@aooth/arbac-moost 0.1.65 → 0.1.67

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-abwC0SjM.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-DDwcuUsU.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-abwC0SjM.mjs";
+import { a as ArbacDbScope, c as enforceControlsPolicy, d as NavRelationKey, f as NavTarget, i as conjoinArbacDbScopes, l as extractUsedControlValues, m as ProjectionOf, n as ArbacUserProviderToken, o as AsArbacDbController, p as OwnFieldKey, r as AoothArbacClaims, s as applyAllowedFieldsAndSet, t as ArbacUserProvider, u as ControlsOf } from "./user.provider-DDwcuUsU.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
@@ -129,11 +129,8 @@ declare class AsArbacDbReadableController<T extends TAtscriptAnnotatedType = TAt
    */
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
   /**
-   * Scope-aware field-existence check — same contract as
-   * {@link AsArbacDbController.hasField} (BUG-3): a field outside the
-   * read-scope projection union answers `false`, so `validateInsights` rejects
-   * `$select` / filter / sort references to it with the identical
-   * `Unknown field "x"` 400 a nonexistent field gets.
+   * Scope-aware field visibility — same contract as
+   * {@link AsArbacDbController.hasField}.
    */
   protected hasField(path: string): boolean;
 }

package/dist/index.mjs

@@ -5,6 +5,7 @@ import { current, key } from "@wooksjs/event-core";
 import { Inherit, Injectable, TInterceptorPriority, defineBeforeInterceptor, getConstructor, getMoostMate, useControllerContext, useLogger } from "moost";
 import { conjoinScopeFilters, intersectControlsPolicy, isFieldAllowed, mergeScopeFilters, restrictProjection, unionControlsPolicy, unionProjections } from "@aooth/arbac";
 import { AsDbController, AsDbReadableController } from "@atscript/moost-db";
+import { groupByFields } from "@uniqu/core";
 //#region src/attenuation.ts
 /**
 * Conjoin the full-authority scopes (`userScopes`, the ceiling) and the
@@ -716,9 +717,9 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	* controls of a request. Runs after the base validator (which checks the
 	* controls DTO shape) and BEFORE the query/aggregation pipeline executes.
 	*
-	* `transformFilter` runs first on every read endpoint and caches the
-	* evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-	* directly here without re-evaluating ARBAC.
+	* Reads the scopes the route-level authorize interceptor cached via
+	* `arbac.setScopes(...)` — validation runs before `transformFilter`, so
+	* this hook never re-evaluates ARBAC.
 	*
 	* On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
 	* `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
@@ -735,18 +736,12 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
 	}
 	/**
-	* Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
-	* above): a field outside the read-scope projection union must be
-	* indistinguishable from a field that does not exist. The base controller's
-	* ONLY call site is `validateInsights`, which turns a `false` here into the
-	* same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
-	* `$select`, filter, and sort references to a hidden field cannot be used
-	* as an existence/value oracle. Identifier fields stay visible (reads
-	* always return them — see {@link MetaVisibility.alwaysVisible}), and paths
-	* under a `with`-granted relation pass through to the sub-scope's own
