@ai0x0/utils 0.0.50 → 0.1.1

package/lib/backend/actions/create-get-list-action.d.ts

@@ -1,13 +1,16 @@
 import { z, ZodSchema } from "zod";
 import { BaseTable, GetListRelations } from "../types.js";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { ScopeArg } from "../scope.js";
 export declare function createGetListAction<T extends ZodSchema, TTable extends BaseTable>({ bodySchema, db, jsonArrayFields, relations, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     jsonArrayFields?: string[];
     relations?: GetListRelations;
     table: TTable;
-}): (params: Partial<z.infer<T>> & Record<string, unknown>) => Promise<{
+}): (params: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
+}) => Promise<{
     data: any;
     total: number;
 }>;

package/lib/backend/actions/create-get-list-action.js

@@ -31,7 +31,7 @@ function createGetListAction({
   relations,
   table
 }) {
-  return async (params) => {
+  return async (params, { scope }) => {
     const { current, pageSize, ...other } = params;
     const fields = {};
     for (const key of Object.keys(bodySchema.shape)) {
@@ -46,6 +46,7 @@ function createGetListAction({
       jsonArrayFields,
       params: other,
       relations,
+      scope,
       table
     });
     return (0, import_get_list_data.getListData)({

package/lib/backend/actions/create-put-action.d.ts

@@ -1,10 +1,11 @@
 import { z, ZodSchema } from "zod";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { BaseTable } from "../types.js";
+import { ScopeArg } from "../scope.js";
 export declare function createPutAction<T extends ZodSchema, TTable extends BaseTable>({ db, table, }: {
     bodySchema: T;
     db: NodePgDatabase<Record<string, unknown>>;
     table: TTable;
-}): (body: Partial<z.infer<T>> & Record<string, unknown>, { byCreator, }?: {
-    byCreator?: boolean | undefined;
+}): (body: Partial<z.infer<T>> & Record<string, unknown>, { scope }: {
+    scope: ScopeArg;
 }) => Promise<z.infer<T>>;

package/lib/backend/actions/create-put-action.js

@@ -22,35 +22,24 @@ __export(create_put_action_exports, {
   createPutAction: () => createPutAction
 });
 module.exports = __toCommonJS(create_put_action_exports);
-var import_zod = require("zod");
 var import_transform_body = require("./transform-body");
 var import_drizzle_orm = require("drizzle-orm");
-var import_backend = require("..");
+var import_scope = require("../scope");
 var import_errors = require("../errors");
 function createPutAction({
   db,
   table
 }) {
-  return async (body, {
-    byCreator = true
-  } = {}) => {
-    if (byCreator) {
-      const data2 = await (0, import_backend.createGetAction)({
-        db,
-        table,
-        bodySchema: import_zod.z.object({
-          creatorId: import_zod.z.string(),
-          id: import_zod.z.string()
-        })
-      })({
-        creatorId: body.editorId,
-        id: body.id
-      });
-      if (!data2) {
-        throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
-      }
+  return async (body, { scope }) => {
+    const id = body.id;
+    if (!id) {
+      throw new import_errors.HttpError(400, "缺少 id");
+    }
+    const guard = (0, import_scope.scopeCondition)(table, scope);
+    const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where(guard ? (0, import_drizzle_orm.and)((0, import_drizzle_orm.eq)(table.id, id), guard) : (0, import_drizzle_orm.eq)(table.id, id)).returning();
+    if (!data && scope !== import_scope.NO_SCOPE) {
+      throw new import_errors.HttpError(404, "未找到编辑对象，或没有权限");
     }
-    const [data] = await db.update(table).set((0, import_transform_body.transformBody)(body)).where((0, import_drizzle_orm.eq)(table.id, body.id)).returning();
     return data;
   };
 }

