@apso/cli 0.45.2 → 0.46.1

package/dist/commands/generate.js

@@ -159,6 +159,7 @@ class Generate extends base_command_1.default {
                     allEntities: entities,
                     apiType: lowerCaseApiType,
                     relationshipMap,
+                    auth,
                 }),
                 generator.generateModule({
                     entity,
@@ -192,7 +193,7 @@ class Generate extends base_command_1.default {
             console.log(`[apso] Finished building entity '${entity.name}' in ${entityBuildTime.toFixed(2)} ms`);
         }
         // Generate guards
-        const guardFiles = await generator.generateGuards(entities, auth);
+        const guardFiles = await generator.generateGuards(entities, auth, relationshipMap);
         for (const file of guardFiles) {
             // eslint-disable-next-line no-await-in-loop
             await writeGenerated(file.path, file.content);

package/dist/commands/mcp/serve.js

@@ -375,6 +375,7 @@ class McpServe extends base_command_1.default {
                             allEntities: entities,
                             apiType: lowerCaseApiType,
                             relationshipMap,
+                            auth,
                         }),
                         generator.generateController({
                             entity,
@@ -401,7 +402,7 @@ class McpServe extends base_command_1.default {
                     }
                 }
                 // Generate guards
-                const guardFiles = await generator.generateGuards(entities, auth);
+                const guardFiles = await generator.generateGuards(entities, auth, relationshipMap);
                 for (const file of guardFiles) {
                     const fullPath = path.join(autogenPath, file.path);
                     // eslint-disable-next-line no-await-in-loop

package/dist/lib/generators/base.d.ts

@@ -1,5 +1,5 @@
 import * as Eta from "eta";
-import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, Entity, AuthConfig } from "../types";
+import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, Entity, AuthConfig, RelationshipMap } from "../types";
 /**
  * Abstract base class for language-specific generators.
  * Provides common functionality and enforces the LanguageGenerator interface.
@@ -60,7 +60,7 @@ export declare abstract class BaseGenerator implements LanguageGenerator {
     /**
      * Generate guard files (auth, scope, etc.)
      */
-    abstract generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    abstract generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Generate shared query utility files (filter, sort, pagination).
      * Default no-op. Override in language generators that need query utils.

package/dist/lib/generators/go.d.ts

@@ -55,6 +55,12 @@ export declare class GoGenerator extends BaseGenerator {
     generateDomainEvents(entities: Entity[], _apiType?: string, opts?: {
         emitEvents?: boolean;
     }): Promise<GeneratedFile[]>;
+    /**
+     * Scope data for a Go service: each direct scopeBy field's struct field and
+     * gorm column (snake_case of the Go field). A field declared on the entity is
+     * pascalCase; a relation's foreign key (organizationId) is OrganizationID.
+     */
+    private goScope;
     generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
     generateQueryUtils(_entities: Entity[], _apiType: string): Promise<GeneratedFile[]>;
 }

