@ai0x0/utils 0.0.49 → 0.1.0

package/es/backend/actions/get-list-query.js

@@ -21,12 +21,14 @@ function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e
 function _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }
 function _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }
 import { and, asc, desc, eq, gte, ilike, inArray, lte, or, sql } from "drizzle-orm";
+import { scopeCondition } from "../scope.js";
 export function getListQuery(_ref) {
   var db = _ref.db,
     fields = _ref.fields,
     jsonArrayFields = _ref.jsonArrayFields,
     params = _ref.params,
     relations = _ref.relations,
+    scope = _ref.scope,
     table = _ref.table;
   var _params$page = params.page,
     page = _params$page === void 0 ? 1 : _params$page,
@@ -136,13 +138,17 @@ export function getListQuery(_ref) {
       var _Object$entries$_i = _slicedToArray(_Object$entries[_i], 2),
         key = _Object$entries$_i[0],
         value = _Object$entries$_i[1];
-      if (!value) continue;
+      if (!value) {
+        continue;
+      }
 
       // 处理日期范围字段
       if (key.endsWith("AtFrom") || key.endsWith("AtTo")) {
         var baseFieldName = key.replace(/(AtFrom|AtTo)$/, "");
         var _targetColumn = findTargetColumn("".concat(baseFieldName, "At"), table, relations);
-        if (!_targetColumn) continue;
+        if (!_targetColumn) {
+          continue;
+        }
         if (key.endsWith("AtFrom")) {
           conditions.push(gte(_targetColumn, new Date(value)));
         } else if (key.endsWith("AtTo")) {
@@ -153,7 +159,9 @@ export function getListQuery(_ref) {
 
       // 处理其他普通过滤条件
       var targetColumn = findTargetColumn(key, table, relations);
-      if (!targetColumn) continue;
+      if (!targetColumn) {
+        continue;
+      }
       addCondition(conditions, key, value, targetColumn);
     }
     return conditions;
@@ -168,19 +176,22 @@ export function getListQuery(_ref) {
   // 构建基础查询
   var baseQuery = buildBaseQuery(table, fields, relations);
 
-  // 构建条件
-  var conditions = buildConditions(filters, table, relations);
+  // 构建条件。**作用域先于筛选加进去**，且它不受 buildConditions 里「空值跳过」那条规矩管：
+  // 那条规矩对 `?name=` 这种空参数是对的，对归属则是灾难性的 —— 条件消失即全表可见。
+  var scopeSql = scopeCondition(table, scope);
+  var conditions = scopeSql ? [scopeSql] : [];
+  conditions.push.apply(conditions, _toConsumableArray(buildConditions(filters, table, relations)));
 
   // 构建主查询
-  var query = baseQuery.where(conditions.length > 0 ? and.apply(void 0, _toConsumableArray(conditions)) : undefined).orderBy(buildOrderBy(table, orderBy, orderDir))
-  // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+  var query = baseQuery.where(conditions.length > 0 ? and.apply(void 0, conditions) : undefined).orderBy(buildOrderBy(table, orderBy, orderDir))
+
   // @ts-ignore
   .limit(pageSize).offset((page - 1) * pageSize);
 
   // 构建计数查询(优化后)
   var countQuery = db.select({
     count: sql(_templateObject3 || (_templateObject3 = _taggedTemplateLiteral(["COUNT(DISTINCT ", ")"])), table.id)
-  }).from(table).where(conditions.length > 0 ? and.apply(void 0, _toConsumableArray(conditions)) : undefined);
+  }).from(table).where(conditions.length > 0 ? and.apply(void 0, conditions) : undefined);
 
