@aooth/arbac-moost 0.1.21 → 0.1.23

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-CKPMp3G8.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BFHjF2vD.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-CKPMp3G8.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-BFHjF2vD.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
@@ -6,6 +6,7 @@ import { Mate, TMateParamMeta, TMoostMetadata } from "moost";
 import { ControlGate, TProjection } from "@aooth/arbac";
 import { AsDbReadableController } from "@atscript/moost-db";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
+import { TMetaResponse } from "@atscript/db";
 
 //#region src/arbac.composables.d.ts
 interface ArbacBindings {
@@ -122,7 +123,115 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
   protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
   protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;
   protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
+  /**
+   * Same ARBAC `/meta` overlay as the writable controller (actions/crud
+   * filtering + BUG-3 field-surface pruning by the read scopes' projection
+   * union) — view-style metas leak hidden field names identically.
+   */
+  protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
+  /**
+   * Scope-aware field-existence check — same contract as
+   * {@link AsArbacDbController.hasField} (BUG-3): a field outside the
+   * read-scope projection union answers `false`, so `validateInsights` rejects
+   * `$select` / filter / sort references to it with the identical
+   * `Unknown field "x"` 400 a nonexistent field gets.
+   */
+  protected hasField(path: string): boolean;
+}
+//#endregion
+//#region src/db/meta-projection.d.ts
+/**
+ * Union the per-scope `projection` whitelists into the single access-control
+ * projection used for FIELD-EXISTENCE decisions (`hasField` parity + `/meta`
+ * pruning). Returns `undefined` when the union imposes no restriction — no
+ * scopes at all, or any scope without a `projection` (a universal grant makes
+ * `unionProjections` collapse to the universe `{}`).
+ */
+declare function unionScopeProjection(scopes: ArbacDbScope[]): TProjection | undefined;
+/**
+ * Relation names any scope explicitly grants via `with.<name>` — an explicit
+ * content grant implies the relation EXISTS for this principal even when the
+ * projection union does not name it (the sub-scope, not the projection, owns
+ * the joined rows' policy — see {@link ArbacDbScope.with}).
+ */
+declare function collectWithGrantNames(scopes: ArbacDbScope[]): ReadonlySet<string>;
+/**
+ * The principal's field-visibility verdict set, assembled once per request
+ * (or per `/meta` overlay) and threaded through the pruning walk.
+ */
+interface MetaVisibility {
+  /** Constrained projection union (never the empty/universe projection). */
+  allowed: TProjection;
+  /**
+   * Identifier fields reads ALWAYS return regardless of projection (the read
+   * path widens `preferredId` back in, and PK addressing requires the key) —
+   * hiding them would advertise less than reads deliver and break `/one/:id`.
+   */
+  alwaysVisible: ReadonlySet<string>;
+  /** Relation names granted via `with.<name>` (see {@link collectWithGrantNames}). */
+  withGrants: ReadonlySet<string>;
 }
+/**
+ * Whether a flattened dot-path field exists for this principal. A path under
+ * a `with`-granted relation passes unconditionally — the sub-scope governs
+ * the joined content, and rejecting the path here would break the very `$with`
+ * expansion the grant permits.
+ */
+declare function isMetaFieldVisible(path: string, vis: MetaVisibility): boolean;
+/**
+ * Prune a `/meta` envelope down to the fields the principal's read scopes can
+ * ever surface, so a scoped UI cannot even OFFER an out-of-scope column (the
+ * designed contract: the projection removes fields from the META entirely,
+ * not just from row payloads). Pruned facets:
+ *
+ * - `fields` — the flat capability map (sortable/filterable flags).
+ * - `type` — the serialized annotated type (what dynamic clients build
+ *   tables/forms from); nested object props prune by dot-path, relation props
+ *   survive whole when the relation itself is visible.
+ * - `relations` — entries neither projected nor `with`-granted.
+ * - `versionColumn` — dropped when the OCC column itself is hidden.
+ *
+ * NEVER mutates the input — the base controller caches the static envelope
+ * (`applyMetaOverlay` contract); every pruned branch is a fresh object.
