@ai0x0/utils 0.5.0 → 0.6.0

package/es/backend/route-operation/operation-common.d.ts

@@ -8,6 +8,18 @@ export type RouteCatch = (error: Error) => Promise<JsonResponse | undefined>;
 export interface DefaultSession {
     userId?: string;
 }
+/**
+ * 「这次请求是谁发的」。四个方法都会把它盖进 params.callerId，自定义 handler 判权、署名、
+ * 判「是不是本人」一律读它。
+ *
+ * **不要拿 params.creatorId 当调用者用。** 那是另一件事：POST 上的 creatorId 是**归属戳**
+ * （access.scope 指的那一列，换成 ownerId 时它就不叫 creatorId 了），PUT 上的 editorId 是要
+ * 写进行里的**审计列**。两者都恰好等于调用者只是默认配置下的巧合。
+ *
+ * 会话形状是泛型的（调用方可以塞自己的 Scope 进来），所以这里按 DefaultSession 取 userId ——
+ * 自定义会话只要带着这个字段就通用。
+ */
+export declare function callerIdOf(session: unknown): string | undefined;
 /**
  * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
  * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
@@ -99,7 +111,7 @@ export declare function getDefaultTags<TTable>({ getTableName, table, }: {
     table?: TTable;
 }): string[];
 export type GetOperationParams<Q extends ZodSchema> = z.infer<Q> & Record<string, unknown> & {
-    creatorId?: string;
+    callerId?: string;
 };
 /**
  * 读操作的参数与作用域。

package/es/backend/route-operation/operation-common.js

@@ -17,6 +17,21 @@ import { isEmptyScopeValue, NO_SCOPE } from "../scope.js";
 
 /** 默认的会话形状。够用于「一条记录属于一个人」的场景。 */
 
+/**
+ * 「这次请求是谁发的」。四个方法都会把它盖进 params.callerId，自定义 handler 判权、署名、
+ * 判「是不是本人」一律读它。
+ *
+ * **不要拿 params.creatorId 当调用者用。** 那是另一件事：POST 上的 creatorId 是**归属戳**
+ * （access.scope 指的那一列，换成 ownerId 时它就不叫 creatorId 了），PUT 上的 editorId 是要
+ * 写进行里的**审计列**。两者都恰好等于调用者只是默认配置下的巧合。
+ *
+ * 会话形状是泛型的（调用方可以塞自己的 Scope 进来），所以这里按 DefaultSession 取 userId ——
+ * 自定义会话只要带着这个字段就通用。
+ */
+export function callerIdOf(session) {
+  return session === null || session === void 0 ? void 0 : session.userId;
+}
+
 /**
  * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
  * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
@@ -245,6 +260,13 @@ export function getDefaultTags(_ref3) {
 // 读操作的参数
 // ==============================================================================
 
+// callerId 是服务端盖的，**不是** query 里来的：调用方在地址栏上写 `?callerId=别人`
+// 覆盖不了它（下面 getReadParams 里它最后展开）。
+//
+// 这里原先声明的是 `creatorId?: string`，而读操作从来没有填过它 —— 类型说有、运行时没有，
+// 于是 `if (!params.creatorId) throw 401` 这种判权写法编译绿灯、线上对所有人 401。
+// 那个字段已经删掉：要调用者就用 callerId，要按创建者筛就在 query schema 里显式声明一个。
+
 /**
  * 读操作的参数与作用域。
  *
@@ -284,6 +306,9 @@ function _getReadParams() {
           session = _yield$resolveAccess.session;
           queryParams = schemas.query.parse(Object.fromEntries(new URL(req.url).searchParams));
           return _context4.abrupt("return", {
+            // 这一份**不带 callerId**：它会被当成筛选条件送进查询构造器，而 callerId 不是任何表的列。
+            // 列表那边认不出的键会跳过（get-list-query 的 `if (!targetColumn) continue`），但别指望
+            // 这条兜底 —— 交给 handler 的那一份在 read-operation-core 里单独拼，见那里。
             params: _objectSpread(_objectSpread({}, queryParams), extraParams),
             scope: scope,
             session: session

