@aooth/arbac-moost 0.2.3 → 0.2.4

package/dist/atscript/index.d.mts

@@ -1,4 +1,4 @@
-import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-BbYgv9RC.mjs";
+import { r as AoothArbacClaims, t as ArbacUserProvider } from "../user.provider-D0cJ_iMd.mjs";
 import { TAtscriptAnnotatedType, TAtscriptTypeObject, TMetadataMap, TValidatorOptions, Validator } from "@atscript/typescript/utils";
 import { AoothUserCredentials } from "@aooth/user/atscript-db/model.as";
 /**

package/dist/index.d.mts

@@ -1,7 +1,7 @@
-import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-BbYgv9RC.mjs";
+import { _ as ProjectionOf, a as conjoinArbacDbScopes, b as TArbacMeta, c as ArbacDbScope, d as extractUsedControlValues, f as applyAllowedFieldsAndSet, g as OwnFieldKey, h as NavTarget, i as ConjoinArbacDbScopesOptions, l as AsArbacDbController, m as NavRelationKey, n as ArbacUserProviderToken, o as RefForeignKey, p as ControlsOf, r as AoothArbacClaims, s as RefTableSource, t as ArbacUserProvider, u as enforceControlsPolicy, v as ARBAC_DELEGATED_AUTH, x as getArbacMate, y as ArbacDelegatedAuth } from "./user.provider-D0cJ_iMd.mjs";
 import { Arbac, Arbac as Arbac$1, TArbacCompiledRule, TArbacEvalResult, TArbacEvalResult as TArbacEvalResult$1, TArbacRole, TArbacRoleForResource, TArbacRule, arbacPatternToRegex } from "@aooth/arbac-core";
 import { ControlGate, ControlGate as ControlGate$1, TProjection, TScopeFieldRules, TScopeFilter, conjoinScopeFilters } from "@aooth/arbac";
-import { TAuthGuardDef } from "@moostjs/event-http";
+import { HttpError, TAuthGuardDef } from "@moostjs/event-http";
 import { EventContext } from "@wooksjs/event-core";
 import { FilterExpr, TDbRemoveGuardContext, TDbWriteCheckContext, TDbWriteGuardContext, TDeleteOptions, TMetaResponse, TRowResolveOptions, TWriteOptions, UniqueryControls } from "@atscript/db";
 import { AsDbReadableController, AsJsonValueHelpController, AsValueHelpController, TDbActionScopeContext, TDbControlsType, TDbIndexFieldPaths, TDbRequestContext, ValueHelpSelect } from "@atscript/moost-db";
@@ -615,9 +615,41 @@ export declare function isScopedFieldVisible(scopes: ArbacDbScope[], path: strin
  * caller's readable rows match the query; the action itself is authorized
  * by its source controller on every batch.
  *
+ * A read endpoint (`query`, `pages`, `geo`, `one`) under a moost-db write
+ * handler (`insert`, `update`, `replace`, `remove`, `removeComposite`) is
+ * served only inside {@link readBackUnderReadGrant} (since 0.2.4), under the
+ * read grant it installs — otherwise a 403, never the write grant. moost-db's
+ * insert read-back (`Prefer: return=representation`) then answers the plain
+ * insert result.
+ *
  * @since 0.1.72
  */
 export declare function prepareArbacRequest(ctx: TDbRequestContext, readable?: VisibilityTableSource): Promise<void>;
+/**
+ * Read back the row `id` after a write, exactly as `GET /one/:id` would
+ * answer the caller (since 0.2.4) — the body of
+ * `AsArbacDbController._readRepresentation`, and the way for a write handler
+ * override to answer the written row:
+ *
+ * ```ts
+ * await super.update(payload);
+ * return readBackUnderReadGrant(id, () => this.getOne(String(id), ""));
+ * ```
+ *
+ * `read` calls the controller's `/one` handler: `getOne` for a scalar `id`,
+ * `getOneComposite` for a key object. The caller's grant on that handler is
+ * evaluated (its `@ArbacResource` / `@ArbacAction`, credential attenuation
+ * included) and installed as the request's scopes while `read` runs — its
+ * row filter, projection and controls apply, and an overridden handler body
+ * runs too — then the write's scopes are restored.
+ *
+ * Answers `undefined` instead of the row when: the caller has no grant on
+ * that handler; the handler carries method-level interceptors (they would
+ * not run on a direct call); `read` answers or throws an `HttpError` (e.g.
+ * the row is outside the read filter → 404); or anything else fails (logged
+ * as a warning, never answered — the write is already committed).
+ */
+export declare function readBackUnderReadGrant<R>(id: unknown, read: () => Promise<R>): Promise<Exclude<R, HttpError> | undefined>;
 /**
  * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
  * caller may run at least one of the actions that take it as input — each

