@ai0x0/utils 0.0.50 → 0.1.1

package/es/backend/scope.d.ts

@@ -0,0 +1,27 @@
+import { SQL } from "drizzle-orm";
+import { BaseTable } from "./types.js";
+/** 归属值：单个（等值匹配）或多个（IN）。 */
+export type ScopeValue = string | string[];
+/** 解析完的作用域：限定哪一列、限定成什么值。 */
+export interface ScopeCondition {
+    /** 承载归属的列名，如 "creatorId" / "ownerId"。 */
+    column: string;
+    value: ScopeValue;
+}
+/**
+ * 明确表示「这条查询不做行级隔离」。
+ *
+ * 用一个可辨识的值而不是 undefined：调用方漏传参数时 TypeScript 会报错，而不是悄悄
+ * 退化成「查全表」。凡是接受作用域的地方都必须收到 ScopeCondition 或 NO_SCOPE 之一。
+ */
+export declare const NO_SCOPE: null;
+export type ScopeArg = ScopeCondition | typeof NO_SCOPE;
+/** 空作用域值（undefined / 空串 / 空数组）—— 拿到它一律视为「解析失败」，不是「不筛」。 */
+export declare function isEmptyScopeValue(value: ScopeValue | undefined): value is undefined;
+/**
+ * 作用域 → drizzle 条件。NO_SCOPE 返回 undefined（调用方据此不加条件）。
+ *
+ * 列不在表上直接抛：这多半是配错了列名，而一个「配错了就不加条件」的实现等于把配置错误
+ * 变成越权漏洞。
+ */
+export declare function scopeCondition(table: BaseTable, scope: ScopeArg): SQL | undefined;

package/es/backend/scope.js

@@ -0,0 +1,60 @@
+import { eq, inArray } from "drizzle-orm";
+
+// ==============================================================================
+// 行级作用域
+// ==============================================================================
+// `access.byCreator` 原本把两件事写死了：**哪一列**承载归属（creatorId）、**取什么值**
+// （session.userId）。够用到出现「一条记录可能属于一个团队而不是一个人」为止 —— 那时归属列
+// 是 ownerId，值是「当前站在哪个空间」，两个维度都得放开。这个文件就是放开后的那个概念。
+//
+// 三条设计约束，改这里之前先读：
+//
+// 1) **作用域不是普通筛选条件。** get-list-query 里的筛选是「空值就跳过」（`if (!value)
+//    continue`），因为 `?name=` 这种空参数本来就该当没传。作用域走同一条路的话，一个取不到值
+//    的作用域会让整条 where 消失 —— 列表返回全表。所以作用域**单独一条通道**传到查询构造器，
+//    而且它没有「空值跳过」这一说：拿不到值就是错误，不是「不筛」。
+//
+// 2) **漏传和「明确不要」必须能区分。** 类型上作用域参数是必填的，不想要行级隔离就显式传
+//    NO_SCOPE。写成可选参数的话，漏传就退化成不隔离，而那是静默的越权。
+//
+// 3) **列不存在要当场炸。** 配错列名（比如表上根本没有 ownerId）如果只是「查不到东西」，
+//    症状是功能坏掉；但如果实现上退化成不加条件，症状就是越权。宁可抛。
+
+/** 归属值：单个（等值匹配）或多个（IN）。 */
+
+/** 解析完的作用域：限定哪一列、限定成什么值。 */
+
+/**
+ * 明确表示「这条查询不做行级隔离」。
+ *
+ * 用一个可辨识的值而不是 undefined：调用方漏传参数时 TypeScript 会报错，而不是悄悄
+ * 退化成「查全表」。凡是接受作用域的地方都必须收到 ScopeCondition 或 NO_SCOPE 之一。
+ */
+export var NO_SCOPE = null;
+/** 空作用域值（undefined / 空串 / 空数组）—— 拿到它一律视为「解析失败」，不是「不筛」。 */
+export function isEmptyScopeValue(value) {
+  if (value === undefined) {
+    return true;
+  }
+  return Array.isArray(value) ? value.length === 0 : value.trim() === "";
+}
+
+/**
+ * 作用域 → drizzle 条件。NO_SCOPE 返回 undefined（调用方据此不加条件）。
+ *
+ * 列不在表上直接抛：这多半是配错了列名，而一个「配错了就不加条件」的实现等于把配置错误
+ * 变成越权漏洞。
+ */
+export function scopeCondition(table, scope) {
+  if (scope === NO_SCOPE) {
+    return undefined;
+  }
+  var column = table[scope.column];
+  if (!column) {
+    throw new Error("\u4F5C\u7528\u57DF\u5217 \"".concat(scope.column, "\" \u4E0D\u5728\u8FD9\u5F20\u8868\u4E0A\u3002\u68C0\u67E5 access.scope.column \u662F\u5426\u5199\u9519\uFF0C\u6216\u8FD9\u5F20\u8868\u662F\u5426\u771F\u7684\u6709\u5F52\u5C5E\u5217\u3002"));
+  }
+  if (isEmptyScopeValue(scope.value)) {
+    throw new Error("\u4F5C\u7528\u57DF\u5217 \"".concat(scope.column, "\" \u62FF\u5230\u7684\u662F\u7A7A\u503C\u3002\u8FD9\u4E0D\u662F\u300C\u4E0D\u7B5B\u300D\u2014\u2014 \u4E0A\u6E38\u5E94\u5F53\u5728\u89E3\u6790\u9636\u6BB5\u5C31\u62D2\u7EDD\u8FD9\u4E2A\u8BF7\u6C42\u3002"));
+  }
+  return Array.isArray(scope.value) ? inArray(column, scope.value) : eq(column, scope.value);
+}

