From 27dd83f4883c02a4b543fdbacfbce495d0042049 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Maxime=20Duch=C3=AAne-Savard?= <mduchene@proton.me>
Date: Fri, 31 Jul 2026 15:27:41 -0400
Subject: [PATCH] allow adding children records

---
 frontend/src/pages/entity-record-viewer.vue   | 31 ++++---
 frontend/tests/user-file.spec.ts              | 87 +++++++++++++++++-
 .../bolts/entity/EntityRecordRepository.kt    | 92 ++++++++++++++++++-
 .../dev/mduchene/bolts/web/UserController.kt  |  4 +
 ...000_create_entity_record_relationships.sql |  9 ++
 src/main/resources/db/reset.sql               |  1 +
 6 files changed, 208 insertions(+), 16 deletions(-)
 create mode 100644 src/main/resources/db/migrations/20260731192000_create_entity_record_relationships.sql

diff --git a/frontend/src/pages/entity-record-viewer.vue b/frontend/src/pages/entity-record-viewer.vue
index 82e3e25..ba86229 100644
--- a/frontend/src/pages/entity-record-viewer.vue
+++ b/frontend/src/pages/entity-record-viewer.vue
@@ -1,5 +1,5 @@
 <script lang="ts" setup>
-  import { computed, onMounted, reactive, ref } from 'vue'
+  import { computed, reactive, ref, watch } from 'vue'
   import { useRoute, useRouter } from 'vue-router'
   import { auth } from '@/auth'
 
@@ -19,6 +19,7 @@
   interface ChildRecords {
     entity: Entity
     relationshipField: Field
+    relationshipDirection?: 'INBOUND' | 'OUTBOUND'
     records: Record<string, unknown>[]
   }
   interface EntityRecord {
@@ -58,7 +59,7 @@
   }
 
   function childKey (child: ChildRecords) {
-    return `${child.entity.id}-${child.relationshipField.id}`
+    return `${child.entity.id}-${child.relationshipField.id}-${child.relationshipDirection ?? 'INBOUND'}`
   }
 
   function editableChildFields (child: ChildRecords) {
@@ -99,6 +100,10 @@
   }
 
   async function loadRecord () {
+    loading.value = true
+    errorMessage.value = ''
+    editing.value = false
+    addingChildKey.value = ''
     try {
       const response = await fetch(recordUrl.value, {
         headers: { Authorization: `Bearer ${auth.token}` },
@@ -146,17 +151,19 @@
     saving.value = true
     errorMessage.value = ''
     try {
-      const response = await fetch(
+      const childUrl = new URL(
         `${recordUrl.value}/children/${encodeURIComponent(child.entity.name)}/${child.relationshipField.id}`,
-        {
-          method: 'POST',
-          headers: {
-            'Authorization': `Bearer ${auth.token}`,
-            'Content-Type': 'application/x-www-form-urlencoded',
-          },
-          body: formBody(fields, childValues[key]),
-        },
+        window.location.origin,
       )
+      childUrl.searchParams.set('direction', child.relationshipDirection ?? 'INBOUND')
+      const response = await fetch(childUrl, {
+        method: 'POST',
+        headers: {
+          'Authorization': `Bearer ${auth.token}`,
+          'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: formBody(fields, childValues[key]),
+      })
       if (!response.ok) throw new Error('Child create failed')
       const created = await response.json() as EntityRecord
       child.records.push(created.values)
@@ -168,7 +175,7 @@
     }
   }
 
-  onMounted(loadRecord)
+  watch(recordUrl, loadRecord, { immediate: true })
 </script>
 
