@aooth/arbac-moost 0.1.76 → 0.1.77

package/dist/index.mjs

@@ -329,6 +329,13 @@ function registeredControllers(target) {
 	return perTarget ? [...perTarget.values()] : [];
 }
 /**
+* Whether an ARBAC DB / value-help controller of the current app serves
+* `type` — stable per-app registration, unlike runtime metadata.
+*/
+function isArbacServedType(type) {
+	return registeredControllers(type).length > 0;
+}
+/**
 * The ARBAC resource + action a controller's handler is authorized as — the
 * precedence `useArbac()` applies while that handler serves a request.
 * Resource: method `@ArbacResource` → class `@ArbacResource` → controller id
@@ -1438,11 +1445,22 @@ function refTargetOf(entry) {
 		return;
 	}
 }
-/** A table-served type: any `db.*` annotation (`db.table`, `db.view`, `db.http.path`, …). */
+/**
+* Whether a no-field target type is table-served (so its read visibility must
+* be checked). Decided from STABLE information only, never from the runtime
+* `db.http.path` metadata: moost-db mirrors it after init, deletes it for an
+* ambiguous model and rewrites it when another app publishes, so a pure
+* value-help dictionary whose only `db.*` key is that mirror would flip.
+* Served when (1) an ARBAC controller of THIS app is registered for the type
+* (fail closed: guarded here => readability is checked), or (2) the schema
+* declares a `db.*` annotation other than `db.http.path` (`db.table`,
+* `db.view`, ...).
+*/
 function isDbServed(type) {
+	if (isArbacServedType(type)) return true;
 	const meta = type.metadata;
 	if (!meta || typeof meta.keys !== "function") return false;
-	for (const key of meta.keys()) if (key.startsWith("db.")) return true;
+	for (const key of meta.keys()) if (key.startsWith("db.") && key !== "db.http.path") return true;
 	return false;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.76",
+  "version": "0.1.77",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -61,30 +61,30 @@
   },
   "dependencies": {
     "@uniqu/core": "^0.1.13",
-    "@aooth/user": "0.1.76",
-    "@aooth/arbac": "0.1.76",
-    "@aooth/arbac-core": "0.1.76"
+    "@aooth/arbac": "0.1.77",
+    "@aooth/arbac-core": "0.1.77",
+    "@aooth/user": "0.1.77"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.100",
-    "@atscript/db": "^0.1.149",
-    "@atscript/db-sql-tools": "^0.1.149",
-    "@atscript/db-sqlite": "^0.1.149",
-    "@atscript/moost-db": "^0.1.149",
-    "@atscript/typescript": "^0.1.100",
-    "@moostjs/event-http": "^0.6.45",
+    "@atscript/core": "^0.1.101",
+    "@atscript/db": "^0.1.150",
+    "@atscript/db-sql-tools": "^0.1.150",
+    "@atscript/db-sqlite": "^0.1.150",
+    "@atscript/moost-db": "^0.1.150",
+    "@atscript/typescript": "^0.1.101",
+    "@moostjs/event-http": "^0.6.47",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.100"
+    "unplugin-atscript": "^0.1.101"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.149",
-    "@atscript/moost-db": "^0.1.149",
-    "@atscript/typescript": "^0.1.100",
-    "@moostjs/event-http": "^0.6.45",
+    "@atscript/db": "^0.1.150",
+    "@atscript/moost-db": "^0.1.150",
+    "@atscript/typescript": "^0.1.101",
+    "@moostjs/event-http": "^0.6.47",
     "@wooksjs/event-core": "^0.7.26",
     "@wooksjs/event-http": "^0.7.26",
-    "moost": "^0.6.45"
+    "moost": "^0.6.47"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {