@aooth/arbac-moost 0.1.78 → 0.1.80

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-D0ySI_-A.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BZkeBV5s.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 //#region src/atscript/auto-provider.d.ts

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-D0ySI_-A.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-BZkeBV5s.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
-import { ControlGate, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
+import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
 import { TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
@@ -490,8 +490,13 @@ declare function pruneMetaByVisibility(meta: TMetaResponse, vis: MetaVisibility,
  *    still need `type` for their insert/update forms. PK + `preferredId` are
  *    never pruned.
  *
+ * 3. The capabilities (`crud[op]` control lists, field `groupable` /
+ *    `bucketable` / `numeric` / `sortable`, relation `filterable`, the
+ *    aggregate and search envelope keys) follow each read op's `controls` policy
+ *    ({@link gateMetaControls}).
+ *
  * The search surface (`searchIndexes`, `searchable`, `vectorSearchable`,
- * `geoSearchable`) is narrowed by moost-db itself (≥ 0.1.147, under the
+ * `geoSearchable`) is also narrowed by moost-db itself (≥ 0.1.147, under the
  * overridden `hasField`), after this overlay.
  *
  * @param source - the controller's `this.readable` (identifiers, relations

package/dist/index.mjs

@@ -130,14 +130,14 @@ function identifierSet(table) {
 function metaAlwaysVisibleFields(_controller, source) {
 	return identifierSet(source);
 }
-const NO_POLICY = {
+const NO_POLICY$1 = {
 	json: NO_NAMES$1,
 	derived: /* @__PURE__ */ new Map(),
 	relations: void 0
 };
 const tablePolicyCache = /* @__PURE__ */ new WeakMap();
 function tablePolicy(table) {
-	if (!table) return NO_POLICY;
+	if (!table) return NO_POLICY$1;
 	return getOrCreate(tablePolicyCache, table, () => {
 		const derived = /* @__PURE__ */ new Map();
 		for (const fd of table.fieldDescriptors ?? []) if (fd.derived?.sourcePath) derived.set(fd.path, fd.derived.sourcePath);
@@ -1242,15 +1242,25 @@ function metaDecisionKey(input, ctx) {
 			const vis = p.refTargets.get(type);
 			refTargets.push(idOf(type), ctx.isServed(type), vis ? encodeLevel(vis, NO_TREE, ctx, seen, 1) : 0);
 		}
-		const { writable, nestedWrites, groupBy } = p;
-		if (groupBy !== void 0 && typeof groupBy !== "boolean" && !Array.isArray(groupBy)) refuse();
+		const { writable, nestedWrites } = p;
+		const controls = [];
+		for (const op of Object.keys(p.controls).toSorted()) {
+			const policy = p.controls[op] ?? {};
+			const gates = [op];
+			for (const key of Object.keys(policy).toSorted()) {
+				const gate = policy[key];
+				if (typeof gate !== "boolean" && !Array.isArray(gate)) refuse();
+				gates.push(key, Array.isArray(gate) ? sortedNames(gate) : gate);
+			}
+			controls.push(gates);
+		}
 		return JSON.stringify([
 			bits(input.actions),
 			bits(input.crud),
 			encodeLevel(p.vis, p.tree, ctx, seen, 0),
 			writable === void 0 ? 0 : writable === "all" ? 1 : sortedNames(writable),
 			nestedWrites ? sortedNames(nestedWrites) : 0,
-			Array.isArray(groupBy) ? sortedNames(groupBy) : groupBy ?? 0,
+			controls,
 			refTargets,
 			p.vis.table?.type ? ctx.isServed(p.vis.table.type) : 0
 		]);
@@ -1856,8 +1866,13 @@ function crudHandlers(op, methods) {
 *    still need `type` for their insert/update forms. PK + `preferredId` are
 *    never pruned.
 *
+* 3. The capabilities (`crud[op]` control lists, field `groupable` /
+*    `bucketable` / `numeric` / `sortable`, relation `filterable`, the
+*    aggregate and search envelope keys) follow each read op's `controls` policy
+*    ({@link gateMetaControls}).
+*
 * The search surface (`searchIndexes`, `searchable`, `vectorSearchable`,
-* `geoSearchable`) is narrowed by moost-db itself (≥ 0.1.147, under the
+* `geoSearchable`) is also narrowed by moost-db itself (≥ 0.1.147, under the
 * overridden `hasField`), after this overlay.
