feat(intent): read-only mode for personal surfaces (personalReadOnly) (#6369)

* feat(intent): read-only mode for personal surfaces (personalReadOnly)

A personal relation may declare personalReadOnly: true alongside personal:
true - the generated <Entity>MyController then serves only the scoped reads
and its create/update/delete return 405, and the my pages drop New/Edit/
Delete. For owner-owned reference records the person may SEE but never author
(a leave-balance account, a payslip) - closes the self-grant hole where a
writable personal surface let the owner create their own entitlement. The
regular (power) controller is unaffected.

Chain: RelationIntent.personalReadOnly -> EdmIntentGenerator emits
relationshipPersonalReadOnly -> parameterUtils sets e.personalReadOnly
(+ composition-child inheritance) -> EntityMyController.java.template guards
the writes -> my-list-view/my-form-view drop the buttons. Guide + IT
(IntentEmissionCoverageIT: Balance entity, emission asserts + runtime GET 200
/ POST 405) extended per the engine-intent keyword contract.

Addresses #6367.

* fix: personalReadOnly write refusal uses 403 FORBIDDEN (SDK honors it; 405 mapped to 400) + IT posts PascalCase body

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: delchev

components/engine/engine-intent/src/main/java/org/eclipse/dirigible/components/intent/generator/edm/EdmIntentGenerator.java

@@ -1214,6 +1214,11 @@ private static void putPersonal(Map<String, Object> p, RelationIntent relation,
             return;
         }
         p.put("relationshipPersonal", "true");
+        if (relation.isPersonalReadOnly()) {
+            // The personal surface is see-only for the owner: the my controller's write methods
+            // 405 and the my pages drop New/Edit/Delete (parameterUtils -> the rest/UI templates).
+            p.put("relationshipPersonalReadOnly", "true");
+        }
         p.put("relationshipIdentityProperty", targetIdentityProperty);
         // The identity entity's display/label field - the personal controller's /me returns it so the
         // personal pages can show "New/Edit <Doc> for <owner>". Falls back to the identity match field.

components/engine/engine-intent/src/main/java/org/eclipse/dirigible/components/intent/model/RelationIntent.java

@@ -109,6 +109,15 @@ public class RelationIntent {
      */
     private boolean personal;
 
+    /**
+     * When set together with {@link #personal}, the personal (my) surface is READ-ONLY for the owner:
+     * the generated {@code <Entity>MyController} exposes only the scoped reads (getAll / get / count)
+     * and its create/update/delete return 405, and the personal pages render without New / Edit /
+     * Delete. Use for records the owner may SEE but never author (a leave-balance account, a payslip);
+     * the regular (power) controller is unaffected. Ignored unless {@link #personal} is also true.
+     */
+    private boolean personalReadOnly;
+
     /**
      * Marks this to-one relation as the OWNER of the record for the PARTNER surface: the generated
      * partner REST controller scopes reads to the logged-in external partner's mapped identity record
@@ -262,6 +271,14 @@ public void setPersonal(boolean personal) {
         this.personal = personal;
     }
 
+    public boolean isPersonalReadOnly() {
+        return personalReadOnly;
+    }
+
+    public void setPersonalReadOnly(boolean personalReadOnly) {
+        this.personalReadOnly = personalReadOnly;
+    }
+
     public boolean isPartner() {
         return partner;
     }

components/engine/engine-intent/src/main/resources/intent-assistant-guide.md

@@ -290,7 +290,11 @@ scope through their parent). The entity then gets an ADDITIONAL generated `<Enti
 scoped to the logged-in user: reads filtered to the mapped identity record, the owner FK forced
 server-side on writes, foreign records 404. A field marked `sensitive: true` (not the PK, the
 identity field, or the owner FK) is stripped from personal responses and ignored on personal
-writes - use it for billing rates and amounts the person must not see. The regular controller is
+writes - use it for billing rates and amounts the person must not see. Add `personalReadOnly: true`
+alongside `personal: true` to make the personal surface **see-only**: the generated `MyController`
+serves the scoped reads but its create/update/delete return **405**, and the my pages drop
+New/Edit/Delete - for records the owner may view but never author (a leave-balance account, a
+payslip); the regular (power) controller still writes them normally. The regular controller is
 unaffected. Sensitivity propagates to derived fields automatically: a rollup target (`op: sum` /
 `latest`) whose `of:` child field is sensitive, and an `aggregate: true` master field fed by a
 same-named sensitive item field, are treated as sensitive whenever their entity has a personal

components/template/template-application-rest-java/src/main/resources/META-INF/dirigible/template-application-rest-java/api/EntityMyController.java.template