package/lib/backend/actions/get-list-query.d.ts

@@ -2,10 +2,17 @@ import { BaseTable, GetListRelations } from "../types.js";
 import { SelectedFields } from "drizzle-orm/pg-core/query-builders/select.types";
 import { SQL } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, table, }: {
+import { ScopeArg } from "../scope.js";
+export declare function getListQuery<TTable extends BaseTable, TSelection extends SelectedFields>({ db, fields, jsonArrayFields, params, relations, scope, table, }: {
     db: NodePgDatabase<Record<string, unknown>>;
     fields: TSelection;
     jsonArrayFields?: string[];
+    /**
+     * 行级作用域。**必填**，不想隔离就显式传 NO_SCOPE —— 写成可选的话，漏传就退化成查全表，
+     * 而那是静默的越权（见 scope.ts）。它不走下面 params 那条筛选通道，因为那条的规矩是
+     * 「空值跳过」，一个取不到值的作用域会让整条 where 消失。
+     */
+    scope: ScopeArg;
     params: {
         [field: string]: unknown;
         orderBy?: keyof BaseTable;

package/lib/backend/actions/get-list-query.js

@@ -23,12 +23,14 @@ __export(get_list_query_exports, {
 });
 module.exports = __toCommonJS(get_list_query_exports);
 var import_drizzle_orm = require("drizzle-orm");
+var import_scope = require("../scope");
 function getListQuery({
   db,
   fields,
   jsonArrayFields,
   params,
   relations,
+  scope,
   table
 }) {
   const {
@@ -109,8 +111,9 @@ function getListQuery({
   function buildConditions(filters2, table2, relations2) {
     const conditions2 = [];
     for (const [key, value] of Object.entries(filters2)) {
-      if (!value)
+      if (!value) {
         continue;
+      }
       if (key.endsWith("AtFrom") || key.endsWith("AtTo")) {
         const baseFieldName = key.replace(/(AtFrom|AtTo)$/, "");
         const targetColumn2 = findTargetColumn(
@@ -118,8 +121,9 @@ function getListQuery({
           table2,
           relations2
         );
-        if (!targetColumn2)
+        if (!targetColumn2) {
           continue;
+        }
         if (key.endsWith("AtFrom")) {
           conditions2.push((0, import_drizzle_orm.gte)(targetColumn2, new Date(value)));
         } else if (key.endsWith("AtTo")) {
@@ -132,8 +136,9 @@ function getListQuery({
         table2,
         relations2
       );
-      if (!targetColumn)
+      if (!targetColumn) {
         continue;
+      }
       addCondition(conditions2, key, value, targetColumn);
     }
     return conditions2;
@@ -143,7 +148,9 @@ function getListQuery({
     return orderDir2 === "asc" ? (0, import_drizzle_orm.asc)(orderColumn) : (0, import_drizzle_orm.desc)(orderColumn);
   }
   const baseQuery = buildBaseQuery(table, fields, relations);
-  const conditions = buildConditions(filters, table, relations);
+  const scopeSql = (0, import_scope.scopeCondition)(table, scope);
+  const conditions = scopeSql ? [scopeSql] : [];
+  conditions.push(...buildConditions(filters, table, relations));
   const query = baseQuery.where(conditions.length > 0 ? (0, import_drizzle_orm.and)(...conditions) : void 0).orderBy(buildOrderBy(table, orderBy, orderDir)).limit(pageSize).offset((page - 1) * pageSize);
   const countQuery = db.select({ count: import_drizzle_orm.sql`COUNT(DISTINCT ${table.id})` }).from(table).where(conditions.length > 0 ? (0, import_drizzle_orm.and)(...conditions) : void 0);
   if (relations == null ? void 0 : relations.length) {

package/lib/backend/index.d.ts

@@ -2,3 +2,4 @@ export * from "./actions/index.js";
 export * from "./route-operation/index.js";
 export * from "./schemas/index.js";
 export * from "./errors.js";
+export * from "./scope.js";

package/lib/backend/index.js

@@ -20,10 +20,12 @@ __reExport(backend_exports, require("./actions"), module.exports);
 __reExport(backend_exports, require("./route-operation"), module.exports);
 __reExport(backend_exports, require("./schemas"), module.exports);
 __reExport(backend_exports, require("./errors"), module.exports);
+__reExport(backend_exports, require("./scope"), module.exports);
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ...require("./actions"),
   ...require("./route-operation"),
   ...require("./schemas"),
-  ...require("./errors")
+  ...require("./errors"),
+  ...require("./scope")
 });

