@apso/cli 0.45.1 → 0.46.0

package/dist/commands/generate.js

@@ -159,6 +159,7 @@ class Generate extends base_command_1.default {
                     allEntities: entities,
                     apiType: lowerCaseApiType,
                     relationshipMap,
+                    auth,
                 }),
                 generator.generateModule({
                     entity,

package/dist/commands/mcp/serve.js

@@ -375,6 +375,7 @@ class McpServe extends base_command_1.default {
                             allEntities: entities,
                             apiType: lowerCaseApiType,
                             relationshipMap,
+                            auth,
                         }),
                         generator.generateController({
                             entity,

package/dist/lib/generators/go.d.ts

@@ -55,6 +55,12 @@ export declare class GoGenerator extends BaseGenerator {
     generateDomainEvents(entities: Entity[], _apiType?: string, opts?: {
         emitEvents?: boolean;
     }): Promise<GeneratedFile[]>;
+    /**
+     * Scope data for a Go service: each direct scopeBy field's struct field and
+     * gorm column (snake_case of the Go field). A field declared on the entity is
+     * pascalCase; a relation's foreign key (organizationId) is OrganizationID.
+     */
+    private goScope;
     generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
     generateQueryUtils(_entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
 }

package/dist/lib/generators/go.js

@@ -196,6 +196,7 @@ class GoGenerator extends base_1.BaseGenerator {
             primaryKeyGoType: this.getPrimaryKeyGoType(primaryKeyType),
             primaryKeySwaggerType: this.getPrimaryKeySwaggerType(primaryKeyType),
             associations: [...new Set(relationshipsForTemplate)],
+            scope: (0, guards_1.entityScope)(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./handlers/handler", data);
         return [
@@ -232,6 +233,7 @@ class GoGenerator extends base_1.BaseGenerator {
             updatedAt,
             columns,
             associations: [...new Set(goRelationships)],
+            scope: this.goScope(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./services/service", data);
         return [
@@ -420,11 +422,34 @@ ${modelRefs}
             },
         ];
     }
+    /**
+     * Scope data for a Go service: each direct scopeBy field's struct field and
+     * gorm column (snake_case of the Go field). A field declared on the entity is
+     * pascalCase; a relation's foreign key (organizationId) is OrganizationID.
+     */
+    goScope(entity, hasAuth) {
+        var _a;
+        const scope = (0, guards_1.entityScope)(entity, hasAuth);
+        if (!scope)
+            return;
+        const declared = new Set(((_a = entity.fields) !== null && _a !== void 0 ? _a : []).map((f) => f.name));
+        return {
+            ...scope,
+            fields: scope.fields.map((f) => ({
+                ...f,
+                goField: declared.has(f.field) || !f.field.endsWith("Id")
+                    ? (0, casing_1.pascalCase)(f.field)
+                    : `${(0, casing_1.pascalCase)(f.field.slice(0, -2))}ID`,
+                column: (0, casing_1.snakeCase)(f.field),
+            })),
+        };
+    }
     async generateGuards(entities, auth) {
         if (!auth)
             return [];
-        if ((0, guards_1.hasScopedEntities)(entities))
-            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Go service authenticates requests but does not filter rows by tenant");
+        const nested = (0, guards_1.nestedScopeEntities)(entities);
+        if (nested.length > 0)
+            console.warn(`[apso] Nested scopeBy paths are enforced in TypeScript services only; ${nested.join(", ")} will not be filtered by those paths in this Go service`);
         let data;
         if ((0, types_1.isJwtAuth)(auth)) {
             data = { jwt: (0, types_1.resolveJwtAuth)(auth) };
@@ -449,12 +474,18 @@ ${modelRefs}
             throw new Error(`auth.provider "${auth.provider}" is generated for TypeScript services only. For Go, use "jwt" (Better Auth issues JWTs with its JWT plugin) or "api-key".`);
         }
         const content = await this.renderTemplate("./middleware/auth", data);
-        return [
-            {
-                path: "middleware/auth.go",
-                content,
-            },
-        ];
+        const files = [{ path: "middleware/auth.go", content }];
+        // Shared helpers for services and handlers of entities with a direct scopeBy.
+        if (entities.some((e) => (0, guards_1.entityScope)(e, true))) {
+            files.push({
+                path: "services/scope.go",
+                content: await this.renderTemplate("./services/scope", {}),
+            }, {
+                path: "handlers/scope.go",
+                content: await this.renderTemplate("./handlers/scope", {}),
+            });
+        }
+        return files;
     }
     async generateQueryUtils(_entities, _apiType) {
         const typesContent = await this.renderTemplate("./utils/types", {});