@@ -90,6 +90,28 @@ public class ${name}MyController {
         return scrub(requireMine(id));
     }
 
+#if($personalReadOnly)
+    // See-only personal surface (intent personalReadOnly): the owner may read their own records but
+    // never author them - the write endpoints exist only to refuse with 405 (the power controller
+    // remains the sole write path). Fixes the self-grant risk on owner-owned reference records.
+    @Post
+    @Documentation("Not allowed - this ${name} is read-only on the personal surface")
+    public ${name}Entity create(@Body ${name}Entity entity) {
+        throw new ResponseStatusException(HttpStatus.FORBIDDEN, "This ${name} is read-only on your personal surface");
+    }
+
+    @Put("/{id}")
+    @Documentation("Not allowed - this ${name} is read-only on the personal surface")
+    public ${name}Entity update(@PathParam("id") #foreach($property in $properties)#if($property.dataPrimaryKey)${property.dataTypeJavaClass}#end#end id, @Body ${name}Entity entity) {
+        throw new ResponseStatusException(HttpStatus.FORBIDDEN, "This ${name} is read-only on your personal surface");
+    }
+
+    @Delete("/{id}")
+    @Documentation("Not allowed - this ${name} is read-only on the personal surface")
+    public void deleteById(@PathParam("id") #foreach($property in $properties)#if($property.dataPrimaryKey)${property.dataTypeJavaClass}#end#end id) {
+        throw new ResponseStatusException(HttpStatus.FORBIDDEN, "This ${name} is read-only on your personal surface");
+    }
+#else
     @Post
     @Documentation("Create a ${name} of mine")
     public ${name}Entity create(@Body ${name}Entity entity) {
@@ -150,6 +172,7 @@ public class ${name}MyController {
             throw e;
         }
     }
+#end
 
     /**
      * The current user's identity record id: the ${personalIdentityProperty} of the identity entity

components/template/template-application-ui-harmonia-java/src/main/resources/META-INF/dirigible/template-application-ui-harmonia-java/ui/my/my-form-view.html.template

@@ -153,6 +153,11 @@
 #end
 
     <div class="hbox gap-2" style="max-width: 900px">
+#if($personalReadOnly)
+      <div class="grow"></div>
+      <button x-h-button data-variant="transparent" @click="goBack()"
+              x-text="T('$projectName:${tprefix}.defaults.back', 'Back')"></button>
+#else
       <button x-h-button data-variant="negative" x-show="mode === 'edit'" @click="deleteOpen = true"
               x-text="T('$projectName:${tprefix}.defaults.delete', 'Delete')"></button>
       <div class="grow"></div>
@@ -162,6 +167,7 @@
         <span x-show="saving" x-h-spinner></span>
         <span x-text="T('$projectName:${tprefix}.defaults.save', 'Save')"></span>
       </button>
+#end
     </div>
   </div>
 

components/template/template-application-ui-harmonia-java/src/main/resources/META-INF/dirigible/template-application-ui-harmonia-java/ui/my/my-list-view.html.template