 <template>
diff --git a/frontend/tests/user-file.spec.ts b/frontend/tests/user-file.spec.ts
index e95e9df..0eeb42b 100644
--- a/frontend/tests/user-file.spec.ts
+++ b/frontend/tests/user-file.spec.ts
@@ -14,6 +14,8 @@ test('admin opens a user file and views a linked entity record', async ({ page }
   let projectTitle = 'Website refresh'
   const projects: Record<string, unknown>[] = [{ id: 42, title: 'Website refresh', owner: 7 }]
   const tasks: Record<string, unknown>[] = []
+  const notes: Record<string, unknown>[] = []
+  const milestones: Record<string, unknown>[] = []
   const projectResponse = () => ({
     entity: {
       id: 3,
@@ -22,6 +24,14 @@ test('admin opens a user file and views a linked entity record', async ({ page }
       fields: [
         { id: 11, name: 'Title', identifier: 'title', type: 'TEXT' },
         { id: 12, name: 'Owner', identifier: 'owner', type: 'USER' },
+        {
+          id: 13,
+          name: 'Milestones',
+          identifier: 'milestones',
+          type: 'RELATIONSHIP',
+          targetEntityId: 6,
+          relationshipType: 'ONE_TO_MANY',
+        },
       ],
     },
     values: { id: 42, title: projectTitle, owner: 7 },
@@ -49,6 +59,23 @@ test('admin opens a user file and views a linked entity record', async ({ page }
         targetEntityId: 3,
       },
       records: tasks,
+    }, {
+      entity: {
+        id: 6,
+        name: 'Milestone',
+        identifier: 'milestone',
+        fields: [{ id: 40, name: 'Label', identifier: 'label', type: 'TEXT' }],
+      },
+      relationshipField: {
+        id: 13,
+        name: 'Milestones',
+        identifier: 'milestones',
+        type: 'RELATIONSHIP',
+        targetEntityId: 6,
+        relationshipType: 'ONE_TO_MANY',
+      },
+      relationshipDirection: 'OUTBOUND',
+      records: milestones,
     }],
   })
 
@@ -90,7 +117,7 @@ test('admin opens a user file and views a linked entity record', async ({ page }
     }
     await route.fulfill({ json: projectResponse() })
   })
-  await page.route('**/api/users/7/entities/Project/records/42/children/Task/21', async route => {
+  await page.route('**/api/users/7/entities/Project/records/42/children/Task/21*', async route => {
     const values = new URLSearchParams(route.request().postData() ?? '')
     const created = { id: 55, description: values.get('description'), project: 42 }
     tasks.push(created)
@@ -103,6 +130,50 @@ test('admin opens a user file and views a linked entity record', async ({ page }
       },
     })
   })
+  await page.route('**/api/users/7/entities/Project/records/42/children/Milestone/13*', async route => {
+    expect(new URL(route.request().url()).searchParams.get('direction')).toBe('OUTBOUND')
+    const values = new URLSearchParams(route.request().postData() ?? '')
+    const created = { id: 60, label: values.get('label') }
+    milestones.push(created)
+    await route.fulfill({
+      status: 201,
+      json: { entity: projectResponse().children.at(1)!.entity, values: created, children: [] },
+    })
+  })
+  await page.route('**/api/users/7/entities/Task/records/55', route => route.fulfill({
+    json: {
+      entity: projectResponse().children.at(0)!.entity,
+      values: tasks.at(0),
+      children: [{
+        entity: {
+          id: 5,
+          name: 'Note',
+          identifier: 'note',
+          fields: [
+            { id: 30, name: 'Contents', identifier: 'contents', type: 'TEXT' },
+            { id: 31, name: 'Task', identifier: 'task', type: 'RELATIONSHIP', targetEntityId: 4 },
+          ],
+        },
+        relationshipField: {
+          id: 31,
+          name: 'Task',
+          identifier: 'task',
+          type: 'RELATIONSHIP',
+          targetEntityId: 4,
+        },
+        records: notes,
+      }],
+    },
+  }))
+  await page.route('**/api/users/7/entities/Task/records/55/children/Note/31*', async route => {
+    const values = new URLSearchParams(route.request().postData() ?? '')
+    const created = { id: 56, contents: values.get('contents'), task: 55 }
+    notes.push(created)
+    await route.fulfill({
+      status: 201,
+      json: { entity: { id: 5, name: 'Note', fields: [] }, values: created, children: [] },
+    })
+  })
 
   await page.goto('/users')
   await page.getByRole('link', { name: 'alex' }).click()
@@ -123,6 +194,12 @@ test('admin opens a user file and views a linked entity record', async ({ page }
   await expect(page.getByText('Website refresh')).toBeVisible()
   await expect(page.getByText('Owner')).toBeVisible()
 