   // 添加关联
   if (relations !== null && relations !== void 0 && relations.length) {

package/es/backend/index.d.ts

@@ -2,3 +2,4 @@ export * from "./actions/index.js";
 export * from "./route-operation/index.js";
 export * from "./schemas/index.js";
 export * from "./errors.js";
+export * from "./scope.js";

package/es/backend/index.js

@@ -1,4 +1,5 @@
 export * from "./actions/index.js";
 export * from "./route-operation/index.js";
 export * from "./schemas/index.js";
-export * from "./errors.js";
+export * from "./errors.js";
+export * from "./scope.js";

package/es/backend/route-operation/delete-operation.d.ts

@@ -11,4 +11,6 @@ export declare const createDeleteOperation: ({ db, getSession, }: {
     } | undefined>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/es/backend/route-operation/get-list-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createGetListOperation: ({ db, getSession, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/route-operation/get-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createGetOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/route-operation/operation-common.d.ts

@@ -1,11 +1,75 @@
 import { NextRequest } from "next/server";
 import { TypedNextRequest, TypedNextResponse } from "next-rest-framework";
 import { z, ZodSchema } from "zod";
+import { ScopeArg, ScopeValue } from "../scope.js";
 export type JsonResponse = ReturnType<(typeof TypedNextResponse)["json"]>;
 export type RouteCatch = (error: Error) => Promise<JsonResponse | undefined>;
-export type SessionGetter = (req: NextRequest) => Promise<{
+/** 默认的会话形状。够用于「一条记录属于一个人」的场景。 */
+export interface DefaultSession {
     userId?: string;
-} | undefined>;
+}
+/**
+ * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
+ * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
+ */
+export type SessionGetter<TSession = DefaultSession> = (req: NextRequest) => Promise<TSession | undefined>;
+export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE";
+/** can 返回它表示拒绝，可自定状态码与文案；返回 false 等价于 { status: 403 }。 */
+export interface AccessDenial {
+    status?: number;
+    message?: string;
+}
+export interface AccessOptions<TSession = DefaultSession> {
+    /**
+     * 老写法，等价于 `scope: { column: "creatorId", value: (s) => s.userId }`。
+     * 与 scope 同时给时以 scope 为准。
+     */
+    byCreator?: boolean;
+    /**
+     * 行级作用域：这次请求只能看到 / 只能动 `column` 等于（或属于）`value` 的那些行。
+     * column 不填默认 "creatorId"。
+     *
+     * value 拿不到值（会话没有、或返回空）时请求会被拒绝，**不会**退化成「不筛」——
