@ai0x0/utils 0.0.50 → 0.1.0

package/.agents/skills/ai0x0-utils/backend/SKILL.md

@@ -48,7 +48,7 @@ export {
   createTableSchema,
   queryListSchema,
   listBodySchema,
-} from "@ai0x0/utils/lib/backend/schemas";
+} from "@ai0x0/utils/backend/schemas";
 ```
 
 ```ts
@@ -59,7 +59,7 @@ export {
   createGetListAction,
   createPostAction,
   createPutAction,
-} from "@ai0x0/utils/lib/backend/actions";
+} from "@ai0x0/utils/backend";
 ```
 
 ```ts
@@ -70,7 +70,7 @@ import {
   createPostOperation,
   createDeleteOperation,
   createGetListOperation,
-} from "@ai0x0/utils/lib/backend";
+} from "@ai0x0/utils/backend";
 import { db } from "@backend/db";
 import getSession from "@backend/utils/get-session";
 
@@ -330,8 +330,13 @@ export const { GET } = route({
 ## Built-in Conventions
 
 - **Base fields** auto-added by `createTableSchema`: `id` (uuid, pk, default random) / `creatorId` / `editorId` / `accessedAt` / `createdAt` / `updatedAt`.
-- **Ownership check**: with `access: { byCreator: true }` (default on PUT/DELETE/GET), PUT/DELETE pre-fetch the row filtered by `creatorId = session.userId` and throw `"未找到…对象，或没有权限"` if missing. Set `access: { byCreator: false }` to skip (e.g. admin endpoints).
-- **Auto injection**: POST writes `creatorId = session.userId`; PUT writes `editorId = session.userId`; GET/GET_LIST append `creatorId = session.userId` to the filter when `access.byCreator` is on.
+- **Row-level scope** (`access`, on by default for every verb): the request may only see / touch rows whose scope column matches. Three knobs:
+  - `byCreator?: boolean` — the old spelling, equivalent to `scope: { column: "creatorId", value: (s) => s.userId }`. Default `true`.
+  - `scope?: { column?, value }` — pick the column (default `creatorId`) and derive the value from the session. Return an array for `IN (...)`. Use this when a row can belong to something other than one user (a team, a workspace).
+  - `can?: ({ session, method }) => boolean | { status?, message? }` — the _action_ gate, as opposed to the _row_ filter. Read-only roles belong here, in one place, not spread across every route.
+- **Fail closed**: if the session is missing → 401; if `scope.value` returns empty → 403. A scope that cannot be resolved is **never** downgraded to "no filter". PUT/DELETE put the scope straight into the `UPDATE`/`DELETE` `where` (one statement, no read-then-write window) and return 404 when it affects zero rows — "does not exist" and "not yours" are deliberately indistinguishable, otherwise the endpoint becomes an existence oracle.
+- **Auto injection**: POST stamps the scope column with the scope value (by default that is `creatorId = session.userId`); PUT writes `editorId = session.userId`; GET/GET_LIST apply the scope as a mandatory `where`.
+- **Session shape** is yours: `getSession` is generic, so resolve "who + which space + what role" once and let `scope.value` / `can` read the same object instead of each querying again.
 - **Date coercion**: any body field ending in `At` is passed through `dayjs(value).toDate()` before write — accept ISO strings from clients.
 - **List filtering** (all querystring values are strings):
   - `key=a,b,c` → `IN (...)` when key ends with `Id`; otherwise `OR ILIKE %a% OR ILIKE %b%`
@@ -352,6 +357,26 @@ export const { GET } = route({
 - Swallowing errors: an unhandled throw in a handler propagates to next-rest-framework as a 500. Provide `catch` for any operation exposed to untrusted clients.
 - For non-CRUD behavior (middleware chains, streaming, custom `TypedNextResponse` unions, RPC) stop using these factories and switch to the `create-next-rest-framework-api` skill.
 
