@almadar/runtime 6.46.0 → 6.47.0

package/dist/OrbitalServerRuntime.js

@@ -8,7 +8,7 @@ import { createLogger } from '@almadar/logger';
 import * as nodeModule from 'module';
 import { evaluateListenPayloadExpr, evaluateGuard, evaluate } from '@almadar/evaluator';
 import { DEFAULT_VIEWER, buildResolvedTraitConfigs, isInlineTrait, isEntityCall, applyListenPayloadMapping, personaFromIdentityRow, normalizeUserContext, isRuntimeEntity } from '@almadar/core';
-import { ownerFieldsFromSchema, identityEntityName } from '@almadar/core/mock';
+import { ownerFieldsFromSchema, identityEntityName, entityAccessPolicies } from '@almadar/core/mock';
 
 // src/identity/routing.ts
 function eventRouteKey(eventName, eventId) {
@@ -33,6 +33,41 @@ function buildSourceMatcher(src, listenerOrbital) {
   const wantedTrait = src.trait;
   return (source) => !!source && source.orbital === wantedOrbital && source.trait === wantedTrait;
 }
+function applyRowAccess(rows, policy, filter, bindings) {
+  if (policy === void 0 && filter === void 0) {
+    return rows;
+  }
+  const predicates = [policy, filter].filter((p) => p !== void 0);
+  return rows.filter((entity) => {
+    const ctx = createContextFromBindings(
+      { entity, payload: bindings.payload, current: entity, user: bindings.user, config: bindings.config },
+      false
+    );
+    return predicates.every((predicate) => {
+      try {
+        return Boolean(evaluate(predicate, ctx));
+      } catch {
+        return false;
+      }
+    });
+  });
+}
+function checkMutationAccess(row, policy, bindings) {
+  if (policy === void 0) {
+    return true;
+  }
+  const ctx = createContextFromBindings(
+    { entity: row, payload: bindings.payload, current: row, user: bindings.user, config: bindings.config },
+    false
+  );
+  try {
+    return Boolean(evaluate(policy, ctx));
+  } catch {
+    return false;
+  }
+}
+
+// src/OrbitalServerRuntime.ts
 var _resolvedNodeRequire = null;
 function nodeRequire(modulePath) {
   if (!_resolvedNodeRequire) {
@@ -1316,8 +1351,15 @@ var OrbitalServerRuntime = class {
           if (action === "create" || action === "update") {
             this.validateRelationCardinality(type, data || {});
           }
+          const accessBindings = { user: bindingsRef?.user, payload: bindingsRef?.payload, config: bindingsRef?.config };
+          const mutationPolicy = this.resolvedSchema ? entityAccessPolicies(this.resolvedSchema, type)?.[action === "create" ? "create" : action === "update" ? "update" : "delete"] : void 0;
           switch (action) {
             case "create": {
+              if (!checkMutationAccess(data || {}, mutationPolicy, accessBindings)) {
+                throw new Error(
+                  `@create denied: the declared access policy for '${type}' rejected this row`
+                );
+              }
               const { id } = await this.persistence.create(type, data || {});
               resultData = { id, ...data || {} };
               break;
@@ -1325,6 +1367,14 @@ var OrbitalServerRuntime = class {
             case "update":
               if (data?.id || entityId) {
                 const updateId = data?.id || entityId;
+                if (mutationPolicy !== void 0) {
+                  const existing = await this.persistence.getById(type, updateId);
+                  if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings)) {
+                    throw new Error(
+                      `@update denied: the declared access policy for '${type}' rejected this row`
+                    );
+                  }
+                }
                 await this.persistence.update(type, updateId, data || {});
                 const updated = await this.persistence.getById(type, updateId);
                 resultData = updated || { id: updateId, ...data || {} };
@@ -1335,6 +1385,14 @@ var OrbitalServerRuntime = class {
               const nestedId = typeof data === "object" && data !== null ? data.id : void 0;
               const deleteId = directId ?? nestedId ?? entityId;
               if (deleteId) {
+                if (mutationPolicy !== void 0) {
+                  const existing = await this.persistence.getById(type, deleteId);
+                  if (!existing || !checkMutationAccess(existing, mutationPolicy, accessBindings)) {
+                    throw new Error(
+                      `@delete denied: the declared access policy for '${type}' rejected this row`
+                    );
+                  }
+                }
                 await this.enforceOnDeleteRules(type, deleteId);
                 await this.persistence.delete(type, deleteId);
                 resultData = { id: deleteId, deleted: true };
@@ -1423,9 +1481,11 @@ var OrbitalServerRuntime = class {
         try {
           let result = null;
           let total = 0;
+          const readPolicy = this.resolvedSchema ? entityAccessPolicies(this.resolvedSchema, fetchEntityType)?.read : void 0;
+          const accessBindings = { user: bindingsRef?.user, payload: bindingsRef?.payload, config: bindingsRef?.config };
           if (options?.id) {
             const entity = await this.persistence.getById(fetchEntityType, options.id);
-            if (entity) {
+            if (entity && applyRowAccess([entity], readPolicy, void 0, accessBindings).length > 0) {
               if (options?.include && options.include.length > 0) {
                 await this.populateRelations([entity], fetchEntityType, options.include);
               }
@@ -1435,24 +1495,12 @@ var OrbitalServerRuntime = class {
             }
           } else {
             let entities = await this.persistence.list(fetchEntityType);
-            if (options?.filter !== void 0 && options.filter !== null) {
-              const predicate = options.filter;
-              entities = entities.filter((entity) => {
-                const ctx = createContextFromBindings(
-                  { entity, payload: bindingsRef?.payload, current: entity, user: bindingsRef?.user },
-                  false
-                );
-                try {
-                  return Boolean(evaluate(predicate, ctx));
-                } catch (err) {
-                  effectLog.error("fetch:filter-eval-error", {
-                    entityType: fetchEntityType,
-                    error: err instanceof Error ? err : String(err)
-                  });
-                  return false;
-                }
-              });
-            }
+            entities = applyRowAccess(
+              entities,
+              readPolicy,
+              options?.filter !== void 0 && options.filter !== null ? options.filter : void 0,
+              accessBindings
+            );
             total = entities.length;
             if (options?.offset && options.offset > 0) {
               entities = entities.slice(options.offset);

package/dist/index.js

@@ -424,7 +424,7 @@ function createServerEffectHandlers(opts) {
             const predicate = options.filter;
             entities = entities.filter((entity) => {
               const ctx = createContextFromBindings(
-                { entity, payload: bindings?.payload, current: entity },
+                { entity, payload: bindings?.payload, current: entity, user: bindings?.user, config: bindings?.config },
                 false
               );
               try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almadar/runtime",
-  "version": "6.46.0",
+  "version": "6.47.0",
   "description": "Interpreted runtime for Almadar orbital applications (OrbitalServerRuntime)",
   "type": "module",
   "main": "./dist/index.js",
@@ -52,11 +52,11 @@
     "access": "public"
   },
   "dependencies": {
-    "@almadar/core": "^10.44.0",
+    "@almadar/core": "^10.45.0",
     "@almadar/evaluator": "^2.38.0",
     "@almadar/logger": "^1.10.0",
     "@almadar/server": "^2.30.0",
-    "@almadar/std": "^16.154.0"
+    "@almadar/std": "^16.155.0"
   },
   "peerDependencies": {
     "express": "^5.0.0"