+  await page.getByRole('button', { name: 'Add Milestone' }).click()
+  const milestoneForm = page.getByRole('form', { name: 'Add Milestone' })
+  await milestoneForm.getByLabel('Label').fill('Public beta')
+  await milestoneForm.getByRole('button', { name: 'Add Milestone' }).click()
+  await expect(page.getByRole('row').filter({ hasText: 'Public beta' })).toBeVisible()
+
   await page.getByRole('button', { name: 'Edit record' }).click()
   const editForm = page.getByRole('form', { name: 'Edit record' })
   await editForm.getByLabel('Title').fill('Mobile application')
@@ -134,4 +211,12 @@ test('admin opens a user file and views a linked entity record', async ({ page }
   await childForm.getByLabel('Description').fill('Prepare launch')
   await childForm.getByRole('button', { name: 'Add Task' }).click()
   await expect(page.getByRole('row').filter({ hasText: 'Prepare launch' })).toContainText('42')
+
+  await page.getByRole('link', { name: 'View Task record 55' }).click()
+  await expect(page.getByRole('heading', { name: 'Task #55' })).toBeVisible()
+  await page.getByRole('button', { name: 'Add Note' }).click()
+  const noteForm = page.getByRole('form', { name: 'Add Note' })
+  await noteForm.getByLabel('Contents').fill('Nested child')
+  await noteForm.getByRole('button', { name: 'Add Note' }).click()
+  await expect(page.getByRole('row').filter({ hasText: 'Nested child' })).toContainText('55')
 })
diff --git a/src/main/kotlin/dev/mduchene/bolts/entity/EntityRecordRepository.kt b/src/main/kotlin/dev/mduchene/bolts/entity/EntityRecordRepository.kt
index e44b290..af08607 100644
--- a/src/main/kotlin/dev/mduchene/bolts/entity/EntityRecordRepository.kt
+++ b/src/main/kotlin/dev/mduchene/bolts/entity/EntityRecordRepository.kt
@@ -22,8 +22,11 @@ data class ChildEntityRecords(
     val entity: EntityDefinition,
     val relationshipField: EntityField,
     val records: List<Map<String, Any?>>,
+    val relationshipDirection: RelationshipDirection = RelationshipDirection.INBOUND,
 )
 
+enum class RelationshipDirection { INBOUND, OUTBOUND }
+
 class EntityRecordRepository(
     private val database: Database,
     private val entities: EntityDefinitionRepository,
@@ -109,12 +112,42 @@ class EntityRecordRepository(
         parentRecordId: Long,
         childEntityName: String,
         relationshipFieldId: Long,
+        relationshipDirection: RelationshipDirection,
         submittedValues: Map<String, String>,
     ): EntityRecord? {
         val definitions = entities.findAll()
         val parent = definitions.firstOrNull { it.name == parentEntityName } ?: return null
         if (findRecordLinkedToUser(userId, parentEntityName, parentRecordId) == null) return null
         val child = definitions.firstOrNull { it.name == childEntityName } ?: return null
+        if (relationshipDirection == RelationshipDirection.OUTBOUND) {
+            val relationship = parent.fields.firstOrNull {
+                it.id == relationshipFieldId && it.type == FieldType.RELATIONSHIP && it.targetEntityId == child.id
+            } ?: return null
+            val storedTargetId = findValues(parent, parentRecordId)?.get(relationship.identifier) as? Number
+            if (
+                relationship.relationshipType == RelationshipType.ONE_TO_ONE &&
+                (storedTargetId != null || outboundChildIds(relationship.id, parentRecordId).isNotEmpty())
+            ) {
+                throw IllegalArgumentException("This relationship already has a child")
+            }
+            val childId = insertRecord(child, userId, submittedValues)
+            database.executeUpdate(
+                "INSERT INTO entity_record_relationships (field_id, source_record_id, target_record_id) VALUES (?, ?, ?)",
+            ) {
+                setLong(1, relationship.id)
+                setLong(2, parentRecordId)
+                setLong(3, childId)
+            }
+            if (relationship.relationshipType == RelationshipType.ONE_TO_ONE) {
+                database.executeUpdate(
+                    "UPDATE ${quote(parent.identifier)} SET ${quote(relationship.identifier)} = ? WHERE \"id\" = ?",
+                ) {
+                    setLong(1, childId)
+                    setLong(2, parentRecordId)
+                }
+            }
+            return findChildRecord(child, childId)
+        }
         val parentField = child.fields.firstOrNull {
             it.id == relationshipFieldId && it.type == FieldType.RELATIONSHIP && it.targetEntityId == parent.id
         } ?: return null
@@ -133,8 +166,9 @@ class EntityRecordRepository(
         return findChildRecord(child, childId)
     }
 