-	* enforcement. Scopes were cached by the route-level authorize interceptor
-	* before validation runs (`useArbac` setScopes), so the union reflects the
-	* exact action being executed.
+	* Scope-aware field visibility (BUG-3 twin of the `/meta` pruning above): a
+	* field outside the read-scope projection union answers `false`, which
+	* moost-db's visibility hook turns into the same `Unknown field "x"` 400 a
+	* nonexistent field gets at every gated query position — see the docs'
+	* "Column-scope security floor". Identifiers stay visible; paths under a
+	* `with`-granted relation pass through to the sub-scope's own enforcement.
 	*/
 	hasField(path) {
 		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));
@@ -808,7 +803,7 @@ function enforceControlsPolicy(policy, controls) {
 		if (Array.isArray(used) && used.length === 0) continue;
 		if (gate === false) throw new HttpError(403, `Control "${key}" is not allowed for your role`);
 		if (Array.isArray(gate)) {
-			const usedValues = extractUsedControlValues(key, used);
+			const usedValues = extractUsedControlValues(key, used, controls);
 			for (const v of usedValues) if (!gate.includes(v)) throw new HttpError(403, `Control "${key}=${v}" is not allowed for your role`);
 		}
 	}
@@ -824,13 +819,16 @@ function enforceControlsPolicy(policy, controls) {
 *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
 *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
 *     Bare strings are tolerated for forward compatibility.
-*   - `$groupBy` — array of column names (strings). Returned as-is.
+*   - `$groupBy` — array of column names (strings). With `controls` given,
+*     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
+*     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
+*     so the whitelist is checked against the column actually grouped on.
 *
 * For unknown controls we return an empty array; the caller then enforces
 * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
 * gate, which throws if a non-whitelistable control receives a string[]).
 */
-function extractUsedControlValues(key, value) {
+function extractUsedControlValues(key, value, controls) {
 	if (!Array.isArray(value)) return [];
 	if (key === "$with") {
 		const out = [];
@@ -838,7 +836,10 @@ function extractUsedControlValues(key, value) {
 		else if (typeof entry?.name === "string") out.push(entry.name);
 		return out;
 	}
-	if (key === "$groupBy") return value.filter((x) => typeof x === "string");
+	if (key === "$groupBy") return controls ? groupByFields({
+		$select: controls.$select,
+		$groupBy: value
+	}) : value.filter((x) => typeof x === "string");
 	return [];
 }
 /**
@@ -925,11 +926,8 @@ let AsArbacDbReadableController = class AsArbacDbReadableController extends AsDb
 		return applyArbacMetaOverlay(meta, metaAlwaysVisibleFields(this, this.readable));
 	}
 	/**
-	* Scope-aware field-existence check — same contract as
-	* {@link AsArbacDbController.hasField} (BUG-3): a field outside the
-	* read-scope projection union answers `false`, so `validateInsights` rejects
-	* `$select` / filter / sort references to it with the identical
-	* `Unknown field "x"` 400 a nonexistent field gets.
+	* Scope-aware field visibility — same contract as
+	* {@link AsArbacDbController.hasField}.
 	*/
 	hasField(path) {
 		return super.hasField(path) && isScopedFieldVisible(readCachedScopes(), path, metaAlwaysVisibleFields(this, this.readable));

