@aooth/arbac-moost 0.1.58 → 0.1.59

package/dist/atscript/index.d.mts

@@ -1,7 +1,6 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BFHjF2vD.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-abwC0SjM.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
-
 //#region src/atscript/auto-provider.d.ts
 /**
  * Minimal atscript-db readable surface used to fetch the user record.
@@ -234,5 +233,6 @@ declare class AoothArbacUserCredentials extends AoothUserCredentials {
   /** @deprecated Example Data support is disabled. To enable, set `exampleData: true` in tsPlugin options. */
   static toExampleData?: () => any;
 }
+// prettier-ignore-end
 //#endregion
 export { AoothArbacUserCredentials, type AoothCredentialMetadataSpec, type AoothUserHandleSpec, type ArbacAttenuationSpec, type ArbacUserTable, AtscriptArbacUserProvider, extractAttenuation, getAoothCredentialMetadataSpec, getAoothUserHandleSpec, getArbacAttenuationSpec, validateAttenuationTargets };

package/dist/atscript/index.mjs

@@ -1,4 +1,4 @@
-import { r as __decorate, t as ArbacUserProvider } from "../user.provider-BiM5P8fl.mjs";
+import { r as __decorate, t as ArbacUserProvider } from "../user.provider-CYiwr7y3.mjs";
 import { defineWook, key } from "@wooksjs/event-core";
 import { Injectable } from "moost";
 import { defineAnnotatedType, throwFeatureDisabled } from "@atscript/typescript/utils";
@@ -22,7 +22,7 @@ function uniqueStrings(values) {
 	return out;
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.133.0/helpers/esm/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-BFHjF2vD.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-abwC0SjM.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
@@ -7,7 +7,6 @@ import { ControlGate, TProjection } from "@aooth/arbac";
 import { AsDbReadableController } from "@atscript/moost-db";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 import { TMetaResponse } from "@atscript/db";
-
 //#region src/arbac.composables.d.ts
 interface ArbacBindings {
   getScopes: <TScope extends object>() => TScope[] | undefined;
@@ -248,6 +247,19 @@ declare function metaAlwaysVisibleFields(controller: object, source: {
  * addressing).
  */
 declare function applyArbacMetaOverlay(meta: TMetaResponse, alwaysVisible: ReadonlySet<string>): Promise<TMetaResponse>;
+/**
+ * Test-friendly internal helper — exported for unit tests and helper
+ * composition; regular consumers should not call this directly.
+ *
+ * Method names of an instance, walking the full prototype chain via property
+ * DESCRIPTORS. Deliberately NOT moost's `getInstanceOwnMethods`: that helper
+ * evaluates `instance[name]` for every property to test "is it a function",
+ * which fires accessors — and moost-db's inherited `.table` getter THROWS for
+ * view-bound controllers, turning every `/meta` request into a 500. Accessor
+ * properties are skipped entirely (a getter-valued property is not a method
+ * and can never carry `@DbAction` metadata).
+ */
+declare function collectMethodNames(instance: object): string[];
 //#endregion
 //#region src/moost-arbac.d.ts
 /**
@@ -263,4 +275,4 @@ declare function applyArbacMetaOverlay(meta: TMetaResponse, alwaysVisible: Reado
  */
 declare class MoostArbac<TUserAttrs extends object, TScope extends object> extends Arbac$1<TUserAttrs, TScope> {}
 //#endregion
-export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { type AoothArbacClaims, Arbac, ArbacAction, ArbacAuthorize, ArbacDbScope, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, type ControlGate, type ControlsOf, MetaVisibility, MoostArbac, type NavRelationKey, type NavTarget, type OwnFieldKey, type ProjectionOf, type TArbacCompiledRule, type TArbacEvalResult, TArbacMeta, type TArbacRole, type TArbacRoleForResource, type TArbacRule, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/index.mjs