 *
 * @param source - the controller's `this.readable` (identifiers, relations
@@ -1880,10 +1895,15 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 	const crudBits = crudScopes.map((scopes) => scopes !== void 0);
 	const readScopes = [];
 	const writeScopes = [];
+	const controls = {};
 	for (let i = 0; i < crudKeys.length; i++) {
 		const scopes = crudScopes[i];
 		if (!scopes) continue;
-		(WRITE_CRUD_OPS.has(crudKeys[i]) ? writeScopes : readScopes).push(...scopes);
+		if (WRITE_CRUD_OPS.has(crudKeys[i])) writeScopes.push(...scopes);
+		else {
+			readScopes.push(...scopes);
+			controls[crudKeys[i]] = effectiveScope(scopes).controls;
+		}
 	}
 	const overlay = () => {
 		const crud = {};
@@ -1900,18 +1920,17 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 		readScopes,
 		writeScopes
 	}, RECORD_CTX) : void 0, memoMax, overlay);
-	const groupBy = effectiveScope(readScopes).controls.$groupBy;
 	const writable = collectWritableFields(writeScopes, false);
 	const nestedWrites = effectiveScope(writeScopes).nestedWrites;
 	if (isIdentifierSet(source)) {
 		const vis = buildScopeVisibility(readScopes, void 0, source);
 		const visible = Object.keys(vis.allowed).length > 0 || vis.withGrants.size > 0;
 		const overlaid = overlay();
-		return gateGroupable(visible ? pruneMetaByVisibility(overlaid, {
+		return gateMetaControls(visible ? pruneMetaByVisibility(overlaid, {
 			...vis,
 			writable,
 			nestedWrites
-		}) : overlaid, groupBy);
+		}) : overlaid, controls);
 	}
 	const vis = buildScopeVisibility(readScopes, source, { relations: await resolveRelationTree(readScopes, source, metaRelationNames(meta), { listSiblings: false }) });
 	const refTargets = await resolveRefTargets(vis, meta);
@@ -1925,14 +1944,14 @@ async function applyArbacMetaOverlay(meta, source, _indexes) {
 			tree: metaRelationNames(meta),
 			writable,
 			nestedWrites,
-			groupBy,
+			controls,
 			refTargets
 		}
-	}, RECORD_CTX) : void 0, memoMax, () => gateGroupable(pruneMetaByVisibility(overlay(), {
+	}, RECORD_CTX) : void 0, memoMax, () => gateMetaControls(pruneMetaByVisibility(overlay(), {
 		...vis,
 		writable,
 		nestedWrites
-	}, refTargets), groupBy));
+	}, refTargets), controls));
 }
 /** What the `/meta` memo's decision record reads from the pruning rules. */
 const RECORD_CTX = {
@@ -2095,28 +2114,143 @@ function stripFormTargets(runtime, node, readable, depth) {
 		type: changed
 	} : out;
 }
-/**
-* `fields[*].groupable` follows the `controls.$groupBy` policy, mirroring the
-* 403 `applyArbacControls` raises: `false` drops the flag everywhere, a
-* whitelist keeps it only on the listed paths. Returns `meta` itself when
-* nothing is stripped.
-*
-* @since 0.1.75
-*/
-function gateGroupable(meta, gate) {
-	if (gate === void 0 || gate === true) return meta;
-	const stripped = (path, field) => field.groupable && (gate === false || !gate.includes(path));
-	const entries = Object.entries(meta.fields);
-	if (!entries.some(([path, field]) => stripped(path, field))) return meta;
+const NO_POLICY = {};
+/** `crud[op]` entries that are query parts of their own, never seen by the controls gate. */
+const NOT_CONTROLS = /* @__PURE__ */ new Set(["filter", "insights"]);
+/**
+* Whether `control` is unusable in an op listing `list` under `policy`: its
+* gate is `false`, or everything it qualifies is unusable (`$index` /
+* `$fuzzy` / `$vector` name how `$search` runs, `$threshold` bounds
+* `$vector`, `$rowOrder` orders `first()` / `last()` in an aggregate
+* `$select`, `$nulls` places NULLs in `$sort` and `$rowOrder` keys).