+ */
+declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility): TMetaResponse;
+/**
+ * Shared body of both ARBAC controllers' `hasField` overrides (BUG-3 twin of
+ * the `/meta` pruning): a field outside the read-scope projection union must
+ * be indistinguishable from a field that does not exist. Returns `true` when
+ * the scopes impose no projection restriction.
+ */
+declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: string, alwaysVisible: ReadonlySet<string>): boolean;
+/**
+ * PK + `preferredId` for a controller's table/readable — the
+ * {@link MetaVisibility.alwaysVisible} set both `applyMetaOverlay` and
+ * `hasField` pass into the visibility checks.
+ */
+declare function metaAlwaysVisibleFields(controller: object, source: {
+  primaryKeys: readonly string[];
+  preferredId: readonly string[];
+}): ReadonlySet<string>;
+/**
+ * The full ARBAC `/meta` overlay, shared by `AsArbacDbController` and
+ * `AsArbacDbReadableController`: filter `actions` + `crud` by per-action
+ * evaluation, then prune the FIELD surface (`fields`, serialized `type`,
+ * `relations`, `versionColumn`) by the read scopes' projection union.
+ *
+ * Field pruning (BUG-3): a scope projection must remove fields from the META
+ * entirely — `transformProjection` already strips their VALUES from every
+ * read, but the envelope still advertised the full field map, so a scoped UI
+ * offered columns that could never populate, and secret-bearing column NAMES
+ * leaked. The pruning union comes from the read-op evaluations already
+ * computed for the `crud` overlay (same `unionProjections` the read path
+ * applies). An allowed read op WITHOUT scopes is an unscoped grant —
+ * universe, no pruning (unchanged behavior for unscoped roles). No read op
+ * allowed → the projection union is empty → no pruning: `crud` already
+ * advertises no read surface, and write-only principals still need `type`
+ * for their insert/update forms. `alwaysVisible` (PK + preferredId) is never
+ * pruned — reads always return those fields (projection widening / id
+ * addressing).
+ */
+declare function applyArbacMetaOverlay(meta: TMetaResponse, alwaysVisible: ReadonlySet<string>): Promise<TMetaResponse>;
 //#endregion
 //#region src/moost-arbac.d.ts
 /**
@@ -138,4 +247,4 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/index.mjs

@@ -3,7 +3,7 @@ import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core"
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { current, key } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getInstanceOwnMethods, getMoostMate, useControllerContext, useLogger } from "moost";
-import { conjoinScopeFilters, intersectControlsPolicy, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
+import { conjoinScopeFilters, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
 //#region src/attenuation.ts
 /**
@@ -239,6 +239,259 @@ const ArbacResource = (name) => getArbacMate().decorate("arbacResourceId", name)
 */
 const ArbacAction = (name) => getArbacMate().decorate("arbacActionId", name);
 //#endregion
+//#region src/db/meta-projection.ts
+/**
+* Union the per-scope `projection` whitelists into the single access-control
+* projection used for FIELD-EXISTENCE decisions (`hasField` parity + `/meta`
+* pruning). Returns `undefined` when the union imposes no restriction — no
+* scopes at all, or any scope without a `projection` (a universal grant makes
+* `unionProjections` collapse to the universe `{}`).
+*/
+function unionScopeProjection(scopes) {
+	if (scopes.length === 0) return void 0;
+	const allowed = unionProjections(...scopes.map((s) => s.projection ?? {}));
+	return Object.keys(allowed).length === 0 ? void 0 : allowed;
+}
+/**
+* Relation names any scope explicitly grants via `with.<name>` — an explicit
+* content grant implies the relation EXISTS for this principal even when the
+* projection union does not name it (the sub-scope, not the projection, owns
+* the joined rows' policy — see {@link ArbacDbScope.with}).
+*/
+function collectWithGrantNames(scopes) {
+	const out = /* @__PURE__ */ new Set();
+	for (const s of scopes) if (s.with) for (const name of Object.keys(s.with)) out.add(name);
+	return out;
+}
+/**
+* Whether a flattened dot-path field exists for this principal. A path under
+* a `with`-granted relation passes unconditionally — the sub-scope governs
+* the joined content, and rejecting the path here would break the very `$with`
+* expansion the grant permits.