@@ -7,10 +7,12 @@
   <div x-h-toolbar data-variant="transparent">
     <span x-h-toolbar-title class="shrink-0" x-text="'My ' + T('$projectName:${tprefix}.t.${dataName}_plural', '${menuLabel}')"></span>
     <div x-h-toolbar-spacer></div>
+#if(!$personalReadOnly)
     <button x-h-button data-variant="primary" @click="newEntity()">
       <i role="img" x-h-lucide data-lucide="plus"></i>
       <span x-text="T('$projectName:${tprefix}.defaults.new', 'New')"></span>
     </button>
+#end
     <!-- Export the own rows as CSV / print them (Save as PDF via the browser dialog). -->
     <button x-h-button data-variant="outline" data-size="sm" :disabled="items.length === 0" @click="exportCsv()">
       <i role="img" x-h-lucide data-lucide="download"></i><span x-text="T('$projectName:${tprefix}.defaults.export', 'Export')"></span>

components/ui/service-generate/src/main/resources/META-INF/dirigible/service-generate/template/parameterUtils.js

@@ -220,6 +220,9 @@ export function process(model, parameters) {
                         e.personalIdentityLabel = p.relationshipIdentityLabel || p.relationshipIdentityProperty;
                         e.personalIdentityEntityClass = `gen.${javaGen}.data.${javaPerspective}.${p.relationshipEntityName}Entity`;
                         e.personalIdentityRepositoryClass = `gen.${javaGen}.data.${javaPerspective}.${p.relationshipEntityName}Repository`;
+                        // See-only personal surface (intent personalReadOnly): the my controller's
+                        // writes 405 and the my pages drop New/Edit/Delete.
+                        e.personalReadOnly = !!p.relationshipPersonalReadOnly;
                     }
                     // partner (intent `partner: true`): the external-partner mirror of the personal
                     // owner - resolves the current external user through the TARGET's repository.
@@ -265,6 +268,7 @@ export function process(model, parameters) {
                 personalProperty: parent.personalProperty,
                 personalFkJavaClass: parent.personalFkJavaClass
             };
+            e.personalReadOnly = !!parent.personalReadOnly; // children inherit the see-only mode
             e.personalIdentityProperty = parent.personalIdentityProperty;
             e.personalIdentityLabel = parent.personalIdentityLabel;
             e.personalIdentityEntityClass = parent.personalIdentityEntityClass;

modules/parsers/typescript/src/main/java/org/eclipse/dirigible/parsers/typescript/TypeScriptParser.java

@@ -1,12 +1,3 @@
-/*
- * Copyright (c) 2010-2026 Eclipse Dirigible contributors
- *
- * All rights reserved. This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
- * http://www.eclipse.org/legal/epl-v20.html
- *
- * SPDX-FileCopyrightText: Eclipse Dirigible contributors SPDX-License-Identifier: EPL-2.0
- */
 // Generated from org/eclipse/dirigible/parsers/typescript/TypeScriptParser.g4 by ANTLR 4.13.2
 package org.eclipse.dirigible.parsers.typescript;
 

modules/parsers/typescript/src/main/java/org/eclipse/dirigible/parsers/typescript/TypeScriptParserBaseListener.java

@@ -1,12 +1,3 @@
-/*
- * Copyright (c) 2010-2026 Eclipse Dirigible contributors
- *
- * All rights reserved. This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
- * http://www.eclipse.org/legal/epl-v20.html
- *
- * SPDX-FileCopyrightText: Eclipse Dirigible contributors SPDX-License-Identifier: EPL-2.0
- */
 // Generated from org/eclipse/dirigible/parsers/typescript/TypeScriptParser.g4 by ANTLR 4.13.2
 package org.eclipse.dirigible.parsers.typescript;
 

modules/parsers/typescript/src/main/java/org/eclipse/dirigible/parsers/typescript/TypeScriptParserBaseVisitor.java

@@ -1,12 +1,3 @@
-/*
- * Copyright (c) 2010-2026 Eclipse Dirigible contributors
- *
- * All rights reserved. This program and the accompanying materials are made available under the
- * terms of the Eclipse Public License v2.0 which accompanies this distribution, and is available at
- * http://www.eclipse.org/legal/epl-v20.html
- *
- * SPDX-FileCopyrightText: Eclipse Dirigible contributors SPDX-License-Identifier: EPL-2.0
- */
 // Generated from org/eclipse/dirigible/parsers/typescript/TypeScriptParser.g4 by ANTLR 4.13.2
 package org.eclipse.dirigible.parsers.typescript;