package/es/backend/route-operation/read-operation-core.js

@@ -1,11 +1,16 @@
 function _typeof(o) { "@babel/helpers - typeof"; return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function (o) { return typeof o; } : function (o) { return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o; }, _typeof(o); }
 function _regeneratorRuntime() { "use strict"; /*! regenerator-runtime -- Copyright (c) 2014-present, Facebook, Inc. -- license (MIT): https://github.com/facebook/regenerator/blob/main/LICENSE */ _regeneratorRuntime = function _regeneratorRuntime() { return e; }; var t, e = {}, r = Object.prototype, n = r.hasOwnProperty, o = Object.defineProperty || function (t, e, r) { t[e] = r.value; }, i = "function" == typeof Symbol ? Symbol : {}, a = i.iterator || "@@iterator", c = i.asyncIterator || "@@asyncIterator", u = i.toStringTag || "@@toStringTag"; function define(t, e, r) { return Object.defineProperty(t, e, { value: r, enumerable: !0, configurable: !0, writable: !0 }), t[e]; } try { define({}, ""); } catch (t) { define = function define(t, e, r) { return t[e] = r; }; } function wrap(t, e, r, n) { var i = e && e.prototype instanceof Generator ? e : Generator, a = Object.create(i.prototype), c = new Context(n || []); return o(a, "_invoke", { value: makeInvokeMethod(t, r, c) }), a; } function tryCatch(t, e, r) { try { return { type: "normal", arg: t.call(e, r) }; } catch (t) { return { type: "throw", arg: t }; } } e.wrap = wrap; var h = "suspendedStart", l = "suspendedYield", f = "executing", s = "completed", y = {}; function Generator() {} function GeneratorFunction() {} function GeneratorFunctionPrototype() {} var p = {}; define(p, a, function () { return this; }); var d = Object.getPrototypeOf, v = d && d(d(values([]))); v && v !== r && n.call(v, a) && (p = v); var g = GeneratorFunctionPrototype.prototype = Generator.prototype = Object.create(p); function defineIteratorMethods(t) { ["next", "throw", "return"].forEach(function (e) { define(t, e, function (t) { return this._invoke(e, t); }); }); } function AsyncIterator(t, e) { function invoke(r, o, i, a) { var c = tryCatch(t[r], t, o); if ("throw" !== c.type) { var u = c.arg, h = u.value; return h && "object" == _typeof(h) && n.call(h, "__await") ? e.resolve(h.__await).then(function (t) { invoke("next", t, i, a); }, function (t) { invoke("throw", t, i, a); }) : e.resolve(h).then(function (t) { u.value = t, i(u); }, function (t) { return invoke("throw", t, i, a); }); } a(c.arg); } var r; o(this, "_invoke", { value: function value(t, n) { function callInvokeWithMethodAndArg() { return new e(function (e, r) { invoke(t, n, e, r); }); } return r = r ? r.then(callInvokeWithMethodAndArg, callInvokeWithMethodAndArg) : callInvokeWithMethodAndArg(); } }); } function makeInvokeMethod(e, r, n) { var o = h; return function (i, a) { if (o === f) throw new Error("Generator is already running"); if (o === s) { if ("throw" === i) throw a; return { value: t, done: !0 }; } for (n.method = i, n.arg = a;;) { var c = n.delegate; if (c) { var u = maybeInvokeDelegate(c, n); if (u) { if (u === y) continue; return u; } } if ("next" === n.method) n.sent = n._sent = n.arg;else if ("throw" === n.method) { if (o === h) throw o = s, n.arg; n.dispatchException(n.arg); } else "return" === n.method && n.abrupt("return", n.arg); o = f; var p = tryCatch(e, r, n); if ("normal" === p.type) { if (o = n.done ? s : l, p.arg === y) continue; return { value: p.arg, done: n.done }; } "throw" === p.type && (o = s, n.method = "throw", n.arg = p.arg); } }; } function maybeInvokeDelegate(e, r) { var n = r.method, o = e.iterator[n]; if (o === t) return r.delegate = null, "throw" === n && e.iterator.return && (r.method = "return", r.arg = t, maybeInvokeDelegate(e, r), "throw" === r.method) || "return" !== n && (r.method = "throw", r.arg = new TypeError("The iterator does not provide a '" + n + "' method")), y; var i = tryCatch(o, e.iterator, r.arg); if ("throw" === i.type) return r.method = "throw", r.arg = i.arg, r.delegate = null, y; var a = i.arg; return a ? a.done ? (r[e.resultName] = a.value, r.next = e.nextLoc, "return" !== r.method && (r.method = "next", r.arg = t), r.delegate = null, y) : a : (r.method = "throw", r.arg = new TypeError("iterator result is not an object"), r.delegate = null, y); } function pushTryEntry(t) { var e = { tryLoc: t[0] }; 1 in t && (e.catchLoc = t[1]), 2 in t && (e.finallyLoc = t[2], e.afterLoc = t[3]), this.tryEntries.push(e); } function resetTryEntry(t) { var e = t.completion || {}; e.type = "normal", delete e.arg, t.completion = e; } function Context(t) { this.tryEntries = [{ tryLoc: "root" }], t.forEach(pushTryEntry, this), this.reset(!0); } function values(e) { if (e || "" === e) { var r = e[a]; if (r) return r.call(e); if ("function" == typeof e.next) return e; if (!isNaN(e.length)) { var o = -1, i = function next() { for (; ++o < e.length;) if (n.call(e, o)) return next.value = e[o], next.done = !1, next; return next.value = t, next.done = !0, next; }; return i.next = i; } } throw new TypeError(_typeof(e) + " is not iterable"); } return GeneratorFunction.prototype = GeneratorFunctionPrototype, o(g, "constructor", { value: GeneratorFunctionPrototype, configurable: !0 }), o(GeneratorFunctionPrototype, "constructor", { value: GeneratorFunction, configurable: !0 }), GeneratorFunction.displayName = define(GeneratorFunctionPrototype, u, "GeneratorFunction"), e.isGeneratorFunction = function (t) { var e = "function" == typeof t && t.constructor; return !!e && (e === GeneratorFunction || "GeneratorFunction" === (e.displayName || e.name)); }, e.mark = function (t) { return Object.setPrototypeOf ? Object.setPrototypeOf(t, GeneratorFunctionPrototype) : (t.