komp_ac/web/CHANGELOG.md

# Changelog

All notable changes to the **komp_ac web** crate — the Axum SSR/HTMX web frontend
for the komp_ac gRPC backend — are documented in this file.

This changelog tracks only the **gRPC endpoints** the web crate consumes (the
browser never calls gRPC directly; Axum proxies to the backend through these
clients) and the extent to which each is used by the pages that mount them.
Other, non-API changes are intentionally out of scope.

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).

---

## [Unreleased]

### Added

- **Role, user and permission administration** — `/admin/permissions` consumes
  `ListRoles`, `AddRole`, `RemoveRole`, `ListUsers`, `AssignUserRole`,
  `ListRolePermissions`, `ListGrantableObjects`, `GrantPermission` and
  `RevokePermission`. Direct and inherited grants are distinguished, and the
  action controls come from each grantable object returned by the backend.
- **Table-family permissions in table definition** — selecting a table shows
  its grant matrix for every editable data role. Creating a table redirects to
  that table in the definition workspace so its initial grants can be assigned
  immediately.
- **Bootstrap administrator claim** — `/initial-password` consumes
  `SetInitialPassword` for the one-time `admin` and `superadmin` setup flow.
- **`TableDefinition.ListColumnTypes`** — called by the add-table and
  table-definition loaders. The whole response is consumed: `name`, `group`,
  `declarable`, `compound`, `spelling`, `requires_currency`, `creation_only`,
  `allows_quantity_ledger` and `sql_type` are each read by a rule that used to
  be hardcoded in `crate::schema`. The column vocabulary is now the backend's,
  so a type it adds is offered by both screens without a change here.

### Changed

- **Web authorization follows permission objects, not role names** — structural
  pages check their `struct:<area>/manage` permission from `GetAuthorization`,
  so inherited `superadmin` authorization works and data roles are no longer
  treated as administrators. Login redirects structural users to the admin
  workspace and data users to analytics.
- **Analytics and import/export use the caller's visible data** — profile-tree
  discovery is authenticated, export is limited to readable tables, and
  import is limited to tables for which the snapshot carries `insert`.
- **Permission mutations retire the browser session** — the current backend
  invalidates every existing token after a policy change. After a successful
  role, assignment, grant or revoke operation the web clears that stale cookie
  and explains why the administrator must sign in again.
- **The column-type picker is the server's list** — it no longer carries its
  own. Types the web crate never offered are now reachable: `numeric` and the
  `ACCOUNTING_TRANSFER` compound column. Server-generated companion types
  (`phone_country`, `iban_bban`, the transfer connectors) are listed by the
  endpoint but never offered, and are refused if one is posted anyway.
- **Creation-only types are refused on the append panel by rule, not by name** —
  `POST /admin/table-definition/columns` used to exclude `accounting` alone;
  it now excludes every type the response marks `creation_only`, which is what
  `AddTableColumns` rejects.
- **Compound columns are staged as the backend expands them** — a compound
  column takes its type's name, cannot be indexed, and is not offered as a row
  display column, since no column of that name survives the expansion.
- **Currency and quantity-ledger rules come from the response** —
  `requires_currency` decides which types carry a currency (previously MONEY
  and ACCOUNTING by name), and `allows_quantity_ledger` both validates the
  choice and writes the hint under the input.
- **`GetProfileDetails` columns show the SQL type behind them** — the
  workspace's column list renders `sql_type` from the catalog beside each
  logical type, including for the companion columns the backend generates.
- **`TableDefinition.GetProfileTree` — `depends_on` is one entry per link** —
  each dependency now carries the target `table_name` and the `column_name`
  holding the reference. Both the admin panel and the table-definition
  workspace render each entry as `table (column)`, so a table that points at
  one target twice shows as two links.
- **`AuthService.Register` — the `role` field is gone** — the request no
  longer carries a client-chosen role; every registration lands as `guest`.
  The register page dropped the role input and its suggestion list.

### Not covered

The endpoints and fields below are part of the current proto surface but the
web crate does not implement them. They are listed so it stays visible what
the backend gained that this client has not wired up yet.

- **`TableDefinition.PostTableDefinition` — `LINK(table)` columns** — the old
  per-request link UI was removed when links became columns, and the new
  spelling is not implemented. The picker offers `link` (the `ListColumnTypes`
  response marks it declarable), but `COLUMN_TYPE_SPELLING_LINK` is not treated
  as parameterised, `relation_tables` is loaded but never rendered or applied,
  and typing `link(table)` is rejected as an unknown type. A link column
  cannot be declared from the web.
- **`TableDefinition.ColumnDefinition.required`** — the new field is always
  sent as `false`; add-table has no required toggle.
- **`TableValidation.DisplayMask.storage_mode`** — the new `MaskStorageMode`
  option is always left absent (raw); there is no formatted-storage choice in
  the validation UI.
- **`TableScript.ScriptDependency.link_column` / `name_in_script`** — the new
  dependency fields are not read; the web only surfaces the id and warnings
  `PostTableScript` returns.
- **`TablesData` account as a string** — accounting-enabled tables now take a
  slash-delimited `account` path instead of the `account_id` reference, and
  the structure endpoint exposes the column as `account`. The bulk-import and
  CSV-export paths treat columns generically and were not changed; the web has
  no accounting data-entry surface of its own.