package/dist/{user.provider-abwC0SjM.d.mts → user.provider-DDwcuUsU.d.mts}

@@ -152,9 +152,9 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    * controls of a request. Runs after the base validator (which checks the
    * controls DTO shape) and BEFORE the query/aggregation pipeline executes.
    *
-   * `transformFilter` runs first on every read endpoint and caches the
-   * evaluated scopes via `arbac.setScopes(...)`, so we read those scopes
-   * directly here without re-evaluating ARBAC.
+   * Reads the scopes the route-level authorize interceptor cached via
+   * `arbac.setScopes(...)` — validation runs before `transformFilter`, so
+   * this hook never re-evaluates ARBAC.
    *
    * On a violation we throw `HttpError(403)`. moost-db's `query` / `pages` /
    * `getOne` handlers do NOT wrap `validateParsed` in try/catch, so the
@@ -163,18 +163,12 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
   protected validateControls(controls: Record<string, unknown>, type: "query" | "pages" | "getOne"): string | undefined;
   protected applyMetaOverlay(meta: TMetaResponse): Promise<TMetaResponse>;
   /**
-   * Field-existence check, scope-aware (BUG-3 twin of the `/meta` pruning
-   * above): a field outside the read-scope projection union must be
-   * indistinguishable from a field that does not exist. The base controller's
-   * ONLY call site is `validateInsights`, which turns a `false` here into the
-   * same `Unknown field "x"` HTTP 400 a truly nonexistent field gets — so
-   * `$select`, filter, and sort references to a hidden field cannot be used
-   * as an existence/value oracle. Identifier fields stay visible (reads
-   * always return them — see {@link MetaVisibility.alwaysVisible}), and paths
-   * under a `with`-granted relation pass through to the sub-scope's own
-   * enforcement. Scopes were cached by the route-level authorize interceptor
-   * before validation runs (`useArbac` setScopes), so the union reflects the
-   * exact action being executed.
+   * Scope-aware field visibility (BUG-3 twin of the `/meta` pruning above): a
+   * field outside the read-scope projection union answers `false`, which
+   * moost-db's visibility hook turns into the same `Unknown field "x"` 400 a
+   * nonexistent field gets at every gated query position — see the docs'
+   * "Column-scope security floor". Identifiers stay visible; paths under a
+   * `with`-granted relation pass through to the sub-scope's own enforcement.
    */
   protected hasField(path: string): boolean;
   protected onWrite(action: "insert" | "insertMany" | "replace" | "replaceMany" | "update" | "updateMany", data: unknown): Promise<unknown>;
@@ -212,13 +206,16 @@ declare function enforceControlsPolicy(policy: Record<string, ControlGate>, cont
  *   - `$with` — array of `{ name, … }` objects (per `TypedWithRelation`,
  *     see `@uniqu/core` parser at `parseWithSegment`); we extract `name`.
  *     Bare strings are tolerated for forward compatibility.
- *   - `$groupBy` — array of column names (strings). Returned as-is.
+ *   - `$groupBy` — array of column names (strings). With `controls` given,
+ *     a calendar-bucket alias (`$select: [{ $bucket, $field, $as }]`) is
+ *     mapped to its source `$field` (`groupByFields` from `@uniqu/core`),
+ *     so the whitelist is checked against the column actually grouped on.
  *
  * For unknown controls we return an empty array; the caller then enforces
  * `false`-only semantics (controlled by `unionControlsPolicy`'s whitelist
  * gate, which throws if a non-whitelistable control receives a string[]).
  */
-declare function extractUsedControlValues(key: string, value: unknown): string[];
+declare function extractUsedControlValues(key: string, value: unknown, controls?: Record<string, unknown>): string[];
 /**
  * Test-friendly internal helper — exported for unit tests and helper
  * composition; regular consumers should not call this directly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.65",
+  "version": "0.1.67",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,26 +60,26 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac": "0.1.65",
-    "@aooth/arbac-core": "0.1.65",
-    "@aooth/user": "0.1.65"
+    "@uniqu/core": "^0.1.10",
+    "@aooth/arbac": "0.1.67",
+    "@aooth/user": "0.1.67",
+    "@aooth/arbac-core": "0.1.67"
   },
   "devDependencies": {
     "@atscript/core": "^0.1.93",
-    "@atscript/db": "^0.1.131",
-    "@atscript/db-sql-tools": "^0.1.131",
-    "@atscript/db-sqlite": "^0.1.131",
-    "@atscript/moost-db": "^0.1.131",
+    "@atscript/db": "^0.1.133",
+    "@atscript/db-sql-tools": "^0.1.133",
+    "@atscript/db-sqlite": "^0.1.133",
+    "@atscript/moost-db": "^0.1.133",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@types/better-sqlite3": "^7.6.13",
-    "@uniqu/core": "^0.1.8",
     "better-sqlite3": "^12.6.2",
     "unplugin-atscript": "^0.1.93"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.131",
-    "@atscript/moost-db": "^0.1.131",
+    "@atscript/db": "^0.1.133",
+    "@atscript/moost-db": "^0.1.133",
     "@atscript/typescript": "^0.1.93",
     "@moostjs/event-http": "^0.6.37",
     "@wooksjs/event-core": "^0.7.23",