+## Using the actions directly
+
+`createGetAction` / `createGetListAction` / `createPutAction` / `createDeleteAction` and `getListQuery` all take the scope as a **required** argument — pass `NO_SCOPE` to opt out explicitly:
+
+```ts
+import { NO_SCOPE } from "@ai0x0/utils/backend";
+
+await createGetListAction({ bodySchema, db, table })(params, {
+  scope: NO_SCOPE,
+});
+await createDeleteAction({ db, table })(
+  { id },
+  {
+    scope: { column: "ownerId", value: currentTeamId },
+  },
+);
+```
+
+It is required rather than optional on purpose: a forgotten scope is a compile error, not a silent full-table query.
+
 ## Escape Hatches
 
 - Extra server-side filters — `setParams(req) => Promise<Record<string, unknown>>` on GET/GET_LIST; returned keys are merged into the filter.
@@ -362,19 +387,18 @@ export const { GET } = route({
 ## Imports
 
 ```
-@ai0x0/utils/lib/backend                   // actions + route-operation + schemas (CJS, used by Next.js server bundle)
-@ai0x0/utils/lib/backend/actions
-@ai0x0/utils/lib/backend/route-operation
-@ai0x0/utils/lib/backend/schemas
+@ai0x0/utils/backend                       // actions + route-operation + schemas + scope
+@ai0x0/utils/backend/schemas               // createTableSchema / queryListSchema
+@ai0x0/utils/backend/sqlite                // same surface, SQLite flavour
 ```
 
-ESM consumers can substitute `/es/backend/...` instead of `/lib/backend/...` when Next.js resolves the `exports` map that way; prefer `/lib/backend` in Next.js projects because the server bundle is CommonJS.
+The `exports` map picks CJS or ESM per consumer; you do not choose. **Do not write `@ai0x0/utils/es/backend/...` or `/lib/backend/...`** — those name build artifacts and hard-code an internal detail into every import. The `./es/*` and `./lib/*` wildcards stay only so existing callers keep working.
 
 ## Done Criteria
 
 - Route files contain zero hand-written `{ db, getSession }` wiring; all operations come from `@backend/utils/route-operation`.
 - Each domain has a `table.ts` (columns + `createTableSchema`) and an `index.ts` (five zod schemas + re-exports).
 - Every list endpoint accepts `current / pageSize / orderBy / orderDir / *AtFrom / *AtTo` and — where applicable — `jsonArrayFields` is declared.
-- `access.byCreator` is explicitly set when the endpoint is admin-facing or otherwise crosses ownership boundaries.
+- `access` is explicitly set when the endpoint is admin-facing or otherwise crosses ownership boundaries — `byCreator: false` for genuinely public data, `scope` when ownership is not "one user", `can` for read-only roles.
 - Non-CRUD endpoints are implemented via raw `routeOperation` + action helpers, not by forcing a CRUD factory.
 - `next-rest-framework validate` / `generate` (from the partner skill) still pass — the factory values are plain `RouteOperationDefinition` and participate in OpenAPI generation.

package/README.md

@@ -19,17 +19,17 @@ See [SKILL.md](./SKILL.md) for detailed workflow, setup, and escape hatches.
 
 ## SQLite Backend (`src/backend/sqlite/`)
 
-Projects that use a local SQLite database can import the same CRUD factory surface from `@ai0x0/utils/es/backend/sqlite`.
+Projects that use a local SQLite database can import the same CRUD factory surface from `@ai0x0/utils/backend/sqlite`.
 
 ```ts
 import {
   createTableSchema,
   queryListSchema,
-} from "@ai0x0/utils/es/backend/sqlite/schemas/index.js";
+} from "@ai0x0/utils/backend/sqlite/schemas";
 import {
   createGetOperation,
   createPostOperation,
-} from "@ai0x0/utils/es/backend/sqlite/index.js";
+} from "@ai0x0/utils/backend/sqlite";
 ```
 
 The SQLite helpers mirror the PostgreSQL helpers, but use `drizzle-orm/sqlite-core`, SQLite `LIKE`, and `json_each(...)` for JSON-array filtering.

package/SKILL.md

@@ -27,7 +27,7 @@ export {
   createTableSchema,
   queryListSchema,
   listBodySchema,
-} from "@ai0x0/utils/lib/backend/schemas";
+} from "@ai0x0/utils/backend/schemas";
 ```
 
 ```ts
@@ -38,7 +38,7 @@ export {
   createGetListAction,
   createPostAction,
   createPutAction,
-} from "@ai0x0/utils/lib/backend/actions";
+} from "@ai0x0/utils/backend";
 ```
 