package/dist/lib/generators/go.js

@@ -196,6 +196,7 @@ class GoGenerator extends base_1.BaseGenerator {
             primaryKeyGoType: this.getPrimaryKeyGoType(primaryKeyType),
             primaryKeySwaggerType: this.getPrimaryKeySwaggerType(primaryKeyType),
             associations: [...new Set(relationshipsForTemplate)],
+            scope: (0, guards_1.entityScope)(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./handlers/handler", data);
         return [
@@ -232,6 +233,7 @@ class GoGenerator extends base_1.BaseGenerator {
             updatedAt,
             columns,
             associations: [...new Set(goRelationships)],
+            scope: this.goScope(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./services/service", data);
         return [
@@ -420,11 +422,34 @@ ${modelRefs}
             },
         ];
     }
+    /**
+     * Scope data for a Go service: each direct scopeBy field's struct field and
+     * gorm column (snake_case of the Go field). A field declared on the entity is
+     * pascalCase; a relation's foreign key (organizationId) is OrganizationID.
+     */
+    goScope(entity, hasAuth) {
+        var _a;
+        const scope = (0, guards_1.entityScope)(entity, hasAuth);
+        if (!scope)
+            return;
+        const declared = new Set(((_a = entity.fields) !== null && _a !== void 0 ? _a : []).map((f) => f.name));
+        return {
+            ...scope,
+            fields: scope.fields.map((f) => ({
+                ...f,
+                goField: declared.has(f.field) || !f.field.endsWith("Id")
+                    ? (0, casing_1.pascalCase)(f.field)
+                    : `${(0, casing_1.pascalCase)(f.field.slice(0, -2))}ID`,
+                column: (0, casing_1.snakeCase)(f.field),
+            })),
+        };
+    }
     async generateGuards(entities, auth) {
         if (!auth)
             return [];
-        if ((0, guards_1.hasScopedEntities)(entities))
-            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Go service authenticates requests but does not filter rows by tenant");
+        const nested = (0, guards_1.nestedScopeEntities)(entities);
+        if (nested.length > 0)
+            console.warn(`[apso] Nested scopeBy paths are enforced in TypeScript services only; ${nested.join(", ")} will not be filtered by those paths in this Go service`);
         let data;
         if ((0, types_1.isJwtAuth)(auth)) {
             data = { jwt: (0, types_1.resolveJwtAuth)(auth) };
@@ -449,12 +474,18 @@ ${modelRefs}
             throw new Error(`auth.provider "${auth.provider}" is generated for TypeScript services only. For Go, use "jwt" (Better Auth issues JWTs with its JWT plugin) or "api-key".`);
         }
         const content = await this.renderTemplate("./middleware/auth", data);
-        return [
-            {
-                path: "middleware/auth.go",
-                content,
-            },
-        ];
+        const files = [{ path: "middleware/auth.go", content }];
+        // Shared helpers for services and handlers of entities with a direct scopeBy.
+        if (entities.some((e) => (0, guards_1.entityScope)(e, true))) {
+            files.push({
+                path: "services/scope.go",
+                content: await this.renderTemplate("./services/scope", {}),
+            }, {
+                path: "handlers/scope.go",
+                content: await this.renderTemplate("./handlers/scope", {}),
+            });
+        }
+        return files;
     }
     async generateQueryUtils(_entities, _apiType) {
         const typesContent = await this.renderTemplate("./utils/types", {});

package/dist/lib/generators/python.js

@@ -155,6 +155,7 @@ class PythonGenerator extends base_1.BaseGenerator {
             pluralEntityName,
             primaryKeyType,
             associations: [...new Set(relationshipsForTemplate)],
+            scope: (0, guards_1.entityScope)(entity, Boolean(options.auth)),
         };
         const content = await this.renderTemplate("./services/service", data);
         return [
@@ -328,8 +329,9 @@ ${downStatements || "    pass"}
     async generateGuards(entities, auth) {
         if (!auth)
             return [];
-        if ((0, guards_1.hasScopedEntities)(entities))
-            console.warn("[apso] scopeBy is enforced in TypeScript services only; this Python service authenticates requests but does not filter rows by tenant");
+        const nested = (0, guards_1.nestedScopeEntities)(entities);
+        if (nested.length > 0)
+            console.warn(`[apso] Nested scopeBy paths are enforced in TypeScript services only; ${nested.join(", ")} will not be filtered by those paths in this Python service`);
         let data;
         if ((0, types_1.isJwtAuth)(auth)) {
             data = { jwt: (0, types_1.resolveJwtAuth)(auth) };

package/dist/lib/generators/typescript.d.ts

@@ -1,5 +1,5 @@
 import { BaseGenerator } from "./base";
-import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, Entity, AuthConfig } from "../types";
+import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, Entity, AuthConfig, RelationshipMap } from "../types";
 /**
  * TypeScript/NestJS generator that wraps the existing generation functions.
  * This generator produces TypeORM entities, NestJS controllers, services, and DTOs.
@@ -20,7 +20,7 @@ export declare class TypeScriptGenerator extends BaseGenerator {
         emitEvents?: boolean;
         auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
-    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Emits a schema-derived manifest of the entities that have opted in to
      * domain-event emission (`.apsorc` `emitEvents`).