package/dist/lib/generators/python.js

@@ -155,6 +155,7 @@ class PythonGenerator extends base_1.BaseGenerator {
             pluralEntityName,
             primaryKeyType,
             associations: [...new Set(relationshipsForTemplate)],
+            scope: (0, guards_1.entityScope)(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./services/service", data);
         return [
@@ -328,8 +329,9 @@ ${downStatements || "    pass"}
     async generateGuards(entities, auth) {
         if (!auth)
             return [];
-        if ((0, guards_1.hasScopedEntities)(entities))
-            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Python service authenticates requests but does not filter rows by tenant");
+        const nested = (0, guards_1.nestedScopeEntities)(entities);
+        if (nested.length > 0)
+            console.warn(`[apso] Nested scopeBy paths are enforced in TypeScript services only; ${nested.join(", ")} will not be filtered by those paths in this Python service`);
         let data;
         if ((0, types_1.isJwtAuth)(auth)) {
             data = { jwt: (0, types_1.resolveJwtAuth)(auth) };

package/dist/lib/guards.d.ts

@@ -38,3 +38,25 @@ export interface ApiKeyTemplateData extends ResolvedApiKeyAuth {
  * has `status` and `expiresAt`, which the guard then enforces.
  */
 export declare function apiKeyTemplateData(apiKey: ResolvedApiKeyAuth, entities: Entity[]): ApiKeyTemplateData;
+/** A direct scopeBy field and the auth context value that fills it. */
+export interface DirectScopeField {
+    field: string;
+    /** userId and email map to the caller's own; anything else is the tenant. */
+    source: "userId" | "email" | "tenant";
+}
+/** What Go and Python services need to scope one entity. */
+export interface EntityScopeData {
+    fields: DirectScopeField[];
+    enforceOn: string[];
+    bypassRoles: string[];
+    injectOnCreate: boolean;
+}
+/**
+ * The direct scopeBy fields of an entity, for services that filter in their
+ * own queries (Go, Python). Undefined without auth: with no caller identity
+ * there is no tenant to scope by. Nested paths (task.workspaceId) are not
+ * included; see hasNestedScopes.
+ */
+export declare function entityScope(entity: Entity, hasAuth: boolean): EntityScopeData | undefined;
+/** Entities whose scopeBy uses a nested path, which Go and Python do not enforce. */
+export declare function nestedScopeEntities(entities: Entity[]): string[];

package/dist/lib/guards.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
+exports.nestedScopeEntities = exports.entityScope = exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 /**
@@ -81,3 +81,38 @@ function apiKeyTemplateData(apiKey, entities) {
     };
 }
 exports.apiKeyTemplateData = apiKeyTemplateData;
+/**
+ * The direct scopeBy fields of an entity, for services that filter in their
+ * own queries (Go, Python). Undefined without auth: with no caller identity
+ * there is no tenant to scope by. Nested paths (task.workspaceId) are not
+ * included; see hasNestedScopes.
+ */
+function entityScope(entity, hasAuth) {
+    if (!hasAuth || !entity.scopeBy)
+        return undefined;
+    const [config] = getScopedEntities([entity]);
+    const fields = config.scopes
+        .filter((s) => s.direct)
+        .map((s) => ({
+        field: s.field,
+        source: s.contextKey === "userId" || s.contextKey === "email"
+            ? s.contextKey
+            : "tenant",
+    }));
+    if (fields.length === 0 || config.enforceOn.length === 0)
+        return undefined;
+    return {
+        fields,
+        enforceOn: config.enforceOn,
+        bypassRoles: config.bypassRoles,
+        injectOnCreate: config.injectOnCreate,
+    };
+}
+exports.entityScope = entityScope;
+/** Entities whose scopeBy uses a nested path, which Go and Python do not enforce. */
+function nestedScopeEntities(entities) {
+    return getScopedEntities(entities)
+        .filter((e) => e.scopes.some((s) => !s.direct))
+        .map((e) => e.name);
+}
+exports.nestedScopeEntities = nestedScopeEntities;