 ```ts
@@ -49,7 +49,7 @@ import {
   createPostOperation,
   createDeleteOperation,
   createGetListOperation,
-} from "@ai0x0/utils/lib/backend";
+} from "@ai0x0/utils/backend";
 import { db } from "@backend/db";
 import getSession from "@backend/utils/get-session";
 
@@ -309,8 +309,13 @@ export const { GET } = route({
 ## Built-in Conventions
 
 - **Base fields** auto-added by `createTableSchema`: `id` (uuid, pk, default random) / `creatorId` / `editorId` / `accessedAt` / `createdAt` / `updatedAt`.
-- **Ownership check**: with `access: { byCreator: true }` (default on PUT/DELETE/GET), PUT/DELETE pre-fetch the row filtered by `creatorId = session.userId` and throw `"未找到…对象，或没有权限"` if missing. Set `access: { byCreator: false }` to skip (e.g. admin endpoints).
-- **Auto injection**: POST writes `creatorId = session.userId`; PUT writes `editorId = session.userId`; GET/GET_LIST append `creatorId = session.userId` to the filter when `access.byCreator` is on.
+- **Row-level scope** (`access`, on by default for every verb): the request may only see / touch rows whose scope column matches. Three knobs:
+  - `byCreator?: boolean` — the old spelling, equivalent to `scope: { column: "creatorId", value: (s) => s.userId }`. Default `true`.
+  - `scope?: { column?, value }` — pick the column (default `creatorId`) and derive the value from the session. Return an array for `IN (...)`. Use this when a row can belong to something other than one user (a team, a workspace).
+  - `can?: ({ session, method }) => boolean | { status?, message? }` — the _action_ gate, as opposed to the _row_ filter. Read-only roles belong here, in one place, not spread across every route.
+- **Fail closed**: if the session is missing → 401; if `scope.value` returns empty → 403. A scope that cannot be resolved is **never** downgraded to "no filter". PUT/DELETE put the scope straight into the `UPDATE`/`DELETE` `where` (one statement, no read-then-write window) and return 404 when it affects zero rows — "does not exist" and "not yours" are deliberately indistinguishable, otherwise the endpoint becomes an existence oracle.
+- **Auto injection**: POST stamps the scope column with the scope value (by default that is `creatorId = session.userId`); PUT writes `editorId = session.userId`; GET/GET_LIST apply the scope as a mandatory `where`.
+- **Session shape** is yours: `getSession` is generic, so resolve "who + which space + what role" once and let `scope.value` / `can` read the same object instead of each querying again.
 - **Date coercion**: any body field ending in `At` is passed through `dayjs(value).toDate()` before write — accept ISO strings from clients.
 - **List filtering** (all querystring values are strings):
   - `key=a,b,c` → `IN (...)` when key ends with `Id`; otherwise `OR ILIKE %a% OR ILIKE %b%`
@@ -331,6 +336,26 @@ export const { GET } = route({
 - Swallowing errors: an unhandled throw in a handler propagates to next-rest-framework as a 500. Provide `catch` for any operation exposed to untrusted clients.
 - For non-CRUD behavior (middleware chains, streaming, custom `TypedNextResponse` unions, RPC) stop using these factories and switch to the `create-next-rest-framework-api` skill.
 
+## Using the actions directly
+
+`createGetAction` / `createGetListAction` / `createPutAction` / `createDeleteAction` and `getListQuery` all take the scope as a **required** argument — pass `NO_SCOPE` to opt out explicitly:
+
+```ts
+import { NO_SCOPE } from "@ai0x0/utils/backend";
+
+await createGetListAction({ bodySchema, db, table })(params, {
+  scope: NO_SCOPE,
+});
+await createDeleteAction({ db, table })(
+  { id },
+  {
+    scope: { column: "ownerId", value: currentTeamId },
+  },
+);
+```
+
+It is required rather than optional on purpose: a forgotten scope is a compile error, not a silent full-table query.
+
 ## Escape Hatches
 
