes warning. - tests: e2e coverage for the mirror read-only/save behaviour and the leave guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On a mirrored artefact (
originset) the remote registry owns the metadata; only local access (public/privateAccess) may be patched. The edit form previously sent every field on save and the API answered 403.What changed:
public/privateAccessvia new VJSFcontextflags (mirrored/accessOnly).computedDeepDiff+fast-deep-equaland added an unsaved-changes leave guard (useLeaveGuard).Why: mirrored artefacts could not have their local access toggled — saving hit a 403 because the form posted remote-owned fields.
Regression risks:
buildPayloadinstead of spreadingeditData; field set is equivalent but worth confirming the normal metadata-edit path still round-trips.