package/dist/lib/templates/go/handlers/handler.eta

@@ -76,6 +76,11 @@ func (h *<%= it.entityName %>Handler) FindAll(c *gin.Context) {
 	if opts.Bare {
 		rows, err := h.service.FindAllBare(c.Request.Context(), opts)
 		if err != nil {
+<% if (it.scope) { %>
+			if scopeError(c, err) {
+				return
+			}
+<% } %>
 			if qe, ok := utils.AsQueryError(err); ok {
 				c.JSON(http.StatusBadRequest, gin.H{"error": qe.Error()})
 				return
@@ -89,6 +94,11 @@ func (h *<%= it.entityName %>Handler) FindAll(c *gin.Context) {
 
 	result, err := h.service.FindAll(c.Request.Context(), opts)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		if qe, ok := utils.AsQueryError(err); ok {
 			c.JSON(http.StatusBadRequest, gin.H{"error": qe.Error()})
 			return
@@ -126,6 +136,11 @@ func (h *<%= it.entityName %>Handler) FindOne(c *gin.Context) {
 
 	result, err := h.service.FindOne(c.Request.Context(), id)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusNotFound, gin.H{"error": "<%= it.entityName %> not found"})
 		return
 	}
@@ -158,6 +173,11 @@ func (h *<%= it.entityName %>Handler) Create(c *gin.Context) {
 
 	result, err := h.service.Create(c.Request.Context(), &input)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -204,6 +224,11 @@ func (h *<%= it.entityName %>Handler) Update(c *gin.Context) {
 
 	result, err := h.service.Update(c.Request.Context(), id, &input)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -236,6 +261,11 @@ func (h *<%= it.entityName %>Handler) Delete(c *gin.Context) {
 <% } %>
 
 	if err := h.service.Delete(c.Request.Context(), id); err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}

package/dist/lib/templates/go/handlers/scope.eta

@@ -0,0 +1,27 @@
+<%~ includeFile('../../header.eta', it) %>
+
+package handlers
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"app/autogen/services"
+	"github.com/gin-gonic/gin"
+)
+
+// scopeError answers a scoped entity's service error: 403 when the caller has
+// no tenant, 404 when the row is missing or belongs to another tenant.
+// It reports whether it wrote a response.
+func scopeError(c *gin.Context, err error) bool {
+	if errors.Is(err, services.ErrForbidden) {
+		c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return true
+	}
+	if strings.HasSuffix(err.Error(), "not found") {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return true
+	}
+	return false
+}

package/dist/lib/templates/go/middleware/auth.eta

@@ -17,8 +17,8 @@ package middleware
 <% } %>
 
 import (
-<% if (it.jwt) { %>
 	"context"
+<% if (it.jwt) { %>
 	"encoding/json"
 <% } else { %>
 	"crypto/sha256"
@@ -63,6 +63,21 @@ type AuthContext struct {
 // AuthContextKey is the gin context key holding *AuthContext.
 const AuthContextKey = "auth"
 
+type authKey struct{}
+
+// setAuth attaches the caller to the gin context and to the request context,
+// where generated services read it for scopeBy.
+func setAuth(c *gin.Context, a *AuthContext) {
+	c.Set(AuthContextKey, a)
+	c.Request = c.Request.WithContext(context.WithValue(c.Request.Context(), authKey{}, a))
+}
+
+// FromContext returns the caller stored on a request context, if any.
+func FromContext(ctx context.Context) (*AuthContext, bool) {
+	a, ok := ctx.Value(authKey{}).(*AuthContext)
+	return a, ok
+}
+
 // GetAuthContext returns the authenticated caller, if any.
 func GetAuthContext(c *gin.Context) (*AuthContext, bool) {
 	v, ok := c.Get(AuthContextKey)
@@ -239,7 +254,7 @@ func AuthMiddleware(_ *gorm.DB) gin.HandlerFunc {
 		if tenant == "" {
 			tenant = str(claim(claims, <%~ JSON.stringify(it.jwt.claims.organizationId || '') %>))
 		}
-		c.Set(AuthContextKey, &AuthContext{
+		setAuth(c, &AuthContext{
 			UserID:         userID,
 			Email:          str(claim(claims, <%~ JSON.stringify(it.jwt.claims.email || '') %>)),
 			WorkspaceID:    tenant,
@@ -329,7 +344,7 @@ func AuthMiddleware(db *gorm.DB) gin.HandlerFunc {
 			roles = append(roles, fmt.Sprint(v))
 		}
 <% } %>
-		c.Set(AuthContextKey, &AuthContext{
+		setAuth(c, &AuthContext{
 			ServiceID:      fmt.Sprint(row["id"]),
 			WorkspaceID:    tenant,
 			OrganizationID: tenant,