package/es/backend/sqlite/actions/create-delete-action.d.ts

@@ -1,8 +1,10 @@
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../../scope.js";
 export declare function createDeleteAction<TTable extends BaseTable>({ table, db, }: {
     db: any;
     table: TTable;
-}): ({ id, creatorId }: {
+}): ({ id }: {
     id: string;
-    creatorId?: string | undefined;
+}, { scope }: {
+    scope: ScopeArg;
 }) => Promise<any>;

package/es/backend/sqlite/actions/create-delete-action.js

@@ -2,53 +2,46 @@ function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" ==
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-import { eq } from "drizzle-orm";
-import { createGetAction } from "./../index.js";
-import { z } from "zod";
+import { and, eq } from "drizzle-orm";
+import { NO_SCOPE, scopeCondition } from "../../scope.js";
 import { HttpError } from "../errors.js";
 export function createDeleteAction(_ref) {
   var table = _ref.table,
     db = _ref.db;
   return /*#__PURE__*/function () {
-    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref2) {
-      var id, creatorId, data;
+    var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(_ref2, _ref3) {
+      var id, scope, guard, rows;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            id = _ref2.id, creatorId = _ref2.creatorId;
-            if (!creatorId) {
-              _context.next = 7;
+            id = _ref2.id;
+            scope = _ref3.scope;
+            if (id) {
+              _context.next = 4;
               break;
             }
-            _context.next = 4;
-            return createGetAction({
-              db: db,
-              table: table,
-              bodySchema: z.object({
-                creatorId: z.string(),
-                id: z.string()
-              })
-            })({
-              creatorId: creatorId,
-              id: id
-            });
+            throw new HttpError(400, "缺少 id");
           case 4:
-            data = _context.sent;
-            if (data) {
-              _context.next = 7;
+            guard = scopeCondition(table, scope);
+            _context.next = 7;
+            return db.delete(table).where(guard ? and(eq(table.id, id), guard) : eq(table.id, id)).returning();
+          case 7:
+            rows = _context.sent;
+            if (!(rows.length === 0 && scope !== NO_SCOPE)) {
+              _context.next = 10;
               break;
             }
             throw new HttpError(404, "未找到删除对象，或没有权限");
-          case 7:
-            return _context.abrupt("return", db.delete(table).where(eq(table.id, id)).returning());
-          case 8:
+          case 10:
+            return _context.abrupt("return", rows);
+          case 11:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref3.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref4.apply(this, arguments);
     };
   }();
 }

package/es/backend/sqlite/actions/create-get-action.d.ts

@@ -1,3 +1,4 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 export declare function createGetAction<TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: any;
@@ -5,4 +6,6 @@ export declare function createGetAction<TTable extends BaseTable>({ bodySchema,
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Record<string, unknown>) => Promise<unknown>;
+}): (params: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<unknown>;