__proto__ = GeneratorFunctionPrototype, define(t, u, "GeneratorFunction")), t.prototype = Object.create(g), t; }, e.awrap = function (t) { return { __await: t }; }, defineIteratorMethods(AsyncIterator.prototype), define(AsyncIterator.prototype, c, function () { return this; }), e.AsyncIterator = AsyncIterator, e.async = function (t, r, n, o, i) { void 0 === i && (i = Promise); var a = new AsyncIterator(wrap(t, r, n, o), i); return e.isGeneratorFunction(r) ? a : a.next().then(function (t) { return t.done ? t.value : a.next(); }); }, defineIteratorMethods(g), define(g, u, "Generator"), define(g, a, function () { return this; }), define(g, "toString", function () { return "[object Generator]"; }), e.keys = function (t) { var e = Object(t), r = []; for (var n in e) r.push(n); return r.reverse(), function next() { for (; r.length;) { var t = r.pop(); if (t in e) return next.value = t, next.done = !1, next; } return next.done = !0, next; }; }, e.values = values, Context.prototype = { constructor: Context, reset: function reset(e) { if (this.prev = 0, this.next = 0, this.sent = this._sent = t, this.done = !1, this.delegate = null, this.method = "next", this.arg = t, this.tryEntries.forEach(resetTryEntry), !e) for (var r in this) "t" === r.charAt(0) && n.call(this, r) && !isNaN(+r.slice(1)) && (this[r] = t); }, stop: function stop() { this.done = !0; var t = this.tryEntries[0].completion; if ("throw" === t.type) throw t.arg; return this.rval; }, dispatchException: function dispatchException(e) { if (this.done) throw e; var r = this; function handle(n, o) { return a.type = "throw", a.arg = e, r.next = n, o && (r.method = "next", r.arg = t), !!o; } for (var o = this.tryEntries.length - 1; o >= 0; --o) { var i = this.tryEntries[o], a = i.completion; if ("root" === i.tryLoc) return handle("end"); if (i.tryLoc <= this.prev) { var c = n.call(i, "catchLoc"), u = n.call(i, "finallyLoc"); if (c && u) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } else if (c) { if (this.prev < i.catchLoc) return handle(i.catchLoc, !0); } else { if (!u) throw new Error("try statement without catch or finally"); if (this.prev < i.finallyLoc) return handle(i.finallyLoc); } } } }, abrupt: function abrupt(t, e) { for (var r = this.tryEntries.length - 1; r >= 0; --r) { var o = this.tryEntries[r]; if (o.tryLoc <= this.prev && n.call(o, "finallyLoc") && this.prev < o.finallyLoc) { var i = o; break; } } i && ("break" === t || "continue" === t) && i.tryLoc <= e && e <= i.finallyLoc && (i = null); var a = i ? i.completion : {}; return a.type = t, a.arg = e, i ? (this.method = "next", this.next = i.finallyLoc, y) : this.complete(a); }, complete: function complete(t, e) { if ("throw" === t.type) throw t.arg; return "break" === t.type || "continue" === t.type ? this.next = t.arg : "return" === t.type ? (this.rval = this.arg = t.arg, this.method = "return", this.next = "end") : "normal" === t.type && e && (this.next = e), y; }, finish: function finish(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.finallyLoc === t) return this.complete(r.completion, r.afterLoc), resetTryEntry(r), y; } }, catch: function _catch(t) { for (var e = this.tryEntries.length - 1; e >= 0; --e) { var r = this.tryEntries[e]; if (r.tryLoc === t) { var n = r.completion; if ("throw" === n.type) { var o = n.arg; resetTryEntry(r); } return o; } } throw new Error("illegal catch attempt"); }, delegateYield: function delegateYield(e, r, n) { return this.delegate = { iterator: values(e), resultName: r, nextLoc: n }, "next" === this.method && (this.arg = t), y; } }, e; }
+function ownKeys(e, r) { var t = Object.keys(e); if (Object.getOwnPropertySymbols) { var o = Object.getOwnPropertySymbols(e); r && (o = o.filter(function (r) { return Object.getOwnPropertyDescriptor(e, r).enumerable; })), t.push.apply(t, o); } return t; }
+function _objectSpread(e) { for (var r = 1; r < arguments.length; r++) { var t = null != arguments[r] ? arguments[r] : {}; r % 2 ? ownKeys(Object(t), !0).forEach(function (r) { _defineProperty(e, r, t[r]); }) : Object.getOwnPropertyDescriptors ? Object.defineProperties(e, Object.getOwnPropertyDescriptors(t)) : ownKeys(Object(t)).forEach(function (r) { Object.defineProperty(e, r, Object.getOwnPropertyDescriptor(t, r)); }); } return e; }
+function _defineProperty(obj, key, value) { key = _toPropertyKey(key); if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == _typeof(i) ? i : String(i); }
+function _toPrimitive(t, r) { if ("object" != _typeof(t) || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != _typeof(i)) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
 function asyncGeneratorStep(gen, resolve, reject, _next, _throw, key, arg) { try { var info = gen[key](arg); var value = info.value; } catch (error) { reject(error); return; } if (info.done) { resolve(value); } else { Promise.resolve(value).then(_next, _throw); } }
 function _asyncToGenerator(fn) { return function () { var self = this, args = arguments; return new Promise(function (resolve, reject) { var gen = fn.apply(self, args); function _next(value) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "next", value); } function _throw(err) { asyncGeneratorStep(gen, resolve, reject, _next, _throw, "throw", err); } _next(undefined); }); }; }
 import { routeOperation, TypedNextResponse } from "next-rest-framework";
 import { listBodySchema } from "../schemas/index.js";
 import { createOpenApiOperation } from "./open-api-operation.js";
-import { getDefaultTags, getReadParams, handleOperationError } from "./operation-common.js";
+import { callerIdOf, getDefaultTags, getReadParams, handleOperationError } from "./operation-common.js";
 