package/dist/lib/templates/go/services/scope.eta

@@ -0,0 +1,62 @@
+<%~ includeFile('../../header.eta', it) %>
+
+package services
+
+import (
+	"encoding"
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+)
+
+// ErrForbidden means the caller has no tenant to scope by (.apsorc scopeBy).
+var ErrForbidden = errors.New("no tenant in the auth context")
+
+// hasAnyRole reports whether the caller holds one of the bypass roles.
+func hasAnyRole(roles []string, bypass ...string) bool {
+	for _, r := range roles {
+		for _, b := range bypass {
+			if r == b {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// setFromString sets a scope field on a model from the caller's tenant id,
+// converting it to the field's type (string, integer, or a TextUnmarshaler such
+// as uuid.UUID; pointers are allocated).
+func setFromString(model interface{}, field, value string) error {
+	f := reflect.ValueOf(model).Elem().FieldByName(field)
+	if !f.IsValid() {
+		return fmt.Errorf("model has no field %s", field)
+	}
+	if f.Kind() == reflect.Ptr {
+		f.Set(reflect.New(f.Type().Elem()))
+		f = f.Elem()
+	}
+	if u, ok := f.Addr().Interface().(encoding.TextUnmarshaler); ok {
+		return u.UnmarshalText([]byte(value))
+	}
+	switch f.Kind() {
+	case reflect.String:
+		f.SetString(value)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		n, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			return fmt.Errorf("tenant id %q is not a number: %w", value, err)
+		}
+		f.SetInt(n)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		n, err := strconv.ParseUint(value, 10, 64)
+		if err != nil {
+			return fmt.Errorf("tenant id %q is not a number: %w", value, err)
+		}
+		f.SetUint(n)
+	default:
+		return fmt.Errorf("cannot set %s from a tenant id", field)
+	}
+	return nil
+}

package/dist/lib/templates/go/services/service.eta

@@ -7,6 +7,9 @@ import (
 	"errors"
 
 	"app/autogen/dto"
+<% if (it.scope) { %>
+	"app/autogen/middleware"
+<% } %>
 	"app/autogen/models"
 	"app/autogen/utils"
 	"gorm.io/gorm"
@@ -37,6 +40,42 @@ type <%= it.entityName %>Service struct {
 func New<%= it.entityName %>Service(db *gorm.DB) *<%= it.entityName %>Service {
 	return &<%= it.entityName %>Service{db: db}
 }
+<% if (it.scope) { %>
+
+// scoped limits q to the caller's tenant for op ("find", "get", "create",
+// "update", "delete") per .apsorc scopeBy, and returns the scope column values.
+// Both are unchanged when op is not enforced or the caller holds a bypass role.
+func (s *<%= it.entityName %>Service) scoped(ctx context.Context, q *gorm.DB, op string) (*gorm.DB, map[string]string, error) {
+	switch op {
+	case <%~ it.scope.enforceOn.map((o) => JSON.stringify(o)).join(', ') %>:
+	default:
+		return q, nil, nil
+	}
+	a, ok := middleware.FromContext(ctx)
+	if !ok {
+		return nil, nil, ErrForbidden
+	}
+<% if (it.scope.bypassRoles.length > 0) { %>
+	if hasAnyRole(a.Roles, <%~ it.scope.bypassRoles.map((r) => JSON.stringify(r)).join(', ') %>) {
+		return q, nil, nil
+	}
+<% } %>
+	values := map[string]string{
+<% it.scope.fields.forEach((f) => { %>
+		<%~ JSON.stringify(f.column) %>: a.<%= f.source === 'userId' ? 'UserID' : f.source === 'email' ? 'Email' : 'WorkspaceID' %>,
+<% }) %>
+	}
+	table := models.<%= it.entityName %>{}.TableName()
+	for col, v := range values {
+		if v == "" {
+			return nil, nil, ErrForbidden
+		}
+		// Compared as text: token claims are strings, the column may be a number or uuid.
+		q = q.Where("CAST("+table+"."+col+" AS TEXT) = ?", v)
+	}
+	return q, values, nil
+}
+<% } %>
 