package/lib/backend/route-operation/delete-operation.d.ts

@@ -11,4 +11,6 @@ export declare const createDeleteOperation: ({ db, getSession, }: {
     } | undefined>;
 }) => <B extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>> = import("zod").ZodObject<{
     id: import("zod").ZodString;
-}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;
+}, import("zod/v4/core").$strip>>({ table, schemas, access, openApiOperation, handler, catch: catchHandler, }: CoreDeleteOperationOptions<BaseTable, B, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"DELETE">;

package/lib/backend/route-operation/get-list-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createGetListOperation: ({ db, getSession, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: CoreGetListOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/get-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createGetOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+}) => <T extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, Q extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: CoreGetOperationOptions<T, Q, BaseTable, GetListRelations, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/operation-common.d.ts

@@ -1,11 +1,75 @@
 import { NextRequest } from "next/server";
 import { TypedNextRequest, TypedNextResponse } from "next-rest-framework";
 import { z, ZodSchema } from "zod";
+import { ScopeArg, ScopeValue } from "../scope.js";
 export type JsonResponse = ReturnType<(typeof TypedNextResponse)["json"]>;
 export type RouteCatch = (error: Error) => Promise<JsonResponse | undefined>;
-export type SessionGetter = (req: NextRequest) => Promise<{
+/** 默认的会话形状。够用于「一条记录属于一个人」的场景。 */
+export interface DefaultSession {
     userId?: string;
-} | undefined>;
+}
+/**
+ * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
+ * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
+ */
+export type SessionGetter<TSession = DefaultSession> = (req: NextRequest) => Promise<TSession | undefined>;
+export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE";
+/** can 返回它表示拒绝，可自定状态码与文案；返回 false 等价于 { status: 403 }。 */
+export interface AccessDenial {
+    status?: number;
+    message?: string;
+}
+export interface AccessOptions<TSession = DefaultSession> {
+    /**
+     * 老写法，等价于 `scope: { column: "creatorId", value: (s) => s.userId }`。
+     * 与 scope 同时给时以 scope 为准。
+     */
+    byCreator?: boolean;
+    /**
+     * 行级作用域：这次请求只能看到 / 只能动 `column` 等于（或属于）`value` 的那些行。
+     * column 不填默认 "creatorId"。
+     *
+     * value 拿不到值（会话没有、或返回空）时请求会被拒绝，**不会**退化成「不筛」——
+     * 那正是这套东西存在的意义，见 scope.ts 的说明。
+     */
+    scope?: {
+        column?: string;
+        value: (session: TSession) => ScopeValue | undefined;
+    };
+    /**
+     * 准入判断。作用域管「能看到哪些行」，这里管「能不能做这个动作」——比如只读角色不能写。
+     * 收在一处而不是散在各路由里：多一档角色时，散着写必然漏。
+     */
+    can?: (_ctx: {
+        session: TSession;
+        method: HttpMethod;
+    }) => boolean | AccessDenial | Promise<boolean | AccessDenial>;
+}
+/**
+ * 把会话读取包成「本次请求最多取一次」的取值器。
+ *
+ * 会话在一次请求里可能被好几处要：作用域要它算归属、can 要它判角色、PUT 还要它填 editorId。
+ * 各自去调 getSession 就是重复往返；预先无条件取一次，则公开端点（关掉隔离的那些）要白付一次
+ * 读取。包一层惰性缓存之后两个问题一起没了 —— 谁要谁调，取不取由用不用决定，不必谁去传一个
+ * 「要不要取」的开关。
+ */
+export declare function sessionLoader<TSession>(getSession: SessionGetter<TSession>, req: NextRequest): () => Promise<TSession | undefined>;
+/**
+ * 解析这次请求的会话、作用域与准入。
+ *
+ * **失败一律抛，不降级。** 会话拿不到就是 401、作用域取不到值就是 403 —— 绝不把一个空值
+ * 往下传。这条是本次改动的核心：在此之前空值会一路流到查询构造器，被「空值跳过筛选」那条
+ * 规则吃掉，结果是列表返回全表、删除按 id 删任意行。
+ */
+export declare function resolveAccess<TSession>({ access, loadSession, method, }: {
+    access?: AccessOptions<TSession>;
+    /** 见 sessionLoader —— 传取值器而不是 (getSession, req)，取不取由这里自己决定。 */
+    loadSession: () => Promise<TSession | undefined>;
+    method: HttpMethod;
+}): Promise<{
+    scope: ScopeArg;
+    session: TSession | undefined;
+}>;
 export type ActionFactory<TTable, TAction> = (_options: {
     bodySchema?: ZodSchema;
     db: unknown;
@@ -25,14 +89,22 @@ export declare function getDefaultTags<TTable>({ getTableName, table, }: {
 export type GetOperationParams<Q extends ZodSchema> = z.infer<Q> & Record<string, unknown> & {
     creatorId?: string;
 };
-export declare function getReadParams<Q extends ZodSchema>({ access, getSession, req, schemas, setParams, }: {
-    access?: {
-        byCreator?: boolean;
-    };
-    getSession: SessionGetter;
+/**
+ * 读操作的参数与作用域。
+ *
+ * 注意作用域**不进 params**：params 会被查询构造器当筛选条件处理，而那里的规矩是「空值跳过」。
+ * 作用域走单独一条通道交给 action，见 scope.ts 顶部第 1 条。
+ */
+export declare function getReadParams<Q extends ZodSchema, TSession>({ access, getSession, req, schemas, setParams, }: {
+    access?: AccessOptions<TSession>;
+    getSession: SessionGetter<TSession>;
     req: NextRequest;
     schemas: {
         query: Q;
     };
     setParams?: (_req: TypedNextRequest<"GET", "application/json", unknown, z.infer<Q>>) => Promise<Record<string, unknown>>;
-}): Promise<GetOperationParams<Q>>;
+}): Promise<{
+    params: GetOperationParams<Q>;
+    scope: ScopeArg;
+    session: TSession | undefined;
+}>;