package/dist/lib/generators/typescript.js

@@ -128,6 +128,9 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         const ctrlName = `${entityName}Controller`;
         const pluralEntityName = (0, pluralize_1.default)(entityName);
         const primaryKeyType = entity.primaryKeyType || "serial";
+        const scopes = auth
+            ? (_b = (_a = (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []
+            : [];
         const data = {
             svcName,
             ctrlName,
@@ -136,12 +139,12 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             primaryKeyType,
             associations: [...new Set(relationshipsForTemplate)],
             nestedJoinsFile,
-            // Direct scopeBy fields @CrudAuth adds to every query once a caller is
-            // authenticated. Nested scopes (task.workspaceId) are checked per row by
-            // ScopeGuard only.
-            crudAuth: auth
-                ? ((_b = (_a = (0, guards_1.getScopedEntities)([entity])[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []).filter((s) => s.direct)
-                : [],
+            // scopeBy fields @CrudAuth adds to every query once a caller is
+            // authenticated. Direct fields match the caller's tenant; nested paths
+            // (task.workspaceId) match the foreign key (taskId) against the parent
+            // ids ScopeGuard loaded for the caller into req.apsoScope.
+            crudAuth: scopes.filter((s) => s.direct),
+            crudAuthNested: scopes.filter((s) => s.fkField),
         };
         const controllerContent = await this.renderTemplate("./rest/controller-rest", data);
         const specContent = await this.renderTemplate("./rest/controller-rest-spec", data);
@@ -328,7 +331,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             },
         ];
     }
-    async generateGuards(entities, auth) {
+    async generateGuards(entities, auth, relationshipMap) {
         const hasScopes = (0, guards_1.hasScopedEntities)(entities);
         const normalizedAuth = this.normalizeAuthConfig(auth);
         const jwt = auth && (0, auth_1.isJwtAuth)(auth) ? (0, auth_1.resolveJwtAuth)(auth) : undefined;
@@ -339,7 +342,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         if (!hasScopes && !hasAuth) {
             return [];
         }
-        const scopedEntities = (0, guards_1.getScopedEntities)(entities);
+        const scopedEntities = (0, guards_1.getScopedEntities)(entities, relationshipMap);
         const files = [];
         const authEntities = normalizedAuth
             ? [
@@ -354,6 +357,8 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
                 : [];
         const templateData = {
             scopedEntities,
+            // Nested paths are only enforced on list and create with a caller's tenant.
+            hasNestedFk: hasAuth && scopedEntities.some((e) => e.scopes.some((s) => s.fkField)),
             authConfig: normalizedAuth,
             hasAuth,
             authProvider: auth === null || auth === void 0 ? void 0 : auth.provider,