-    private fun findChildren(parentEntityId: Long, parentRecordId: Long): List<ChildEntityRecords> =
-        entities.findAll().flatMap { child ->
+    private fun findChildren(parentEntityId: Long, parentRecordId: Long): List<ChildEntityRecords> {
+        val definitions = entities.findAll()
+        val inbound = definitions.flatMap { child ->
             child.fields
                 .filter { it.type == FieldType.RELATIONSHIP && it.targetEntityId == parentEntityId }
                 .map { relationship ->
@@ -147,6 +181,40 @@ class EntityRecordRepository(
                     ChildEntityRecords(child, relationship, records)
                 }
         }
+        val parent = definitions.firstOrNull { it.id == parentEntityId } ?: return inbound
+        val outbound = parent.fields
+            .filter { it.type == FieldType.RELATIONSHIP && it.targetEntityId != null }
+            .mapNotNull { relationship ->
+                val child = definitions.firstOrNull { it.id == relationship.targetEntityId } ?: return@mapNotNull null
+                val storedTargetId = findValues(parent, parentRecordId)?.get(relationship.identifier)
+                    ?.let { it as? Number }?.toLong()
+                val childIds = (outboundChildIds(relationship.id, parentRecordId) + listOfNotNull(storedTargetId)).distinct()
+                val records = childIds.mapNotNull { findValues(child, it) }
+                ChildEntityRecords(child, relationship, records, RelationshipDirection.OUTBOUND)
+            }
+        return inbound + outbound
+    }
+
+    private fun outboundChildIds(fieldId: Long, sourceRecordId: Long): List<Long> =
+        database.queryList(
+            "SELECT target_record_id FROM entity_record_relationships WHERE field_id = ? AND source_record_id = ? ORDER BY target_record_id",
+            bind = {
+                setLong(1, fieldId)
+                setLong(2, sourceRecordId)
+            },
+        ) { getLong("target_record_id") }
+
+    private fun insertRecord(entity: EntityDefinition, userId: Long, submittedValues: Map<String, String>): Long {
+        val fields = entity.fields
+        val sql = "INSERT INTO ${quote(entity.identifier)} (${fields.joinToString { quote(it.identifier) }}) " +
+            "VALUES (${fields.joinToString { "?" }}) RETURNING \"id\""
+        return checkNotNull(database.queryOne(sql, bind = {
+            fields.forEachIndexed { index, field ->
+                if (field.type == FieldType.USER) setLong(index + 1, userId)
+                else bindField(index + 1, field, submittedValues[field.identifier].orEmpty())
+            }
+        }) { getLong("id") })
+    }
 