package/es/backend/sqlite/actions/create-get-action.js

@@ -17,11 +17,12 @@ export function createGetAction(_ref) {
     relations = _ref.relations,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params) {
-      var fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery, _yield$getListData, _yield$getListData$da, result;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params, _ref2) {
+      var scope, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery, _yield$getListData, _yield$getListData$da, result;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
+            scope = _ref2.scope;
             fields = {};
             for (_i = 0, _Object$keys = Object.keys(bodySchema.shape); _i < _Object$keys.length; _i++) {
               key = _Object$keys[_i];
@@ -35,10 +36,11 @@ export function createGetAction(_ref) {
               fields: fields,
               jsonArrayFields: jsonArrayFields,
               params: params,
+              scope: scope,
               relations: relations,
               table: table
             }), query = _getListQuery.query, countQuery = _getListQuery.countQuery;
-            _context.next = 5;
+            _context.next = 6;
             return getListData({
               bodySchema: bodySchema,
               countQuery: countQuery,
@@ -46,19 +48,19 @@ export function createGetAction(_ref) {
               pageSize: 1,
               query: query
             })();
-          case 5:
+          case 6:
             _yield$getListData = _context.sent;
             _yield$getListData$da = _slicedToArray(_yield$getListData.data, 1);
             result = _yield$getListData$da[0];
             return _context.abrupt("return", result);
-          case 9:
+          case 10:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/sqlite/actions/create-get-list-action.d.ts

@@ -1,3 +1,4 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 export declare function createGetListAction<TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: any;
@@ -5,7 +6,9 @@ export declare function createGetListAction<TTable extends BaseTable>({ bodySche
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Record<string, unknown>) => Promise<{
+}): (params: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<{
     data: unknown[];
     total: number;
 }>;

package/es/backend/sqlite/actions/create-get-list-action.js

@@ -14,12 +14,13 @@ export function createGetListAction(_ref) {
     relations = _ref.relations,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params) {
-      var _ref3, current, pageSize, other, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(params, _ref2) {
+      var scope, _ref4, current, pageSize, other, fields, _i, _Object$keys, key, field, _getListQuery, query, countQuery;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            _ref3 = params, current = _ref3.current, pageSize = _ref3.pageSize, other = _objectWithoutProperties(_ref3, _excluded);
+            scope = _ref2.scope;
+            _ref4 = params, current = _ref4.current, pageSize = _ref4.pageSize, other = _objectWithoutProperties(_ref4, _excluded);
             fields = {};
             for (_i = 0, _Object$keys = Object.keys(bodySchema.shape); _i < _Object$keys.length; _i++) {
               key = _Object$keys[_i];
@@ -33,6 +34,7 @@ export function createGetListAction(_ref) {
               fields: fields,
               jsonArrayFields: jsonArrayFields,
               params: other,
+              scope: scope,
               relations: relations,
               table: table
             }), query = _getListQuery.query, countQuery = _getListQuery.countQuery;
@@ -43,14 +45,14 @@ export function createGetListAction(_ref) {
               pageSize: pageSize,
               query: query
             })());
-          case 5:
+          case 6:
           case "end":
             return _context.stop();
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/sqlite/actions/create-put-action.d.ts

@@ -1,8 +1,9 @@
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../../scope.js";
 export declare function createPutAction<TTable extends BaseTable>({ db, table, }: {
     bodySchema: any;
     db: any;
     table: TTable;
-}): (body: Record<string, unknown>, { byCreator, }?: {
-    byCreator?: boolean | undefined;
+}): (body: Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
 }) => Promise<any>;

