@aooth/arbac-moost 0.1.3 → 0.1.4

package/README.md

@@ -33,6 +33,22 @@ Full docs, API reference, and recipes: **https://aooth.moost.org/moost/**
 - [Decorators](https://aooth.moost.org/moost/decorators)
 - [API reference](https://aooth.moost.org/api/arbac-moost)
 
+## Custom action handlers — your responsibility
+
+The `@ArbacAuthorize` interceptor gates the **entry** to a `@DbAction` handler: if the user lacks the privilege, the handler doesn't run. But what the handler does inside its body is on you — the interceptor doesn't follow secondary database calls or external side effects.
+
+If your handler reads or writes rows from the same table the entry-gate scopes, route those calls through the active scope. `useArbac().getScopes<ArbacDbScope>()` exposes the per-event scope array; from there:
+
+- `scope.filter` — AND-merge into your WHERE clause (use the union of all scope filters via `mergeScopeFilters` from `@aooth/arbac`, not just the first).
+- `scope.set` — overlay onto any insert/update payload **after** your own body keys, so scope-set wins over caller-supplied values.
+- `scope.projection` — restrict any custom SELECT to the union of allowed fields.
+
+The demo at [`packages/e2e-demo/src/controllers/_helpers.ts`](../e2e-demo/src/controllers/_helpers.ts) shows the convention (`scopedFilter`, `scopedSet`); the test `ACT-08` in [`packages/e2e-demo/test/arbac-actions.spec.ts`](../e2e-demo/test/arbac-actions.spec.ts) pins that handlers using this pattern correctly enforce row-level scope.
+
+If your handler talks to a different system (audit log, cache, external API, sibling table) or has special logic (cross-tenant aggregations, admin escape hatches), you wire the scope to whatever surface that system exposes — there is no automatic propagation, and the trust decisions stay explicit in the handler.
+
+> **Why not enforce structurally?** The framework can't know, at the action-entry point, what the handler intends to read or write. A handler that calls a remote service, spans transactions across tables, or has admin-only branches won't compose cleanly with an automatic row-level gate. Keeping scope enforcement explicit makes the trust decision a code-review-visible artifact. The tradeoff is that a forgetful contributor can bypass it — mitigate via code review and ACT-08-style regression tests.
+
 ## License
 
 MIT

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { t as AoothArbacUserCredentials } from "../user-CFXfHtsb.mjs";
+import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
 import { t as ArbacUserProvider } from "../user.provider-JpI5dD6Z.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 

package/dist/atscript/index.mjs

@@ -1,5 +1,5 @@
 import { r as __decorate, t as ArbacUserProvider } from "../user.provider-CGWueNjx.mjs";
-import { t as AoothArbacUserCredentials } from "../user-CFXfHtsb.mjs";
+import { t as AoothArbacUserCredentials } from "../user-ChbLPYhG.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
 //#region \0@oxc-project+runtime@0.129.0/helpers/decorateMetadata.js

package/dist/index.d.mts

@@ -237,6 +237,25 @@ type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavR
 declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbController<T> {
   protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
   protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;
+  /**
+   * Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
+   * bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
+   * no try/catch, so a malformed `?status=...` (e.g. unquoted single quote at a
+   * non-string position) surfaces as a server error — misleading, since the
+   * server is fine and the client sent bad input.
+   *
+   * Narrow targeting: only `SyntaxError` raised from inside the parser is
+   * remapped. Other errors (e.g. a programmer-introduced TypeError in a future
+   * override) still bubble as 500. SQL-injection-shaped payloads remain safely
+   * handled either way — see SEC-17 for the parameterisation invariant; this
+   * override is an orthogonal robustness pin around the parse step.
+   */
+  protected parseQueryString(url: string): ReturnType<AsDbController<T>["parseQueryString"]>;
+  /**
+   * Same parser-error → 400 remap as {@link parseQueryString}, applied to the
+   * `/one` and `/one?…` code paths which use `parseControlsOnlyFromUrl`.
+   */
+  protected parseControlsOnlyFromUrl(url: string): ReturnType<AsDbController<T>["parseControlsOnlyFromUrl"]>;
   /**
    * Enforce per-role `ArbacDbScope.controls` gates against the parsed Uniquery
    * controls of a request. Runs after the base validator (which checks the

