add table is better now

web/src/pages/add_table/loader.rs

@@ -1,22 +1,27 @@
 use axum::http::HeaderMap;
 
 use crate::{
-    AppState,
-    auth::GetAuthorizationRequest,
-    definitions::common::Empty,
+    AppState, auth::GetAuthorizationRequest, definitions::common::Empty,
     services::authenticated_request,
 };
 
-use super::state::{AddTablePageState, CreateTableForm};
+use super::{draft::TableDraft, state::AddTablePageState};
 
+/// Loads everything the builder needs around the draft: the profiles that can
+/// be picked, and — for whichever profile the table will belong to — the tables
+/// that are link targets and the names the new table may not reuse.
+///
+/// The link targets and reserved names always come from the live profile tree,
+/// never from the posted form, so they cannot be spoofed by a crafted request.
 pub(crate) async fn load_page(
     state: AppState,
     headers: &HeaderMap,
-    form: CreateTableForm,
+    mut draft: TableDraft,
+    status: Option<String>,
     error: Option<String>,
 ) -> Result<AddTablePageState, LoadError> {
-    let authorization_request =
-        authenticated_request(headers, GetAuthorizationRequest {}).map_err(|_| LoadError::Unauthenticated)?;
+    let authorization_request = authenticated_request(headers, GetAuthorizationRequest {})
+        .map_err(|_| LoadError::Unauthenticated)?;
     let mut auth = state.auth;
     let authorization = auth
         .get_authorization(authorization_request)
@@ -38,10 +43,41 @@ pub(crate) async fn load_page(
         .await
         .map_err(|error| LoadError::Backend(error.message().to_string()))?
         .into_inner();
+
+    let effective_profile = draft.effective_profile_name();
+    match tree
+        .profiles
+        .iter()
+        .find(|profile| profile.name == effective_profile)
+    {
+        // An existing profile: its tables are the link targets, and their
+        // names are reserved against duplicate table creation.
+        Some(profile) => {
+            let table_names = profile
+                .tables
+                .iter()
+                .filter(|table| table.name != "accounts")
+                .map(|table| table.name.clone())
+                .collect::<Vec<_>>();
+            draft.existing_profile_tables = table_names.clone();
+            draft.set_available_relation_tables(table_names);
+        }
+        // A brand-new (or not-yet-named) profile has nothing to link to.
+        None => {
+            draft.existing_profile_tables.clear();
+            draft.links.clear();
+        }
+    }
+
     Ok(AddTablePageState {
         nav: crate::ui::Nav::new(headers, "admin").with_role(authorization.role),
-        profiles: tree.profiles.into_iter().map(|profile| profile.name).collect(),
-        form,
+        profiles: tree
+            .profiles
+            .into_iter()
+            .map(|profile| profile.name)
+            .collect(),
+        draft,
+        status,
         error,
     })
 }