+     * 那正是这套东西存在的意义，见 scope.ts 的说明。
+     */
+    scope?: {
+        column?: string;
+        value: (session: TSession) => ScopeValue | undefined;
+    };
+    /**
+     * 准入判断。作用域管「能看到哪些行」，这里管「能不能做这个动作」——比如只读角色不能写。
+     * 收在一处而不是散在各路由里：多一档角色时，散着写必然漏。
+     */
+    can?: (_ctx: {
+        session: TSession;
+        method: HttpMethod;
+    }) => boolean | AccessDenial | Promise<boolean | AccessDenial>;
+}
+/**
+ * 把会话读取包成「本次请求最多取一次」的取值器。
+ *
+ * 会话在一次请求里可能被好几处要：作用域要它算归属、can 要它判角色、PUT 还要它填 editorId。
+ * 各自去调 getSession 就是重复往返；预先无条件取一次，则公开端点（关掉隔离的那些）要白付一次
+ * 读取。包一层惰性缓存之后两个问题一起没了 —— 谁要谁调，取不取由用不用决定，不必谁去传一个
+ * 「要不要取」的开关。
+ */
+export declare function sessionLoader<TSession>(getSession: SessionGetter<TSession>, req: NextRequest): () => Promise<TSession | undefined>;
+/**
+ * 解析这次请求的会话、作用域与准入。
+ *
+ * **失败一律抛，不降级。** 会话拿不到就是 401、作用域取不到值就是 403 —— 绝不把一个空值
+ * 往下传。这条是本次改动的核心：在此之前空值会一路流到查询构造器，被「空值跳过筛选」那条
+ * 规则吃掉，结果是列表返回全表、删除按 id 删任意行。
+ */
+export declare function resolveAccess<TSession>({ access, loadSession, method, }: {
+    access?: AccessOptions<TSession>;
+    /** 见 sessionLoader —— 传取值器而不是 (getSession, req)，取不取由这里自己决定。 */
+    loadSession: () => Promise<TSession | undefined>;
+    method: HttpMethod;
+}): Promise<{
+    scope: ScopeArg;
+    session: TSession | undefined;
+}>;
 export type ActionFactory<TTable, TAction> = (_options: {
     bodySchema?: ZodSchema;
     db: unknown;
@@ -25,14 +89,22 @@ export declare function getDefaultTags<TTable>({ getTableName, table, }: {
 export type GetOperationParams<Q extends ZodSchema> = z.infer<Q> & Record<string, unknown> & {
     creatorId?: string;
 };
-export declare function getReadParams<Q extends ZodSchema>({ access, getSession, req, schemas, setParams, }: {
-    access?: {
-        byCreator?: boolean;
-    };
-    getSession: SessionGetter;
+/**
+ * 读操作的参数与作用域。
+ *
+ * 注意作用域**不进 params**：params 会被查询构造器当筛选条件处理，而那里的规矩是「空值跳过」。
+ * 作用域走单独一条通道交给 action，见 scope.ts 顶部第 1 条。
+ */
+export declare function getReadParams<Q extends ZodSchema, TSession>({ access, getSession, req, schemas, setParams, }: {
+    access?: AccessOptions<TSession>;
+    getSession: SessionGetter<TSession>;
     req: NextRequest;
     schemas: {
         query: Q;
     };
     setParams?: (_req: TypedNextRequest<"GET", "application/json", unknown, z.infer<Q>>) => Promise<Record<string, unknown>>;
-}): Promise<GetOperationParams<Q>>;
+}): Promise<{
+    params: GetOperationParams<Q>;
+    scope: ScopeArg;
+    session: TSession | undefined;
+}>;