 - Extra server-side filters — `setParams(req) => Promise<Record<string, unknown>>` on GET/GET_LIST; returned keys are merged into the filter.
@@ -341,19 +366,18 @@ export const { GET } = route({
 ## Imports
 
 ```
-@ai0x0/utils/lib/backend                   // actions + route-operation + schemas (CJS, used by Next.js server bundle)
-@ai0x0/utils/lib/backend/actions
-@ai0x0/utils/lib/backend/route-operation
-@ai0x0/utils/lib/backend/schemas
+@ai0x0/utils/backend                       // actions + route-operation + schemas + scope
+@ai0x0/utils/backend/schemas               // createTableSchema / queryListSchema
+@ai0x0/utils/backend/sqlite                // same surface, SQLite flavour
 ```
 
-ESM consumers can substitute `/es/backend/...` instead of `/lib/backend/...` when Next.js resolves the `exports` map that way; prefer `/lib/backend` in Next.js projects because the server bundle is CommonJS.
+The `exports` map picks CJS or ESM per consumer; you do not choose. **Do not write `@ai0x0/utils/es/backend/...` or `/lib/backend/...`** — those name build artifacts and hard-code an internal detail into every import. The `./es/*` and `./lib/*` wildcards stay only so existing callers keep working.
 
 ## Done Criteria
 
 - Route files contain zero hand-written `{ db, getSession }` wiring; all operations come from `@backend/utils/route-operation`.
 - Each domain has a `table.ts` (columns + `createTableSchema`) and an `index.ts` (five zod schemas + re-exports).
 - Every list endpoint accepts `current / pageSize / orderBy / orderDir / *AtFrom / *AtTo` and — where applicable — `jsonArrayFields` is declared.
-- `access.byCreator` is explicitly set when the endpoint is admin-facing or otherwise crosses ownership boundaries.
+- `access` is explicitly set when the endpoint is admin-facing or otherwise crosses ownership boundaries — `byCreator: false` for genuinely public data, `scope` when ownership is not "one user", `can` for read-only roles.
 - Non-CRUD endpoints are implemented via raw `routeOperation` + action helpers, not by forcing a CRUD factory.
 - `next-rest-framework validate` / `generate` (from the partner skill) still pass — the factory values are plain `RouteOperationDefinition` and participate in OpenAPI generation.

package/es/backend/actions/create-delete-action.d.ts

@@ -1,9 +1,11 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createDeleteAction<TTable extends BaseTable>({ table, db, }: {
     db: NodePgDatabase<Record<string, unknown>>;
     table: TTable;
-}): ({ id, creatorId }: {
+}): ({ id }: {
     id: string;
-    creatorId?: string | undefined;
+}, { scope }: {
+    scope: ScopeArg;
 }) => Promise<TTable["$inferSelect"] extends infer T ? T extends TTable["$inferSelect"] ? T extends undefined ? QueryResult<import("drizzle-orm").Assume<this["row"], QueryResultRow>> : T[] : never : never>;

package/es/backend/actions/create-delete-action.js

@@ -2,53 +2,47 @@ function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" ==
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-import { eq } from "drizzle-orm";
-import { createGetAction } from "./../index.js";
-import { z } from "zod";
+import { and, eq } from "drizzle-orm";
+import { NO_SCOPE, scopeCondition } from "../scope.js";
 import { HttpError } from "../errors.js";
 export function createDeleteAction(_ref) {
   var table = _ref.table,
     db = _ref.db;
   return /*#__PURE__*/function () {
-    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref2) {
-      var id, creatorId, data;
+    var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref2, _ref3) {
+      var id, scope, guard, rows;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            id = _ref2.id, creatorId = _ref2.creatorId;
-            if (!creatorId) {
-              _context.next = 7;
+            id = _ref2.id;
+            scope = _ref3.scope;
+            if (id) {
+              _context.next = 4;
               break;
             }
-            _context.next = 4;
-            return createGetAction({
-              db: db,
-              table: table,
-              bodySchema: z.object({
-                creatorId: z.string(),
-                id: z.string()
-              })
-            })({
-              creatorId: creatorId,
-              id: id
-            });
+            throw new HttpError(400, "缺少 id");
           case 4:
-            data = _context.sent;
-            if (data) {
-              _context.next = 7;
+            // 归属写进 DELETE 的 where，不先查后删（理由同 create-put-action）。
+            guard = scopeCondition(table, scope);
+            _context.next = 7;
+            return db.delete(table).where(guard ? and(eq(table.id, id), guard) : eq(table.id, id)).returning();
+          case 7:
+            rows = _context.sent;
+            if (!(rows.length === 0 && scope !== NO_SCOPE)) {
+              _context.next = 10;
               break;
             }
             throw new HttpError(404, "未找到删除对象，或没有权限");
-          case 7:
-            return _context.abrupt("return", db.delete(table).where(eq(table.id, id)).returning());
-          case 8:
+          case 10:
+            return _context.abrupt("return", rows);
+          case 11:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref3.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref4.apply(this, arguments);
     };
   }();
 }