package/dist/index.mjs

@@ -21,6 +21,15 @@ function getOrCreate(map, key, create) {
 function hasSelfOrAncestor(set, path) {
 	return set.has(path) || findAncestorInSet(path, set) !== void 0;
 }
+/**
+* A key object (a composite id, read by `getOneComposite`) — a plain object.
+* A class instance such as a MongoDB `ObjectId` is a scalar id: `String(id)`.
+*/
+function isKeyObject(id) {
+	if (id === null || typeof id !== "object") return false;
+	const proto = Object.getPrototypeOf(id);
+	return proto === Object.prototype || proto === null;
+}
 /** A patch (`update` / `updateMany`) — only the keys it carries are written. */
 function isPatchAction(action) {
 	return action === "update" || action === "updateMany";
@@ -2603,10 +2612,11 @@ function cachedRequestScopes() {
 */
 async function resolveRequestScopes() {
 	const ctx = current();
+	const prior = resolved();
+	if (prior?.readBack) return prior.scopes;
 	const arbac = useArbac(ctx);
 	const cachedScopes = arbac.getScopes();
 	const fromInterceptor = cachedScopes && scopesOwnedBy(cachedScopes, arbac.resource, arbac.action) ? cachedScopes : void 0;
-	const prior = resolved();
 	if (prior && prior.resource === arbac.resource && prior.action === arbac.action && prior.source === fromInterceptor) return prior.scopes;
 	const scopes = normalizeScopes(fromInterceptor !== void 0 ? {
 		allowed: true,
@@ -2684,6 +2694,13 @@ function isScopedFieldVisible(scopes, path, source) {
 * caller's readable rows match the query; the action itself is authorized
 * by its source controller on every batch.
 *
+* A read endpoint (`query`, `pages`, `geo`, `one`) under a moost-db write
+* handler (`insert`, `update`, `replace`, `remove`, `removeComposite`) is
+* served only inside {@link readBackUnderReadGrant} (since 0.2.4), under the
+* read grant it installs — otherwise a 403, never the write grant. moost-db's
+* insert read-back (`Prefer: return=representation`) then answers the plain
+* insert result.
+*
 * @since 0.1.72
 */
 async function prepareArbacRequest(ctx, readable) {
@@ -2695,10 +2712,67 @@ async function prepareArbacRequest(ctx, readable) {
 		await authorizeDelegatedQueryTarget();
 		return;
 	}
+	if (READ_ENDPOINTS.has(ctx.endpoint) && !resolved()?.readBack && underWriteHandler()) {
+		const { resource, action } = useArbac();
+		throw insufficientPrivileges(resource, action);
+	}
 	const scopes = await resolveRequestScopes();
 	if (ctx.endpoint === "insert" && ctx.onConflict === "ignore") resolved().insertIgnore = true;
 	if (READ_ENDPOINTS.has(ctx.endpoint)) enforceRelationGates(await resolveRequestRelations(scopes, ctx.controls, readable, ctx.filter), visibilityFor(scopes, readable));
 }
+/** moost-db's write handler methods — a read under one of them must be a read-back. */
+const WRITE_HANDLERS = new Set([...WRITE_CRUD_OPS].flatMap((op) => DB_CRUD_HANDLERS[op]));
+function underWriteHandler() {
+	const method = useControllerContext().getMethod();
+	return method !== void 0 && WRITE_HANDLERS.has(method);
+}
+/**
+* Read back the row `id` after a write, exactly as `GET /one/:id` would
+* answer the caller (since 0.2.4) — the body of
+* `AsArbacDbController._readRepresentation`, and the way for a write handler
+* override to answer the written row:
+*
+* ```ts
+* await super.update(payload);
+* return readBackUnderReadGrant(id, () => this.getOne(String(id), ""));
+* ```
+*
+* `read` calls the controller's `/one` handler: `getOne` for a scalar `id`,
+* `getOneComposite` for a key object. The caller's grant on that handler is
+* evaluated (its `@ArbacResource` / `@ArbacAction`, credential attenuation
+* included) and installed as the request's scopes while `read` runs — its
+* row filter, projection and controls apply, and an overridden handler body
+* runs too — then the write's scopes are restored.
+*
+* Answers `undefined` instead of the row when: the caller has no grant on