@@ -1,8 +1,8 @@
-import { n as ArbacUserProviderToken, r as __decorate, t as ArbacUserProvider } from "./user.provider-BiM5P8fl.mjs";
+import { n as ArbacUserProviderToken, r as __decorate, t as ArbacUserProvider } from "./user.provider-CYiwr7y3.mjs";
 import { Arbac, Arbac as Arbac$1, arbacPatternToRegex } from "@aooth/arbac-core";
 import { Authenticate, HttpError } from "@moostjs/event-http";
 import { current, key } from "@wooksjs/event-core";
-import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getInstanceOwnMethods, getMoostMate, useControllerContext, useLogger } from "moost";
+import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
 import { conjoinScopeFilters, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
 //#region src/attenuation.ts
@@ -436,7 +436,7 @@ function metaAlwaysVisibleFields(controller, source) {
 	const ctor = controller.constructor;
 	let set = alwaysVisibleFieldsCache.get(ctor);
 	if (!set) {
-		set = new Set([...source.primaryKeys, ...source.preferredId]);
+		set = /* @__PURE__ */ new Set([...source.primaryKeys, ...source.preferredId]);
 		alwaysVisibleFieldsCache.set(ctor, set);
 	}
 	return set;
@@ -448,7 +448,7 @@ function metaAlwaysVisibleFields(controller, source) {
 * fails closed (a principal whose only read grant is the new op still gets
 * a pruned envelope rather than the full field map).
 */
-const WRITE_CRUD_OPS = new Set([
+const WRITE_CRUD_OPS = /* @__PURE__ */ new Set([
 	"insert",
 	"update",
 	"replace",
@@ -528,8 +528,7 @@ function collectActionMetaByName() {
 	const map = /* @__PURE__ */ new Map();
 	const ctrlMeta = cc.getControllerMeta();
 	for (const entry of ctrlMeta?.atscript_db_actions ?? []) map.set(entry.name, {});
-	for (const methodName of getInstanceOwnMethods(instance)) {
-		if (typeof methodName !== "string") continue;
+	for (const methodName of collectMethodNames(instance)) {
 		const m = cc.getMethodMeta(methodName);
 		if (!m) continue;
 		const actionMeta = m.atscript_db_action;
@@ -541,6 +540,31 @@ function collectActionMetaByName() {
 	actionMetaByClassCache.set(ctor, map);
 	return map;
 }
+/**
+* Test-friendly internal helper — exported for unit tests and helper
+* composition; regular consumers should not call this directly.
+*
+* Method names of an instance, walking the full prototype chain via property
+* DESCRIPTORS. Deliberately NOT moost's `getInstanceOwnMethods`: that helper
+* evaluates `instance[name]` for every property to test "is it a function",
+* which fires accessors — and moost-db's inherited `.table` getter THROWS for
+* view-bound controllers, turning every `/meta` request into a 500. Accessor
+* properties are skipped entirely (a getter-valued property is not a method
+* and can never carry `@DbAction` metadata).
+*/
+function collectMethodNames(instance) {
+	const names = /* @__PURE__ */ new Set();
+	let obj = instance;
+	while (obj && obj !== Object.prototype) {
+		for (const name of Object.getOwnPropertyNames(obj)) {
+			if (name === "constructor") continue;
+			const desc = Object.getOwnPropertyDescriptor(obj, name);
+			if (desc && typeof desc.value === "function") names.add(name);
+		}
+		obj = Object.getPrototypeOf(obj);
+	}
+	return [...names];
+}
 //#endregion
 //#region src/db/shared-read-helpers.ts
 /** Filter that matches no rows; used when ARBAC denies the request. */
@@ -716,7 +740,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		applyArbacRelationScopes(controls, scopes);
 	}
 	applyMetaOverlay(meta) {
-		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.table));
+		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
 	}
 	/**
 	* Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
@@ -733,7 +757,7 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	* exact action being executed.
 	*/
 	hasField(path) {
-		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.table));
+		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));
 	}
 	async onWrite(action, data) {
 		const scopes = readCachedScopes();
@@ -748,17 +772,17 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		const scopeFilter = mergeScopeFilters(scopes.map((s) => s.filter ?? {}));
 		if (!scopeFilter) return;
 		const ids = Array.isArray(idOrIds) ? idOrIds : [idOrIds];
-		const idFilters = ids.map((id) => this.table.resolveIdFilter(id));
+		const idFilters = ids.map((id) => this.readable.resolveIdFilter(id));
 		if (idFilters.some((f) => !f)) throw new HttpError(404, "Not found");
 		const idFilter = idFilters.length === 1 ? idFilters[0] : { $or: idFilters };
-		if (await this.table.count({ filter: { $and: [idFilter, scopeFilter] } }) < ids.length) throw new HttpError(404, "Not found");
+		if (await this.readable.count({ filter: { $and: [idFilter, scopeFilter] } }) < ids.length) throw new HttpError(404, "Not found");
 	}
 	identifierFields() {
 		const ctor = this.constructor;
 		const cached = identifierFieldsCache.get(ctor);
 		if (cached) return cached;
 		const out = /* @__PURE__ */ new Set();
-		for (const ident of this.table.identifications) for (const f of ident.fields) out.add(f);
+		for (const ident of this.readable.identifications) for (const f of ident.fields) out.add(f);
 		const arr = [...out];
 		identifierFieldsCache.set(ctor, arr);
 		return arr;
@@ -921,4 +945,4 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 };
 AsArbacDbReadableController = __decorate([Inherit()], AsArbacDbReadableController);
 //#endregion
-export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };
+export { Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, MoostArbac, applyAllowedFieldsAndSet, applyArbacMetaOverlay, arbacAuthorizeInterceptor, arbacPatternToRegex, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, enforceControlsPolicy, extractUsedControlValues, getArbacMate, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, pruneMetaByVisibility, unionScopeProjection, useArbac };