package/es/backend/actions/create-get-action.d.ts

@@ -1,10 +1,13 @@
 import { z, ZodSchema } from "zod";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable, GetListRelations } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createGetAction<T extends ZodSchema, TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Partial<z.infer<T>> & Record<string, unknown>) => Promise<z.core.output<T> | undefined>;
+}): (params: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<z.core.output<T> | undefined>;

package/es/backend/actions/create-get-action.js

@@ -17,16 +17,15 @@ export function createGetAction(_ref) {
     relations = _ref.relations,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params) {
-      var fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery, _yield$getListData, _yield$getListData$da, result;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params, _ref2) {
+      var scope, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery, _yield$getListData, _yield$getListData$da, result;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            fields = {}; // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore
+            scope = _ref2.scope;
+            fields = {}; // @ts-ignore
             for (_i = 0, _Object$keys = Object.keys(bodySchema.shape); _i < _Object$keys.length; _i++) {
               key = _Object$keys[_i];
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
               // @ts-ignore
               field = table[key];
               if (field) {
@@ -39,9 +38,10 @@ export function createGetAction(_ref) {
               jsonArrayFields: jsonArrayFields,
               params: params,
               relations: relations,
+              scope: scope,
               table: table
             }), query = _getListQuery.query, countQuery = _getListQuery.countQuery;
-            _context.next = 5;
+            _context.next = 6;
             return getListData({
               bodySchema: bodySchema,
               countQuery: countQuery,
@@ -49,19 +49,19 @@ export function createGetAction(_ref) {
               pageSize: 1,
               query: query
             })();
-          case 5:
+          case 6:
             _yield$getListData = _context.sent;
             _yield$getListData$da = _slicedToArray(_yield$getListData.data, 1);
             result = _yield$getListData$da[0];
             return _context.abrupt("return", result);
-          case 9:
+          case 10:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/actions/create-get-list-action.d.ts

@@ -1,13 +1,16 @@
 import { z, ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { ScopeArg } from "../scope.js";
 export declare function createGetListAction<T extends ZodSchema, TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Partial<z.infer<T>> & Record<string, unknown>) => Promise<{
+}): (params: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<{
     data: any;
     total: number;
 }>;

package/es/backend/actions/create-get-list-action.js

@@ -14,17 +14,16 @@ export function createGetListAction(_ref) {
     relations = _ref.relations,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params) {
-      var _ref3, current, pageSize, other, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params, _ref2) {
+      var scope, _ref4, current, pageSize, other, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            _ref3 = params, current = _ref3.current, pageSize = _ref3.pageSize, other = _objectWithoutProperties(_ref3, _excluded);
-            fields = {}; // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-            // @ts-ignore
+            scope = _ref2.scope;
+            _ref4 = params, current = _ref4.current, pageSize = _ref4.pageSize, other = _objectWithoutProperties(_ref4, _excluded);
+            fields = {}; // @ts-ignore
             for (_i = 0, _Object$keys = Object.keys(bodySchema.shape); _i < _Object$keys.length; _i++) {
               key = _Object$keys[_i];
-              // eslint-disable-next-line @typescript-eslint/ban-ts-comment
               // @ts-ignore
               field = table[key];
               if (field) {
@@ -37,6 +36,7 @@ export function createGetListAction(_ref) {
               jsonArrayFields: jsonArrayFields,
               params: other,
               relations: relations,
+              scope: scope,
               table: table
             }), query = _getListQuery.query, countQuery = _getListQuery.countQuery;
             return _context.abrupt("return", getListData({
@@ -46,14 +46,14 @@ export function createGetListAction(_ref) {
               pageSize: pageSize,
               query: query
             })());
-          case 5:
+          case 6:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/actions/create-put-action.d.ts