+*/
+function isControlOff(control, list, policy) {
+	if (!NOT_CONTROLS.has(control) && policy[`$${control}`] === false) return true;
+	const off = (c) => isControlOff(c, list, policy);
+	switch (control) {
+		case "index":
+		case "fuzzy": return list.includes("search") && off("search");
+		case "vector": return off("search");
+		case "threshold": return off("vector");
+		case "rowOrder": return off("groupBy") || off("select");
+		case "nulls": return off("sort") && (!list.includes("rowOrder") || off("rowOrder"));
+		default: return false;
+	}
+}
+/** Envelope keys that advertise aggregate queries (`$groupBy`, aggregate / bucket `$select`). */
+const AGGREGATE_ENVELOPE_KEYS = [
+	"aggregateFns",
+	"aggregateExpressions",
+	"bucketUnits"
+];
+/**
+* The `/meta` capabilities follow each read op's `controls` policy (`policies`;
+* an op without one is unrestricted), mirroring the 403 `applyArbacControls`
+* raises on that op's requests:
+*
+* - `crud[op]` loses every control the op's policy makes unusable
+*   ({@link isControlOff});
+* - a capability flag stays when SOME op listing its controls keeps them
+*   (no op lists them → left as built): `groupable` (`groupBy`, and the
+*   field on that op's `$groupBy` whitelist, if any), `bucketable` (the same
+*   plus `select` — a bucket is checked as the field it buckets), `numeric`
+*   and the aggregate envelope keys (`groupBy` + `select`: every aggregate,
+*   calendar bucket or arithmetic `$select` is `$groupBy` use), `sortable`
+*   (`sort`), `nullsPlacement` (`nulls`), `searchable` + `searchIndexes`
+*   (`search`), `vectorSearchable` + the vector indexes (`search` +
+*   `vector`), the non-default text indexes (`search` + `index`), a
+*   relation's `filterable` (`filter` + `with`, and the relation on that
+*   op's `$with` whitelist, if any).
+*
+* Returns `meta` itself when nothing changes.
+*
+* @since 0.1.75 (`groupable`), 0.1.80 (the rest)
+*/
+function gateMetaControls(meta, policies) {
+	if (!Object.values(policies).some((p) => p && Object.keys(p).length > 0)) return meta;
+	let changed = false;
+	const crud = {};
+	const ops = [];
+	for (const [op, list] of Object.entries(meta.crud)) {
+		const policy = policies[op] ?? NO_POLICY;
+		const kept = list.filter((c) => !isControlOff(c, list, policy));
+		if (kept.length !== list.length) changed = true;
+		crud[op] = kept;
+		ops.push({
+			list,
+			kept,
+			policy
+		});
+	}
+	/** Some op listing `controls` keeps them all (and `name` passes its `whitelist` gate). */
+	const served = (controls, name, whitelist = "$groupBy") => {
+		const listing = ops.filter((o) => controls.every((c) => o.list.includes(c)));
+		return listing.length === 0 || listing.some(({ kept, policy }) => {
+			const gate = policy[whitelist];
+			return controls.every((c) => kept.includes(c)) && (name === void 0 || !Array.isArray(gate) || gate.includes(name));
+		});
+	};
+	const aggregates = served(["groupBy", "select"]);
+	const sortable = served(["sort"]);
 	const fields = {};
-	for (const [path, field] of entries) if (stripped(path, field)) {
-		const { groupable: _groupable, ...rest } = field;
-		fields[path] = rest;
-	} else fields[path] = field;
-	return {
+	for (const [path, field] of Object.entries(meta.fields)) {
+		let next = field;
+		const strip = (flag, keep) => {
+			if (!next[flag] || keep()) return;
+			const { [flag]: _dropped, ...rest } = next;
+			next = rest;
+		};
+		strip("groupable", () => served(["groupBy"], path));
+		strip("bucketable", () => served(["groupBy", "select"], path));
+		strip("numeric", () => aggregates);
+		if (!sortable && next.sortable) next = {
+			...next,
+			sortable: false
+		};
+		if (next !== field) changed = true;
+		fields[path] = next;
+	}
+	const out = {
 		...meta,
-		fields
+		fields,
+		crud
 	};
+	const unfilterable = (r) => r.filterable && !served(["filter", "with"], r.name, "$with");
+	if (out.relations.some(unfilterable)) {
