@aooth/arbac 0.1.85 → 0.2.1

package/dist/index.cjs

@@ -997,7 +997,12 @@ function mergePartScope(shared, part) {
 function composeScope(shared, part) {
 	if (!part) return shared;
 	if (!shared) return part;
-	return (attrs, userId) => mergePartScope(shared(attrs, userId), part(attrs, userId));
+	return (attrs, userId) => {
+		const s = shared(attrs, userId);
+		if (s == null) return s;
+		const p = part(attrs, userId);
+		return p == null ? p : mergePartScope(s, p);
+	};
 }
 /**
 * One table policy → consistent rules for every endpoint of an

package/dist/index.d.cts

@@ -27,7 +27,7 @@ interface RoleBuilder<TUserAttrs, TScope> {
    * Append an allow rule for a (resource, action) pair, with an optional scope
    * function that derives a scope object from user attrs.
    */
-  allow(resource: string, action: string, scope?: (attrs: TUserAttrs, userId: string) => TScope): RoleBuilder<TUserAttrs, TScope>;
+  allow(resource: string, action: string, scope?: (attrs: TUserAttrs, userId: string) => TScope | null | undefined): RoleBuilder<TUserAttrs, TScope>;
   /** Append a deny rule (`effect: 'deny'`) for a (resource, action) pair. */
   deny(resource: string, action: string): RoleBuilder<TUserAttrs, TScope>;
   /**
@@ -140,7 +140,8 @@ type TTableOp = "read" | "meta" | "insert" | "update" | "replace" | "remove";
  * for write-only principals that still render forms from `/meta`.
  */
 declare const TABLE_OP_ACTIONS: Readonly<Record<TTableOp, readonly string[]>>;
-type ScopeFn<TUserAttrs, TScope> = (attrs: TUserAttrs, userId: string) => TScope;
+/** A rule scope; `null` / `undefined` = this rule admits nothing (deny for it). */
+type ScopeFn<TUserAttrs, TScope> = (attrs: TUserAttrs, userId: string) => TScope | null | undefined;
 interface ScopeOpts<TUserAttrs, TScope> {
   scope?: ScopeFn<TUserAttrs, TScope>;
 }

package/dist/index.d.mts

@@ -27,7 +27,7 @@ interface RoleBuilder<TUserAttrs, TScope> {
    * Append an allow rule for a (resource, action) pair, with an optional scope
    * function that derives a scope object from user attrs.
    */
-  allow(resource: string, action: string, scope?: (attrs: TUserAttrs, userId: string) => TScope): RoleBuilder<TUserAttrs, TScope>;
+  allow(resource: string, action: string, scope?: (attrs: TUserAttrs, userId: string) => TScope | null | undefined): RoleBuilder<TUserAttrs, TScope>;
   /** Append a deny rule (`effect: 'deny'`) for a (resource, action) pair. */
   deny(resource: string, action: string): RoleBuilder<TUserAttrs, TScope>;
   /**
@@ -140,7 +140,8 @@ type TTableOp = "read" | "meta" | "insert" | "update" | "replace" | "remove";
  * for write-only principals that still render forms from `/meta`.
  */
 declare const TABLE_OP_ACTIONS: Readonly<Record<TTableOp, readonly string[]>>;
-type ScopeFn<TUserAttrs, TScope> = (attrs: TUserAttrs, userId: string) => TScope;
+/** A rule scope; `null` / `undefined` = this rule admits nothing (deny for it). */
+type ScopeFn<TUserAttrs, TScope> = (attrs: TUserAttrs, userId: string) => TScope | null | undefined;
 interface ScopeOpts<TUserAttrs, TScope> {
   scope?: ScopeFn<TUserAttrs, TScope>;
 }

package/dist/index.mjs

@@ -997,7 +997,12 @@ function mergePartScope(shared, part) {
 function composeScope(shared, part) {
 	if (!part) return shared;
 	if (!shared) return part;
-	return (attrs, userId) => mergePartScope(shared(attrs, userId), part(attrs, userId));
+	return (attrs, userId) => {
+		const s = shared(attrs, userId);
+		if (s == null) return s;
+		const p = part(attrs, userId);
+		return p == null ? p : mergePartScope(s, p);
+	};
 }
 /**
 * One table policy → consistent rules for every endpoint of an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aooth/arbac",
-  "version": "0.1.85",
+  "version": "0.2.1",
   "description": "Batteries-included RBAC: builder API, privilege factories, scope merge utilities",
   "keywords": [
     "access-control",
@@ -45,7 +45,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@aooth/arbac-core": "0.1.85"
+    "@aooth/arbac-core": "0.2.1"
   },
   "scripts": {
     "build": "vp pack",