@@ -1,10 +1,11 @@
 import { z, ZodSchema } from "zod";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createPutAction<T extends ZodSchema, TTable extends BaseTable>({ db, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     table: TTable;
-}): (body: Partial<z.infer<T>> & Record<string, unknown>, { byCreator, }?: {
-    byCreator?: boolean | undefined;
+}): (body: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
 }) => Promise<z.infer<T>>;

package/es/backend/actions/create-put-action.js

@@ -8,58 +8,43 @@ function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" !=
 function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-import { z } from "zod";
 import { transformBody } from "./transform-body.js";
-import { eq } from "drizzle-orm";
-import { createGetAction } from "./../index.js";
+import { and, eq } from "drizzle-orm";
+import { NO_SCOPE, scopeCondition } from "../scope.js";
 import { HttpError } from "../errors.js";
 export function createPutAction(_ref) {
   var db = _ref.db,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(body) {
-      var _ref3,
-        _ref3$byCreator,
-        byCreator,
-        _data,
-        _yield$db$update$set$,
-        _yield$db$update$set$2,
-        data,
-        _args = arguments;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(body, _ref2) {
+      var scope, id, guard, _yield$db$update$set$, _yield$db$update$set$2, data;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            _ref3 = _args.length > 1 && _args[1] !== undefined ? _args[1] : {}, _ref3$byCreator = _ref3.byCreator, byCreator = _ref3$byCreator === void 0 ? true : _ref3$byCreator;
-            if (!byCreator) {
-              _context.next = 7;
+            scope = _ref2.scope;
+            id = body.id;
+            if (id) {
+              _context.next = 4;
               break;
             }
-            _context.next = 4;
-            return createGetAction({
-              db: db,
-              table: table,
-              bodySchema: z.object({
-                creatorId: z.string(),
-                id: z.string()
-              })
-            })({
-              creatorId: body.editorId,
-              id: body.id
-            });
+            throw new HttpError(400, "缺少 id");
           case 4:
-            _data = _context.sent;
-            if (_data) {
-              _context.next = 7;
-              break;
-            }
-            throw new HttpError(404, "未找到编辑对象，或没有权限");
+            // 归属条件直接写进 UPDATE 的 where，而不是「先查一次确认归属、再无条件更新」。
+            // 先查后改有两个问题：多一次往返，以及那一查一改之间归属可能已经变了（转移给团队、
+            // 踢出成员）。一条语句里带上归属，改不到就是改不到。
+            guard = scopeCondition(table, scope);
+            _context.next = 7;
+            return db.update(table).set(transformBody(body)).where(guard ? and(eq(table.id, id), guard) : eq(table.id, id)).returning();
           case 7:
-            _context.next = 9;
-            return db.update(table).set(transformBody(body)).where(eq(table.id, body.id)).returning();
-          case 9:
             _yield$db$update$set$ = _context.sent;
             _yield$db$update$set$2 = _slicedToArray(_yield$db$update$set$, 1);
             data = _yield$db$update$set$2[0];
+            if (!(!data && scope !== NO_SCOPE)) {
+              _context.next = 12;
+              break;
+            }
+            throw new HttpError(404, "未找到编辑对象，或没有权限");
+          case 12:
             return _context.abrupt("return", data);
           case 13:
           case "end":
@@ -67,8 +52,8 @@ export function createPutAction(_ref) {
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/actions/get-list-query.d.ts

@@ -2,10 +2,17 @@ import { BaseTable, GetListRelations } from "../types.js";
 import { SelectedFields } from "drizzle-orm/pg-core/query-builders/select.types";
 import { SQL } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, table, }: {
+import { ScopeArg } from "../scope.js";
+export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, scope, table, }: {
     db: NodePgDatabase<Record<string, unknown>>;
     fields: TSelection;
     jsonArrayFields?: string[];
+    /**
+     * 行级作用域。**必填**，不想隔离就显式传 NO_SCOPE —— 写成可选的话，漏传就退化成查全表，
+     * 而那是静默的越权（见 scope.ts）。它不走下面 params 那条筛选通道，因为那条的规矩是
+     * 「空值跳过」，一个取不到值的作用域会让整条 where 消失。
+     */
+    scope: ScopeArg;
     params: {
         [field: string]: unknown;
         orderBy?: keyof BaseTable;