+*/
+function isMetaFieldVisible(path, vis) {
+	if (vis.alwaysVisible.has(path)) return true;
+	const dot = path.indexOf(".");
+	const head = dot === -1 ? path : path.slice(0, dot);
+	if (vis.withGrants.has(head)) return true;
+	return isFieldAllowed(path, vis.allowed);
+}
+/**
+* Prune a `/meta` envelope down to the fields the principal's read scopes can
+* ever surface, so a scoped UI cannot even OFFER an out-of-scope column (the
+* designed contract: the projection removes fields from the META entirely,
+* not just from row payloads). Pruned facets:
+*
+* - `fields` — the flat capability map (sortable/filterable flags).
+* - `type` — the serialized annotated type (what dynamic clients build
+*   tables/forms from); nested object props prune by dot-path, relation props
+*   survive whole when the relation itself is visible.
+* - `relations` — entries neither projected nor `with`-granted.
+* - `versionColumn` — dropped when the OCC column itself is hidden.
+*
+* NEVER mutates the input — the base controller caches the static envelope
+* (`applyMetaOverlay` contract); every pruned branch is a fresh object.
+*/
+function pruneMetaByVisibility(meta, vis) {
+	const fields = {};
+	for (const [path, fieldMeta] of Object.entries(meta.fields)) if (isMetaFieldVisible(path, vis)) fields[path] = fieldMeta;
+	const relationNames = new Set(meta.relations.map((r) => r.name));
+	const relations = meta.relations.filter((r) => isMetaFieldVisible(r.name, vis));
+	const out = {
+		...meta,
+		fields,
+		relations,
+		type: pruneSerializedType(meta.type, "", vis, relationNames)
+	};
+	if (out.versionColumn !== void 0 && !isMetaFieldVisible(out.versionColumn, vis)) delete out.versionColumn;
+	return out;
+}
+/**
+* Copy-on-prune walk over a serialized type node. `basePath` is the flattened
+* dot-path prefix ("" at the root). Top-level relation props (nav props named
+* in `meta.relations`) are kept or dropped WHOLE — their internal shape is the
+* joined model's business (content scoping happens per-request through the
+* `with` sub-scopes), while own-field subtrees prune recursively so an
+* include-mode union like `{ "password.hash": 1 }` keeps `password` with only
+* `hash` inside.
+*/
+function pruneSerializedType(node, basePath, vis, relationNames) {
+	const def = node.type;
+	if (def.kind === "object") {
+		const props = {};
+		for (const [name, prop] of Object.entries(def.props)) {
+			const path = basePath ? `${basePath}.${name}` : name;
+			if (basePath === "" && relationNames.has(name)) {
+				if (isMetaFieldVisible(name, vis)) props[name] = prop;
+				continue;
+			}
+			if (!isMetaFieldVisible(path, vis)) continue;
+			props[name] = pruneSerializedType(prop, path, vis, relationNames);
+		}
+		return {
+			...node,
+			type: {
+				...def,
+				props
+			}
+		};
+	}
+	if (def.kind === "array") return {
+		...node,
+		type: {
+			...def,
+			of: pruneSerializedType(def.of, basePath, vis, relationNames)
+		}
+	};
+	if (def.kind === "union" || def.kind === "intersection" || def.kind === "tuple") return {
+		...node,
+		type: {
+			...def,
+			items: def.items.map((item) => pruneSerializedType(item, basePath, vis, relationNames))
+		}
+	};
+	return node;
+}
+const UNRESTRICTED_VISIBILITY = {
+	allowed: void 0,
+	withGrants: /* @__PURE__ */ new Set()
+};
+const scopeVisibilityCache = /* @__PURE__ */ new WeakMap();
+function scopeVisibility(scopes) {
+	if (scopes.length === 0) return UNRESTRICTED_VISIBILITY;
+	let vis = scopeVisibilityCache.get(scopes);
+	if (!vis) {
+		vis = {
+			allowed: unionScopeProjection(scopes),
+			withGrants: collectWithGrantNames(scopes)
+		};
+		scopeVisibilityCache.set(scopes, vis);
+	}
+	return vis;
+}
+/**
+* Shared body of both ARBAC controllers' `hasField` overrides (BUG-3 twin of
+* the `/meta` pruning): a field outside the read-scope projection union must
+* be indistinguishable from a field that does not exist. Returns `true` when
+* the scopes impose no projection restriction.