+		out.relations = out.relations.map((r) => {
+			if (!unfilterable(r)) return r;
+			const { filterable: _filterable, ...rest } = r;
+			return rest;
+		});
+		changed = true;
+	}
+	if (!aggregates) for (const key of AGGREGATE_ENVELOPE_KEYS) {
+		if (out[key] === void 0) continue;
+		delete out[key];
+		changed = true;
+	}
+	if (out.nullsPlacement && !served(["nulls"])) {
+		delete out.nullsPlacement;
+		changed = true;
+	}
+	const search = served(["search"]);
+	const vector = search && served(["search", "vector"]);
+	const named = served(["search", "index"]);
+	const all = out.searchIndexes ?? [];
+	const indexes = all.filter((i) => i.type === "vector" ? vector : search && (named || !!i.isDefault));
+	if (indexes.length !== all.length) {
+		out.searchIndexes = indexes;
+		changed = true;
+	}
+	if (out.searchable && !search) {
+		out.searchable = false;
+		changed = true;
+	}
+	if (out.vectorSearchable && !vector) {
+		out.vectorSearchable = false;
+		changed = true;
+	}
+	return changed ? out : meta;
 }
 const metaNamesCache = /* @__PURE__ */ new WeakMap();
 /** The relation names `/meta`'s serialized type reaches: root relations, then nav props of each nav body. */
@@ -3264,14 +3398,19 @@ const preservedFieldsCache = /* @__PURE__ */ new WeakMap();
 *   - `readonly string[]`: allow only the listed values; reject any other.
 *
 * "Used" means the control key is present AND non-empty (an empty array is
-* treated as not used, matching how the parser leaves missing controls).
+* treated as not used, matching how the parser leaves missing controls) —
+* except `$groupBy`, whose presence alone marks an aggregate query: moost-db
+* (≥ 0.1.155) gives an ungrouped aggregate (`$select=sum(amount):total`, no
+* `$groupBy`) `$groupBy: []`, so a `false` gate denies it and a whitelist
+* passes it (no column is grouped on; the aggregated fields go through the
+* field-visibility gate like any other read).
 */
 function enforceControlsPolicy(policy, controls) {
 	if (Object.keys(policy).length === 0) return;
 	for (const [key, gate] of Object.entries(policy)) {
 		const used = controls[key];
 		if (used === void 0 || used === null) continue;
-		if (Array.isArray(used) && used.length === 0) continue;
+		if (Array.isArray(used) && used.length === 0 && key !== "$groupBy") continue;
 		if (gate === false) throw new HttpError(403, `Control "${key}" is not allowed for your role`);
 		if (Array.isArray(gate)) {
 			const usedValues = extractUsedControlValues(key, used, controls);

package/dist/{user.provider-D0ySI_-A.d.mts → user.provider-BZkeBV5s.d.mts}

@@ -84,20 +84,21 @@ type NavRelationKey<T> = keyof NavPropsOf<T> extends never ? string : (keyof Nav
  * `unionProjections` / `restrictProjection` keep compiling.
  */
 type ProjectionOf<T> = IsUnknown<T> extends true ? TProjection : Partial<Record<OwnFieldKey<T>, 0 | 1>>;
+/** The Uniquery controls a gate can only allow or deny (`true` / `false`). */
+type BooleanControl = "$select" | "$sort" | "$nulls" | "$skip" | "$limit" | "$count" | "$page" | "$size" | "$search" | "$index" | "$fuzzy" | "$vector" | "$threshold" | "$actions" | "$rowOrder" | "$having" | "$center" | "$maxDistance" | "$minDistance";
 /**
- * Typed control gates: `$with` against nav names, `$select` against own
- * fields, other `$`-prefixed controls passthrough. Falls back to the
- * legacy untyped `Record<string, ControlGate>` for `T = unknown` so
- * internal helpers (`unionControlsPolicy`) and existing untyped call
- * sites keep compiling.
+ * Typed control gates, matching what `unionControlsPolicy` accepts: only
+ * `$with` (nav relation names) and `$groupBy` (own field paths) take a
+ * whitelist; every other control is `true` / `false` (a whitelist there
+ * throws at scope merge). Unknown control keys are rejected. Falls back to
+ * the legacy untyped `Record<string, ControlGate>` for `T = unknown` so
+ * internal helpers (`unionControlsPolicy`) and existing untyped call sites
+ * keep compiling.