package/dist/lib/guards.d.ts

@@ -1,4 +1,4 @@
-import { Entity, ResolvedApiKeyAuth } from "./types";
+import { Entity, RelationshipMap, ResolvedApiKeyAuth } from "./types";
 /**
  * Represents a scope field configuration for template rendering
  */
@@ -7,6 +7,14 @@ export interface ScopeFieldConfig {
     contextKey: string;
     direct: boolean;
     path?: string;
+    /**
+     * Nested paths only, set when the relationship map is given: the entity's
+     * foreign key to the first hop (taskId), the entity it points to (Task),
+     * and the rest of the path on that entity (workspaceId).
+     */
+    fkField?: string;
+    parentEntity?: string;
+    parentPath?: string;
 }
 /**
  * Represents a scoped entity configuration for template rendering
@@ -21,9 +29,10 @@ export interface ScopedEntityConfig {
     bypassRoles: string[];
 }
 /**
- * Extracts scoped entity configurations from all entities.
+ * Extracts scoped entity configurations from all entities. Pass the
+ * relationship map to resolve nested paths to their foreign keys.
  */
-export declare function getScopedEntities(entities: Entity[]): ScopedEntityConfig[];
+export declare function getScopedEntities(entities: Entity[], relationshipMap?: RelationshipMap): ScopedEntityConfig[];
 /**
  * Checks if any entities have scopeBy configured.
  */
@@ -38,3 +47,25 @@ export interface ApiKeyTemplateData extends ResolvedApiKeyAuth {
  * has `status` and `expiresAt`, which the guard then enforces.
  */
 export declare function apiKeyTemplateData(apiKey: ResolvedApiKeyAuth, entities: Entity[]): ApiKeyTemplateData;
+/** A direct scopeBy field and the auth context value that fills it. */
+export interface DirectScopeField {
+    field: string;
+    /** userId and email map to the caller's own; anything else is the tenant. */
+    source: "userId" | "email" | "tenant";
+}
+/** What Go and Python services need to scope one entity. */
+export interface EntityScopeData {
+    fields: DirectScopeField[];
+    enforceOn: string[];
+    bypassRoles: string[];
+    injectOnCreate: boolean;
+}
+/**
+ * The direct scopeBy fields of an entity, for services that filter in their
+ * own queries (Go, Python). Undefined without auth: with no caller identity
+ * there is no tenant to scope by. Nested paths (task.workspaceId) are not
+ * included; see hasNestedScopes.
+ */
+export declare function entityScope(entity: Entity, hasAuth: boolean): EntityScopeData | undefined;
+/** Entities whose scopeBy uses a nested path, which Go and Python do not enforce. */
+export declare function nestedScopeEntities(entities: Entity[]): string[];

package/dist/lib/guards.js

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
+exports.nestedScopeEntities = exports.entityScope = exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
+const parse_1 = require("./utils/relationships/parse");
 /**
  * Default scope options when not specified
  */
@@ -36,18 +37,40 @@ function toRepoName(entityName) {
     return `${camelCase}Repository`;
 }
 /**
- * Extracts scoped entity configurations from all entities.
+ * A nested path's first segment must be a ManyToOne relationship of the
+ * entity: its foreign key is what list queries filter on.
  */
-function getScopedEntities(entities) {
+function resolveNestedScope(entityName, scope, relationshipMap) {
+    var _a;
+    if (scope.direct || !scope.path)
+        return scope;
+    const relation = ((_a = relationshipMap[entityName]) !== null && _a !== void 0 ? _a : []).find((r) => r.type === "ManyToOne" && (0, parse_1.getRelationshipName)(r) === scope.field);
+    if (!relation)
+        throw new Error(`${entityName}.scopeBy "${scope.path}": "${scope.field}" must be a many-to-one relationship of ${entityName}`);
+    return {
+        ...scope,
+        fkField: (0, parse_1.getRelationshipIdField)(relation),
+        parentEntity: relation.name,
+        parentPath: scope.path.split(".").slice(1).join("."),
+    };
+}
+/**
+ * Extracts scoped entity configurations from all entities. Pass the
+ * relationship map to resolve nested paths to their foreign keys.
+ */
+function getScopedEntities(entities, relationshipMap) {
     return entities
         .filter((entity) => entity.scopeBy)
         .map((entity) => {
         const options = { ...DEFAULT_SCOPE_OPTIONS, ...entity.scopeOptions };
+        const scopes = parseScopeBy(entity.scopeBy);
         return {
             name: entity.name,
             routeName: toRouteName(entity.name),
             repoName: toRepoName(entity.name),
-            scopes: parseScopeBy(entity.scopeBy),
+            scopes: relationshipMap
+                ? scopes.map((s) => resolveNestedScope(entity.name, s, relationshipMap))
+                : scopes,
             injectOnCreate: options.injectOnCreate,
             enforceOn: options.enforceOn,
             bypassRoles: options.bypassRoles,
@@ -81,3 +104,38 @@ function apiKeyTemplateData(apiKey, entities) {
     };
 }
 exports.apiKeyTemplateData = apiKeyTemplateData;
+/**
+ * The direct scopeBy fields of an entity, for services that filter in their
+ * own queries (Go, Python). Undefined without auth: with no caller identity
+ * there is no tenant to scope by. Nested paths (task.workspaceId) are not
+ * included; see hasNestedScopes.
+ */
+function entityScope(entity, hasAuth) {
+    if (!hasAuth || !entity.scopeBy)
+        return undefined;
+    const [config] = getScopedEntities([entity]);
+    const fields = config.scopes
+        .filter((s) => s.direct)
+        .map((s) => ({
+        field: s.field,
+        source: s.contextKey === "userId" || s.contextKey === "email"
+            ? s.contextKey
+            : "tenant",
+    }));
+    if (fields.length === 0 || config.enforceOn.length === 0)
+        return undefined;
+    return {
+        fields,
+        enforceOn: config.enforceOn,
+        bypassRoles: config.bypassRoles,
+        injectOnCreate: config.injectOnCreate,
+    };
+}
+exports.entityScope = entityScope;
+/** Entities whose scopeBy uses a nested path, which Go and Python do not enforce. */
+function nestedScopeEntities(entities) {
+    return getScopedEntities(entities)
+        .filter((e) => e.scopes.some((s) => !s.direct))
+        .map((e) => e.name);
+}
+exports.nestedScopeEntities = nestedScopeEntities;