 // ==============================================================================
 // GET single operation
@@ -44,7 +49,7 @@ export function createGetOperationFactory(_ref) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref4 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee(req) {
-          var _yield$getReadParams, mergedParams, scope, rawResult, result;
+          var _yield$getReadParams, mergedParams, scope, session, rawResult, result;
           return _regeneratorRuntime().wrap(function _callee$(_context) {
             while (1) switch (_context.prev = _context.next) {
               case 0:
@@ -61,11 +66,12 @@ export function createGetOperationFactory(_ref) {
                 _yield$getReadParams = _context.sent;
                 mergedParams = _yield$getReadParams.params;
                 scope = _yield$getReadParams.scope;
+                session = _yield$getReadParams.session;
                 if (!(table && db)) {
-                  _context.next = 12;
+                  _context.next = 13;
                   break;
                 }
-                _context.next = 9;
+                _context.next = 10;
                 return createAction({
                   bodySchema: schemas.response,
                   db: db,
@@ -75,40 +81,43 @@ export function createGetOperationFactory(_ref) {
                 })(mergedParams, {
                   scope: scope
                 });
-              case 9:
+              case 10:
                 _context.t0 = _context.sent;
-                _context.next = 13;
+                _context.next = 14;
                 break;
-              case 12:
-                _context.t0 = mergedParams;
               case 13:
+                _context.t0 = mergedParams;
+              case 14:
                 rawResult = _context.t0;
                 result = rawResult !== null && rawResult !== void 0 ? rawResult : {};
                 if (!handler) {
-                  _context.next = 19;
+                  _context.next = 20;
                   break;
                 }
-                _context.next = 18;
+                _context.next = 19;
                 return handler({
                   data: result,
-                  params: mergedParams,
+                  // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+                  params: _objectSpread(_objectSpread({}, mergedParams), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
-              case 18:
-                result = _context.sent;
               case 19:
+                result = _context.sent;
+              case 20:
                 return _context.abrupt("return", TypedNextResponse.json(result, {
                   status: 200
                 }));
-              case 22:
-                _context.prev = 22;
+              case 23:
+                _context.prev = 23;
                 _context.t1 = _context["catch"](0);
                 return _context.abrupt("return", handleOperationError(_context.t1, catchHandler));
-              case 25:
+              case 26:
               case "end":
                 return _context.stop();
             }
-          }, _callee, null, [[0, 22]]);
+          }, _callee, null, [[0, 23]]);
         }));
         return function (_x) {
           return _ref4.apply(this, arguments);
@@ -155,7 +164,7 @@ export function createGetListOperationFactory(_ref5) {
         status: 200
       }]).handler( /*#__PURE__*/function () {
         var _ref8 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee2(req) {
-          var _yield$getReadParams2, mergedParams, scope, result;
+          var _yield$getReadParams2, mergedParams, scope, session, result;
           return _regeneratorRuntime().wrap(function _callee2$(_context2) {
             while (1) switch (_context2.prev = _context2.next) {
               case 0:
@@ -172,11 +181,12 @@ export function createGetListOperationFactory(_ref5) {
                 _yield$getReadParams2 = _context2.sent;
                 mergedParams = _yield$getReadParams2.params;
                 scope = _yield$getReadParams2.scope;
+                session = _yield$getReadParams2.session;
                 if (!(table && db)) {
-                  _context2.next = 12;
+                  _context2.next = 13;
                   break;
                 }
-                _context2.next = 9;
+                _context2.next = 10;
                 return createAction({
                   bodySchema: schemas.response,
                   db: db,
@@ -186,42 +196,45 @@ export function createGetListOperationFactory(_ref5) {
                 })(mergedParams, {
                   scope: scope
                 });
-              case 9:
+              case 10:
                 _context2.t0 = _context2.sent;
-                _context2.next = 13;
+                _context2.next = 14;
                 break;
-              case 12:
+              case 13:
                 _context2.t0 = {
                   data: [],
                   total: 0
                 };
-              case 13:
+              case 14:
                 result = _context2.t0;
                 if (!handler) {
-                  _context2.next = 18;
+                  _context2.next = 19;
                   break;
                 }
-                _context2.next = 17;
+                _context2.next = 18;
                 return handler({
                   data: result,
-                  params: mergedParams,
+                  // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+                  params: _objectSpread(_objectSpread({}, mergedParams), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
-              case 17:
-                result = _context2.sent;
               case 18:
+                result = _context2.sent;
+              case 19:
                 return _context2.abrupt("return", TypedNextResponse.json(result, {
                   status: 200
                 }));
-              case 21:
-                _context2.prev = 21;
+              case 22:
+                _context2.prev = 22;
                 _context2.t1 = _context2["catch"](0);
                 return _context2.abrupt("return", handleOperationError(_context2.t1, catchHandler));
-              case 24:
+              case 25:
               case "end":
                 return _context2.stop();
             }
-          }, _callee2, null, [[0, 21]]);
+          }, _callee2, null, [[0, 22]]);
         }));
         return function (_x2) {
           return _ref8.apply(this, arguments);