package/es/backend/sqlite/actions/create-put-action.js

@@ -8,58 +8,40 @@ function _iterableToArrayLimit(r, l) { var t = null == r ? null : "undefined" !=
 function _arrayWithHoles(arr) { if (Array.isArray(arr)) return arr; }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
-import { z } from "zod";
 import { transformBody } from "./transform-body.js";
-import { eq } from "drizzle-orm";
-import { createGetAction } from "./../index.js";
+import { and, eq } from "drizzle-orm";
+import { NO_SCOPE, scopeCondition } from "../../scope.js";
 import { HttpError } from "../errors.js";
 export function createPutAction(_ref) {
   var db = _ref.db,
     table = _ref.table;
   return /*#__PURE__*/function () {
-    var _ref2 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(body) {
-      var _ref3,
-        _ref3$byCreator,
-        byCreator,
-        _data,
-        _yield$db$update$set$,
-        _yield$db$update$set$2,
-        data,
-        _args = arguments;
+    var _ref3 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(body, _ref2) {
+      var scope, id, guard, _yield$db$update$set$, _yield$db$update$set$2, data;
       return _regeneratorRuntime().wrap(function _callee$(_context) {
         while (1) switch (_context.prev = _context.next) {
           case 0:
-            _ref3 = _args.length > 1 && _args[1] !== undefined ? _args[1] : {}, _ref3$byCreator = _ref3.byCreator, byCreator = _ref3$byCreator === void 0 ? true : _ref3$byCreator;
-            if (!byCreator) {
-              _context.next = 7;
+            scope = _ref2.scope;
+            id = body.id;
+            if (id) {
+              _context.next = 4;
               break;
             }
-            _context.next = 4;
-            return createGetAction({
-              db: db,
-              table: table,
-              bodySchema: z.object({
-                creatorId: z.string(),
-                id: z.string()
-              })
-            })({
-              creatorId: body.editorId,
-              id: body.id
-            });
+            throw new HttpError(400, "缺少 id");
           case 4:
-            _data = _context.sent;
-            if (_data) {
-              _context.next = 7;
-              break;
-            }
-            throw new HttpError(404, "未找到编辑对象，或没有权限");
+            guard = scopeCondition(table, scope);
+            _context.next = 7;
+            return db.update(table).set(transformBody(body)).where(guard ? and(eq(table.id, id), guard) : eq(table.id, id)).returning();
           case 7:
-            _context.next = 9;
-            return db.update(table).set(transformBody(body)).where(eq(table.id, body.id)).returning();
-          case 9:
             _yield$db$update$set$ = _context.sent;
             _yield$db$update$set$2 = _slicedToArray(_yield$db$update$set$, 1);
             data = _yield$db$update$set$2[0];
+            if (!(!data && scope !== NO_SCOPE)) {
+              _context.next = 12;
+              break;
+            }
+            throw new HttpError(404, "未找到编辑对象，或没有权限");
+          case 12:
             return _context.abrupt("return", data);
           case 13:
           case "end":
@@ -67,8 +49,8 @@ export function createPutAction(_ref) {
         }
       }, _callee);
     }));
-    return function (_x) {
-      return _ref2.apply(this, arguments);
+    return function (_x, _x2) {
+      return _ref3.apply(this, arguments);
     };
   }();
 }

package/es/backend/sqlite/actions/get-list-query.d.ts

@@ -1,9 +1,12 @@
+import { ScopeArg } from "../../scope.js";
 import { BaseTable, GetListRelations } from "../types.js";
 import { SelectedFields } from "drizzle-orm/sqlite-core/query-builders/select.types";
-export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, table, }: {
+export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, scope, relations, table, }: {
     db: any;
     fields: TSelection;
     jsonArrayFields?: string[];
+    /** 必填。与 pg 那套同义，见 backend/scope.ts。 */
+    scope: ScopeArg;
     params: {
         [field: string]: unknown;
         orderBy?: keyof BaseTable;

package/es/backend/sqlite/actions/get-list-query.js

@@ -20,12 +20,14 @@ function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol"
 function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
 function _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }
 function _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }
+import { scopeCondition } from "../../scope.js";
 import { and, asc, desc, eq, gte, like, inArray, lte, or, sql } from "drizzle-orm";
 export function getListQuery(_ref) {
   var db = _ref.db,
     fields = _ref.fields,
     jsonArrayFields = _ref.jsonArrayFields,
     params = _ref.params,
+    scope = _ref.scope,
     relations = _ref.relations,
     table = _ref.table;
   var _params$page = params.page,
@@ -175,15 +177,18 @@ export function getListQuery(_ref) {
   var baseQuery = buildBaseQuery(table, fields, relations);
 
   // 构建条件
-  var conditions = buildConditions(filters, table, relations);
+  // 作用域先加，且不受「空值跳过」那条规矩管（见 backend/scope.ts 第 1 条）。
+  var scopeSql = scopeCondition(table, scope);
+  var conditions = scopeSql ? [scopeSql] : [];
+  conditions.push.apply(conditions, _toConsumableArray(buildConditions(filters, table, relations)));
 
   // 构建主查询
-  var query = baseQuery.where(conditions.length > 0 ? and.apply(void 0, _toConsumableArray(conditions)) : undefined).orderBy(buildOrderBy(table, orderBy, orderDir)).limit(pageSize).offset((page - 1) * pageSize);
+  var query = baseQuery.where(conditions.length > 0 ? and.apply(void 0, conditions) : undefined).orderBy(buildOrderBy(table, orderBy, orderDir)).limit(pageSize).offset((page - 1) * pageSize);
 