package/lib/backend/route-operation/operation-common.js

@@ -22,10 +22,53 @@ __export(operation_common_exports, {
   getDefaultTags: () => getDefaultTags,
   getReadParams: () => getReadParams,
   handleOperationError: () => handleOperationError,
-  readPostBody: () => readPostBody
+  readPostBody: () => readPostBody,
+  resolveAccess: () => resolveAccess,
+  sessionLoader: () => sessionLoader
 });
 module.exports = __toCommonJS(operation_common_exports);
 var import_next_rest_framework = require("next-rest-framework");
+var import_errors = require("../errors");
+var import_scope = require("../scope");
+var DEFAULT_SCOPE_COLUMN = "creatorId";
+function sessionLoader(getSession, req) {
+  let pending;
+  return () => pending ?? (pending = getSession(req));
+}
+async function resolveAccess({
+  access,
+  loadSession,
+  method
+}) {
+  var _a;
+  const wantsScope = Boolean(access == null ? void 0 : access.scope) || ((access == null ? void 0 : access.byCreator) ?? true);
+  const session = wantsScope || (access == null ? void 0 : access.can) ? await loadSession() : void 0;
+  if (access == null ? void 0 : access.can) {
+    if (!session) {
+      throw new import_errors.HttpError(401, "未登录");
+    }
+    const verdict = await access.can({ method, session });
+    if (verdict !== true) {
+      const denial = typeof verdict === "object" ? verdict : {};
+      throw new import_errors.HttpError(denial.status ?? 403, denial.message ?? "没有权限");
+    }
+  }
+  if (!wantsScope) {
+    return { scope: import_scope.NO_SCOPE, session };
+  }
+  if (!session) {
+    throw new import_errors.HttpError(401, "未登录");
+  }
+  const column = ((_a = access == null ? void 0 : access.scope) == null ? void 0 : _a.column) ?? DEFAULT_SCOPE_COLUMN;
+  const value = (access == null ? void 0 : access.scope) ? access.scope.value(session) : session.userId;
+  if ((0, import_scope.isEmptyScopeValue)(value)) {
+    throw new import_errors.HttpError(
+      403,
+      `无法确定这次请求的归属（${column}）。这不是「不做隔离」——请求被拒绝。`
+    );
+  }
+  return { scope: { column, value }, session };
+}
 function isHttpLikeError(error) {
   return error instanceof Error && error.name === "HttpError" && typeof error.status === "number";
 }
@@ -72,19 +115,26 @@ async function getReadParams({
   const extraParams = await (setParams == null ? void 0 : setParams(
     req
   )) || {};
-  if ((access == null ? void 0 : access.byCreator) ?? true) {
-    const { userId } = await getSession(req) || {};
-    extraParams.creatorId = userId;
-  }
+  const { scope, session } = await resolveAccess({
+    access,
+    loadSession: sessionLoader(getSession, req),
+    method: "GET"
+  });
   const queryParams = schemas.query.parse(
     Object.fromEntries(new URL(req.url).searchParams)
   );
-  return { ...queryParams, ...extraParams };
+  return {
+    params: { ...queryParams, ...extraParams },
+    scope,
+    session
+  };
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   getDefaultTags,
   getReadParams,
   handleOperationError,
-  readPostBody
+  readPostBody,
+  resolveAccess,
+  sessionLoader
 });

