@ai0x0/utils 0.1.1 → 0.1.3

package/SKILL.md

@@ -68,7 +68,7 @@ export const getListOperation = createGetListOperation({ db, getSession });
 
 | Export              | Purpose                    | Required options                    | Notable optional options                                                                                         |
 | ------------------- | -------------------------- | ----------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
-| `createTableSchema` | pg `Table` + 5 zod schemas | `name`, `columns`                   | `refineSchema`, `extraConfig`                                                                                    |
+| `createTableSchema` | pg `Table` + 5 zod schemas | `name`, `columns`                   | `serverColumns`, `refineSchema`, `extraConfig`                                                                   |
 | `getOperation`      | GET one by filters         | `schemas.query`, `schemas.response` | `table`, `setParams`, `relations`, `jsonArrayFields`, `access.byCreator`, `handler`, `catch`, `openApiOperation` |
 | `getListOperation`  | GET paginated list         | `schemas.query`, `schemas.response` | `table`, `setParams`, `relations`, `jsonArrayFields`, `handler`, `catch`, `openApiOperation`                     |
 | `postOperation`     | POST create                | `schemas.body`                      | `table`, `contentType`, `parseBody`, `schemas.response`, `setBody`, `handler`, `catch`, `openApiOperation`       |
@@ -308,7 +308,8 @@ export const { GET } = route({
 
 ## Built-in Conventions
 
-- **Base fields** auto-added by `createTableSchema`: `id` (uuid, pk, default random) / `creatorId` / `editorId` / `accessedAt` / `createdAt` / `updatedAt`.
+- **Base fields** auto-added by `createTableSchema`: `id` (uuid, pk, default random) / `creatorId` / `editorId` / `accessedAt` / `createdAt` / `updatedAt`. They never appear in the insert/update schemas — the server writes them.
+- **Server-owned business columns** (`serverColumns: { ownerId: uuid("owner_id").notNull() }`): a second column bucket, alongside `columns`. Everything in it goes on the table and into `selectSchema` (you can read it), but **not** into `insertSchema` / `updateSchema` — exactly how the base fields already behave, just opened up to columns you declare yourself. Use it for anything carrying ownership (`ownerId`, `tenantId`): letting a client send that column is letting it choose whose row this is. Pair it with `access.scope.column` — that decides _which rows you see_, this decides _that you cannot write the column_. Which bucket a column sits in is the whole rule, so there is nothing to remember and nothing to forget; `insertSchema.omit(...)` per table would work too, but missing one table is not a compile error, it is a silent privilege escalation.
 - **Row-level scope** (`access`, on by default for every verb): the request may only see / touch rows whose scope column matches. Three knobs:
   - `byCreator?: boolean` — the old spelling, equivalent to `scope: { column: "creatorId", value: (s) => s.userId }`. Default `true`.
   - `scope?: { column?, value }` — pick the column (default `creatorId`) and derive the value from the session. Return an array for `IN (...)`. Use this when a row can belong to something other than one user (a team, a workspace).