package/es/backend/route-operation/operation-common.js

@@ -1,43 +1,186 @@
-function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
 function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
 function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
 function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : String(i); }
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 import { TypedNextResponse } from "next-rest-framework";
+import { HttpError } from "../errors.js";
+import { isEmptyScopeValue, NO_SCOPE } from "../scope.js";
+
+// ==============================================================================
+// 会话与准入的类型
+// ==============================================================================
+
+/** 默认的会话形状。够用于「一条记录属于一个人」的场景。 */
+
+/**
+ * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
+ * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
+ */
+
+/** can 返回它表示拒绝，可自定状态码与文案；返回 false 等价于 { status: 403 }。 */
+
+var DEFAULT_SCOPE_COLUMN = "creatorId";
+
+// ==============================================================================
+// 作用域解析
+// ==============================================================================
+
+/**
+ * 把会话读取包成「本次请求最多取一次」的取值器。
+ *
+ * 会话在一次请求里可能被好几处要：作用域要它算归属、can 要它判角色、PUT 还要它填 editorId。
+ * 各自去调 getSession 就是重复往返；预先无条件取一次，则公开端点（关掉隔离的那些）要白付一次
+ * 读取。包一层惰性缓存之后两个问题一起没了 —— 谁要谁调，取不取由用不用决定，不必谁去传一个
+ * 「要不要取」的开关。
+ */
+export function sessionLoader(getSession, req) {
+  var pending;
+  return function () {
+    var _pending;
+    return (_pending = pending) !== null && _pending !== void 0 ? _pending : pending = getSession(req);
+  };
+}
+
+/**
+ * 解析这次请求的会话、作用域与准入。
+ *
+ * **失败一律抛，不降级。** 会话拿不到就是 401、作用域取不到值就是 403 —— 绝不把一个空值
+ * 往下传。这条是本次改动的核心：在此之前空值会一路流到查询构造器，被「空值跳过筛选」那条
+ * 规则吃掉，结果是列表返回全表、删除按 id 删任意行。
+ */
+export function resolveAccess(_x) {
+  return _resolveAccess.apply(this, arguments);
+}
+
+// ==============================================================================
+// 动作工厂
+// ==============================================================================
+function _resolveAccess() {
+  _resolveAccess = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref) {
+    var _access$byCreator, _access$scope$column, _access$scope;
+    var access, loadSession, method, wantsScope, session, verdict, _denial$status, _denial$message, denial, column, value;
+    return _regeneratorRuntime().wrap(function _callee$(_context) {
+      while (1) switch (_context.prev = _context.next) {
+        case 0:
+          access = _ref.access, loadSession = _ref.loadSession, method = _ref.method;
+          wantsScope = Boolean(access === null || access === void 0 ? void 0 : access.scope) || ((_access$byCreator = access === null || access === void 0 ? void 0 : access.byCreator) !== null && _access$byCreator !== void 0 ? _access$byCreator : true); // 不需要就不取：关掉隔离的路由（多半是公开端点）不该为此白付一次会话读取。
+          if (!(wantsScope || access !== null && access !== void 0 && access.can)) {
+            _context.next = 8;
+            break;
+          }
+          _context.next = 5;
+          return loadSession();
+        case 5:
+          _context.t0 = _context.sent;
+          _context.next = 9;
+          break;
+        case 8:
+          _context.t0 = undefined;
+        case 9:
+          session = _context.t0;
+          if (!(access !== null && access !== void 0 && access.can)) {
+            _context.next = 19;
+            break;
+          }
+          if (session) {
+            _context.next = 13;
+            break;
+          }
+          throw new HttpError(401, "未登录");
+        case 13:
+          _context.next = 15;
+          return access.can({
+            method: method,
+            session: session
+          });
+        case 15:
+          verdict = _context.sent;
+          if (!(verdict !== true)) {
+            _context.next = 19;
+            break;
+          }
+          denial = _typeof(verdict) === "object" ? verdict : {};
+          throw new HttpError((_denial$status = denial.status) !== null && _denial$status !== void 0 ? _denial$status : 403, (_denial$message = denial.message) !== null && _denial$message !== void 0 ? _denial$message : "没有权限");
+        case 19:
+          if (wantsScope) {
+            _context.next = 21;
+            break;
+          }
+          return _context.abrupt("return", {
+            scope: NO_SCOPE,
+            session: session
+          });
+        case 21:
+          if (session) {
+            _context.next = 23;
+            break;
+          }
+          throw new HttpError(401, "未登录");
+        case 23:
+          column = (_access$scope$column = access === null || access === void 0 || (_access$scope = access.scope) === null || _access$scope === void 0 ? void 0 : _access$scope.column) !== null && _access$scope$column !== void 0 ? _access$scope$column : DEFAULT_SCOPE_COLUMN;