package/es/backend/route-operation/write-operation-core.d.ts

@@ -5,6 +5,7 @@ import { type RouteOpenApiOperation } from "./open-api-operation.js";
 import { AccessOptions, ActionFactory, DefaultSession, RouteCatch, SessionGetter } from "./operation-common.js";
 import { ScopeArg } from "../scope.js";
 export type PostOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     creatorId?: string;
 };
 export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -37,6 +38,7 @@ export declare function createPostOperationFactory<TTable>({ createAction, getTa
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: PostOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
 export type PutOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     editorId?: string;
 };
 export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -65,7 +67,7 @@ export declare function createPutOperationFactory<TTable>({ createAction, getTab
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: PutOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
 export type DeleteOperationParams<B extends ZodSchema> = z.infer<B> & Record<string, unknown> & {
-    creatorId?: string;
+    callerId?: string;
     id: string;
 };
 export interface DeleteOperationOptions<TTable, B extends ZodSchema, TSession = DefaultSession> {

package/es/backend/route-operation/write-operation-core.js

@@ -10,13 +10,17 @@ function _asyncToGenerator(fn) { return function () { var self = this, args = ar
 import { routeOperation, TypedNextResponse } from "next-rest-framework";
 import { z } from "zod";
 import { createOpenApiOperation } from "./open-api-operation.js";
-import { getDefaultTags, handleOperationError, readPostBody, resolveAccess, sessionLoader } from "./operation-common.js";
+import { callerIdOf, getDefaultTags, handleOperationError, readPostBody, resolveAccess, sessionLoader } from "./operation-common.js";
 import { NO_SCOPE } from "../scope.js";
 
 // ==============================================================================
 // POST create operation
 // ==============================================================================
 
+// creatorId 是**归属戳**（access.scope 指的那一列）——默认作用域下它确实叫 creatorId，
+// 但换成 `scope: { column: "ownerId" }` 之后这一行盖的就是 ownerId 了。要「谁发的请求」
+// 一律读 callerId，那个四个方法都有、也不受作用域配置影响。
+
 export function createPostOperationFactory(_ref) {
   var createAction = _ref.createAction,
     getTableName = _ref.getTableName;
@@ -127,7 +131,11 @@ export function createPostOperationFactory(_ref) {
                 _context.next = 28;
                 return handler({
                   data: raw,
-                  params: params,
+                  // callerId 只加在**交给 handler 的那一份**上，不进上面 createAction 收到的
+                  // params —— 那一份会被原样 insert，而 callerId 不是任何表的列。
+                  params: _objectSpread(_objectSpread({}, params), {}, {
+                    callerId: callerIdOf(session)
+                  }),
                   req: req
                 });
               case 28:
@@ -163,6 +171,9 @@ export function createPostOperationFactory(_ref) {
 // PUT update operation
 // ==============================================================================
 