package/lib/backend/route-operation/post-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createPostOperation: ({ getSession, db, }: {
     getSession(req: NextRequest): Promise<{
         userId?: string;
     } | undefined>;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: CorePostOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"POST">;

package/lib/backend/route-operation/put-operation.d.ts

@@ -9,4 +9,6 @@ export declare const createPutOperation: ({ getSession, db, }: {
         userId?: string;
     } | undefined>;
     db?: NodePgDatabase<Record<string, unknown>> | undefined;
-}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
+}) => <IB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>, OB extends ZodSchema<unknown, unknown, import("zod/v4/core").$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: CorePutOperationOptions<IB, OB, PgTable<import("drizzle-orm/pg-core").TableConfig>, {
+    userId?: string | undefined;
+}>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;

package/lib/backend/route-operation/read-operation-core.d.ts

@@ -2,15 +2,14 @@ import { NextRequest } from "next/server";
 import { TypedNextRequest } from "next-rest-framework";
 import { z, ZodSchema } from "zod";
 import { type RouteOpenApiOperation } from "./open-api-operation.js";
-import { ActionFactory, GetOperationParams, RouteCatch, SessionGetter } from "./operation-common.js";
-export interface GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable, TRelations> {
+import { AccessOptions, ActionFactory, DefaultSession, GetOperationParams, RouteCatch, SessionGetter } from "./operation-common.js";
+import { ScopeArg } from "../scope.js";
+export interface GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable, TRelations, TSession = DefaultSession> {
     schemas: {
         query: Q;
         response: T;
     };
-    access?: {
-        byCreator?: boolean;
-    };
+    access?: AccessOptions<TSession>;
     jsonArrayFields?: string[];
     relations?: TRelations;
     setParams?: (_req: TypedNextRequest<"GET", "application/json", unknown, z.infer<Q>>) => Promise<Record<string, unknown>>;
@@ -24,13 +23,15 @@ export interface GetOperationOptions<T extends ZodSchema, Q extends ZodSchema, T
     table?: TTable;
 }
 export declare function createGetOperationFactory<TTable, TRelations>({ createAction, getTableName, }: {
-    createAction: ActionFactory<TTable, (_params: Record<string, unknown>) => Promise<unknown | undefined>>;
+    createAction: ActionFactory<TTable, (_params: Record<string, unknown>, _options: {
+        scope: ScopeArg;
+    }) => Promise<unknown | undefined>>;
     getTableName(table: TTable): string;
-}): ({ db, getSession }: {
+}): <TSession = DefaultSession>({ db, getSession, }: {
     db?: unknown;
-    getSession: SessionGetter;
-}) => <T extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, Q extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: GetOperationOptions<T, Q, TTable, TRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
-export interface GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable, TRelations> extends Omit<GetOperationOptions<T, Q, TTable, TRelations>, "handler"> {
+    getSession: SessionGetter<TSession>;