+          value = access !== null && access !== void 0 && access.scope ? access.scope.value(session) : session.userId;
+          if (!isEmptyScopeValue(value)) {
+            _context.next = 27;
+            break;
+          }
+          throw new HttpError(403, "\u65E0\u6CD5\u786E\u5B9A\u8FD9\u6B21\u8BF7\u6C42\u7684\u5F52\u5C5E\uFF08".concat(column, "\uFF09\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u505A\u9694\u79BB\u300D\u2014\u2014\u8BF7\u6C42\u88AB\u62D2\u7EDD\u3002"));
+        case 27:
+          return _context.abrupt("return", {
+            scope: {
+              column: column,
+              value: value
+            },
+            session: session
+          });
+        case 28:
+        case "end":
+          return _context.stop();
+      }
+    }, _callee);
+  }));
+  return _resolveAccess.apply(this, arguments);
+} // ==============================================================================
+// 错误处理
+// ==============================================================================
 function isHttpLikeError(error) {
   return error instanceof Error && error.name === "HttpError" && typeof error.status === "number";
 }
-export function handleOperationError(_x, _x2) {
+export function handleOperationError(_x2, _x3) {
   return _handleOperationError.apply(this, arguments);
 }
+
+// ==============================================================================
+// 请求体与标签
+// ==============================================================================
 function _handleOperationError() {
-  _handleOperationError = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(error, catchHandler) {
+  _handleOperationError = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(error, catchHandler) {
     var response;
-    return _regeneratorRuntime().wrap(function _callee$(_context) {
-      while (1) switch (_context.prev = _context.next) {
+    return _regeneratorRuntime().wrap(function _callee2$(_context2) {
+      while (1) switch (_context2.prev = _context2.next) {
         case 0:
           if (!isHttpLikeError(error)) {
             console.error(error);
           }
-          _context.next = 3;
+          _context2.next = 3;
           return catchHandler === null || catchHandler === void 0 ? void 0 : catchHandler(error);
         case 3:
-          response = _context.sent;
+          response = _context2.sent;
           if (!response) {
-            _context.next = 6;
+            _context2.next = 6;
             break;
           }
-          return _context.abrupt("return", response);
+          return _context2.abrupt("return", response);
         case 6:
           if (!isHttpLikeError(error)) {
-            _context.next = 8;
+            _context2.next = 8;
             break;
           }
-          return _context.abrupt("return", TypedNextResponse.json({
+          return _context2.abrupt("return", TypedNextResponse.json({
             message: error.message
           }, {
             status: error.status
@@ -46,103 +189,109 @@ function _handleOperationError() {
           throw error;
         case 9:
         case "end":
-          return _context.stop();
+          return _context2.stop();
       }
-    }, _callee);
+    }, _callee2);
   }));
   return _handleOperationError.apply(this, arguments);
 }
-export function readPostBody(_x3, _x4) {
+export function readPostBody(_x4, _x5) {
   return _readPostBody.apply(this, arguments);
 }
 function _readPostBody() {
-  _readPostBody = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req, _ref) {
+  _readPostBody = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req, _ref2) {
     var contentType, parseBody;
-    return _regeneratorRuntime().wrap(function _callee2$(_context2) {
-      while (1) switch (_context2.prev = _context2.next) {
+    return _regeneratorRuntime().wrap(function _callee3$(_context3) {
+      while (1) switch (_context3.prev = _context3.next) {
         case 0:
-          contentType = _ref.contentType, parseBody = _ref.parseBody;
+          contentType = _ref2.contentType, parseBody = _ref2.parseBody;
           if (!parseBody) {
-            _context2.next = 3;
+            _context3.next = 3;
             break;
           }
-          return _context2.abrupt("return", parseBody(req));
+          return _context3.abrupt("return", parseBody(req));
         case 3:
           if (!(contentType === "multipart/form-data")) {
-            _context2.next = 9;
+            _context3.next = 9;
             break;
           }
-          _context2.t0 = Object;
-          _context2.next = 7;
+          _context3.t0 = Object;
+          _context3.next = 7;
           return req.formData();
         case 7:
-          _context2.t1 = _context2.sent;
-          return _context2.abrupt("return", _context2.t0.fromEntries.call(_context2.t0, _context2.t1));
+          _context3.t1 = _context3.sent;
