@agilesyndrome/cf-genai-base 2.0.0 → 2.0.1

package/CONTRACT.md

@@ -62,6 +62,8 @@ manifest through `feature.dataResources`. Each resource must declare a safe
 name, table, explicit columns, and one scope: `user`, `tenant`, or `system`.
 Resources may also declare allowed operations (`read`, `create`, `update`, and
 `delete`); reads support bounded cursor pagination through `reader.page()`.
+Anonymous tenant reads require an explicit worker `publicTenantId` and a
+resource-level `publicRead: true` declaration.
 Request handlers receive `state.data`, whose scope-specific readers apply the
 validated user or tenant predicate. Domain handlers must not use unrestricted
 `env.DB` for registered resources. Base cannot provide row-level security to

package/README.md

@@ -82,6 +82,9 @@ the reader applies ownership predicates, supports bounded cursor pagination via
 `.page()`, and never accepts raw SQL. Resources can explicitly restrict their
 operations to `read`, `create`, `update`, and `delete`.
 
+Anonymous tenant reads require both `publicTenantId` on `createWorker` and
+`publicRead: true` on the resource; they never grant anonymous system access.
+
 For example, a tenant-owned resource registers its `tenant_id` column with
 base, while feature code calls `state.data.tenant.list("recipes")` without
 passing a tenant ID. The active tenant must be a validated membership. A

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agilesyndrome/cf-genai-base",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "type": "module",
   "exports": {
     ".": "./src/index.js",

package/src/data.js

@@ -36,7 +36,7 @@ export function normalizeDataResources(resources = []) {
     if (writableColumns.some((column) => !columns.includes(column))) throw new TypeError(`Data resource ${resource.name} references an unwritable column`);
     const operations = [...new Set((resource.operations || ["read", ...(writableColumns.length ? ["create", "update", "delete"] : [])]).map((operation) => String(operation).toLowerCase()))];
     if (!operations.length || operations.some((operation) => !DATA_OPERATIONS.includes(operation)) || !operations.includes("read")) throw new TypeError(`Data resource ${name} has invalid operations`);
-    return { ...resource, name, table: String(resource.table), scope, columns, idColumn, ownerColumn, tenantColumn, filterableColumns, orderableColumns, writableColumns, operations };
+    return { ...resource, name, table: String(resource.table), scope, columns, idColumn, ownerColumn, tenantColumn, filterableColumns, orderableColumns, writableColumns, operations, publicRead: Boolean(resource.publicRead) };
   });
 }
 
@@ -122,18 +122,18 @@ export function createDataReader(env, { resources = [], context } = {}) {
   return { user: scope("user"), tenant: scope("tenant"), system: scope("system"), resources: [...registry.values()] };
 }
 
-export async function requestDataContext(env, { state = {}, request } = {}) {
+export async function requestDataContext(env, { state = {}, request, publicTenantId = null } = {}) {
   const authUser = state.authUser || (state.user ? await ensureUser(env, state.user, { who: `user:${state.user.sub || "unknown"}` }) : null);
   const system = Boolean(state.user?.auth_strategy === "http_basic" || (authUser && authUser.is_admin));
-  if (!authUser) return { userId: null, tenantId: null, system: false };
+  if (!authUser) return { userId: null, tenantId: publicTenantId, public: Boolean(publicTenantId), system: false };
   const tenants = await listUserTenants(env, authUser.id, { who: `user:${authUser.id}` });
   const requestedTenant = state.tenantId || request?.headers?.get("X-Tenant-ID") || null;
   const tenant = requestedTenant ? tenants.find((item) => item.id === requestedTenant) : tenants.length === 1 ? tenants[0] : null;
-  return { userId: authUser.id, tenantId: tenant?.id || null, system, tenants };
+  return { userId: authUser.id, tenantId: tenant?.id || null, public: false, system, tenants };
 }
 
 function isAllowed(resource, requestedScope, actor, operation) {
-  const allowed = requestedScope === "system" ? Boolean(actor.system) : requestedScope === resource.scope && (requestedScope === "user" ? Boolean(actor.userId) : Boolean(actor.userId && actor.tenantId));
+  const allowed = requestedScope === "system" ? Boolean(actor.system) : requestedScope === resource.scope && (requestedScope === "user" ? Boolean(actor.userId) : Boolean(actor.tenantId && (actor.userId || (actor.public && resource.publicRead))));
   if (!allowed || !resource.operations.includes(operation)) {
     auditLog({ who: actorLabel(actor), operation: "deny", resource: `data:${resource.name}:${requestedScope}:${operation}` });
     return false;

package/src/index.js

@@ -7,7 +7,7 @@ import { getCircuitBreaker, evaluateCircuitBreaker, listCircuitBreakers, listHea
 import { createDataReader, DataScopeError, normalizeDataResources, requestDataContext } from "./data.js";
 export * from "./core.js";
 export * from "./data.js";
-export function createWorker({ fetch, scheduled, auth, authorize, scopes = [], scopeRoutes = [], middleware = [], features = [], dataResources = [], health, boot, metrics, security = true, adminPage, siteAdminPage }) {
+export function createWorker({ fetch, scheduled, auth, authorize, scopes = [], scopeRoutes = [], middleware = [], features = [], dataResources = [], publicTenantId = null, health, boot, metrics, security = true, adminPage, siteAdminPage }) {
   if (typeof fetch !== "function") throw new TypeError("createWorker requires a fetch handler");
   const provider = auth || features.find((feature) => typeof feature?.getUser === "function");
   const registeredDataResources = normalizeDataResources([...dataResources, ...features.flatMap((feature) => Array.isArray(feature?.dataResources) ? feature.dataResources : [])]);
@@ -23,7 +23,7 @@ export function createWorker({ fetch, scheduled, auth, authorize, scopes = [], s
         if (boot) await boot(env, { request, ctx });
         const url = new URL(request.url);
         const state = Object.create(null);
-        state.data = createDataReader(env, { resources: registeredDataResources, context: () => requestDataContext(env, { state, request }) });
+        state.data = createDataReader(env, { resources: registeredDataResources, context: () => requestDataContext(env, { state, request, publicTenantId }) });
         if (env?.DB && features.some((feature) => typeof feature?.healthcheck === "function" || feature?.healthchecks?.length || feature?.healthChecks?.length || feature?.circuitBreakers?.length || feature?.circuit_breakers?.length)) ctx?.waitUntil?.(registerFeatureManifests(env, features, { who: "system:update" }).then(() => listCircuitBreakers(env, { who: "system:update" }).then((breakers) => Promise.all(breakers.filter(Boolean).map((breaker) => evaluateCircuitBreaker(env, breaker.id, { who: "system:update" }))))).catch((error) => console.error("[EventLog] feature manifest registration failed", error)));
         const dispatch = async (index, currentRequest = request) => {
           const layer = chain[index];