 // FindAll retrieves a paginated list of <%= it.pluralName %> with filtering, sorting, and joins.
 // Used by the nestjsx dialect ({data,count,total,page,pageCount} envelope).
@@ -47,6 +86,12 @@ func (s *<%= it.entityName %>Service) FindAll(ctx context.Context, opts utils.Qu
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "find")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 	query, total, pageCount, err := utils.ApplyQueryE(query, opts, AllowedFields<%= it.entityName %>)
 	if err != nil {
@@ -82,6 +127,12 @@ func (s *<%= it.entityName %>Service) FindAllBare(ctx context.Context, opts util
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "find")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 	query, _, _, err := utils.ApplyQueryE(query, opts, AllowedFields<%= it.entityName %>)
 	if err != nil {
@@ -107,6 +158,12 @@ func (s *<%= it.entityName %>Service) FindOne(ctx context.Context, id string) (*
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "get")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 <% if (it.primaryKeyType === 'uuid') { %>
 	if err := query.Where("id = ?", id).First(&item).Error; err != nil {
@@ -137,6 +194,21 @@ func (s *<%= it.entityName %>Service) Create(ctx context.Context, input *dto.<%=
 		<%= assoc.referenceName || assoc.name %>ID: input.<%= assoc.referenceName || assoc.name %>ID,
 <% }) %>
 	}
+<% if (it.scope && it.scope.injectOnCreate) { %>
+
+	// The caller's tenant, never one from the body (.apsorc scopeBy).
+	_, scopeVals, scopeErr := s.scoped(ctx, s.db, "create")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% it.scope.fields.forEach((f) => { %>
+	if v, ok := scopeVals[<%~ JSON.stringify(f.column) %>]; ok {
+		if err := setFromString(&item, <%~ JSON.stringify(f.goField) %>, v); err != nil {
+			return nil, err
+		}
+	}
+<% }) %>
+<% } %>
 
 	if err := s.db.WithContext(ctx).Create(&item).Error; err != nil {
 		return nil, err
@@ -150,10 +222,17 @@ func (s *<%= it.entityName %>Service) Create(ctx context.Context, input *dto.<%=
 func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, input *dto.<%= it.entityName %>Update) (*dto.<%= it.entityName %>Response, error) {
 	var item models.<%= it.entityName %>
 
+	findQuery := s.db.WithContext(ctx)
+<% if (it.scope) { %>
+	findQuery, scopeVals, scopeErr := s.scoped(ctx, findQuery, "update")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 <% if (it.primaryKeyType === 'uuid') { %>
-	if err := s.db.WithContext(ctx).Where("id = ?", id).First(&item).Error; err != nil {
+	if err := findQuery.Where("id = ?", id).First(&item).Error; err != nil {
 <% } else { %>
-	if err := s.db.WithContext(ctx).First(&item, id).Error; err != nil {
+	if err := findQuery.First(&item, id).Error; err != nil {
 <% } %>
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, errors.New("<%= it.entityName %> not found")
@@ -172,6 +251,12 @@ func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, inp
 		updates["<%= assoc.snakeReferenceName || assoc.snakeName %>_id"] = *input.<%= assoc.referenceName || assoc.name %>ID
 	}
 <% }) %>
+<% if (it.scope) { %>
+	// A scoped row cannot move to another tenant.
+	for col := range scopeVals {
+		delete(updates, col)
+	}
+<% } %>
 
 	if len(updates) > 0 {
 		if err := s.db.WithContext(ctx).Model(&item).Updates(updates).Error; err != nil {
@@ -198,10 +283,17 @@ func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, inp
 