package/es/backend/route-operation/write-operation-core.js

@@ -87,9 +87,16 @@ export function createPostOperationFactory(_ref) {
               case 13:
                 extraBody = _context.t0;
                 // 新建的行归属这次请求的作用域。默认情形下作用域就是 creatorId = 当前用户，
-                // 所以这与从前的行为逐字等价；换了归属列（比如 ownerId）时它自动跟着换。
+                // 换了归属列（比如 ownerId）时它自动跟着换。
                 // 想再记一个「谁建的」用 setBody 补 —— 那是调用方的语义，库不猜。
-                params = _objectSpread(_objectSpread(_objectSpread({}, scopeStamp(scope)), body), extraBody);
+                //
+                // **归属戳必须最后展开**，这是一条安全不变量，别为了「让调用方能覆盖」而调顺序：
+                // `.input({ body })` 只校验、**不替换**请求体（next-rest-framework 交给 handler 的
+                // clone 会重新解析原始 JSON），而 createPostAction 直接 insert，中间没有第二道
+                // schema 过滤。所以只要 body 排在戳后面，客户端在 JSON 里塞一个 `ownerId` /
+                // `creatorId` 就能把行写到别人名下 —— 调用方把该列从 schema 里 omit 掉也拦不住。
+                // 见 __tests__/route-operation-scope-stamp。
+                params = _objectSpread(_objectSpread(_objectSpread({}, body), extraBody), scopeStamp(scope));
                 if (!(table && db)) {
                   _context.next = 21;
                   break;
@@ -183,7 +190,7 @@ export function createPutOperationFactory(_ref5) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref8 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req) {
-          var _yield$loadSession, loadSession, _yield$resolveAccess2, scope, body, extraBody, params, raw, data;
+          var _yield$loadSession, loadSession, _yield$resolveAccess2, scope, body, extraBody, editorId, params, raw, data;
           return _regeneratorRuntime().wrap(function _callee2$(_context2) {
             while (1) switch (_context2.prev = _context2.next) {
               case 0:
@@ -213,42 +220,38 @@ export function createPutOperationFactory(_ref5) {
                 _context2.t0 = {};
               case 14:
                 extraBody = _context2.t0;
-                _context2.t1 = _objectSpread;
-                _context2.t2 = _objectSpread;
-                _context2.next = 19;
+                _context2.next = 17;
                 return loadSession();
-              case 19:
-                _context2.t4 = _yield$loadSession = _context2.sent;
-                _context2.t3 = _context2.t4 === null;
-                if (_context2.t3) {
-                  _context2.next = 23;
+              case 17:
+                _context2.t2 = _yield$loadSession = _context2.sent;
+                _context2.t1 = _context2.t2 === null;
+                if (_context2.t1) {
+                  _context2.next = 21;
                   break;
                 }
-                _context2.t3 = _yield$loadSession === void 0;
-              case 23:
-                if (!_context2.t3) {
-                  _context2.next = 27;
+                _context2.t1 = _yield$loadSession === void 0;
+              case 21:
+                if (!_context2.t1) {
+                  _context2.next = 25;
                   break;
                 }
-                _context2.t5 = void 0;
-                _context2.next = 28;
+                _context2.t3 = void 0;
+                _context2.next = 26;
                 break;
-              case 27:
-                _context2.t5 = _yield$loadSession.userId;
-              case 28:
-                _context2.t6 = _context2.t5;
-                _context2.t7 = {
-                  editorId: _context2.t6
-                };
-                _context2.t8 = body;
-                _context2.t9 = (0, _context2.t2)(_context2.t7, _context2.t8);
-                _context2.t10 = extraBody;
-                params = (0, _context2.t1)(_context2.t9, _context2.t10);
+              case 25:
+                _context2.t3 = _yield$loadSession.userId;
+              case 26:
+                editorId = _context2.t3;
+                // editorId 同样**最后**展开：它是审计字段，让请求体覆盖等于让人随便写「是谁改的」。
+                // 理由与 POST 那边的归属戳一样，见那里的说明。
+                params = _objectSpread(_objectSpread(_objectSpread({}, body), extraBody), {}, {
+                  editorId: editorId
+                });
                 if (!(table && db)) {
-                  _context2.next = 40;
+                  _context2.next = 34;
                   break;
                 }
-                _context2.next = 37;
+                _context2.next = 31;
                 return createAction({
                   bodySchema: schemas.body,
                   db: db,
@@ -256,44 +259,44 @@ export function createPutOperationFactory(_ref5) {
                 })(params, {
                   scope: scope
                 });
-              case 37:
-                _context2.t11 = _context2.sent;
-                _context2.next = 41;
+              case 31:
+                _context2.t4 = _context2.sent;
+                _context2.next = 35;
                 break;
-              case 40:
-                _context2.t11 = params;
-              case 41:
-                raw = _context2.t11;
+              case 34:
+                _context2.t4 = params;
+              case 35:
+                raw = _context2.t4;
                 if (!handler) {
-                  _context2.next = 48;
+                  _context2.next = 42;
                   break;
                 }
-                _context2.next = 45;
+                _context2.next = 39;
                 return handler({
                   data: raw,
                   params: params,
                   req: req
                 });
-              case 45:
-                _context2.t12 = _context2.sent;
-                _context2.next = 49;
+              case 39:
+                _context2.t5 = _context2.sent;
+                _context2.next = 43;
                 break;
-              case 48:
-                _context2.t12 = raw;
-              case 49:
-                data = _context2.t12;
+              case 42:
+                _context2.t5 = raw;
+              case 43:
+                data = _context2.t5;
                 return _context2.abrupt("return", TypedNextResponse.json(data, {
                   status: 200
                 }));
-              case 53:
-                _context2.prev = 53;
-                _context2.t13 = _context2["catch"](0);
-                return _context2.abrupt("return", handleOperationError(_context2.t13, catchHandler));
-              case 56:
+              case 47:
+                _context2.prev = 47;
+                _context2.t6 = _context2["catch"](0);
+                return _context2.abrupt("return", handleOperationError(_context2.t6, catchHandler));
+              case 50:
               case "end":
                 return _context2.stop();
             }
-          }, _callee2, null, [[0, 53]]);
+          }, _callee2, null, [[0, 47]]);
         }));
         return function (_x2) {
           return _ref8.apply(this, arguments);