package/dist/index.mjs

@@ -256,6 +256,37 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return applyArbacProjection(projection, readCachedScopes());
 	}
 	/**
+	* Translate `@uniqu/url` parser failures into HTTP 400 instead of letting them
+	* bubble as 500. The base `parseQueryString` calls `parseUrl()` directly with
+	* no try/catch, so a malformed `?status=...` (e.g. unquoted single quote at a
+	* non-string position) surfaces as a server error — misleading, since the
+	* server is fine and the client sent bad input.
+	*
+	* Narrow targeting: only `SyntaxError` raised from inside the parser is
+	* remapped. Other errors (e.g. a programmer-introduced TypeError in a future
+	* override) still bubble as 500. SQL-injection-shaped payloads remain safely
+	* handled either way — see SEC-17 for the parameterisation invariant; this
+	* override is an orthogonal robustness pin around the parse step.
+	*/
+	parseQueryString(url) {
+		try {
+			return super.parseQueryString(url);
+		} catch (err) {
+			throw remapUniquUrlSyntaxError(err);
+		}
+	}
+	/**
+	* Same parser-error → 400 remap as {@link parseQueryString}, applied to the
+	* `/one` and `/one?…` code paths which use `parseControlsOnlyFromUrl`.
+	*/
+	parseControlsOnlyFromUrl(url) {
+		try {
+			return super.parseControlsOnlyFromUrl(url);
+		} catch (err) {
+			throw remapUniquUrlSyntaxError(err);
+		}
+	}
+	/**
 	* Enforce per-role `ArbacDbScope.controls` gates against the parsed Uniquery
 	* controls of a request. Runs after the base validator (which checks the
 	* controls DTO shape) and BEFORE the query/aggregation pipeline executes.
@@ -448,6 +479,24 @@ function applyPreparedOverlay(data, prepared) {
 	if (prepared.setOverrides) Object.assign(merged, prepared.setOverrides);
 	return merged;
 }
+/**
+* Translate a `@uniqu/url` parser `SyntaxError` into `HttpError(400)`. Any
+* other error (including a pre-existing `HttpError`) is returned as-is so the
+* caller's `throw remapUniquUrlSyntaxError(err)` preserves the original
+* status — no double-wrapping.
+*
+* Matching is narrow: only `SyntaxError` whose message carries the parser's
+* "at pos N" / "at N" positional marker (every throw site in @uniqu/url's
+* lexer + parser emits one). This avoids catching unrelated SyntaxErrors that
+* a future override might surface from `JSON.parse` etc.
+*/
+function remapUniquUrlSyntaxError(err) {
+	if (err instanceof HttpError) return err;
+	if (!(err instanceof SyntaxError)) return err;
+	const msg = err.message;
+	if (!/at (?:pos )?\d+/.test(msg)) return err;
+	return new HttpError(400, `Invalid query string: ${msg}`);
+}
 //#endregion
 //#region src/db/as-arbac-db-readable-controller.ts
 let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDbReadableController {

package/dist/user-ChbLPYhG.mjs

@@ -0,0 +1,15 @@
+import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
+import "@aooth/user/atscript-db/model.as";
+//#region src/atscript/models/user.as
+var AoothArbacUserCredentials = class {
+	static __is_atscript_annotated_type = true;
+	static type = {};
+	static metadata = /* @__PURE__ */ new Map();
+	static id = "AoothArbacUserCredentials";
+	static toJsonSchema() {
+		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
+	}
+};
+defineAnnotatedType("object", AoothArbacUserCredentials).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("version", defineAnnotatedType().designType("number").tags("int", "number").annotate("db.column.version", true).annotate("expect.int", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).prop("lastUsedWindow", defineAnnotatedType().designType("number").tags("int", "number").annotate("expect.int", true).optional().$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("backupCodes", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
+//#endregion
+export { AoothArbacUserCredentials as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -54,22 +54,22 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.3",
-    "@aooth/arbac-core": "0.1.3",
-    "@aooth/user": "0.1.3"
+    "@aooth/arbac": "0.1.4",
+    "@aooth/arbac-core": "0.1.4",
+    "@aooth/user": "0.1.4"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.56",
-    "@atscript/db": "^0.1.80",
-    "@atscript/db-sql-tools": "^0.1.80",
-    "@atscript/db-sqlite": "^0.1.80",
-    "@atscript/moost-db": "^0.1.80",
-    "@atscript/typescript": "^0.1.56",
-    "@moostjs/event-http": "^0.6.10",
+    "@atscript/core": "^0.1.61",
+    "@atscript/db": "^0.1.87",
+    "@atscript/db-sql-tools": "^0.1.87",
+    "@atscript/db-sqlite": "^0.1.87",
+    "@atscript/moost-db": "^0.1.87",
+    "@atscript/typescript": "^0.1.61",
+    "@moostjs/event-http": "^0.6.17",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.6",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.56"
+    "unplugin-atscript": "^0.1.61"
   },
   "peerDependencies": {
     "@atscript/db": ">=0.1.79",
@@ -92,10 +92,11 @@
     }
   },
   "scripts": {
-    "gen:atscript": "node --experimental-strip-types scripts/gen-as.mjs",
+    "gen:atscript": "asc",
     "build": "vp pack",
     "dev": "vp pack --watch",
     "test": "vp test",
-    "check": "vp check"
+    "check": "vp check",
+    "postinstall": "asc"
   }
 }

package/dist/user-CFXfHtsb.mjs

@@ -1,15 +0,0 @@
-import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
-import "@aooth/user/atscript-db/model.as";
-//#region src/atscript/models/user.as
-var AoothArbacUserCredentials = class {
-	static __is_atscript_annotated_type = true;
-	static type = {};
-	static metadata = /* @__PURE__ */ new Map();
-	static id = "AoothArbacUserCredentials";
-	static toJsonSchema() {
-		throwFeatureDisabled("JSON Schema", "jsonSchema", "emit.jsonSchema");
-	}
-};
-defineAnnotatedType("object", AoothArbacUserCredentials).prop("username", defineAnnotatedType().designType("string").tags("string").annotate("db.index.unique", "username_idx", true).$type).prop("password", defineAnnotatedType("object").prop("hash", defineAnnotatedType().designType("string").tags("string").$type).prop("history", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).$type).prop("lastChanged", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("isInitial", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("account", defineAnnotatedType("object").prop("active", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("locked", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("lockReason", defineAnnotatedType().designType("string").tags("string").$type).prop("lockEnds", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("failedLoginAttempts", defineAnnotatedType().designType("number").tags("number").$type).prop("lastLogin", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("pendingInvitation", defineAnnotatedType().designType("boolean").tags("boolean").optional().$type).annotate("db.patch.strategy", "merge").$type).prop("mfa", defineAnnotatedType("object").prop("methods", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("name", defineAnnotatedType().designType("string").tags("string").$type).prop("confirmed", defineAnnotatedType().designType("boolean").tags("boolean").$type).prop("value", defineAnnotatedType().designType("string").tags("string").$type).$type).$type).prop("defaultMethod", defineAnnotatedType().designType("string").tags("string").$type).prop("autoSend", defineAnnotatedType().designType("boolean").tags("boolean").$type).annotate("db.patch.strategy", "merge").$type).prop("trustedDevices", defineAnnotatedType("array").of(defineAnnotatedType("object").prop("token", defineAnnotatedType().designType("string").tags("string").$type).prop("ip", defineAnnotatedType().designType("string").tags("string").optional().$type).prop("issuedAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("expiresAt", defineAnnotatedType().designType("number").tags("timestamp", "number").annotate("expect.int", true).$type).prop("name", defineAnnotatedType().designType("string").tags("string").optional().$type).$type).annotate("db.patch.strategy", "merge").optional().$type).prop("roles", defineAnnotatedType("array").of(defineAnnotatedType().designType("string").tags("string").$type).annotate("arbac.role", true).$type);
-//#endregion
-export { AoothArbacUserCredentials as t };