@aooth/arbac-moost 0.1.56 → 0.1.57

package/dist/index.d.mts

@@ -170,7 +170,23 @@ interface MetaVisibility {
   alwaysVisible: ReadonlySet<string>;
   /** Relation names granted via `with.<name>` (see {@link collectWithGrantNames}). */
   withGrants: ReadonlySet<string>;
+  /**
+   * Fields the principal's WRITE scopes allow (union of `allowedFields`, or
+   * `"all"` for an unrestricted write grant). A field that is writable but not
+   * read-visible is NOT pruned from `/meta` — it survives with a `db.writeOnly`
+   * stamp (type only; rows/projections never carry it), so generic forms and
+   * client preflight validators can still SET sealed fields (e.g. credentials
+   * behind a read projection). Absent → nothing extra survives.
+   */
+  writable?: ReadonlySet<string> | "all";
 }
+/**
+ * Union of write-scope `allowedFields`; `"all"` for field-unrestricted write
+ * access. Mirrors `prepareScopeOverlay`: the whitelist exists only when at
+ * least one scope carries an `allowedFields` array — scoped-but-unlisted
+ * writes are field-unrestricted.
+ */
+declare function collectWritableFields(scopes: ArbacDbScope[], unrestricted: boolean): ReadonlySet<string> | "all" | undefined;
 /**
  * Whether a flattened dot-path field exists for this principal. A path under
  * a `with`-granted relation passes unconditionally — the sub-scope governs
@@ -247,4 +263,4 @@ declare function applyArbacMetaOverlay(meta: TMetaResponse, alwaysVisible: Reado
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/index.mjs

@@ -263,6 +263,33 @@ function collectWithGrantNames(scopes) {
 	for (const s of scopes) if (s.with) for (const name of Object.keys(s.with)) out.add(name);
 	return out;
 }
+/** Exact-or-ancestor membership: `credit.credentials.user` matches a `credit.credentials` grant. */
+function isPathWritable(path, writable) {
+	if (!writable) return false;
+	if (writable === "all") return true;
+	if (writable.has(path)) return true;
+	let pos = path.length;
+	while ((pos = path.lastIndexOf(".", pos - 1)) !== -1) if (writable.has(path.slice(0, pos))) return true;
+	return false;
+}
+/**
+* Union of write-scope `allowedFields`; `"all"` for field-unrestricted write
+* access. Mirrors `prepareScopeOverlay`: the whitelist exists only when at
+* least one scope carries an `allowedFields` array — scoped-but-unlisted
+* writes are field-unrestricted.
+*/
+function collectWritableFields(scopes, unrestricted) {
+	if (unrestricted) return "all";
+	if (scopes.length === 0) return void 0;
+	const out = /* @__PURE__ */ new Set();
+	let sawWhitelist = false;
+	for (const s of scopes) if (Array.isArray(s.allowedFields)) {
+		sawWhitelist = true;
+		for (const f of s.allowedFields) out.add(f);
+	}
+	if (!sawWhitelist) return "all";
+	return out.size > 0 ? out : void 0;
+}
 /**
 * Whether a flattened dot-path field exists for this principal. A path under
 * a `with`-granted relation passes unconditionally — the sub-scope governs
@@ -295,6 +322,12 @@ function isMetaFieldVisible(path, vis) {
 function pruneMetaByVisibility(meta, vis) {
 	const fields = {};
 	for (const [path, fieldMeta] of Object.entries(meta.fields)) if (isMetaFieldVisible(path, vis)) fields[path] = fieldMeta;
+	else if (isPathWritable(path, vis.writable)) fields[path] = {
+		...fieldMeta,
+		writeOnly: true,
+		filterable: false,
+		sortable: false
+	};
 	const relationNames = new Set(meta.relations.map((r) => r.name));
 	const relations = meta.relations.filter((r) => isMetaFieldVisible(r.name, vis));
 	const out = {
@@ -325,7 +358,16 @@ function pruneSerializedType(node, basePath, vis, relationNames) {
 				if (isMetaFieldVisible(name, vis)) props[name] = prop;
 				continue;
 			}
-			if (!isMetaFieldVisible(path, vis)) continue;
+			if (!isMetaFieldVisible(path, vis)) {
+				if (isPathWritable(path, vis.writable)) props[name] = {
+					...prop,
+					metadata: {
+						...prop.metadata,
+						"db.writeOnly": true
+					}
+				};
+				continue;
+			}
 			props[name] = pruneSerializedType(prop, path, vis, relationNames);
 		}
 		return {
@@ -451,10 +493,17 @@ async function applyArbacMetaOverlay(meta, alwaysVisible) {
 		crud: filteredCrud
 	};
 	let readUnrestricted = false;
+	let writeUnrestricted = false;
 	const readScopes = [];
+	const writeScopes = [];
 	for (let i = 0; i < crudKeys.length; i++) {
-		if (!crudResults[i].allowed || WRITE_CRUD_OPS.has(crudKeys[i])) continue;
+		if (!crudResults[i].allowed) continue;
 		const scopes = crudResults[i].scopes;
+		if (WRITE_CRUD_OPS.has(crudKeys[i])) {
+			if (!scopes || scopes.length === 0) writeUnrestricted = true;
+			else writeScopes.push(...scopes);
+			continue;
+		}
 		if (!scopes || scopes.length === 0) readUnrestricted = true;
 		else readScopes.push(...scopes);
 	}
@@ -463,7 +512,8 @@ async function applyArbacMetaOverlay(meta, alwaysVisible) {
 		if (allowed) overlaid = pruneMetaByVisibility(overlaid, {
 			allowed,
 			alwaysVisible,
-			withGrants: collectWithGrantNames(readScopes)
+			withGrants: collectWithGrantNames(readScopes),
+			writable: collectWritableFields(writeScopes, writeUnrestricted)
 		});
 	}
 	return overlaid;
@@ -871,4 +921,4 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.56",
+  "version": "0.1.57",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,16 +60,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.56",
-    "@aooth/arbac-core": "0.1.56",
-    "@aooth/user": "0.1.56"
+    "@aooth/arbac": "0.1.57",
+    "@aooth/user": "0.1.57",
+    "@aooth/arbac-core": "0.1.57"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.85",
-    "@atscript/db": "^0.1.122",
-    "@atscript/db-sql-tools": "^0.1.122",
-    "@atscript/db-sqlite": "^0.1.122",
-    "@atscript/moost-db": "^0.1.122",
+    "@atscript/db": "^0.1.123",
+    "@atscript/db-sql-tools": "^0.1.123",
+    "@atscript/db-sqlite": "^0.1.123",
+    "@atscript/moost-db": "^0.1.123",
     "@atscript/typescript": "^0.1.85",
     "@moostjs/event-http": "^0.6.33",
     "@types/better-sqlite3": "^7.6.13",
@@ -78,8 +78,8 @@
     "unplugin-atscript": "^0.1.85"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.122",
-    "@atscript/moost-db": "^0.1.122",
+    "@atscript/db": "^0.1.123",
+    "@atscript/moost-db": "^0.1.123",
     "@atscript/typescript": "^0.1.85",
     "@moostjs/event-http": "^0.6.33",
     "@wooksjs/event-core": "^0.7.21",