+*/
+function isScopedFieldVisible(scopes, path, alwaysVisible) {
+	const { allowed, withGrants } = scopeVisibility(scopes);
+	if (!allowed) return true;
+	return isMetaFieldVisible(path, {
+		allowed,
+		alwaysVisible,
+		withGrants
+	});
+}
+const alwaysVisibleFieldsCache = /* @__PURE__ */ new WeakMap();
+/**
+* PK + `preferredId` for a controller's table/readable — the
+* {@link MetaVisibility.alwaysVisible} set both `applyMetaOverlay` and
+* `hasField` pass into the visibility checks.
+*/
+function metaAlwaysVisibleFields(controller, source) {
+	const ctor = controller.constructor;
+	let set = alwaysVisibleFieldsCache.get(ctor);
+	if (!set) {
+		set = new Set([...source.primaryKeys, ...source.preferredId]);
+		alwaysVisibleFieldsCache.set(ctor, set);
+	}
+	return set;
+}
+/**
+* The write CRUD ops. Everything else in `meta.crud` is row-returning read
+* surface whose scopes govern field VISIBILITY in `/meta` — classified by
+* complement so a read op added upstream defaults to READ and the pruning
+* fails closed (a principal whose only read grant is the new op still gets
+* a pruned envelope rather than the full field map).
+*/
+const WRITE_CRUD_OPS = new Set([
+	"insert",
+	"update",
+	"replace",
+	"remove"
+]);
+/**
+* The full ARBAC `/meta` overlay, shared by `AsArbacDbController` and
+* `AsArbacDbReadableController`: filter `actions` + `crud` by per-action
+* evaluation, then prune the FIELD surface (`fields`, serialized `type`,
+* `relations`, `versionColumn`) by the read scopes' projection union.
+*
+* Field pruning (BUG-3): a scope projection must remove fields from the META
+* entirely — `transformProjection` already strips their VALUES from every
+* read, but the envelope still advertised the full field map, so a scoped UI
+* offered columns that could never populate, and secret-bearing column NAMES
+* leaked. The pruning union comes from the read-op evaluations already
+* computed for the `crud` overlay (same `unionProjections` the read path
+* applies). An allowed read op WITHOUT scopes is an unscoped grant —
+* universe, no pruning (unchanged behavior for unscoped roles). No read op
+* allowed → the projection union is empty → no pruning: `crud` already
+* advertises no read surface, and write-only principals still need `type`
+* for their insert/update forms. `alwaysVisible` (PK + preferredId) is never
+* pruned — reads always return those fields (projection widening / id
+* addressing).
+*/
+async function applyArbacMetaOverlay(meta, alwaysVisible) {
+	const arbac = useArbac();
+	const actionToMethodMeta = collectActionMetaByName();
+	const crudKeys = Object.keys(meta.crud);
+	const [actionResults, crudResults] = await Promise.all([Promise.all(meta.actions.map((entry) => {
+		const methodMeta = actionToMethodMeta.get(entry.name);
+		const arbacAction = methodMeta?.arbacActionId ?? methodMeta?.id ?? entry.name;
+		return arbac.evaluate({ action: arbacAction });
+	})), Promise.all(crudKeys.map((key) => arbac.evaluate({ action: key })))]);
+	const filteredActions = [];
+	for (let i = 0; i < meta.actions.length; i++) if (actionResults[i].allowed) filteredActions.push(meta.actions[i]);
+	const filteredCrud = {};
+	for (let i = 0; i < crudKeys.length; i++) if (crudResults[i].allowed) filteredCrud[crudKeys[i]] = meta.crud[crudKeys[i]];
+	let overlaid = {
+		...meta,
+		actions: filteredActions,
+		crud: filteredCrud
+	};
+	let readUnrestricted = false;
+	const readScopes = [];
+	for (let i = 0; i < crudKeys.length; i++) {
+		if (!crudResults[i].allowed || WRITE_CRUD_OPS.has(crudKeys[i])) continue;
+		const scopes = crudResults[i].scopes;
+		if (!scopes || scopes.length === 0) readUnrestricted = true;
+		else readScopes.push(...scopes);
+	}
+	if (!readUnrestricted) {
+		const allowed = unionScopeProjection(readScopes);
+		if (allowed) overlaid = pruneMetaByVisibility(overlaid, {
+			allowed,
+			alwaysVisible,
+			withGrants: collectWithGrantNames(readScopes)