package/dist/plugin.d.mts

@@ -1,5 +1,4 @@
 import { TAtscriptPlugin } from "@atscript/core";
-
 //#region src/plugin.d.ts
 /**
  * Registers the `@arbac.*` annotation namespace for `@aooth/arbac-moost`:

package/dist/{user.provider-BiM5P8fl.mjs → user.provider-CYiwr7y3.mjs}

@@ -1,4 +1,4 @@
-//#region \0@oxc-project+runtime@0.133.0/helpers/esm/decorate.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);

package/dist/{user.provider-BFHjF2vD.d.mts → user.provider-abwC0SjM.d.mts}

@@ -3,7 +3,6 @@ import { ControlGate, TProjection, TScopeFilter } from "@aooth/arbac";
 import { AsDbController } from "@atscript/moost-db";
 import { NavPropsOf, OwnPropsOf, TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 import { TMetaResponse } from "@atscript/db";
-
 //#region src/db/scope-types.d.ts
 /**
  * Unwrap a `NavPropsOf<T>[K]` value to its target model type:
@@ -125,7 +124,7 @@ interface ArbacDbScope<T = unknown> {
  * keep the untyped escape hatch. Lives here (not in `scope-types.ts`)
  * because it must reference `ArbacDbScope` recursively.
  */
-type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavRelationKey<T>]?: K extends keyof NavPropsOf<T> ? ArbacDbScope<NavTarget<NavPropsOf<T>[K]>> : ArbacDbScope };
+type WithOf<T> = unknown extends T ? Record<string, ArbacDbScope> : { [K in NavRelationKey<T>]?: K extends keyof NavPropsOf<T> ? ArbacDbScope<NavTarget<NavPropsOf<T>[K]>> : ArbacDbScope; };
 declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAnnotatedType> extends AsDbController<T> {
   protected transformFilter(filter: Record<string, unknown> | undefined): Promise<Record<string, unknown>>;
   protected transformProjection(projection?: TProjection): TProjection | undefined | Promise<TProjection | undefined>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.58",
+  "version": "0.1.59",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.58",
-    "@aooth/user": "0.1.58",
-    "@aooth/arbac-core": "0.1.58"
+    "@aooth/arbac": "0.1.59",
+    "@aooth/arbac-core": "0.1.59",
+    "@aooth/user": "0.1.59"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.85",
-    "@atscript/db": "^0.1.124",
-    "@atscript/db-sql-tools": "^0.1.124",
-    "@atscript/db-sqlite": "^0.1.124",
-    "@atscript/moost-db": "^0.1.124",
-    "@atscript/typescript": "^0.1.85",
-    "@moostjs/event-http": "^0.6.33",
+    "@atscript/core": "^0.1.86",
+    "@atscript/db": "^0.1.125",
+    "@atscript/db-sql-tools": "^0.1.125",
+    "@atscript/db-sqlite": "^0.1.125",
+    "@atscript/moost-db": "^0.1.125",
+    "@atscript/typescript": "^0.1.86",
+    "@moostjs/event-http": "^0.6.34",
     "@types/better-sqlite3": "^7.6.13",
     "@uniqu/core": "^0.1.7",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.85"
+    "unplugin-atscript": "^0.1.86"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.124",
-    "@atscript/moost-db": "^0.1.124",
-    "@atscript/typescript": "^0.1.85",
-    "@moostjs/event-http": "^0.6.33",
+    "@atscript/db": "^0.1.125",
+    "@atscript/moost-db": "^0.1.125",
+    "@atscript/typescript": "^0.1.86",
+    "@moostjs/event-http": "^0.6.34",
     "@wooksjs/event-core": "^0.7.21",
     "@wooksjs/event-http": "^0.7.21",
-    "moost": "^0.6.33"
+    "moost": "^0.6.34"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {