@aooth/arbac-moost 0.1.64 → 0.1.66

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-abwC0SjM.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-B1f6ZI45.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-abwC0SjM.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-B1f6ZI45.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";

package/dist/index.mjs

@@ -5,6 +5,7 @@ import { current, key } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
 import { conjoinScopeFilters, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
+import { groupByFields } from "@uniqu/core";
 //#region src/attenuation.ts
 /**
 * Conjoin the full-authority scopes (`userScopes`, the ceiling) and the
@@ -808,7 +809,7 @@ function enforceControlsPolicy(policy, controls) {
 		if (Array.isArray(used) && used.length === 0) continue;
 		if (gate === false) throw new HttpError(403, `Control "${key}" is not allowed for your role`);
 		if (Array.isArray(gate)) {
-			const usedValues = extractUsedControlValues(key, used);
+			const usedValues = extractUsedControlValues(key, used, controls);
 			for (const v of usedValues) if (!gate.includes(v)) throw new HttpError(403, `Control "${key}=${v}" is not allowed for your role`);
 		}
 	}
@@ -824,13 +825,16 @@ function enforceControlsPolicy(policy, controls) {
 *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
 *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
 *     Bare strings are tolerated for forward compatibility.
-*   - `$groupBy` — array of column names (strings). Returned as-is.
+*   - `$groupBy` — array of column names (strings). With `controls` given,
+*     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
+*     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
+*     so the whitelist is checked against the column actually grouped on.
 *
 * For unknown controls we return an empty array; the caller then enforces
 * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
 * gate, which throws if a non-whitelistable control receives a string[]).
 */
-function extractUsedControlValues(key, value) {
+function extractUsedControlValues(key, value, controls) {
 	if (!Array.isArray(value)) return [];
 	if (key === "$with") {
 		const out = [];
@@ -838,7 +842,10 @@ function extractUsedControlValues(key, value) {
 		else if (typeof entry?.name === "string") out.push(entry.name);
 		return out;
 	}
-	if (key === "$groupBy") return value.filter((x) => typeof x === "string");
+	if (key === "$groupBy") return controls ? groupByFields({
+		$select: controls.$select,
+		$groupBy: value
+	}) : value.filter((x) => typeof x === "string");
 	return [];
 }
 /**

package/dist/{user.provider-abwC0SjM.d.mts → user.provider-B1f6ZI45.d.mts}

@@ -212,13 +212,16 @@ declare function enforceControlsPolicy(policy: Record<string, ControlGate>, cont
  *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
  *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
  *     Bare strings are tolerated for forward compatibility.
- *   - `$groupBy` — array of column names (strings). Returned as-is.
+ *   - `$groupBy` — array of column names (strings). With `controls` given,
+ *     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
+ *     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
+ *     so the whitelist is checked against the column actually grouped on.
  *
  * For unknown controls we return an empty array; the caller then enforces
  * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
  * gate, which throws if a non-whitelistable control receives a string[]).
  */
-declare function extractUsedControlValues(key: string, value: unknown): string[];
+declare function extractUsedControlValues(key: string, value: unknown, controls?: Record<string, unknown>): string[];
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,26 +60,26 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.64",
-    "@aooth/user": "0.1.64",
-    "@aooth/arbac-core": "0.1.64"
+    "@uniqu/core": "^0.1.9",
+    "@aooth/arbac": "0.1.66",
+    "@aooth/user": "0.1.66",
+    "@aooth/arbac-core": "0.1.66"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.93",
-    "@atscript/db": "^0.1.130",
-    "@atscript/db-sql-tools": "^0.1.130",
-    "@atscript/db-sqlite": "^0.1.130",
-    "@atscript/moost-db": "^0.1.130",
+    "@atscript/db": "^0.1.132",
+    "@atscript/db-sql-tools": "^0.1.132",
+    "@atscript/db-sqlite": "^0.1.132",
+    "@atscript/moost-db": "^0.1.132",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@types/better-sqlite3": "^7.6.13",
-    "@uniqu/core": "^0.1.8",
     "better-sqlite3": "^12.6.2",
     "unplugin-atscript": "^0.1.93"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.130",
-    "@atscript/moost-db": "^0.1.130",
+    "@atscript/db": "^0.1.132",
+    "@atscript/moost-db": "^0.1.132",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@wooksjs/event-core": "^0.7.23",