+		});
+	}
+	return overlaid;
+}
+const actionMetaByClassCache = /* @__PURE__ */ new WeakMap();
+function collectActionMetaByName() {
+	const cc = useControllerContext();
+	const instance = cc.getController();
+	const ctor = getConstructor(instance);
+	const cached = actionMetaByClassCache.get(ctor);
+	if (cached) return cached;
+	const map = /* @__PURE__ */ new Map();
+	const ctrlMeta = cc.getControllerMeta();
+	for (const entry of ctrlMeta?.atscript_db_actions ?? []) map.set(entry.name, {});
+	for (const methodName of getInstanceOwnMethods(instance)) {
+		if (typeof methodName !== "string") continue;
+		const m = cc.getMethodMeta(methodName);
+		if (!m) continue;
+		const actionMeta = m.atscript_db_action;
+		if (actionMeta?.name) map.set(actionMeta.name, {
+			arbacActionId: m.arbacActionId,
+			id: m.id
+		});
+	}
+	actionMetaByClassCache.set(ctor, map);
+	return map;
+}
+//#endregion
 //#region src/db/shared-read-helpers.ts
 /** Filter that matches no rows; used when ARBAC denies the request. */
 const DENY_FILTER = { $or: [] };
@@ -274,11 +527,12 @@ async function transformArbacFilter(filter) {
 * Union the per-scope `projection` whitelists and restrict the user-supplied
 * projection to that union. Returns the original projection untouched when
 * no scope declares a projection (so caller sees the unrestricted shape).
+* Uses the same `unionScopeProjection` the field-visibility seams (`hasField`
+* / `/meta` pruning) use, so value stripping and name hiding cannot drift.
 */
 function applyArbacProjection(projection, scopes) {
-	if (scopes.length === 0) return projection;
-	const allowed = unionProjections(...scopes.map((s) => s.projection ?? {}));
-	if (Object.keys(allowed).length === 0) return projection;
+	const allowed = unionScopeProjection(scopes);
+	if (!allowed) return projection;
 	return restrictProjection(projection ?? {}, allowed);
 }
 /**
@@ -411,24 +665,25 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		applyArbacControls(controls, scopes);
 		applyArbacRelationScopes(controls, scopes);
 	}
-	async applyMetaOverlay(meta) {
-		const arbac = useArbac();
-		const actionToMethodMeta = collectActionMetaByName();
-		const crudKeys = Object.keys(meta.crud);
-		const [actionResults, crudResults] = await Promise.all([Promise.all(meta.actions.map((entry) => {
-			const methodMeta = actionToMethodMeta.get(entry.name);
-			const arbacAction = methodMeta?.arbacActionId ?? methodMeta?.id ?? entry.name;
-			return arbac.evaluate({ action: arbacAction });
-		})), Promise.all(crudKeys.map((key) => arbac.evaluate({ action: key })))]);
-		const filteredActions = [];
-		for (let i = 0; i < meta.actions.length; i++) if (actionResults[i].allowed) filteredActions.push(meta.actions[i]);
-		const filteredCrud = {};
-		for (let i = 0; i < crudKeys.length; i++) if (crudResults[i].allowed) filteredCrud[crudKeys[i]] = meta.crud[crudKeys[i]];
-		return {
-			...meta,
-			actions: filteredActions,
-			crud: filteredCrud
-		};
+	applyMetaOverlay(meta) {
+		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.table));
+	}
+	/**
+	* Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
+	* above): a field outside the read-scope projection union must be
+	* indistinguishable from a field that does not exist. The base controller's
+	* ONLY call site is `validateInsights`, which turns a `false` here into the
+	* same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
+	* `$select`, filter, and sort references to a hidden field cannot be used
+	* as an existence/value oracle. Identifier fields stay visible (reads
+	* always return them — see {@link MetaVisibility.alwaysVisible}), and paths
+	* under a `with`-granted relation pass through to the sub-scope's own
+	* enforcement. Scopes were cached by the route-level authorize interceptor
+	* before validation runs (`useArbac` setScopes), so the union reflects the
+	* exact action being executed.
+	*/
+	hasField(path) {
+		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.table));
 	}
 	async onWrite(action, data) {
 		const scopes = readCachedScopes();
@@ -461,29 +716,6 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 };
 AsArbacDbController = __decorate([Inherit()], AsArbacDbController);
 const identifierFieldsCache = /* @__PURE__ */ new WeakMap();
-const actionMetaByClassCache = /* @__PURE__ */ new WeakMap();
-function collectActionMetaByName() {
-	const cc = useControllerContext();
-	const instance = cc.getController();
-	const ctor = getConstructor(instance);
-	const cached = actionMetaByClassCache.get(ctor);
-	if (cached) return cached;
-	const map = /* @__PURE__ */ new Map();
-	const ctrlMeta = cc.getControllerMeta();
-	for (const entry of ctrlMeta?.atscript_db_actions ?? []) map.set(entry.name, {});
-	for (const methodName of getInstanceOwnMethods(instance)) {
-		if (typeof methodName !== "string") continue;
-		const m = cc.getMethodMeta(methodName);
-		if (!m) continue;
-		const actionMeta = m.atscript_db_action;
-		if (actionMeta?.name) map.set(actionMeta.name, {
-			arbacActionId: m.arbacActionId,
-			id: m.id
-		});
-	}
-	actionMetaByClassCache.set(ctor, map);
-	return map;
-}
 /**
 * Test-friendly internal helper — exported for unit tests and helper
 * composition; regular consumers should not call this directly.
@@ -618,7 +850,25 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 		applyArbacControls(controls, scopes);
 		applyArbacRelationScopes(controls, scopes);
 	}
+	/**
+	* Same ARBAC `/meta` overlay as the writable controller (actions/crud
+	* filtering + BUG-3 field-surface pruning by the read scopes' projection
+	* union) — view-style metas leak hidden field names identically.
+	*/
+	applyMetaOverlay(meta) {
+		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
+	}
+	/**
+	* Scope-aware field-existence check — same contract as
+	* {@link AsArbacDbController.hasField} (BUG-3): a field outside the
+	* read-scope projection union answers `false`, so `validateInsights` rejects
+	* `$select` / filter / sort references to it with the identical
+	* `Unknown field "x"` 400 a nonexistent field gets.
+	*/
+	hasField(path) {
+		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));
+	}
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, arbacAuthorizeInterceptor, arbacPatternToRegex, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, useArbac };
+export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/{user.provider-CKPMp3G8.d.mts → user.provider-BFHjF2vD.d.mts}

@@ -163,6 +163,21 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    */
   protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
+  /**
+   * Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
+   * above): a field outside the read-scope projection union must be
+   * indistinguishable from a field that does not exist. The base controller's
+   * ONLY call site is `validateInsights`, which turns a `false` here into the
+   * same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
+   * `$select`, filter, and sort references to a hidden field cannot be used
+   * as an existence/value oracle. Identifier fields stay visible (reads
+   * always return them — see {@link MetaVisibility.alwaysVisible}), and paths
+   * under a `with`-granted relation pass through to the sub-scope's own
+   * enforcement. Scopes were cached by the route-level authorize interceptor
+   * before validation runs (`useArbac` setScopes), so the union reflects the
+   * exact action being executed.
+   */
+  protected hasField(path: string): boolean;
   protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
   protected onRemove(id: unknown): Promise<unknown>;
   private assertInScope;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,9 +60,9 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac-core": "0.1.21",
-    "@aooth/arbac": "0.1.21",
-    "@aooth/user": "0.1.21"
+    "@aooth/arbac-core": "0.1.23",
+    "@aooth/arbac": "0.1.23",
+    "@aooth/user": "0.1.23"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.76",