+          return _context3.abrupt("return", _context3.t0.fromEntries.call(_context3.t0, _context3.t1));
         case 9:
-          _context2.next = 11;
+          _context3.next = 11;
           return req.json();
         case 11:
-          return _context2.abrupt("return", _context2.sent);
+          return _context3.abrupt("return", _context3.sent);
         case 12:
         case "end":
-          return _context2.stop();
+          return _context3.stop();
       }
-    }, _callee2);
+    }, _callee3);
   }));
   return _readPostBody.apply(this, arguments);
 }
-export function getDefaultTags(_ref2) {
-  var getTableName = _ref2.getTableName,
-    table = _ref2.table;
+export function getDefaultTags(_ref3) {
+  var getTableName = _ref3.getTableName,
+    table = _ref3.table;
   return table ? [getTableName(table)] : [];
 }
-export function getReadParams(_x5) {
+
+// ==============================================================================
+// 读操作的参数
+// ==============================================================================
+
+/**
+ * 读操作的参数与作用域。
+ *
+ * 注意作用域**不进 params**：params 会被查询构造器当筛选条件处理，而那里的规矩是「空值跳过」。
+ * 作用域走单独一条通道交给 action，见 scope.ts 顶部第 1 条。
+ */
+export function getReadParams(_x6) {
   return _getReadParams.apply(this, arguments);
 }
 function _getReadParams() {
-  _getReadParams = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(_ref3) {
-    var _access$byCreator;
-    var access, getSession, req, schemas, setParams, extraParams, _ref4, userId, queryParams;
-    return _regeneratorRuntime().wrap(function _callee3$(_context3) {
-      while (1) switch (_context3.prev = _context3.next) {
+  _getReadParams = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee4(_ref4) {
+    var access, getSession, req, schemas, setParams, extraParams, _yield$resolveAccess, scope, session, queryParams;
+    return _regeneratorRuntime().wrap(function _callee4$(_context4) {
+      while (1) switch (_context4.prev = _context4.next) {
         case 0:
-          access = _ref3.access, getSession = _ref3.getSession, req = _ref3.req, schemas = _ref3.schemas, setParams = _ref3.setParams;
-          _context3.next = 3;
+          access = _ref4.access, getSession = _ref4.getSession, req = _ref4.req, schemas = _ref4.schemas, setParams = _ref4.setParams;
+          _context4.next = 3;
           return setParams === null || setParams === void 0 ? void 0 : setParams(req);
         case 3:
-          _context3.t0 = _context3.sent;
-          if (_context3.t0) {
-            _context3.next = 6;
+          _context4.t0 = _context4.sent;
+          if (_context4.t0) {
+            _context4.next = 6;
             break;
           }
-          _context3.t0 = {};
+          _context4.t0 = {};
         case 6:
-          extraParams = _context3.t0;
-          if (!((_access$byCreator = access === null || access === void 0 ? void 0 : access.byCreator) !== null && _access$byCreator !== void 0 ? _access$byCreator : true)) {
-            _context3.next = 16;
-            break;
-          }
-          _context3.next = 10;
-          return getSession(req);
-        case 10:
-          _context3.t1 = _context3.sent;
-          if (_context3.t1) {
-            _context3.next = 13;
-            break;
-          }
-          _context3.t1 = {};
-        case 13:
-          _ref4 = _context3.t1;
-          userId = _ref4.userId;
-          extraParams.creatorId = userId;
-        case 16:
+          extraParams = _context4.t0;
+          _context4.next = 9;
+          return resolveAccess({
+            access: access,
+            loadSession: sessionLoader(getSession, req),
+            method: "GET"
+          });
+        case 9:
+          _yield$resolveAccess = _context4.sent;
+          scope = _yield$resolveAccess.scope;
+          session = _yield$resolveAccess.session;
           queryParams = schemas.query.parse(Object.fromEntries(new URL(req.url).searchParams));
-          return _context3.abrupt("return", _objectSpread(_objectSpread({}, queryParams), extraParams));
-        case 18:
+          return _context4.abrupt("return", {
+            params: _objectSpread(_objectSpread({}, queryParams), extraParams),
+            scope: scope,
+            session: session
+          });
+        case 14:
         case "end":
-          return _context3.stop();
+          return _context4.stop();
       }
-    }, _callee3);
+    }, _callee4);
   }));
   return _getReadParams.apply(this, arguments);
 }

package/es/backend/route-operation/post-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createPostOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/es/backend/route-operation/put-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createPutOperation: ({ getSession, db, }: {
         userId?: string;
     } | undefined>;
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;