+}) => <T extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, Q extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, setParams, jsonArrayFields, handler, catch: catchHandler, }: GetOperationOptions<T, Q, TTable, TRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+export interface GetListOperationOptions<T extends ZodSchema, Q extends ZodSchema, TTable, TRelations, TSession = DefaultSession> extends Omit<GetOperationOptions<T, Q, TTable, TRelations, TSession>, "handler"> {
     handler?: <D extends T>(_payload: {
         params: GetOperationParams<Q>;
         data: {
@@ -44,12 +45,14 @@ export interface GetListOperationOptions<T extends ZodSchema, Q extends ZodSchem
     }>;
 }
 export declare function createGetListOperationFactory<TTable, TRelations>({ createAction, getTableName, }: {
-    createAction: ActionFactory<TTable, (_params: Record<string, unknown>) => Promise<{
+    createAction: ActionFactory<TTable, (_params: Record<string, unknown>, _options: {
+        scope: ScopeArg;
+    }) => Promise<{
         data: unknown[];
         total: number;
     }>>;
     getTableName(table: TTable): string;
-}): ({ db, getSession }: {
+}): <TSession = DefaultSession>({ db, getSession, }: {
     db?: unknown;
-    getSession: SessionGetter;
-}) => <T extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, Q extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: GetListOperationOptions<T, Q, TTable, TRelations>) => import("next-rest-framework").RouteOperationDefinition<"GET">;
+    getSession: SessionGetter<TSession>;
+}) => <T extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, Q extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, table, openApiOperation, relations, jsonArrayFields, setParams, handler, catch: catchHandler, }: GetListOperationOptions<T, Q, TTable, TRelations, TSession>) => import("next-rest-framework").RouteOperationDefinition<"GET">;

package/lib/backend/route-operation/read-operation-core.js

@@ -31,7 +31,10 @@ function createGetOperationFactory({
   createAction,
   getTableName
 }) {
-  return ({ db, getSession }) => ({
+  return ({
+    db,
+    getSession
+  }) => ({
     schemas,
     access,
     table,
@@ -57,7 +60,7 @@ function createGetOperationFactory({
     }
   ]).handler(async (req) => {
     try {
-      const mergedParams = await (0, import_operation_common.getReadParams)({
+      const { params: mergedParams, scope } = await (0, import_operation_common.getReadParams)({
         access,
         getSession,
         req,
@@ -70,7 +73,7 @@ function createGetOperationFactory({
         jsonArrayFields,
         relations,
         table
-      })(mergedParams) : mergedParams;
+      })(mergedParams, { scope }) : mergedParams;
       let result = rawResult ?? {};
       if (handler) {
         result = await handler({
@@ -89,7 +92,10 @@ function createGetListOperationFactory({
   createAction,
   getTableName
 }) {
-  return ({ db, getSession }) => ({
+  return ({
+    db,
+    getSession
+  }) => ({
     schemas,
     access,
     table,
@@ -115,7 +121,7 @@ function createGetListOperationFactory({
     }
   ]).handler(async (req) => {
     try {
-      const mergedParams = await (0, import_operation_common.getReadParams)({
+      const { params: mergedParams, scope } = await (0, import_operation_common.getReadParams)({
         access,
         getSession,
         req,
@@ -128,7 +134,7 @@ function createGetListOperationFactory({
         jsonArrayFields,
         relations,
         table
-      })(mergedParams) : { data: [], total: 0 };
+      })(mergedParams, { scope }) : { data: [], total: 0 };
       if (handler) {
         result = await handler({
           data: result,