 // Delete removes a <%= it.entityName %> by ID
 func (s *<%= it.entityName %>Service) Delete(ctx context.Context, id string) error {
+	deleteQuery := s.db.WithContext(ctx)
+<% if (it.scope) { %>
+	deleteQuery, _, scopeErr := s.scoped(ctx, deleteQuery, "delete")
+	if scopeErr != nil {
+		return scopeErr
+	}
+<% } %>
 <% if (it.primaryKeyType === 'uuid') { %>
-	result := s.db.WithContext(ctx).Where("id = ?", id).Delete(&models.<%= it.entityName %>{})
+	result := deleteQuery.Where("id = ?", id).Delete(&models.<%= it.entityName %>{})
 <% } else { %>
-	result := s.db.WithContext(ctx).Delete(&models.<%= it.entityName %>{}, id)
+	result := deleteQuery.Delete(&models.<%= it.entityName %>{}, id)
 <% } %>
 	if result.Error != nil {
 		return result.Error

package/dist/lib/templates/guards/scope.guard.eta

@@ -184,6 +184,13 @@ export class ScopeGuard implements CanActivate {
     if (operation === 'create' && scopeConfig.injectOnCreate) {
       this.injectScopeValues(request, scopeConfig);
     }
+<% if (it.hasAuth) { %>
+
+    // A scoped row cannot move to another tenant on update.
+    if (operation === 'update') {
+      this.injectScopeValues(request, scopeConfig);
+    }
+<% } %>
 
     // For GET (list) requests, add scope filter
     if (operation === 'find') {
@@ -324,7 +331,10 @@ export class ScopeGuard implements CanActivate {
       request[contextKey] ||
       request.user?.[contextKey] ||
       request.scope?.[contextKey] ||
-      request.context?.[contextKey]
+      request.context?.[contextKey]<% if (it.hasAuth) { %> ||
+      // A scope field with another name (orgId, tenantId) is the caller's tenant.
+      request.auth?.[contextKey] ||
+      request.auth?.workspaceId<% } %>
     );
   }
 

package/dist/lib/templates/python/routers/router.eta

@@ -55,7 +55,7 @@ async def get_many(
     - order=col.asc|desc[.nullsfirst|nullslast]
     - limit=..&offset=.. (windows the bare array)
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     try:
         options = parse_query_params(request.query_params, x_crud_dialect)
     except QueryParseError as exc:
@@ -113,7 +113,7 @@ async def get_one(
     Supports query parameters:
     - join=relation (repeatable)
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
 
     options = parse_query_params(request.query_params)
     joins = [j.relation for j in options.joins] if options.joins else None
@@ -134,13 +134,14 @@ async def get_one(
     summary="Create a single <%= it.entityName %>",
 )
 async def create_one(
+    request: Request,
     data: <%= it.entityName %>Create,
     db: AsyncSession = Depends(get_db),
 ) -> <%= it.entityName %>Schema:
     """
     Create a new <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     return await service.create_one(data)
 
 
@@ -151,13 +152,14 @@ async def create_one(
     summary="Create multiple <%= it.pluralEntityName %>",
 )
 async def create_many(
+    request: Request,
     data: List[<%= it.entityName %>Create],
     db: AsyncSession = Depends(get_db),
 ) -> List[<%= it.entityName %>Schema]:
     """
     Create multiple <%= it.pluralEntityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     return await service.create_many(data)
 
 
@@ -167,6 +169,7 @@ async def create_many(
     summary="Update a single <%= it.entityName %>",
 )
 async def update_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     data: <%= it.entityName %>Update,
     db: AsyncSession = Depends(get_db),
@@ -174,7 +177,7 @@ async def update_one(
     """
     Update an existing <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     item = await service.update_one(id, data)
     if not item:
         raise HTTPException(
@@ -190,6 +193,7 @@ async def update_one(
     summary="Replace a single <%= it.entityName %>",
 )
 async def replace_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     data: <%= it.entityName %>Create,
     db: AsyncSession = Depends(get_db),
@@ -197,7 +201,7 @@ async def replace_one(
     """
     Replace an existing <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     item = await service.replace_one(id, data)
     if not item:
         raise HTTPException(
@@ -213,13 +217,14 @@ async def replace_one(
     summary="Delete a single <%= it.entityName %>",
 )
 async def delete_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     db: AsyncSession = Depends(get_db),
 ) -> None:
     """
     Delete a <%= it.entityName %> by ID.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     deleted = await service.delete_one(id)
     if not deleted:
         raise HTTPException(

package/dist/lib/templates/python/services/service.eta

@@ -3,6 +3,10 @@
 from typing import List, Optional, Any
 
 from sqlalchemy.ext.asyncio import AsyncSession
+<% if (it.scope) { %>
+from fastapi import HTTPException, status
+from sqlalchemy import String, cast
+<% } %>
 
 from ..models.<%= it.entityName.toLowerCase() %> import <%= it.entityName %>
 from ..schemas.<%= it.entityName.toLowerCase() %> import <%= it.entityName %>Create, <%= it.entityName %>Update
@@ -14,38 +18,94 @@ class <%= it.entityName %>Service:
     Service layer for <%= it.entityName %> CRUD operations.
     """
 
