@aooth/arbac 0.1.62 → 0.1.63

package/dist/index.cjs

@@ -291,16 +291,24 @@ function mergeScopeFilters(scopes) {
 	return { $or: scopes };
 }
 /**
-* Conjoin two ALREADY-UNIONED scope filters (each the output of
-* {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
-* row survives only if BOTH sides admit it. This is the credential-attenuation
-* combiner: it clips any widening the credential pass might introduce.
+* Conjoin two filters under `$and` semantics — a row survives only if BOTH
+* sides admit it. The restrict-only combiner, used wherever two independent
+* constraints must both hold:
+*
+* - **credential attenuation** — assigned authority ∧ presented authority, so
+*   a scoped token can only clip what the role grants (see
+*   `conjoinArbacDbScopes`);
+* - **scope ∧ request** — the caller's scope union ∧ the user-supplied query
+*   filter, on both the top-level read and the per-relation `$with` overlay.
+*
+* Either side may be a {@link mergeScopeFilters} output or a raw filter.
 *
 * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
 * `undefined` filter is the universe and acts as the **identity** here
 * (dropped from the `$and`, contributing NO constraint) — never the absorbing
-* "unrestricted wins". Never object-spreads the two filters (credential keys
-* could overwrite user keys and silently widen).
+* "unrestricted wins". Never object-spreads the two filters: a key present on
+* both sides would be overwritten rather than intersected, silently widening
+* access (a caller scoped to `tenantId: 'a'` asking for `'b'` would get `'b'`).
 *
 * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
 */

package/dist/index.d.cts

@@ -206,16 +206,24 @@ declare function restrictProjection(desired: TProjection, accessControl: TProjec
  */
 declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undefined;
 /**
- * Conjoin two ALREADY-UNIONED scope filters (each the output of
- * {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
- * row survives only if BOTH sides admit it. This is the credential-attenuation
- * combiner: it clips any widening the credential pass might introduce.
+ * Conjoin two filters under `$and` semantics — a row survives only if BOTH
+ * sides admit it. The restrict-only combiner, used wherever two independent
+ * constraints must both hold:
+ *
+ * - **credential attenuation** — assigned authority ∧ presented authority, so
+ *   a scoped token can only clip what the role grants (see
+ *   `conjoinArbacDbScopes`);
+ * - **scope ∧ request** — the caller's scope union ∧ the user-supplied query
+ *   filter, on both the top-level read and the per-relation `$with` overlay.
+ *
+ * Either side may be a {@link mergeScopeFilters} output or a raw filter.
  *
  * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
  * `undefined` filter is the universe and acts as the **identity** here
  * (dropped from the `$and`, contributing NO constraint) — never the absorbing
- * "unrestricted wins". Never object-spreads the two filters (credential keys
- * could overwrite user keys and silently widen).
+ * "unrestricted wins". Never object-spreads the two filters: a key present on
+ * both sides would be overwritten rather than intersected, silently widening
+ * access (a caller scoped to `tenantId: 'a'` asking for `'b'` would get `'b'`).
  *
  * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
  */

package/dist/index.d.mts

@@ -206,16 +206,24 @@ declare function restrictProjection(desired: TProjection, accessControl: TProjec
  */
 declare function mergeScopeFilters(scopes: TScopeFilter[]): TScopeFilter | undefined;
 /**
- * Conjoin two ALREADY-UNIONED scope filters (each the output of
- * {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
- * row survives only if BOTH sides admit it. This is the credential-attenuation
- * combiner: it clips any widening the credential pass might introduce.
+ * Conjoin two filters under `$and` semantics — a row survives only if BOTH
+ * sides admit it. The restrict-only combiner, used wherever two independent
+ * constraints must both hold:
+ *
+ * - **credential attenuation** — assigned authority ∧ presented authority, so
+ *   a scoped token can only clip what the role grants (see
+ *   `conjoinArbacDbScopes`);
+ * - **scope ∧ request** — the caller's scope union ∧ the user-supplied query
+ *   filter, on both the top-level read and the per-relation `$with` overlay.
+ *
+ * Either side may be a {@link mergeScopeFilters} output or a raw filter.
  *
  * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
  * `undefined` filter is the universe and acts as the **identity** here
  * (dropped from the `$and`, contributing NO constraint) — never the absorbing
- * "unrestricted wins". Never object-spreads the two filters (credential keys
- * could overwrite user keys and silently widen).
+ * "unrestricted wins". Never object-spreads the two filters: a key present on
+ * both sides would be overwritten rather than intersected, silently widening
+ * access (a caller scoped to `tenantId: 'a'` asking for `'b'` would get `'b'`).
  *
  * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
  */

package/dist/index.mjs

@@ -291,16 +291,24 @@ function mergeScopeFilters(scopes) {
 	return { $or: scopes };
 }
 /**
-* Conjoin two ALREADY-UNIONED scope filters (each the output of
-* {@link mergeScopeFilters} for one authority pass) under `$and` semantics — a
-* row survives only if BOTH sides admit it. This is the credential-attenuation
-* combiner: it clips any widening the credential pass might introduce.
+* Conjoin two filters under `$and` semantics — a row survives only if BOTH
+* sides admit it. The restrict-only combiner, used wherever two independent
+* constraints must both hold:
+*
+* - **credential attenuation** — assigned authority ∧ presented authority, so
+*   a scoped token can only clip what the role grants (see
+*   `conjoinArbacDbScopes`);
+* - **scope ∧ request** — the caller's scope union ∧ the user-supplied query
+*   filter, on both the top-level read and the per-relation `$with` overlay.
+*
+* Either side may be a {@link mergeScopeFilters} output or a raw filter.
 *
 * Polarity is the **opposite** of {@link mergeScopeFilters}: an empty `{}` /
 * `undefined` filter is the universe and acts as the **identity** here
 * (dropped from the `$and`, contributing NO constraint) — never the absorbing
-* "unrestricted wins". Never object-spreads the two filters (credential keys
-* could overwrite user keys and silently widen).
+* "unrestricted wins". Never object-spreads the two filters: a key present on
+* both sides would be overwritten rather than intersected, silently widening
+* access (a caller scoped to `tenantId: 'a'` asking for `'b'` would get `'b'`).
 *
 * @returns the conjoined filter, or `undefined` when BOTH sides are unrestricted.
 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac",
-  "version": "0.1.62",
+  "version": "0.1.63",
   "description": "Batteries-included RBAC: builder API, privilege factories, scope merge utilities",
   "keywords": [
     "access-control",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac-core": "0.1.62"
+    "@aooth/arbac-core": "0.1.63"
   },
   "scripts": {
     "build": "vp pack",