@aooth/arbac 0.1.77 → 0.1.78

package/dist/index.cjs

@@ -780,8 +780,8 @@ const NO_FIELDS = Object.freeze({});
 * conjunction — so every row path sees the restriction. The custom value
 * stays on the scope. Scopes are never mutated: a changed scope is a copy.
 * Memoized per rule registry and scope object (process-wide), and
-* idempotent (a folded scope folds to itself); without row rules (and no
-* `onUnknownField`) the input list is returned as is.
+* idempotent (a folded scope folds to itself); without row rules the input
+* list is returned as is (after the `onUnknownField` report, if any).
 *
 * @since 0.1.72
 */
@@ -799,7 +799,10 @@ function applyScopeFieldFilters(scopes, fields, opts = {}) {
 	}
 	const { rules, memo } = state;
 	const { onUnknownField } = opts;
-	if (rules.length === 0 && !onUnknownField) return scopes;
+	if (rules.length === 0) {
+		if (onUnknownField) for (const scope of scopes) reportUnknownFields(scope, registry, onUnknownField);
+		return scopes;
+	}
 	const fold = (scope) => {
 		if (scope === null || typeof scope !== "object") return scope;
 		const hit = memo.get(scope);
@@ -837,6 +840,16 @@ function applyScopeFieldFilters(scopes, fields, opts = {}) {
 	const out = scopes.map(fold);
 	return out.every((s, i) => s === scopes[i]) ? scopes : out;
 }
+/** {@link applyScopeFieldFilters}' unknown-field report without row rules, recursing into `with`. */
+function reportUnknownFields(scope, registry, onUnknownField) {
+	if (scope === null || typeof scope !== "object") return;
+	const record = scope;
+	for (const key of Object.keys(scope)) {
+		if (BUILT_IN_KEYS.has(key) || Object.hasOwn(registry, key)) continue;
+		if (record[key] !== void 0) onUnknownField(key);
+	}
+	if (scope.with) for (const sub of Object.values(scope.with)) reportUnknownFields(sub, registry, onUnknownField);
+}
 /**
 * Marks a `with.<rel>` sub-scope {@link conjoinScopes} built from ONE side's
 * declaration. The other side is silent on the relation, so ITS policy for

package/dist/index.d.cts

@@ -619,9 +619,10 @@ declare function conjoinScopes<S extends TDbScope>(a: readonly S[], b: readonly
 /** Options of {@link applyScopeFieldFilters}. @since 0.1.72 */
 interface TApplyScopeFieldFiltersOptions {
   /**
-   * Called for a non-built-in scope key with no rule in `fields` (once per
-   * scope object carrying it) — e.g. to warn about a field that will fail
-   * the first attenuated conjunction.
+   * Called for a non-built-in scope key with no rule in `fields` — e.g. to
+   * warn about a field that will fail the first attenuated conjunction. With
+   * row rules registered it fires once per scope object carrying the key
+   * (memoized fold); without any, on every call.
    */
   onUnknownField?: (field: string) => void;
 }
@@ -632,8 +633,8 @@ interface TApplyScopeFieldFiltersOptions {
  * conjunction — so every row path sees the restriction. The custom value
  * stays on the scope. Scopes are never mutated: a changed scope is a copy.
  * Memoized per rule registry and scope object (process-wide), and
- * idempotent (a folded scope folds to itself); without row rules (and no
- * `onUnknownField`) the input list is returned as is.
+ * idempotent (a folded scope folds to itself); without row rules the input
+ * list is returned as is (after the `onUnknownField` report, if any).
  *
  * @since 0.1.72
  */

package/dist/index.d.mts

@@ -619,9 +619,10 @@ declare function conjoinScopes<S extends TDbScope>(a: readonly S[], b: readonly
 /** Options of {@link applyScopeFieldFilters}. @since 0.1.72 */
 interface TApplyScopeFieldFiltersOptions {
   /**
-   * Called for a non-built-in scope key with no rule in `fields` (once per
-   * scope object carrying it) — e.g. to warn about a field that will fail
-   * the first attenuated conjunction.
+   * Called for a non-built-in scope key with no rule in `fields` — e.g. to
+   * warn about a field that will fail the first attenuated conjunction. With
+   * row rules registered it fires once per scope object carrying the key
+   * (memoized fold); without any, on every call.
    */
   onUnknownField?: (field: string) => void;
 }
@@ -632,8 +633,8 @@ interface TApplyScopeFieldFiltersOptions {
  * conjunction — so every row path sees the restriction. The custom value
  * stays on the scope. Scopes are never mutated: a changed scope is a copy.
  * Memoized per rule registry and scope object (process-wide), and
- * idempotent (a folded scope folds to itself); without row rules (and no
- * `onUnknownField`) the input list is returned as is.
+ * idempotent (a folded scope folds to itself); without row rules the input
+ * list is returned as is (after the `onUnknownField` report, if any).
  *
  * @since 0.1.72
  */

package/dist/index.mjs

@@ -780,8 +780,8 @@ const NO_FIELDS = Object.freeze({});
 * conjunction — so every row path sees the restriction. The custom value
 * stays on the scope. Scopes are never mutated: a changed scope is a copy.
 * Memoized per rule registry and scope object (process-wide), and
-* idempotent (a folded scope folds to itself); without row rules (and no
-* `onUnknownField`) the input list is returned as is.
+* idempotent (a folded scope folds to itself); without row rules the input
+* list is returned as is (after the `onUnknownField` report, if any).
 *
 * @since 0.1.72
 */
@@ -799,7 +799,10 @@ function applyScopeFieldFilters(scopes, fields, opts = {}) {
 	}
 	const { rules, memo } = state;
 	const { onUnknownField } = opts;
-	if (rules.length === 0 && !onUnknownField) return scopes;
+	if (rules.length === 0) {
+		if (onUnknownField) for (const scope of scopes) reportUnknownFields(scope, registry, onUnknownField);
+		return scopes;
+	}
 	const fold = (scope) => {
 		if (scope === null || typeof scope !== "object") return scope;
 		const hit = memo.get(scope);
@@ -837,6 +840,16 @@ function applyScopeFieldFilters(scopes, fields, opts = {}) {
 	const out = scopes.map(fold);
 	return out.every((s, i) => s === scopes[i]) ? scopes : out;
 }
+/** {@link applyScopeFieldFilters}' unknown-field report without row rules, recursing into `with`. */
+function reportUnknownFields(scope, registry, onUnknownField) {
+	if (scope === null || typeof scope !== "object") return;
+	const record = scope;
+	for (const key of Object.keys(scope)) {
+		if (BUILT_IN_KEYS.has(key) || Object.hasOwn(registry, key)) continue;
+		if (record[key] !== void 0) onUnknownField(key);
+	}
+	if (scope.with) for (const sub of Object.values(scope.with)) reportUnknownFields(sub, registry, onUnknownField);
+}
 /**
 * Marks a `with.<rel>` sub-scope {@link conjoinScopes} built from ONE side's
 * declaration. The other side is silent on the relation, so ITS policy for

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac",
-  "version": "0.1.77",
+  "version": "0.1.78",
   "description": "Batteries-included RBAC: builder API, privilege factories, scope merge utilities",
   "keywords": [
     "access-control",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac-core": "0.1.77"
+    "@aooth/arbac-core": "0.1.78"
   },
   "scripts": {
     "build": "vp pack",