## [v0.8.38] — 2026-08-05

The web crate wires up seven gRPC services and calls the following endpoints.
Coverage notes describe which pages exercise each call and how deeply its
response is consumed.

### Auth (`AuthServiceClient`)

- **`AuthService.Login`** — called by `POST /login`. Exchanges identifier and
  password for an access token; the token and `expires_in` are written into the
  `analytics_token` HTTP-only cookie that every subsequent gRPC call is signed
  with. Fully covered end-to-end.
- **`AuthService.Register`** — called by `POST /register`. Submits the full
  `RegisterRequest` surface (username, email, password, password_confirmation,
  role, timezone, phone_country). Only the success/error message is shown; it
  does not create a session.
- **`AuthService.GetAuthorization`** — called by every admin page loader
  (`/admin`, table-definition, add-table, add-logic, add-validation,
  import/export). Returns the caller's role; the web crate uses it for two
  things: gating the admin panel to `role == "admin"` and rendering the navbar
  with the current role. Response fields beyond `role` are not used.

### Table definition (`TableDefinitionClient`)

- **`TableDefinition.GetProfileTree`** — called by the analytics, admin, table
  definition, add-table, add-logic, and add-validation loaders. Populates the
  profile selectors (profile name + table count) and, in the admin panel, the
  per-profile table list including `depends_on` and `row_display_columns`.
  Response is consumed fairly deeply.
- **`TableDefinition.PostTableDefinition`** — called by `POST /admin/tables`
  (add-table page). Creates a table from the draft; the returned `success`,
  `sql`, and `message` are surfaced. Full form → endpoint mapping.
- **`TableDefinition.GetProfileDetails`** — called by the table-definition
  workspace loader. Returns per-table columns (name, type, currency,
  quantity-ledger, rounding, generated/read-only behaviors and `generated_from`
  for Steel scripts), scripts (target column/type/description/source), row
  display columns, and table kind. The most deeply consumed definition endpoint.
- **`TableDefinition.GetColumnAliasRenameHistory`** — called by the
  table-definition workspace loader. Returns rename history entries
  (table, old/new column names, timestamp); only those four fields are rendered.
- **`TableDefinition.AddTableColumns`** — called by
  `POST /admin/table-definition/columns`. Adds columns to an existing table.
- **`TableDefinition.RenameColumnAlias`** — called by
  `POST /admin/table-definition/rename`. Renames a table column alias.
- **`TableDefinition.DeleteTable`** — called by
  `POST /admin/table-definition/delete`. Deletes a table definition.
- **`TableDefinition.CopyProfile`** — called by
  `POST /admin/table-definition/copy`. Copies a profile.
- **`TableDefinition.CreateInvoiceTemplateTable`** — called by
  `POST /admin/table-definition/invoice-template`. Creates a table from the
  invoice template contract.

### Table script (`TableScriptClient`)

- **`TableScript.PostTableScript`** — called by `POST /admin/logic`
  (add-logic page). Creates a Steel table script; the returned id and warnings
  are surfaced to the user.

### Table validation (`TableValidationServiceClient`)

- **`TableValidationService.UpdateFieldValidation`** — called by
  `POST /admin/validation`. Creates/updates a field validation.
- **`TableValidationService.UpsertValidationRule`** — called by
  `POST /admin/validation/rules`. Creates/updates a reusable validation rule.
- **`TableValidationService.ApplyValidationSet`** — called by
  `POST /admin/validation/sets`. Applies a validation set.
- **`TableValidationService.UpsertValidationSet`** — called by
  `POST /admin/validation/sets`. Creates/updates a reusable validation set.

Each validation POST maps the submitted form into the corresponding request and
renders only the returned `success`/`message`.

### Table structure (`TableStructureServiceClient`)

- **`TableStructureService.GetTableStructure`** — called by the admin panel,
  CSV import, and CSV export. Returns table structures used three ways: the
  admin column browse (name, type, nullable, primary key, quantity-ledger),
  import header validation, and export column ordering. Only the structure for
  the selected/imported/exported tables is requested at a time.

### Tables data (`TablesDataClient`)

- **`TablesData.PostTableDataBulk`** — called by `POST /admin/import`. Chunked
  bulk insert of parsed CSV rows into a table, with per-chunk requests.
- **`TablesData.GetTableDataByPosition`** — called by `POST /admin/export.csv`.
  Reads table rows by position for CSV download, one request per table.

### Analytics (`AnalyticsServiceClient`)

- **`AnalyticsService.GetAnalyticsCatalog`** — called by `POST /api/catalog`.
  Returns the live public analytics catalog for a profile (tables, columns,
  types, links); rendered in the sidebar and used to generate starter queries
  and LLM schema context.
- **`AnalyticsService.ExecuteAnalyticsQuery`** — called by `POST /api/query`.
  Runs a read-only analytics SQL query; the result columns/rows feed the
  ECharts charts and table view.
- The analytics profile selector is fed by `TableDefinition.GetProfileTree`
  (see above), not by a dedicated analytics profile endpoint.