+// editorId 是要写进行里的**审计列**（「谁改的」）。它恰好等于调用者，但语义是两件事 ——
+// 判权请读 callerId，别读它。
+
 export function createPutOperationFactory(_ref5) {
   var createAction = _ref5.createAction,
     getTableName = _ref5.getTableName;
@@ -279,7 +290,11 @@ export function createPutOperationFactory(_ref5) {
                 _context2.next = 39;
                 return handler({
                   data: raw,
-                  params: params,
+                  // 同 POST：callerId 不进 createAction 那一份（它会被 .set() 原样写进 UPDATE，
+                  // 而 callerId 不是列）。editorId 是列，所以它留在 params 里。
+                  params: _objectSpread(_objectSpread({}, params), {}, {
+                    callerId: editorId
+                  }),
                   req: req
                 });
               case 39:
@@ -318,6 +333,11 @@ export function createPutOperationFactory(_ref5) {
 var defaultDeleteBodySchema = z.object({
   id: z.string().describe("Id of the row to delete.")
 });
+
+// 原先这里声明的是 `creatorId?: string`，而删除**从来没有填过它** —— 类型说有、运行时没有，
+// 于是 `requireAdmin(params.creatorId)` 这种判权写法编译绿灯、线上对所有人 401。换成 callerId
+// 并且真的盖上。
+
 export function createDeleteOperationFactory(_ref9) {
   var createAction = _ref9.createAction,
     getTableName = _ref9.getTableName;
@@ -345,7 +365,7 @@ export function createDeleteOperationFactory(_ref9) {
         contentType: "application/json"
       }).handler( /*#__PURE__*/function () {
         var _ref12 = _asyncToGenerator( /*#__PURE__*/_regeneratorRuntime().mark(function _callee3(req) {
-          var bodySchema, body, _yield$resolveAccess3, scope, data;
+          var bodySchema, body, loadSession, _yield$resolveAccess3, scope, data;
           return _regeneratorRuntime().wrap(function _callee3$(_context3) {
             while (1) switch (_context3.prev = _context3.next) {
               case 0:
@@ -357,20 +377,22 @@ export function createDeleteOperationFactory(_ref9) {
               case 5:
                 _context3.t1 = _context3.sent;
                 body = _context3.t0.parse.call(_context3.t0, _context3.t1);
-                _context3.next = 9;
+                // loadSession 带缓存，下面取 callerId 时不会再往返一次。
+                loadSession = sessionLoader(getSession, req);
+                _context3.next = 10;
                 return resolveAccess({
                   access: access,
-                  loadSession: sessionLoader(getSession, req),
+                  loadSession: loadSession,
                   method: "DELETE"
                 });
-              case 9:
+              case 10:
                 _yield$resolveAccess3 = _context3.sent;
                 scope = _yield$resolveAccess3.scope;
                 if (!(table && db)) {
-                  _context3.next = 17;
+                  _context3.next = 18;
                   break;
                 }
-                _context3.next = 14;
+                _context3.next = 15;
                 return createAction({
                   db: db,
                   table: table
@@ -379,33 +401,54 @@ export function createDeleteOperationFactory(_ref9) {
                 }, {
                   scope: scope
                 });
-              case 14:
+              case 15:
                 _context3.t2 = _context3.sent;
-                _context3.next = 18;
+                _context3.next = 19;
                 break;
-              case 17:
-                _context3.t2 = body;
               case 18:
+                _context3.t2 = body;
+              case 19:
                 data = _context3.t2;
-                _context3.next = 21;
-                return handler === null || handler === void 0 ? void 0 : handler({
-                  data: data,
-                  params: body,
-                  req: req
-                });
-              case 21:
+                if (!handler) {
+                  _context3.next = 37;
+                  break;
+                }
+                _context3.t3 = handler;
+                _context3.t4 = data;
+                _context3.t5 = _objectSpread;
+                _context3.t6 = _objectSpread({}, body);
+                _context3.t7 = {};
+                _context3.t8 = callerIdOf;
+                _context3.next = 29;
+                return loadSession();
+              case 29:
+                _context3.t9 = _context3.sent;
+                _context3.t10 = (0, _context3.t8)(_context3.t9);
+                _context3.t11 = {
+                  callerId: _context3.t10
+                };
+                _context3.t12 = (0, _context3.t5)(_context3.t6, _context3.t7, _context3.t11);
+                _context3.t13 = req;
+                _context3.t14 = {
+                  data: _context3.t4,
+                  params: _context3.t12,
+                  req: _context3.t13
+                };
+                _context3.next = 37;
+                return (0, _context3.t3)(_context3.t14);
+              case 37:
                 return _context3.abrupt("return", TypedNextResponse.json(data, {
                   status: 200
                 }));
-              case 24:
-                _context3.prev = 24;
-                _context3.t3 = _context3["catch"](0);
-                return _context3.abrupt("return", handleOperationError(_context3.t3, catchHandler));
-              case 27:
+              case 40:
+                _context3.prev = 40;
+                _context3.t15 = _context3["catch"](0);
+                return _context3.abrupt("return", handleOperationError(_context3.t15, catchHandler));
+              case 43:
               case "end":
                 return _context3.stop();
             }
-          }, _callee3, null, [[0, 24]]);
+          }, _callee3, null, [[0, 40]]);
         }));
         return function (_x3) {
           return _ref12.apply(this, arguments);