+* that handler; the handler carries method-level interceptors (they would
+* not run on a direct call); `read` answers or throws an `HttpError` (e.g.
+* the row is outside the read filter → 404); or anything else fails (logged
+* as a warning, never answered — the write is already committed).
+*/
+async function readBackUnderReadGrant(id, read) {
+	const ctx = current();
+	const prior = resolved();
+	if (!prior) return void 0;
+	try {
+		const instance = useControllerContext(ctx).getController();
+		const method = isKeyObject(id) ? "getOneComposite" : "getOne";
+		if (getMoostMate().read(instance, method)?.interceptors?.length) return void 0;
+		const ids = resolveHandlerArbacIds(instance, method);
+		const [outcome] = await evaluateHandlerOutcomes([ids]);
+		const scopes = normalizeScopes(outcome);
+		if (!scopes) return void 0;
+		storeResolved(ctx, ids, void 0, scopes);
+		ctx.get(requestScopesKey).readBack = true;
+		const row = await read();
+		return row instanceof HttpError ? void 0 : row;
+	} catch (error) {
+		if (!(error instanceof HttpError)) useLogger("arbac", ctx).warn(`Read-back of the written row failed: ${String(error)}`);
+		return;
+	} finally {
+		ctx.set(requestScopesKey, prior);
+	}
+}
 /**
 * `authorizeForm` for the ARBAC DB controllers: a form is served iff the
 * caller may run at least one of the actions that take it as input — each
@@ -3205,6 +3279,15 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 		return prepareArbacRequest(ctx, this.readable);
 	}
 	/**
+	* The read-back of `Prefer: return=representation` on `POST /` (since
+	* 0.2.4; opt in with `returnRepresentation()`): this controller's own
+	* `/one` handler under the caller's grant on it — see
+	* {@link readBackUnderReadGrant}.
+	*/
+	_readRepresentation(id) {
+		return readBackUnderReadGrant(id, () => isKeyObject(id) ? this.getOneComposite(textKey(id), "") : this.getOne(String(id), ""));
+	}
+	/**
 	* The request filter ∧ the union of the scopes' `filter`s. Computed
 	* synchronously, but typed with moost-db's async-capable contract
 	* (`FilterExpr | Promise<FilterExpr>`) so a subclass may override it
@@ -3392,6 +3475,10 @@ let AsArbacDbController = class AsArbacDbController extends AsDbController {
 	}
 };
 AsArbacDbController = __decorate([Inherit()], AsArbacDbController);
+/** A key object as `GET /one?…` receives it — every value as text. */
+function textKey(id) {
+	return Object.fromEntries(Object.entries(id).map(([k, v]) => [k, String(v)]));
+}
 const preservedFieldsCache = /* @__PURE__ */ new WeakMap();
 /**
 * Test-friendly internal helper — exported for unit tests and helper
@@ -3813,4 +3900,4 @@ async function useArbacDbScope() {
 		})
 	};
 }
-export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };
+export { ARBAC_DELEGATED_AUTH, Arbac, ArbacAction, ArbacAuthorize, ArbacResource, ArbacUserProvider, ArbacUserProviderToken, AsArbacDbController, AsArbacDbReadableController, AsArbacJsonValueHelpController, AsArbacValueHelpController, MoostArbac, applyAllowedFieldsAndSet, applyArbacControls, applyArbacMetaOverlay, applyArbacProjection, applyArbacRelationScopes, arbacActionRowScope, arbacAllowedActions, arbacAuthorizeInterceptor, arbacPatternToRegex, arbacRelationFilter, arbacRowFilter, authorizeArbacForm, buildScopeVisibility, cachedRequestScopes, checkArbacWrite, collectMethodNames, collectWithGrantNames, collectWritableFields, conjoinArbacDbScopes, conjoinScopeFilters, enforceControlsPolicy, extractUsedControlValues, getArbacMate, getArbacScopes, guardArbacRemove, guardArbacWrite, isMetaFieldVisible, isScopedFieldVisible, metaAlwaysVisibleFields, prepareArbacRequest, pruneMetaByVisibility, readBackUnderReadGrant, registerArbacDbTarget, requestFieldVisible, requireRequestScopes, resolveHandlerArbacIds, resolveRequestScopes, unionScopeProjection, useArbac, useArbacDbScope };