package/dist/lib/templates/go/handlers/handler.eta

@@ -76,6 +76,11 @@ func (h *<%= it.entityName %>Handler) FindAll(c *gin.Context) {
 	if opts.Bare {
 		rows, err := h.service.FindAllBare(c.Request.Context(), opts)
 		if err != nil {
+<% if (it.scope) { %>
+			if scopeError(c, err) {
+				return
+			}
+<% } %>
 			if qe, ok := utils.AsQueryError(err); ok {
 				c.JSON(http.StatusBadRequest, gin.H{"error": qe.Error()})
 				return
@@ -89,6 +94,11 @@ func (h *<%= it.entityName %>Handler) FindAll(c *gin.Context) {
 
 	result, err := h.service.FindAll(c.Request.Context(), opts)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		if qe, ok := utils.AsQueryError(err); ok {
 			c.JSON(http.StatusBadRequest, gin.H{"error": qe.Error()})
 			return
@@ -126,6 +136,11 @@ func (h *<%= it.entityName %>Handler) FindOne(c *gin.Context) {
 
 	result, err := h.service.FindOne(c.Request.Context(), id)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusNotFound, gin.H{"error": "<%= it.entityName %> not found"})
 		return
 	}
@@ -158,6 +173,11 @@ func (h *<%= it.entityName %>Handler) Create(c *gin.Context) {
 
 	result, err := h.service.Create(c.Request.Context(), &input)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -204,6 +224,11 @@ func (h *<%= it.entityName %>Handler) Update(c *gin.Context) {
 
 	result, err := h.service.Update(c.Request.Context(), id, &input)
 	if err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}
@@ -236,6 +261,11 @@ func (h *<%= it.entityName %>Handler) Delete(c *gin.Context) {
 <% } %>
 
 	if err := h.service.Delete(c.Request.Context(), id); err != nil {
+<% if (it.scope) { %>
+		if scopeError(c, err) {
+			return
+		}
+<% } %>
 		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
 		return
 	}

package/dist/lib/templates/go/handlers/scope.eta

@@ -0,0 +1,27 @@
+<%~ includeFile('../../header.eta', it) %>
+
+package handlers
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"app/autogen/services"
+	"github.com/gin-gonic/gin"
+)
+
+// scopeError answers a scoped entity's service error: 403 when the caller has
+// no tenant, 404 when the row is missing or belongs to another tenant.
+// It reports whether it wrote a response.
+func scopeError(c *gin.Context, err error) bool {
+	if errors.Is(err, services.ErrForbidden) {
+		c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return true
+	}
+	if strings.HasSuffix(err.Error(), "not found") {
+		c.JSON(http.StatusNotFound, gin.H{"error": err.Error()})
+		return true
+	}
+	return false
+}

package/dist/lib/templates/go/middleware/auth.eta

@@ -17,8 +17,8 @@ package middleware
 <% } %>
 
 import (
-<% if (it.jwt) { %>
 	"context"
+<% if (it.jwt) { %>
 	"encoding/json"
 <% } else { %>
 	"crypto/sha256"
@@ -63,6 +63,21 @@ type AuthContext struct {
 // AuthContextKey is the gin context key holding *AuthContext.
 const AuthContextKey = "auth"
 