package/lib/backend/route-operation/operation-common.d.ts

@@ -8,6 +8,18 @@ export type RouteCatch = (error: Error) => Promise<JsonResponse | undefined>;
 export interface DefaultSession {
     userId?: string;
 }
+/**
+ * 「这次请求是谁发的」。四个方法都会把它盖进 params.callerId，自定义 handler 判权、署名、
+ * 判「是不是本人」一律读它。
+ *
+ * **不要拿 params.creatorId 当调用者用。** 那是另一件事：POST 上的 creatorId 是**归属戳**
+ * （access.scope 指的那一列，换成 ownerId 时它就不叫 creatorId 了），PUT 上的 editorId 是要
+ * 写进行里的**审计列**。两者都恰好等于调用者只是默认配置下的巧合。
+ *
+ * 会话形状是泛型的（调用方可以塞自己的 Scope 进来），所以这里按 DefaultSession 取 userId ——
+ * 自定义会话只要带着这个字段就通用。
+ */
+export declare function callerIdOf(session: unknown): string | undefined;
 /**
  * 会话读取器。泛型化是为了让调用方能在这里一次性解析出「你是谁 + 你现在站在哪个空间 +
  * 你在那个空间里是什么角色」，后面 access.scope / access.can 都读同一份，不必各自再查一遍库。
@@ -99,7 +111,7 @@ export declare function getDefaultTags<TTable>({ getTableName, table, }: {
     table?: TTable;
 }): string[];
 export type GetOperationParams<Q extends ZodSchema> = z.infer<Q> & Record<string, unknown> & {
-    creatorId?: string;
+    callerId?: string;
 };
 /**
  * 读操作的参数与作用域。

package/lib/backend/route-operation/operation-common.js

@@ -19,6 +19,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/backend/route-operation/operation-common.ts
 var operation_common_exports = {};
 __export(operation_common_exports, {
+  callerIdOf: () => callerIdOf,
   getDefaultTags: () => getDefaultTags,
   getReadParams: () => getReadParams,
   handleOperationError: () => handleOperationError,
@@ -30,6 +31,9 @@ module.exports = __toCommonJS(operation_common_exports);
 var import_next_rest_framework = require("next-rest-framework");
 var import_errors = require("../errors");
 var import_scope = require("../scope");
+function callerIdOf(session) {
+  return session == null ? void 0 : session.userId;
+}
 var DEFAULT_SCOPE_COLUMN = "creatorId";
 function sessionLoader(getSession, req) {
   let pending;
@@ -124,6 +128,9 @@ async function getReadParams({
     Object.fromEntries(new URL(req.url).searchParams)
   );
   return {
+    // 这一份**不带 callerId**：它会被当成筛选条件送进查询构造器，而 callerId 不是任何表的列。
+    // 列表那边认不出的键会跳过（get-list-query 的 `if (!targetColumn) continue`），但别指望
+    // 这条兜底 —— 交给 handler 的那一份在 read-operation-core 里单独拼，见那里。
     params: { ...queryParams, ...extraParams },
     scope,
     session
@@ -131,6 +138,7 @@ async function getReadParams({
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  callerIdOf,
   getDefaultTags,
   getReadParams,
   handleOperationError,