-    def __init__(self, db: AsyncSession):
+    def __init__(self, db: AsyncSession, auth: Any = None):
         self.db = db
-        self._qb = QueryBuilder(<%= it.entityName %>, db)
+        # The caller (app.autogen.auth.AuthContext), when auth is configured.
+        self.auth = auth
+<% if (it.scope) { %>
+
+    def _scope_values(self, op: str) -> dict:
+        """
+        The caller's value for each scopeBy field for op ("find", "get",
+        "create", "update", "delete"); empty when op is not enforced or the
+        caller holds a bypass role. 403 when the caller has no tenant.
+        """
+        if op not in <%~ JSON.stringify(it.scope.enforceOn) %>:
+            return {}
+        a = self.auth
+        if a is None:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tenant in the auth context")
+<% if (it.scope.bypassRoles.length > 0) { %>
+        if set(a.roles) & set(<%~ JSON.stringify(it.scope.bypassRoles) %>):
+            return {}
+<% } %>
+        values = {
+<% it.scope.fields.forEach((f) => { %>
+            <%~ JSON.stringify(f.field) %>: a.<%= f.source === 'userId' ? 'user_id' : f.source === 'email' ? 'email' : 'workspace_id' %>,
+<% }) %>
+        }
+        if any(v in (None, "") for v in values.values()):
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tenant in the auth context")
+        return values
+
+    def _qb(self, op: str) -> QueryBuilder:
+        """A query builder limited to the caller's tenant (compared as text)."""
+        scope = [
+            cast(getattr(<%= it.entityName %>, field), String) == str(value)
+            for field, value in self._scope_values(op).items()
+        ]
+        return QueryBuilder(<%= it.entityName %>, self.db, scope=scope)
+
+    def _with_tenant(self, payload: dict) -> dict:
+        """Set every scopeBy field to the caller's value, converted to the column's type."""
+<% if (it.scope.injectOnCreate) { %>
+        for field, value in self._scope_values("create").items():
+            try:
+                value = getattr(<%= it.entityName %>, field).type.python_type(value)
+            except (NotImplementedError, TypeError, ValueError):
+                pass
+            payload[field] = value
+<% } %>
+        return payload
+<% } else { %>
+
+    def _qb(self, op: str) -> QueryBuilder:
+        return QueryBuilder(<%= it.entityName %>, self.db)
+<% } %>
 
     async def get_many(self, options: QueryOptions) -> PaginatedResult:
         """
         Retrieve a paginated list of <%= it.pluralEntityName %> with filtering, sorting, and joins.
         (nestjsx dialect — {data,count,total,page,pageCount} envelope.)
         """
-        return await self._qb.get_many(options)
+        return await self._qb("find").get_many(options)
 
     async def get_many_list(self, options: QueryOptions) -> List[Any]:
         """
         Retrieve <%= it.pluralEntityName %> as a bare list (PostgREST dialect).
         """
-        return await self._qb.get_many_list(options)
+        return await self._qb("find").get_many_list(options)
 
     async def get_one(
         self,
         id: Any,
         joins: Optional[List[str]] = None,
+        op: str = "get",
     ) -> Optional[<%= it.entityName %>]:
         """
         Retrieve a single <%= it.entityName %> by ID.
         """
-        return await self._qb.get_one(id, joins=joins)
+        return await self._qb(op).get_one(id, joins=joins)
 