package/dist/{user.provider-BbYgv9RC.d.mts → user.provider-D0cJ_iMd.d.mts}

@@ -268,6 +268,13 @@ declare class AsArbacDbController<T extends TAtscriptAnnotatedType = TAtscriptAn
    * is resolved for the requested relations.
    */
   protected prepareRequest(ctx: TDbRequestContext): Promise<void>;
+  /**
+   * The read-back of `Prefer: return=representation` on `POST /` (since
+   * 0.2.4; opt in with `returnRepresentation()`): this controller's own
+   * `/one` handler under the caller's grant on it — see
+   * {@link readBackUnderReadGrant}.
+   */
+  protected _readRepresentation(id: unknown): Promise<TAtscriptDataType<T> | undefined>;
   /**
    * The request filter ∧ the union of the scopes' `filter`s. Computed
    * synchronously, but typed with moost-db's async-capable contract

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac-moost",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Moost RBAC integration for aoothjs (migrated from @moostjs/arbac)",
   "keywords": [
     "abac",
@@ -61,16 +61,16 @@
   },
   "dependencies": {
     "@uniqu/core": "^0.2.0",
-    "@aooth/arbac": "0.2.3",
-    "@aooth/user": "0.2.3",
-    "@aooth/arbac-core": "0.2.3"
+    "@aooth/arbac": "0.2.4",
+    "@aooth/user": "0.2.4",
+    "@aooth/arbac-core": "0.2.4"
   },
   "devDependencies": {
     "@atscript/core": "^0.2.4",
-    "@atscript/db": "^0.1.168",
-    "@atscript/db-sql-tools": "^0.1.168",
-    "@atscript/db-sqlite": "^0.1.168",
-    "@atscript/moost-db": "^0.1.168",
+    "@atscript/db": "^0.1.169",
+    "@atscript/db-sql-tools": "^0.1.169",
+    "@atscript/db-sqlite": "^0.1.169",
+    "@atscript/moost-db": "^0.1.169",
     "@atscript/typescript": "^0.2.4",
     "@moostjs/event-http": "^0.7.2",
     "@types/better-sqlite3": "^7.6.13",
@@ -78,8 +78,8 @@
     "unplugin-atscript": "^0.2.4"
   },
   "peerDependencies": {
-    "@atscript/db": "^0.1.168",
-    "@atscript/moost-db": "^0.1.168",
+    "@atscript/db": "^0.1.169",
+    "@atscript/moost-db": "^0.1.169",
     "@atscript/typescript": "^0.2.4",
     "@moostjs/event-http": "^0.7.2",
     "@wooksjs/event-core": "^0.8.0",