package/lib/backend/route-operation/read-operation-core.js

@@ -60,7 +60,11 @@ function createGetOperationFactory({
     }
   ]).handler(async (req) => {
     try {
-      const { params: mergedParams, scope } = await (0, import_operation_common.getReadParams)({
+      const {
+        params: mergedParams,
+        scope,
+        session
+      } = await (0, import_operation_common.getReadParams)({
         access,
         getSession,
         req,
@@ -78,7 +82,8 @@ function createGetOperationFactory({
       if (handler) {
         result = await handler({
           data: result,
-          params: mergedParams,
+          // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+          params: { ...mergedParams, callerId: (0, import_operation_common.callerIdOf)(session) },
           req
         });
       }
@@ -121,7 +126,11 @@ function createGetListOperationFactory({
     }
   ]).handler(async (req) => {
     try {
-      const { params: mergedParams, scope } = await (0, import_operation_common.getReadParams)({
+      const {
+        params: mergedParams,
+        scope,
+        session
+      } = await (0, import_operation_common.getReadParams)({
         access,
         getSession,
         req,
@@ -138,7 +147,8 @@ function createGetListOperationFactory({
       if (handler) {
         result = await handler({
           data: result,
-          params: mergedParams,
+          // callerId 只给 handler，不进上面那份筛选/写入用的 params（见 getReadParams）。
+          params: { ...mergedParams, callerId: (0, import_operation_common.callerIdOf)(session) },
           req
         });
       }

package/lib/backend/route-operation/write-operation-core.d.ts

@@ -5,6 +5,7 @@ import { type RouteOpenApiOperation } from "./open-api-operation.js";
 import { AccessOptions, ActionFactory, DefaultSession, RouteCatch, SessionGetter } from "./operation-common.js";
 import { ScopeArg } from "../scope.js";
 export type PostOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     creatorId?: string;
 };
 export interface PostOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -37,6 +38,7 @@ export declare function createPostOperationFactory<TTable>({ createAction, getTa
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, contentType, openApiOperation, parseBody, setBody, table, handler, catch: catchHandler, }: PostOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"POST">;
 export type PutOperationParams<IB extends ZodSchema> = z.infer<IB> & Record<string, unknown> & {
+    callerId?: string;
     editorId?: string;
 };
 export interface PutOperationOptions<IB extends ZodSchema, OB extends ZodSchema, TTable, TSession = DefaultSession> {
@@ -65,7 +67,7 @@ export declare function createPutOperationFactory<TTable>({ createAction, getTab
     getSession: SessionGetter<TSession>;
 }) => <IB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, OB extends z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>({ schemas, access, openApiOperation, table, setBody, handler, catch: catchHandler, }: PutOperationOptions<IB, OB, TTable, TSession>) => import("next-rest-framework").RouteOperationDefinition<"PUT">;
 export type DeleteOperationParams<B extends ZodSchema> = z.infer<B> & Record<string, unknown> & {
-    creatorId?: string;
+    callerId?: string;
     id: string;
 };
 export interface DeleteOperationOptions<TTable, B extends ZodSchema, TSession = DefaultSession> {

package/lib/backend/route-operation/write-operation-core.js

@@ -85,7 +85,12 @@ function createPostOperationFactory({
       })(params))[0] : params;
       const data = handler ? await handler({
         data: raw,
-        params,
+        // callerId 只加在**交给 handler 的那一份**上，不进上面 createAction 收到的
+        // params —— 那一份会被原样 insert，而 callerId 不是任何表的列。
+        params: {
+          ...params,
+          callerId: (0, import_operation_common.callerIdOf)(session)
+        },
         req
       }) : raw;
       return import_next_rest_framework.TypedNextResponse.json(data, { status: 200 });
@@ -146,7 +151,12 @@ function createPutOperationFactory({
       })(params, { scope }) : params;
       const data = handler ? await handler({
         data: raw,
-        params,
+        // 同 POST：callerId 不进 createAction 那一份（它会被 .set() 原样写进 UPDATE，
+        // 而 callerId 不是列）。editorId 是列，所以它留在 params 里。
+        params: {
+          ...params,
+          callerId: editorId
+        },
         req
       }) : raw;
       return import_next_rest_framework.TypedNextResponse.json(data, { status: 200 });
@@ -187,13 +197,23 @@ function createDeleteOperationFactory({
       const body = bodySchema.parse(
         await req.json()
       );
+      const loadSession = (0, import_operation_common.sessionLoader)(getSession, req);
       const { scope } = await (0, import_operation_common.resolveAccess)({
         access,
-        loadSession: (0, import_operation_common.sessionLoader)(getSession, req),
+        loadSession,
         method: "DELETE"
       });
       const data = table && db ? await createAction({ db, table })({ id: body.id }, { scope }) : body;
-      await (handler == null ? void 0 : handler({ data, params: body, req }));
+      if (handler) {
+        await handler({
+          data,
+          params: {
+            ...body,
+            callerId: (0, import_operation_common.callerIdOf)(await loadSession())
+          },
+          req
+        });
+      }
       return import_next_rest_framework.TypedNextResponse.json(data, { status: 200 });
     } catch (error) {
       return (0, import_operation_common.handleOperationError)(error, catchHandler);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai0x0/utils",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "AI0x0 utils",
   "keywords": [
     "ai0x0"