@anteros/core 0.0.1-alpha.2 → 0.0.1-alpha.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@anteros/core",
   "module": "index.ts",
-  "version": "0.0.1-alpha.2",
+  "version": "0.0.1-alpha.3",
   "type": "module",
   "description": "Anteros Core",
   "private": false,

package/server/api.ts

@@ -42,6 +42,55 @@ const ActionsValues = [
 
 
 
+// ─── File access helper ────────────────────────────────────────────────────
+
+async function checkFileAccess(
+    access: { [key: string]: boolean | ((ctx: any) => boolean | Promise<boolean>) | undefined } | undefined,
+    operation: string,
+    tenant_id: string,
+    c: any,
+): Promise<void> {
+    // No access config at all → deny (secure by default)
+    if (!access) {
+        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+    }
+
+    const hasWildcard = access['*'] !== undefined;
+    const hasSpecific = access[operation] !== undefined;
+
+    // No matching rule at all → deny
+    if (!hasWildcard && !hasSpecific) {
+        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+    }
+
+    // Specific rule takes precedence over wildcard
+    const rule = hasSpecific ? access[operation] : access['*'];
+    if (rule === undefined) {
+        throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
+    }
+
+    const t = c.get('token');
+    const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
+
+    if (accessToken.expired) {
+        throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
+    }
+    if (!accessToken.value) {
+        throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
+    }
+
+    let allowed: boolean;
+    if (typeof rule === 'function') {
+        const rest = new useRest({ internal: false, tenant_id });
+        allowed = await rule({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
+    } else {
+        allowed = rule;
+    }
+    if (!allowed) {
+        throw new AppError(`${operation} not allowed`, { status: 401, code: 'ACCESS_DENIED' });
+    }
+}
+
 function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
 
     // Crud API
@@ -567,29 +616,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
       if (!colUpload) {
         throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
       }
-      if (colUpload?.api?.access?.upload) {
-        const t = c.get('token');
-        const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
-
-        if (accessToken.expired) {
-          throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
-        }
-        if (!accessToken.value) {
-          throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
-        }
-
-        const accessCheck = colUpload.api.access.upload;
-        let allowed: boolean;
-        if (typeof accessCheck === 'function') {
-          const rest = new useRest({ internal: false, tenant_id });
-          allowed = await accessCheck({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-        } else {
-          allowed = accessCheck;
-        }
-        if (!allowed) {
-          throw new AppError('Upload not allowed', { status: 401, code: 'ACCESS_DENIED' });
-        }
-      }
+      await checkFileAccess(colUpload?.api?.access as any, 'upload', tenant_id, c);
 
       const contentType = c.req.header('Content-Type') || '';
       if (!contentType.includes('multipart/form-data')) {
@@ -646,29 +673,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
       if (!colServe) {
         throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
       }
-      if (colServe?.api?.access?.read) {
-        const t = c.get('token');
-        const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
-
-        if (accessToken.expired) {
-          throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
-        }
-        if (!accessToken.value) {
-          throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
-        }
-
-        const accessCheck = colServe.api.access.read;
-        let allowed: boolean;
-        if (typeof accessCheck === 'function') {
-          const rest = new useRest({ internal: false, tenant_id });
-          allowed = await accessCheck({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-        } else {
-          allowed = accessCheck;
-        }
-        if (!allowed) {
-          throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-        }
-      }
+      await checkFileAccess(colServe?.api?.access as any, 'read', tenant_id, c);
 
       const filename = basename(c.req.param('file') as string);
       if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {
@@ -721,29 +726,7 @@ function initializeApi(app: Hono<{ Variables: HonoVariables }>) {
       if (!colDelete) {
         throw new AppError('File collection `' + collection + '` not found', { status: 400, code: 'FILE_COLLECTION_NOT_FOUND' });
       }
-      if (colDelete?.api?.access?.delete) {
-        const t = c.get('token');
-        const accessToken = { value: t?.value ?? null, decoded: t?.decoded ?? null, provided: t?.provided ?? false, expired: t?.expired ?? false };
-
-        if (accessToken.expired) {
-          throw new AppError('Token expired', { status: 401, code: 'TOKEN_EXPIRED' });
-        }
-        if (!accessToken.value) {
-          throw new AppError('Authentication required', { status: 401, code: 'AUTH_REQUIRED' });
-        }
-
-        const accessCheck = colDelete.api.access.delete;
-        let allowed: boolean;
-        if (typeof accessCheck === 'function') {
-          const rest = new useRest({ internal: false, tenant_id });
-          allowed = await accessCheck({ rest, error: fn.error, jwt: func.jwt, token: accessToken });
-        } else {
-          allowed = accessCheck;
-        }
-        if (!allowed) {
-          throw new AppError('Access denied', { status: 401, code: 'ACCESS_DENIED' });
-        }
-      }
+      await checkFileAccess(colDelete?.api?.access as any, 'delete', tenant_id, c);
 
       const filename = basename(c.req.param('file') as string);
       if (!filename || filename.startsWith('.') || filename.includes('..') || filename.includes('/')) {

package/types/file.d.ts

@@ -13,6 +13,8 @@ type FileAccessHandler = (ctx: {
 }) => boolean | Promise<boolean>;
 
 type FileApiAccess = {
+    /** Default access rule applied when no per-operation rule is set */
+    '*'?: boolean | FileAccessHandler;
     /** Access control for POST /upload/:tenant_id/:slug */
     upload?: boolean | FileAccessHandler;
     /** Access control for GET /files/:tenant_id/:slug/:file */