     private fun findChildRecord(entity: EntityDefinition, recordId: Long): EntityRecord? {
         val values = findValues(entity, recordId) ?: return null
@@ -173,7 +241,7 @@ class EntityRecordRepository(
         if (entity.fields.any { it.type == FieldType.USER && (values[it.identifier] as? Number)?.toLong() == userId }) {
             return true
         }
-        return entity.fields
+        val accessibleThroughStoredField = entity.fields
             .filter { it.type == FieldType.RELATIONSHIP && it.targetEntityId != null }
             .any { field ->
                 val parentId = (values[field.identifier] as? Number)?.toLong() ?: return@any false
@@ -181,6 +249,24 @@ class EntityRecordRepository(
                 val parentValues = findValues(parent, parentId) ?: return@any false
                 isAccessibleToUser(parent, parentValues, userId, definitions, visited)
             }
+        if (accessibleThroughStoredField) return true
+        return definitions.any { parent ->
+            parent.fields
+                .filter { it.type == FieldType.RELATIONSHIP && it.targetEntityId == entity.id }
+                .any { field ->
+                    database.queryList(
+                        "SELECT source_record_id FROM entity_record_relationships " +
+                            "WHERE field_id = ? AND target_record_id = ?",
+                        bind = {
+                            setLong(1, field.id)
+                            setLong(2, recordId)
+                        },
+                    ) { getLong("source_record_id") }.any { parentId ->
+                        val parentValues = findValues(parent, parentId) ?: return@any false
+                        isAccessibleToUser(parent, parentValues, userId, definitions, visited)
+                    }
+                }
+        }
     }
 
     private fun PreparedStatement.bindField(index: Int, field: EntityField, rawValue: String) {
diff --git a/src/main/kotlin/dev/mduchene/bolts/web/UserController.kt b/src/main/kotlin/dev/mduchene/bolts/web/UserController.kt
index 190700d..b707adb 100644
--- a/src/main/kotlin/dev/mduchene/bolts/web/UserController.kt
+++ b/src/main/kotlin/dev/mduchene/bolts/web/UserController.kt
@@ -1,6 +1,7 @@
 package dev.mduchene.bolts.web
 
 import dev.mduchene.bolts.entity.EntityRecordRepository
+import dev.mduchene.bolts.entity.RelationshipDirection
 import dev.mduchene.bolts.user.LoginService
 import dev.mduchene.bolts.user.UserRepository
 import io.javalin.router.JavalinDefaultRoutingApi
@@ -114,6 +115,9 @@ class UserController(
                     recordId,
                     childEntityName,
                     fieldId,
+                    ctx.queryParam("direction")?.let {
+                        runCatching { RelationshipDirection.valueOf(it) }.getOrNull()
+                    } ?: RelationshipDirection.INBOUND,
                     ctx.singleFormParams(),
                 )
                 if (child == null) ctx.notFound() else ctx.status(201).json(child)
diff --git a/src/main/resources/db/migrations/20260731192000_create_entity_record_relationships.sql b/src/main/resources/db/migrations/20260731192000_create_entity_record_relationships.sql
new file mode 100644
index 0000000..4e9f4e1
--- /dev/null
+++ b/src/main/resources/db/migrations/20260731192000_create_entity_record_relationships.sql
@@ -0,0 +1,9 @@
+CREATE TABLE entity_record_relationships (
+    field_id BIGINT NOT NULL REFERENCES entity_fields(id) ON DELETE CASCADE,
+    source_record_id BIGINT NOT NULL,
+    target_record_id BIGINT NOT NULL,
+    PRIMARY KEY (field_id, source_record_id, target_record_id)
+);
+
+CREATE INDEX entity_record_relationships_target_idx
+    ON entity_record_relationships(field_id, target_record_id);
diff --git a/src/main/resources/db/reset.sql b/src/main/resources/db/reset.sql
index b6ca9cd..4172148 100644
--- a/src/main/resources/db/reset.sql
+++ b/src/main/resources/db/reset.sql
@@ -1,3 +1,4 @@
+DROP TABLE IF EXISTS entity_record_relationships;
 DROP TABLE IF EXISTS entity_fields;
 DROP TABLE IF EXISTS entity_definitions;
 DROP TABLE IF EXISTS sessions;