   // 构建计数查询(优化后)
   var countQuery = db.select({
     count: sql(_templateObject3 || (_templateObject3 = _taggedTemplateLiteral(["COUNT(DISTINCT ", ")"])), table.id)
-  }).from(table).where(conditions.length > 0 ? and.apply(void 0, _toConsumableArray(conditions)) : undefined);
+  }).from(table).where(conditions.length > 0 ? and.apply(void 0, conditions) : undefined);
 
   // 添加关联
   if (relations !== null && relations !== void 0 && relations.length) {

package/es/backend/sqlite/route-operation/delete-operation.d.ts

@@ -10,4 +10,6 @@ export declare const createDeleteOperation: ({ db, getSession, }: {
     } | undefined>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/es/backend/sqlite/route-operation/get-list-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createGetListOperation: ({ db, getSession, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/sqlite/route-operation/get-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createGetOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/es/backend/sqlite/route-operation/post-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createPostOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/es/backend/sqlite/route-operation/put-operation.d.ts

@@ -8,4 +8,6 @@ export declare const createPutOperation: ({ getSession, db, }: {
         userId?: string;
     } | undefined>;
     db?: unknown;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, SQLiteTable<import("drizzle-orm/sqlite-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/lib/backend/actions/create-delete-action.d.ts

@@ -1,9 +1,11 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createDeleteAction<TTable extends BaseTable>({ table, db, }: {
     db: NodePgDatabase<Record<string, unknown>>;
     table: TTable;
-}): ({ id, creatorId }: {
+}): ({ id }: {
     id: string;
-    creatorId?: string | undefined;
+}, { scope }: {
+    scope: ScopeArg;
 }) => Promise<TTable["$inferSelect"] extends infer T ? T extends TTable["$inferSelect"] ? T extends undefined ? QueryResult<import("drizzle-orm").Assume<this["row"], QueryResultRow>> : T[] : never : never>;

package/lib/backend/actions/create-delete-action.js

@@ -23,28 +23,22 @@ __export(create_delete_action_exports, {
 });
 module.exports = __toCommonJS(create_delete_action_exports);
 var import_drizzle_orm = require("drizzle-orm");
-var import_backend = require("..");
-var import_zod = require("zod");
+var import_scope = require("../scope");
 var import_errors = require("../errors");
 function createDeleteAction({
   table,
   db
 }) {
-  return async ({ id, creatorId }) => {
-    if (creatorId) {
-      const data = await (0, import_backend.createGetAction)({
-        db,
-        table,
-        bodySchema: import_zod.z.object({
-          creatorId: import_zod.z.string(),
-          id: import_zod.z.string()
-        })
-      })({ creatorId, id });
-      if (!data) {
-        throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
-      }
+  return async ({ id }, { scope }) => {
+    if (!id) {
+      throw new import_errors.HttpError(400, "缺少 id");
     }
-    return db.delete(table).where((0, import_drizzle_orm.eq)(table.id, id)).returning();
+    const guard = (0, import_scope.scopeCondition)(table, scope);
+    const rows = await db.delete(table).where(guard ? (0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(table.id, id), guard) : (0, import_drizzle_orm.eq)(table.id, id)).returning();
+    if (rows.length === 0 && scope !== import_scope.NO_SCOPE) {
+      throw new import_errors.HttpError(404, "未找到删除对象，或没有权限");
+    }
+    return rows;
   };
 }
 // Annotate the CommonJS export names for ESM import in node:

package/lib/backend/actions/create-get-action.d.ts

@@ -1,10 +1,13 @@
 import { z, ZodSchema } from "zod";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable, GetListRelations } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createGetAction<T extends ZodSchema, TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Partial<z.infer<T>> & Record<string, unknown>) => Promise<z.core.output<T> | undefined>;
+}): (params: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<z.core.output<T> | undefined>;

package/lib/backend/actions/create-get-action.js

@@ -31,7 +31,7 @@ function createGetAction({
   relations,
   table
 }) {
-  return async (params) => {
+  return async (params, { scope }) => {
     const fields = {};
     for (const key of Object.keys(bodySchema.shape)) {
       const field = table[key];
@@ -45,6 +45,7 @@ function createGetAction({
       jsonArrayFields,
       params,
       relations,
+      scope,
       table
     });
     const {