+type authKey struct{}
+
+// setAuth attaches the caller to the gin context and to the request context,
+// where generated services read it for scopeBy.
+func setAuth(c *gin.Context, a *AuthContext) {
+	c.Set(AuthContextKey, a)
+	c.Request = c.Request.WithContext(context.WithValue(c.Request.Context(), authKey{}, a))
+}
+
+// FromContext returns the caller stored on a request context, if any.
+func FromContext(ctx context.Context) (*AuthContext, bool) {
+	a, ok := ctx.Value(authKey{}).(*AuthContext)
+	return a, ok
+}
+
 // GetAuthContext returns the authenticated caller, if any.
 func GetAuthContext(c *gin.Context) (*AuthContext, bool) {
 	v, ok := c.Get(AuthContextKey)
@@ -239,7 +254,7 @@ func AuthMiddleware(_ *gorm.DB) gin.HandlerFunc {
 		if tenant == "" {
 			tenant = str(claim(claims, <%~ JSON.stringify(it.jwt.claims.organizationId || '') %>))
 		}
-		c.Set(AuthContextKey, &AuthContext{
+		setAuth(c, &AuthContext{
 			UserID:         userID,
 			Email:          str(claim(claims, <%~ JSON.stringify(it.jwt.claims.email || '') %>)),
 			WorkspaceID:    tenant,
@@ -329,7 +344,7 @@ func AuthMiddleware(db *gorm.DB) gin.HandlerFunc {
 			roles = append(roles, fmt.Sprint(v))
 		}
 <% } %>
-		c.Set(AuthContextKey, &AuthContext{
+		setAuth(c, &AuthContext{
 			ServiceID:      fmt.Sprint(row["id"]),
 			WorkspaceID:    tenant,
 			OrganizationID: tenant,

package/dist/lib/templates/go/services/scope.eta

@@ -0,0 +1,62 @@
+<%~ includeFile('../../header.eta', it) %>
+
+package services
+
+import (
+	"encoding"
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+)
+
+// ErrForbidden means the caller has no tenant to scope by (.apsorc scopeBy).
+var ErrForbidden = errors.New("no tenant in the auth context")
+
+// hasAnyRole reports whether the caller holds one of the bypass roles.
+func hasAnyRole(roles []string, bypass ...string) bool {
+	for _, r := range roles {
+		for _, b := range bypass {
+			if r == b {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// setFromString sets a scope field on a model from the caller's tenant id,
+// converting it to the field's type (string, integer, or a TextUnmarshaler such
+// as uuid.UUID; pointers are allocated).
+func setFromString(model interface{}, field, value string) error {
+	f := reflect.ValueOf(model).Elem().FieldByName(field)
+	if !f.IsValid() {
+		return fmt.Errorf("model has no field %s", field)
+	}
+	if f.Kind() == reflect.Ptr {
+		f.Set(reflect.New(f.Type().Elem()))
+		f = f.Elem()
+	}
+	if u, ok := f.Addr().Interface().(encoding.TextUnmarshaler); ok {
+		return u.UnmarshalText([]byte(value))
+	}
+	switch f.Kind() {
+	case reflect.String:
+		f.SetString(value)
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		n, err := strconv.ParseInt(value, 10, 64)
+		if err != nil {
+			return fmt.Errorf("tenant id %q is not a number: %w", value, err)
+		}
+		f.SetInt(n)
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		n, err := strconv.ParseUint(value, 10, 64)
+		if err != nil {
+			return fmt.Errorf("tenant id %q is not a number: %w", value, err)
+		}
+		f.SetUint(n)
+	default:
+		return fmt.Errorf("cannot set %s from a tenant id", field)
+	}
+	return nil
+}