     async def create_one(self, data: <%= it.entityName %>Create) -> <%= it.entityName %>:
         """
         Create a new <%= it.entityName %>.
         """
+<% if (it.scope) { %>
+        item = <%= it.entityName %>(**self._with_tenant(data.model_dump(exclude_unset=True)))
+<% } else { %>
         item = <%= it.entityName %>(**data.model_dump(exclude_unset=True))
+<% } %>
         self.db.add(item)
         await self.db.commit()
         await self.db.refresh(item)
@@ -55,7 +115,11 @@ class <%= it.entityName %>Service:
         """
         Create multiple <%= it.pluralEntityName %>.
         """
+<% if (it.scope) { %>
+        items = [<%= it.entityName %>(**self._with_tenant(item.model_dump(exclude_unset=True))) for item in data]
+<% } else { %>
         items = [<%= it.entityName %>(**item.model_dump(exclude_unset=True)) for item in data]
+<% } %>
         self.db.add_all(items)
         await self.db.commit()
         for item in items:
@@ -70,11 +134,16 @@ class <%= it.entityName %>Service:
         """
         Update an existing <%= it.entityName %>.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="update")
         if not item:
             return None
 
         update_data = data.model_dump(exclude_unset=True)
+<% if (it.scope) { %>
+        # A scoped row cannot move to another tenant.
+        for field in self._scope_values("update"):
+            update_data.pop(field, None)
+<% } %>
         for field, value in update_data.items():
             setattr(item, field, value)
 
@@ -90,11 +159,15 @@ class <%= it.entityName %>Service:
         """
         Replace an existing <%= it.entityName %>.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="update")
         if not item:
             return None
 
         replace_data = data.model_dump()
+<% if (it.scope) { %>
+        for field in self._scope_values("update"):
+            replace_data.pop(field, None)
+<% } %>
         for field, value in replace_data.items():
             setattr(item, field, value)
 
@@ -106,7 +179,7 @@ class <%= it.entityName %>Service:
         """
         Delete a <%= it.entityName %> by ID.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="delete")
         if not item:
             return False
 

package/dist/lib/templates/python/utils/query.eta

@@ -701,9 +701,11 @@ def parse_query_params(params: Any, dialect_header: Optional[str] = None) -> Que
 class QueryBuilder:
     """Build and execute filtered/sorted/paginated SQLAlchemy queries."""
 
-    def __init__(self, model: Type[T], db: AsyncSession):
+    def __init__(self, model: Type[T], db: AsyncSession, scope: Optional[List[Any]] = None):
         self.model = model
         self.db = db
+        # Conditions every query must meet (the caller's tenant, .apsorc scopeBy).
+        self.scope = list(scope or [])
 
     # -- shared predicate builders ----------------------------------------
 
@@ -735,7 +737,7 @@ class QueryBuilder:
         return or_(*exprs) if group.operator == "$or" else and_(*exprs)
 
     def _where_clauses(self, options: QueryOptions) -> List[Any]:
-        clauses: List[Any] = []
+        clauses: List[Any] = list(self.scope)
         for f in options.filters:
             expr = self._filter_expr(f)
             if expr is not None:
@@ -889,7 +891,7 @@ class QueryBuilder:
         id: Any,
         joins: Optional[List[str]] = None,
     ) -> Optional[Any]:
-        query = select(self.model).where(self.model.id == id)
+        query = select(self.model).where(self.model.id == id, *self.scope)
 
         if joins:
             for join_name in joins:

package/dist/lib/templates/rest/controller-rest.eta

@@ -56,12 +56,12 @@ import {<%= it.svcName %>} from './<%= it.entityName %>.service';
 @CrudAuth({
     filter: (req: any) => ({
 <% it.crudAuth.forEach((s) => { %>
-        <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %>,
+        <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>
     }),
     persist: (req: any) => ({
 <% it.crudAuth.forEach((s) => { %>
-        <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %>,
+        <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>
     }),
 })

package/dist/lib/types/generator.d.ts

@@ -167,6 +167,11 @@ export interface ServiceGenerationOptions extends EntityGenerationOptions {
      * Relationship map for service methods
      */
     relationshipMap: RelationshipMap;
+    /**
+     * The .apsorc auth config; with scopeBy, Go and Python services filter
+     * every query to the caller's tenant
+     */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating DTOs/schemas

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.45.1",
+  "version": "0.46.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.45.1",
+      "version": "0.46.0",
       "license": "Apache-2.0",
       "dependencies": {
         "@apso/schema-tools": "^0.2.0",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.45.1",
+  "version": "0.46.0",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.45.1",
+  "version": "0.46.0",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",