  */
 type ControlsOf<T> = IsUnknown<T> extends true ? Record<string, ControlGate> : {
-  $with?: Array<NavRelationKey<T>> | boolean;
-  $select?: Array<OwnFieldKey<T>> | boolean;
-  $groupBy?: ControlGate;
-  $having?: ControlGate;
-  [key: `$${string}`]: ControlGate | Array<string> | undefined;
-};
+  $with?: ReadonlyArray<NavRelationKey<T>> | boolean;
+  $groupBy?: ReadonlyArray<OwnFieldKey<T>> | boolean;
+} & Partial<Record<BooleanControl, boolean>>;
 //#endregion
 //#region src/db/write-fields.d.ts
 /**
@@ -173,6 +174,10 @@ interface ArbacDbScope<T = unknown> {
    *     `?$with=comments`, rejects `?$with=tasks`). Supported only for `$with`
    *     (relation names) and `$groupBy` (column names) in v1.
    *
+   * An ungrouped aggregate (`$select=sum(amount):total`, no `$groupBy`) counts
+   * as `$groupBy` use (0.1.80+, with atscript-db 0.1.155+): `$groupBy: false`
+   * denies it; a `$groupBy` whitelist allows it (no column is grouped on).
+   *
    * Across roles, gates union additively (silence wins) via {@link unionControlsPolicy}.
    *
    * @example `{ controls: { $with: false } }` — disable $with for this role.
@@ -406,7 +411,12 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
  *   - `readonly string[]`: allow only the listed values; reject any other.
  *
  * "Used" means the control key is present AND non-empty (an empty array is
- * treated as not used, matching how the parser leaves missing controls).
+ * treated as not used, matching how the parser leaves missing controls) —
+ * except `$groupBy`, whose presence alone marks an aggregate query: moost-db
+ * (≥ 0.1.155) gives an ungrouped aggregate (`$select=sum(amount):total`, no
+ * `$groupBy`) `$groupBy: []`, so a `false` gate denies it and a whitelist
+ * passes it (no column is grouped on; the aggregated fields go through the
+ * field-visibility gate like any other read).
  */
 declare function enforceControlsPolicy(policy: Record<string, ControlGate>, controls: Record<string, unknown>): void;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.1.78",
+  "version": "0.1.80",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -60,31 +60,31 @@
     "access": "public"
   },
   "dependencies": {
-    "@uniqu/core": "^0.1.14",
-    "@aooth/arbac": "0.1.78",
-    "@aooth/user": "0.1.78",
-    "@aooth/arbac-core": "0.1.78"
+    "@uniqu/core": "^0.1.15",
+    "@aooth/arbac": "0.1.80",
+    "@aooth/user": "0.1.80",
+    "@aooth/arbac-core": "0.1.80"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.102",
-    "@atscript/db": "^0.1.152",
-    "@atscript/db-sql-tools": "^0.1.152",
-    "@atscript/db-sqlite": "^0.1.152",
-    "@atscript/moost-db": "^0.1.152",
-    "@atscript/typescript": "^0.1.102",
-    "@moostjs/event-http": "^0.6.48",
+    "@atscript/core": "^0.1.106",
+    "@atscript/db": "^0.1.156",
+    "@atscript/db-sql-tools": "^0.1.156",
+    "@atscript/db-sqlite": "^0.1.156",
+    "@atscript/moost-db": "^0.1.156",
+    "@atscript/typescript": "^0.1.106",
+    "@moostjs/event-http": "^0.6.51",
     "@types/better-sqlite3": "^7.6.13",
     "better-sqlite3": "^12.6.2",
-    "unplugin-atscript": "^0.1.102"
+    "unplugin-atscript": "^0.1.106"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.152",
-    "@atscript/moost-db": "^0.1.152",
-    "@atscript/typescript": "^0.1.102",
-    "@moostjs/event-http": "^0.6.48",
-    "@wooksjs/event-core": "^0.7.27",
-    "@wooksjs/event-http": "^0.7.27",
-    "moost": "^0.6.48"
+    "@atscript/db": "^0.1.156",
+    "@atscript/moost-db": "^0.1.156",
+    "@atscript/typescript": "^0.1.106",
+    "@moostjs/event-http": "^0.6.51",
+    "@wooksjs/event-core": "^0.7.29",
+    "@wooksjs/event-http": "^0.7.29",
+    "moost": "^0.6.51"
   },
   "peerDependenciesMeta": {
     "@atscript/db": {